A restrained technical plate traces separate Boolean and integer declarations through well-sorted formulas and an assertion register, projects deterministic SMT syntax, relates evaluation in both directions to holding or refuting evidence, and follows a concrete counterexample valuation back to a false conclusion.
Typed SMT syntax, semantics, and counterexample plate

ff-smt

repository URL pending

Scope

ff-smt formalizes a typed language for satisfiability-modulo-theories problems over Booleans and integers. Its core covers sorts, declaration contexts, typed variables, environments, expressions, evaluation, rendered solver scripts, and problems assembled from assertions and a conclusion. The syntax and derived layers add readable logical connectives, integer relations, conditionals, interval predicates, and aggregate Boolean constraints. The semantic layer connects computed truth values with propositions for holding and refuting formulas, then lifts that account to statements and counterexamples. Progressive, advanced, showcase, and systems examples are paired with rendering-focused tests that exercise the language across increasingly structured problems.

Most important results

Context- and sort-indexed expressions ensure that variables and operators can only be combined at compatible types. The core supplies total evaluation together with renderers for declarations, expressions, assertions, counterexample checks, and counterexample queries. The semantics establishes both directions between evaluation and the holding or refuting interpretation, including soundness and completeness results for integer comparisons and Boolean connectives. Counterexample records yield refutations of statements, while the derived layer packages reusable constructions such as bounds, minima, maxima, clamping, cardinality constraints, and Boolean indicators.

Library modules

18 checked modules

Select a module to inspect its generated Agda source view.

Skip to content

Agda libraries

ff-smt

A safe Agda/Cubical SMT fragment with SMT-LIB rendering, Z3 counterexample workflows, and Agda-side refutation objects.

Typed SMT syntax, semantics, and counterexample plateA restrained technical plate traces separate Boolean and integer declarations through well-sorted formulas and an assertion register, projects deterministic SMT syntax, relates evaluation in both directions to holding or refuting evidence, and follows a concrete counterexample valuation back to a false conclusion.
A restrained technical plate traces separate Boolean and integer declarations through well-sorted formulas and an assertion register, projects deterministic SMT syntax, relates evaluation in both directions to holding or refuting evidence, and follows a concrete counterexample valuation back to a false conclusion.

Scope

ff-smt formalizes a typed language for satisfiability-modulo-theories problems over Booleans and integers. Its core covers sorts, declaration contexts, typed variables, environments, expressions, evaluation, rendered solver scripts, and problems assembled from assertions and a conclusion. The syntax and derived layers add readable logical connectives, integer relations, conditionals, interval predicates, and aggregate Boolean constraints. The semantic layer connects computed truth values with propositions for holding and refuting formulas, then lifts that account to statements and counterexamples. Progressive, advanced, showcase, and systems examples are paired with rendering-focused tests that exercise the language across increasingly structured problems.

Most important results

Context- and sort-indexed expressions ensure that variables and operators can only be combined at compatible types. The core supplies total evaluation together with renderers for declarations, expressions, assertions, counterexample checks, and counterexample queries. The semantics establishes both directions between evaluation and the holding or refuting interpretation, including soundness and completeness results for integer comparisons and Boolean connectives. Counterexample records yield refutations of statements, while the derived layer packages reusable constructions such as bounds, minima, maxima, clamping, cardinality constraints, and Boolean indicators.

Used by

Source browser

Modules

Read the full library article

ff-smt is an Agda/Cubical library for describing a small SMT fragment, rendering it to SMT-LIB for Z3, and interpreting counterexamples back in Agda.

It belongs in the library section because it shows another useful boundary: proof assistants do not have to do every search internally. A solver can find or reject counterexamples, while Agda keeps a typed representation of the problem and the interpretation of results.

Safe Core

The safe core supports quantifier-free linear integer arithmetic with Boolean connectives:

  • typed contexts with Int and Bool declarations;
  • typed variables and environments;
  • integer constants, variables, negation, addition, subtraction, and constant scaling;
  • integer equality, disequality, <, <=, >, and >=;
  • Boolean literals, negation, conjunction, disjunction, exclusive-or, implication, equality, and ite;
  • SMT-LIB rendering for counterexample checks and model-producing queries.

SMT.Semantics connects executable Boolean semantics to Agda propositions through Holds, Refutes, SemanticStatement, NoCounterexample, and satisfiability notions.

Counterexample Discipline

A Problem has assumptions and a claim. The Z3 query asserts the assumptions plus the negation of the claim. If Z3 finds a model, an external preprocessing step can turn that model into an Agda environment plus proofs that the assumptions evaluate to true and the claim evaluates to false.

That data has type Counterexample p, and refute turns it into an Agda proof of negation for the original statement.

Unsafe Z3 Layer

The unsafe companion package provides macros for running Z3 and asking for sat/unsat or model output. The intended workflow is explicit: a successful solver result can justify an assumption boundary, but it is not silently treated as a native Agda proof.

How It Fits

ff-smt gives the stack a disciplined solver boundary: a typed Agda fragment, SMT-LIB rendering, counterexample objects, and a visible unsafe Z3 integration layer.

Proof assistants are not always the best place to search. SMT solvers are very good at finding models and counterexamples for supported fragments. If a solver result is treated as invisible magic, however, the formal story becomes weaker.

ff-smt separates the roles. Solver search can find a counterexample. Agda represents the problem, the environment, and the fact that the assumptions hold while the claim fails. The refute function then turns that counterexample object into a proof of negation for the original statement.

The unsafe Z3 layer stays visible. It can run solver queries and support assumption workflows, but a solver answer is not silently treated as a native Agda proof.

The public claim is precise: ff-smt is a small typed SMT fragment with rendering, semantic bridges, counterexample objects, examples, and a clearly separated Z3 integration layer. It is not a certificate-producing SMT proof checker.

Browse modulesOpen generated Agda sources

Cabinet index

Explore Formal Foundry

Search the archive

Find a page

Type to search the published content.