SLIDE 1 Complete Instantiation of Quantified Formulas in Satisfiability Modulo Theories
Yeting Ge1 Leonardo de Moura2
1New York University 2Microsoft Research
7th International Workshop on Satisfiability Modulo Theories Aug 3, 2009 Montreal, Canada
SLIDE 2 Quantified SMT formulas
Traditional SMT solvers only deal with quantifier free formulas Quantified SMT formulas are useful
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 3 Quantified SMT formulas
Traditional SMT solvers only deal with quantifier free formulas Quantified SMT formulas are useful Unsupported/customized theories
Type system in ESC/Java, Boogie ∀x1, x2, x3 : (subtype(x1, x2) ∧ subtype(x2, x3) → subtype(x1, x3))
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 4 Quantified SMT formulas
Traditional SMT solvers only deal with quantifier free formulas Quantified SMT formulas are useful Unsupported/customized theories
Type system in ESC/Java, Boogie ∀x1, x2, x3 : (subtype(x1, x2) ∧ subtype(x2, x3) → subtype(x1, x3))
User assertions/invariants
∀x, y : (x ≤ y → read(a, x) ≤ read(a, y))
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 5 Quantified SMT formulas
Traditional SMT solvers only deal with quantifier free formulas Quantified SMT formulas are useful Unsupported/customized theories
Type system in ESC/Java, Boogie ∀x1, x2, x3 : (subtype(x1, x2) ∧ subtype(x2, x3) → subtype(x1, x3))
User assertions/invariants
∀x, y : (x ≤ y → read(a, x) ≤ read(a, y))
Many more......
Heaps, linked lists,...
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 6 Quantifier Reasoning in SMT: a long-standing challenge
Mixed uninterpreted and interpreted symbols
Quantified SMT formulas
All uninterpreted ATP All interpreted Quantifier Elimination Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 7 Quantifier Reasoning in SMT: a long-standing challenge
Mixed uninterpreted and interpreted symbols
Quantified SMT formulas
All uninterpreted ATP All interpreted Quantifier Elimination
Difficult for a general solution
Uninterpreted functions + arithmetic : undecidable
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 8 Quantifier Reasoning in SMT: a long-standing challenge
Mixed uninterpreted and interpreted symbols
Quantified SMT formulas
All uninterpreted ATP All interpreted Quantifier Elimination
Difficult for a general solution
Uninterpreted functions + arithmetic : undecidable
Solutions
Theory resolution, SMT+ATP,...
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 9 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 10 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
1 Select some ground terms Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 11 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
1 Select some ground terms 2 Instantiate ∀x : P using ground terms from step 1
Let P′ be the conjunction of instantiations
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 12 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
1 Select some ground terms 2 Instantiate ∀x : P using ground terms from step 1
Let P′ be the conjunction of instantiations
3 Check P′
If P′ is unsatisfiable, then ∀x : P is unsatisfiable P′ is quantifier free
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 13 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
1 Select some ground terms 2 Instantiate ∀x : P using ground terms from step 1
Let P′ be the conjunction of instantiations
3 Check P′
If P′ is unsatisfiable, then ∀x : P is unsatisfiable P′ is quantifier free
Example f (a) < 1 ∧ (∀x : f (x) > 2) Select a as the ground term for instantiation Instantiate ∀x : f (x) > 2 with x substituted by a f (a) < 1 ∧ f (a) > 2, contradiction
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 14 Instantiation Based Quantifier Reasoning in SMT
The big idea: Given quantified formula ∀x : P
1 Select some ground terms 2 Instantiate ∀x : P using ground terms from step 1
Let P′ be the conjunction of instantiations
3 Check P′
If P′ is unsatisfiable, then ∀x : P is unsatisfiable P′ is quantifier free
Example f (a) < 1 ∧ (∀x : f (x) > 2) Select a as the ground term for instantiation Instantiate ∀x : f (x) > 2 with x substituted by a f (a) < 1 ∧ f (a) > 2, contradiction What if P′ is satisfiable?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 15 Incomplete vs Complete Instantiation
Instantiation based methods are attractive Acceptable performance (E-matching,...) Problem:Incompleteness
If P′ is satisfiable, we can say nothing about the satisfiability
In this talk, we will introduce a series of new fragments that can be solved by complete instantiation
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 16 Incomplete vs Complete Instantiation
