## Nitrox 2013

Jasmin C. Blanchette1, Emina Torlak2
1Technische Universität München, Germany
2University of California, Berkeley, USA

### Architecture

Nitrox is the first-order version of Nitpick [BN10], an open source counterexample generator for Isabelle/HOL [NPW13]. It builds on Kodkod [TJ07], a highly optimized first-order relational model finder based on SAT. The name Nitrox is a portmanteau of Nitpick and Paradox (clever, eh?).

### Strategies

Nitrox employs Kodkod to find a finite model of the negated conjecture. It performs a few transformations on the input, such as pushing quantifiers inside, but 99% of the solving logic is in Kodkod and the underlying SAT solver.

The translation from HOL to Kodkod's first-order relational logic (FORL) is parameterized by the cardinalities of the atomic types occurring in it. Nitrox enumerates the possible cardinalities for the universe. If a formula has a finite counterexample, the tool eventually finds it, unless it runs out of resources.

Nitpick is optimized to work with higher-order logic (HOL) and its definitional principles (e.g., (co)inductive predicates, (co)inductive datatypes, (co)recursive functions). When invoked on untyped first-order problem, few of its optimizations come into play, and the problem handed to Kodkod is essentially a first-order relational logic (FORL) rendering of the TPTP FOF problem. There are two main exceptions:

- Nested quantifiers are moved as far inside the formula as possible before Kodkod gets a chance to look at them [BN10].
- Definitions invoked with fixed arguments are specialized.

### Implementation

Nitrox, like most of Isabelle/HOL, is written in Standard ML. Unlike Isabelle itself, which adheres to the LCF small-kernel discipline, Nitrox does not certify its results and must be trusted. Kodkod is written in Java. MiniSat 1.14 is used as the SAT solver.

### Expected Competition Performance

Since Nitpick was designed for HOL, it doesn't have any type inference à la Paradox. It also doesn't use the SAT solver incrementally, which penalizes it a bit (but not as much as the missing type inference). Kodkod itself is known to perform less well on FOF than Paradox, because it is designed and optimized for a somewhat different logic, FORL. On the other hand, Kodkod's symmetry breaking might be better calibrated than Paradox's. Hence, we expect Nitrox to end up in second or third place in the FNT category.

### References

BN10
  Blanchette J. C., Nipkow T. (2010), Nitpick: A Counterexample Generator for Higher-Order Logic Based on a Relational Model Finder, ITP 2010, LNCS 6172, pp. 131–146, Springer.
NPW13
  Nipkow T., Paulson L. C., Wenzel M. (2013), Isabelle/HOL: A Proof Assistant for Higher-Order Logic, http://www.cl.cam.ac.uk/research/hvg/Isabelle/dist/Isabelle/doc/tutorial.pdf.
TJ07
  Torlak E., Jackson D. (2007), Kodkod: A Relational Model Finder, TACAS 2007, LNCS 4424, pp. 632–647, Springer.