[Paper Review] Formal Proofs of Tarjan's Algorithm in Why3, Coq, and Isabelle

Ran Chen, Cyril Cohen+3 more|arXiv (Cornell University)|Oct 29, 2018

Logic, programming, and type systems8 references4 citations

TL;DR

This paper presents a formal correctness proof of Tarjan's algorithm for finding strongly connected components in directed graphs using three distinct proof assistants: Why3, Coq, and Isabelle/HOL. The authors implement the algorithm at a functional, abstract level with finite sets, stacks, and mappings, ensuring linear-time behavior, and prove its correctness uniformly across all three systems, highlighting differences in expressivity, automation, and verification style while demonstrating the feasibility of cross-tool formalization of complex graph algorithms.

ABSTRACT

Comparing provers on a formalization of the same problem is always a valuable exercise. In this paper, we present the formal proof of correctness of a non-trivial algorithm from graph theory that was carried out in three proof assistants: Why3, Coq, and Isabelle.

Motivation & Objective

• To formally verify Tarjan's algorithm for strongly connected components using three different proof assistants.
• To compare the expressiveness, automation, and verification workflows of Why3, Coq, and Isabelle/HOL on a non-trivial algorithm.
• To produce a uniform, abstract, and readable formalization that preserves the algorithm’s linear-time behavior.
• To evaluate the challenges and benefits of formalizing complex graph algorithms across heterogeneous proof systems.
• To provide a foundation for future cross-tool comparisons and for verifying imperative implementations of the algorithm.

Proposed method

• The algorithm is formalized in a functional style using finite sets, stacks, and mappings, abstracting from low-level data structures.
• A core invariant-based proof strategy is employed, relying on the same logical arguments across all three systems.
• Mutually recursive functions dfs1 and dfs manage depth-first traversal, stack management, and component detection.
• Key auxiliary functions include add_stack_incr (push and assign serial number), split (pop stack until a vertex), and set_infty (mark vertices as inactive).
• Proofs are structured using inductive predicates (Why3), dependent types and higher-order logic (Coq), and Isar with automation (Isabelle/HOL).
• Termination is handled via well-founded relations and domintros in Isabelle, while Coq uses explicit upper bounds; Why3 relies on automatic prover checks.

Experimental results

Research questions

• RQ1 How do the design choices and expressivity of Why3, Coq, and Isabelle/HOL affect the structure and maintainability of a formal proof of Tarjan’s algorithm?
• RQ2 To what extent can the same logical arguments be reused across three proof assistants with different foundational logics?
• RQ3 What are the trade-offs between automation, readability, and verification stability in formalizing a complex graph algorithm?
• RQ4 How does the absence or presence of automation influence the development and debugging of formal proofs?
• RQ5 Can a single abstract formalization serve as a common basis for formal verification in multiple proof systems?

Key findings

• The formal proof was successfully implemented in all three systems—Why3, Coq, and Isabelle/HOL—using the same algorithmic abstraction and core logic.
• Why3 achieved the highest level of automation, relying on external SMT and superposition provers, but required careful specification to ensure trusted proof checking.
• Coq’s dependent types enabled a highly expressive and concise formalization, though the proof required more manual intervention and expertise.
• Isabelle/HOL offered a balance between expressivity and automation, with sledgehammer significantly aiding proof discovery, and Isar providing human-readable proof structure.
• The proof in Isabelle/HOL was 50% shorter than the original Why3 version, indicating improved readability and maintainability.
• Termination was handled differently in each system: via explicit bounds (Coq), well-founded relations (Isabelle), and trusted prover checks (Why3), with all approaches being formally verified.