Instantiation based methods are attractive Acceptable performance (E-matching,...) Problem:Incompleteness
If P′ is satisfiable, we can say nothing about the satisfiability
Can we have a complete method based on instantiation? Ideally, given F, we would like to have a F ∗ such that : F ∗ is quantifier free F ∗ is the conjunction of instantiations of F F and F ∗ are equi-satisfiable In this talk, we will introduce a series of new fragments that can be solved by complete instantiation
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 17 Incomplete vs Complete Instantiation
Instantiation based methods are attractive Acceptable performance (E-matching,...) Problem:Incompleteness
If P′ is satisfiable, we can say nothing about the satisfiability
Can we have a complete method based on instantiation? Ideally, given F, we would like to have a F ∗ such that : F ∗ is quantifier free F ∗ is the conjunction of instantiations of F F and F ∗ are equi-satisfiable Of course, only possible for formulas in some fragments Array property fragment by Bradley et al Linked list by Scott et al In this talk, we will introduce a series of new fragments that can be solved by complete instantiation
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 18 New Fragments for Complete Instantiation
More Extensions Arithmetic Literals Essentially Uninterpreted
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 19 New Fragments for Complete Instantiation
More Extensions Arithmetic Literals Essentially Uninterpreted Two key issues for complete instantiation: What to instantiate? How to collect ground terms for instantiation? Why complete? How to prove?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 20 Notations
x, y, x1, y1, ... denotes variables a, b, c, ... are constants f , g, h, ... are uninterpreted functions +, −, ∗, <, ≤, ... are interpreted arithmetic symbols tM denotes the interpretation of term t in model M
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 21 Essentially Uninterpreted Formulas
Definition (Essentially Uninterpreted) Variables only appear as arguments of uninterpreted functions/predicates For complete instantiation, two key issues: What to instantiate? Why complete?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 22 Essentially Uninterpreted Formulas
Definition (Essentially Uninterpreted) Variables only appear as arguments of uninterpreted functions/predicates Example f (x) + b > c, YES For complete instantiation, two key issues: What to instantiate? Why complete?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 23 Essentially Uninterpreted Formulas
Definition (Essentially Uninterpreted) Variables only appear as arguments of uninterpreted functions/predicates Example f (x) + b > c, YES f (x + y) > c, NO For complete instantiation, two key issues: What to instantiate? Why complete?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 24 Essentially Uninterpreted Formulas
Definition (Essentially Uninterpreted) Variables only appear as arguments of uninterpreted functions/predicates Example f (x) + b > c, YES f (x + y) > c, NO A formula in pure first order logic is an EU formula For complete instantiation, two key issues: What to instantiate? Why complete?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 25 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 26 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes.
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 27 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 28 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)).
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 29 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)). So?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 30 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)). So? Then I construct a Mπ for P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)).
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 31 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)). So? Then I construct a Mπ for P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)). From M?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 32 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)). So? Then I construct a Mπ for P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)). From M? Yes.
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 33 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? Yes. Why? My SMT solver finds M, a model for P(f (b)) ∧ Q(f (a)) ∧ P(f (a)). So? Then I construct a Mπ for P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)). From M? Yes.
