Scalable Deductive Verification of Data-Level Parallel Programs
Lars B. van den Haak, Anton Wijs, Marieke Huisman
cs.SE
May 13, 2026 · v1
TL;DR
The correctness of the quantifier-rewriting procedure (Theorem 3.1) is proven in about 2500 lines of Lean 4, provided in the artefact.
Abstract
This paper introduces several techniques that improve the scalability of the deductive verification of data-level programs working on arrays and matrices. First of all, we introduce a technique to rewrite expressions with (nested) quantifiers, so suitable triggers can be generated for these expressions. We have proven this rewrite technique correct in a theorem prover. Second, we make reasoning about potentially overlapping arrays easier, by providing specification constructs to indicate and verify that two arrays are not aliases, or that they are immutable, so they can be modelled as mathematical sequences. All our techniques are implemented in the VerCors program verifier. We illustrate how our techniques improve scalability through a large number of experiments. Using our techniques on a set of typical GPU kernels, we achieve a reduction of verification time by, on average, a factor of 9, with outliers being up to 150 times faster. Additionally, applying these techniques to earlier experiments and an earlier case study of a radio telescope pipeline permitted the verification of results which were previously unobtainable and significantly reduced the verification time.
Problem
Deductive verification of data-parallel programs over arrays and matrices scales poorly. Nested quantifiers produce unsuitable SMT triggers, and possible aliasing between arrays adds many proof obligations.
Approach
The authors rewrite quantified expressions whose triggers contain linear index arithmetic, using a bijective mapping and its inverse so that plain array accesses can serve as triggers. Correctness of this rewrite is proven in Lean 4 (about 2500 lines). They also add `unique` and `immutable` type qualifiers for arrays, so that non-aliased or constant arrays can be modelled more cheaply. Both techniques are implemented in the VerCors verifier.
Results
None of the reported experiments verified without the rewrite procedure. On CLBlast GPU kernels, verification is on average 9x faster, with outliers up to 150x faster. Halide-generated programs and a radio telescope pipeline case study saw speedups, and previously unobtainable verification results were achieved.