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 34 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 35 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? We use f M(aM) to denote the interpretation of f (a) in model M
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 36 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? We use f M(aM) to denote the interpretation of f (a) in model M M: aM bM f M(aM) f M(bM)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 37 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? We use f M(aM) to denote the interpretation of f (a) in model M One solution of Mπ is to let f Mπ(e) be f M(aM) for every element e except bM in the domain (Other solutions possible) M: aM bM f M(aM) f M(bM)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 38 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? We use f M(aM) to denote the interpretation of f (a) in model M One solution of Mπ is to let f Mπ(e) be f M(aM) for every element e except bM in the domain (Other solutions possible) M: aM bM f M(aM) f M(bM) Mπ: aM bM f M(aM) f M(bM) f Mπ
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 39 Motivation Example
Is P(f (b)) ∧ Q(f (a)) ∧ ∀x : P(f (x)) satisfiable? We use f M(aM) to denote the interpretation of f (a) in model M One solution of Mπ is to let f Mπ(e) be f M(aM) for every element e except bM in the domain (Other solutions possible) M: aM bM f M(aM) f M(bM) Mπ: aM bM f M(aM) f M(bM) f Mπ We have PMπ(f Mπ(e)) holds for all e in the domain
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 40 More notations
From now on, assume: A formula is a set of CNF clauses A clause is universally quantified at outermost scope t[x1, x2, ..., xn] means term t may contains variables x1, x2, ..., xn t[x/t1] is the result of substituting t1 for all free occurrences
t[x1/s1, x2/ss, ..., xn/sn] with the obvious meaning t[S1, S2, ..., Sn] denotes the set {t[x1/s1, x2/ss, ..., xn/sn] | si ∈ Si}, where Si are sets of terms
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 41 Rules for Collecting Ground Terms for EU Formulas
Si and Af are sets of ground terms Details skipped Si contains ground terms for instantiating variable xi Af contains all ground terms that can appear as argument of f in the result of instantiation
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 42 Rules for Collecting Ground Terms for EU Formulas
Si and Af are sets of ground terms Details skipped Si contains ground terms for instantiating variable xi Af contains all ground terms that can appear as argument of f in the result of instantiation Suppose f (t) appears in the quantified formula : t is a ground term Af includes t t is s[x1, ..., xn] Af contains s[S1, ..., Sn] t is variable xj Af equals to Sj
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 43
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground
SLIDE 44
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground
SLIDE 45
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground
SLIDE 46
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground
SLIDE 47
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground
SLIDE 48
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = { } Af = {a} S1 = { } S2 = { }
SLIDE 49
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = { } Af = {a} S1 = { } S2 = { }
SLIDE 50
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = { } Af = {a} S1 = { } S2 = {a}
SLIDE 51
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = { } Af = {a} S1 = { } S2 = {a}
SLIDE 52
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = {f (a)} Af = {a} S1 = { } S2 = {a}
SLIDE 53
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = {f (a)} Af = {a} S1 = { } S2 = {a}
SLIDE 54
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = {f (a)} Af = {a} S1 = {f (a)} S2 = {a}
SLIDE 55
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground Ground terms Ag = {f (a)} Af = {a} S1 = {f (a)} S2 = {a} The ground terms are collected incrementally
SLIDE 56
EU Example
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 Constraints —— Rules used Ag = S1 x1 is a variable f [S2] ⊆ Ag f (x2) contains variable x2 Af = S2 x2 is a variable a ∈ Af a is ground F ∗ g(f (a)) ≤ 0 g(f (a)) + 1 ≤ f (a) f (a) = 0 Ground terms Ag = {f (a)} Af = {a} S1 = {f (a)} S2 = {a} The ground terms are collected incrementally
SLIDE 57 EU Example (Cont.)
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 F ∗ g(f (a)) ≤ 0 g(f (a)) + 1 ≤ f (a) f (a) = 0
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 58 EU Example (Cont.)
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 F ∗ g(f (a)) ≤ 0 g(f (a)) + 1 ≤ f (a) f (a) = 0 M Let a = 2 f (a) = 0 g(0) = −1
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 59 EU Example (Cont.)
F g(x1) ≤ 0 g(f (x2)) + 1 ≤ f (x2) f (a) = 0 F ∗ g(f (a)) ≤ 0 g(f (a)) + 1 ≤ f (a) f (a) = 0 Mπ Let a = 2 f = λx.0 g = λx. − 1 M Let a = 2 f (a) = 0 g(0) = −1
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 60 Proof of Completeness
Details skipped The big idea:
Construct Mπ from M by defining interpretation for uninterpreted functions (projection) Assume F ∗ is satisfiable but F is not Deduce contradiction
Theorem Given F an essentially uninterpreted formula, F and F ∗ are equi-satisfiable
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 61 Finite F ∗
If F ∗ is finite, then we have a decision procedure When F ∗ is finite?
The set {Si} is stratified Details skipped Better than sorts stratification
f (a) = a ∧ g(f (x)) = f (x) a and f (a) must be in the same sort
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 62 Herbrand Theorem and Finite F ∗
Let’s assume Q and P are uninterpreted predicates Q(f (a)) ∧ ∀x : P(f (x)) Herbrand universe
{a, f (a), f (f (a)), ...}
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 63 Herbrand Theorem and Finite F ∗
Let’s assume Q and P are uninterpreted predicates Q(f (a)) ∧ ∀x : P(f (x)) Herbrand universe
{a, f (a), f (f (a)), ...}
In the standard Herbrand Theorem, we need to check the satisfiability of Q(f (a)) ∧ P(f (a)) ∧ P(f (f (a))) ∧ P(f (f (f (a))))...
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 64 Herbrand Theorem and Finite F ∗
Let’s assume Q and P are uninterpreted predicates Q(f (a)) ∧ ∀x : P(f (x)) Herbrand universe
{a, f (a), f (f (a)), ...}
In the standard Herbrand Theorem, we need to check the satisfiability of Q(f (a)) ∧ P(f (a)) ∧ P(f (f (a))) ∧ P(f (f (f (a))))... In our theorem, we only need to check Q(f (a)) ∧ P(f (a))
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 65 Herbrand Theorem and Finite F ∗
Let’s assume Q and P are uninterpreted predicates Q(f (a)) ∧ ∀x : P(f (x)) Herbrand universe
{a, f (a), f (f (a)), ...}
In the standard Herbrand Theorem, we need to check the satisfiability of Q(f (a)) ∧ P(f (a)) ∧ P(f (f (a))) ∧ P(f (f (f (a))))... In our theorem, we only need to check Q(f (a)) ∧ P(f (a)) Do we have a new decidable class (stratified) in pure first
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 66 Herbrand Theorem and Finite F ∗
Let’s assume Q and P are uninterpreted predicates Q(f (a)) ∧ ∀x : P(f (x)) Herbrand universe
{a, f (a), f (f (a)), ...}
In the standard Herbrand Theorem, we need to check the satisfiability of Q(f (a)) ∧ P(f (a)) ∧ P(f (f (a))) ∧ P(f (f (f (a))))... In our theorem, we only need to check Q(f (a)) ∧ P(f (a)) Do we have a new decidable class (stratified) in pure first
Yes, we have
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 67 Refinement: Lazy construction of F ∗
F ∗ may be very big (even infinite) By following the rules for collecting ground terms, incrementally construct sequence F 0 ⊂ F 1 ⊂ ... If F k is unsatisfiable, then return unsatisfiable If F k is satisfiable, construct candidate model Mπk
If Mπk is a model for all quantified formulas, return satisfiable If Mπk is not a model for all quantified formulas, continue
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 68 Refinement: Model Checking Example
How to check if M is a model of a quantified formula ∀P? Model M h = λx. IF (x = 2) THEN 0 ELSE 1 g = λx, y. IF (x = 0 AND y = 2) THEN − 1 ELSE 0 Quantified Formula ∀x1, x2 : g(x1, x2) = 0 ∨ h(x2) = 0
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 69 Refinement: Model Checking Example
How to check if M is a model of a quantified formula ∀P? Model M h = λx. IF (x = 2) THEN 0 ELSE 1 g = λx, y. IF (x = 0 AND y = 2) THEN − 1 ELSE 0 Quantified Formula ∀x1, x2 : g(x1, x2) = 0 ∨ h(x2) = 0 Plug in the model ∀x1, x2 : (( IF (x1 = 0 ∧ x2 = 2) THEN − 1 ELSE 0) = 0) ∧ (IF (x2 = 2) THEN 0 ELSE 1) = 0
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 70 Refinement: Model Checking Example
How to check if M is a model of a quantified formula ∀P? Model M h = λx. IF (x = 2) THEN 0 ELSE 1 g = λx, y. IF (x = 0 AND y = 2) THEN − 1 ELSE 0 Quantified Formula ∀x1, x2 : g(x1, x2) = 0 ∨ h(x2) = 0 Plug in the model ∀x1, x2 : (( IF (x1 = 0 ∧ x2 = 2) THEN − 1 ELSE 0) = 0) ∧ (IF (x2 = 2) THEN 0 ELSE 1) = 0 Check if valid (Send it to a SMT solver)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 71 Refinement: Model Checking Example
How to check if M is a model of a quantified formula ∀P? Model M h = λx. IF (x = 2) THEN 0 ELSE 1 g = λx, y. IF (x = 0 AND y = 2) THEN − 1 ELSE 0 Quantified Formula ∀x1, x2 : g(x1, x2) = 0 ∨ h(x2) = 0 Plug in the model ∀x1, x2 : (( IF (x1 = 0 ∧ x2 = 2) THEN − 1 ELSE 0) = 0) ∧ (IF (x2 = 2) THEN 0 ELSE 1) = 0 Check if valid (Send it to a SMT solver) The above formula is valid and we conclude that M is indeed a model for the quantified formula
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 72 Refinement: Model Based Instantiation
Model checking can be used to select ground terms for instantiation Example F f (x) ≤ 0, f (a) = 1,f (b) = −1 F 0 f (a) = 1,f (b) = −1 Mπ0 {a = 2, b = 3, f = λx.(IF x = 2 THEN 1 ELSE − 1)}
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 73 Refinement: Model Based Instantiation
Model checking can be used to select ground terms for instantiation Example F f (x) ≤ 0, f (a) = 1,f (b) = −1 F 0 f (a) = 1,f (b) = −1 Mπ0 {a = 2, b = 3, f = λx.(IF x = 2 THEN 1 ELSE − 1)}
Model Checking:¬(( IF s = 2 THEN 1 ELSE − 1) < 0) Satisfiable, with s = 2
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 74 Refinement: Model Based Instantiation
Model checking can be used to select ground terms for instantiation Example F f (x) ≤ 0, f (a) = 1,f (b) = −1 F 0 f (a) = 1,f (b) = −1 Mπ0 {a = 2, b = 3, f = λx.(IF x = 2 THEN 1 ELSE − 1)}
Model Checking:¬(( IF s = 2 THEN 1 ELSE − 1) < 0) Satisfiable, with s = 2 Because a = 2 in Mπ0 Instantiate x with a
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 75 Refinement: Model Based Instantiation
Model checking can be used to select ground terms for instantiation Example F f (x) ≤ 0, f (a) = 1,f (b) = −1 F 0 f (a) = 1,f (b) = −1 Mπ0 {a = 2, b = 3, f = λx.(IF x = 2 THEN 1 ELSE − 1)}
Model Checking:¬(( IF s = 2 THEN 1 ELSE − 1) < 0) Satisfiable, with s = 2 Because a = 2 in Mπ0 Instantiate x with a
F 1 f (a) = 1,f (b) = −1, f (a) < 0
Unsatisfiable
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 76 Infinite F ∗ and Refutation Complete
When F ∗ is infinite, is the procedure refutation complete? F : unsatisfiable, x ranges over integers f (x1) < f (f (x1)) f is always increasing f (x2) < a f has a up limit 1 < f (0) f has a bottom F ∗ : every finite subset is satisfiable f (0) < f (f (0)), f (f (0)) < f (f (f (0))), ... f (0) < a, f (f (0)) < a, ... 1 < f (0)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 77 Infinite F ∗ and Refutation Complete
When F ∗ is infinite, is the procedure refutation complete? Not always F : unsatisfiable, x ranges over integers f (x1) < f (f (x1)) f is always increasing f (x2) < a f has a up limit 1 < f (0) f has a bottom F ∗ : every finite subset is satisfiable f (0) < f (f (0)), f (f (0)) < f (f (f (0))), ... f (0) < a, f (f (0)) < a, ... 1 < f (0)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 78 Infinite F ∗ and Refutation Complete
When F ∗ is infinite, is the procedure refutation complete? Not always F : unsatisfiable, x ranges over integers f (x1) < f (f (x1)) f is always increasing f (x2) < a f has a up limit 1 < f (0) f has a bottom F ∗ : every finite subset is satisfiable f (0) < f (f (0)), f (f (0)) < f (f (f (0))), ... f (0) < a, f (f (0)) < a, ... 1 < f (0) Refutation complete, if we assume the background theory is a (potentially infinite) set of sentences
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 79 Infinite F ∗ and Refutation Complete
When F ∗ is infinite, is the procedure refutation complete? Not always F : unsatisfiable, x ranges over integers f (x1) < f (f (x1)) f is always increasing f (x2) < a f has a up limit 1 < f (0) f has a bottom F ∗ : every finite subset is satisfiable f (0) < f (f (0)), f (f (0)) < f (f (f (0))), ... f (0) < a, f (f (0)) < a, ... 1 < f (0) Refutation complete, if we assume the background theory is a (potentially infinite) set of sentences Refutation incomplete, if the background theory is a class of structures (Why? Compactness no longer holds)
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 80 Arithmetic Literals
Definition (Arithmetic Literals) Variables in a CNF clause may appear in literals of the form: ¬(xi ≤ xj), ¬(xi ≤ t), ¬(t ≤ xi), xi = t
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 81 Arithmetic Literals
Definition (Arithmetic Literals) Variables in a CNF clause may appear in literals of the form: ¬(xi ≤ xj), ¬(xi ≤ t), ¬(t ≤ xi), xi = t Details skipped, we have similar rules for arithmetic literals
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 82 Arithmetic Literals
Definition (Arithmetic Literals) Variables in a CNF clause may appear in literals of the form: ¬(xi ≤ xj), ¬(xi ≤ t), ¬(t ≤ xi), xi = t Details skipped, we have similar rules for arithmetic literals Example ¬(xi ≤ xj) ∨ A[xi] ≤ A[xj]
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 83 More Extensions
Offsets
xi + 2 ¬(0 ≤ xi) ∨ ¬(xi ≤ n) ∨ f (xi) = g(xi + 2)
Modular equalities
¬(xi =n t), means xi = t + n ∗ c, n is an integer and c is a constant ¬(x1 =4 0) ∨ (star(x1) = e)
Pseudo-macros
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 84 Related Works
Array property fragment
No nested application of uninterpreted functions P(f (g(x))), NO
“What else is decidable” by Habermehl et al
Literals of the form xi − xi ≤ c are allowed In a clause, at most one literal of the form f (xi) − g(xi) ≤ c is allowed No other type literal allowed, no nested applications Proof based on a customized automaton, implementation unknown
Local Theories
Certain quantified formulas can be added upon other decidable fragments
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 85 Summary
Several new fragments that can be decided by complete instantiation Model checking and model based instantiation Conditions for refutation complete Z3 was the only solver could return SAT for satisfiable quantified formulas in SMT COMP 2008 Future works: Efficient implementation More fragments for complete instantiation
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
SLIDE 86 Thank you
Questions?
Yeting Ge, Leonardo de Moura Complete Instantiation of Quantified SMT Formulas
