Satisfiability Modulo Theories

Equality and Uninterpreted functions

EUF

  (declare-sort A)
  (declare-fun f (A) A)
  (declare-const x A)
  (assert (= (f (f x)) x))
  (assert (= (f (f (f x))) x))
  (check-sat)
  
  (assert (not (= (f x) x)))
  (check-sat)

Deciding Equality

Disequalities

Variants of union-find are effective to decide equality.

Free functions

Congruence rule

Naming sub-terms

Applying Congruence (1)

Applying Congruence (2)

EUF Models

A satisfiable version:

EUF Models (II)

• Associate a distinct value with each equivalence class.

Linear Arithmetic

(set-logic QF_IDL) ; optional in Z3
(declare-fun t11 () Int)
(declare-fun t12 () Int)
(declare-fun t21 () Int)
(declare-fun t22 () Int)
(declare-fun t31 () Int)
(declare-fun t32 () Int)

(assert (and (>= t11 0) (>= t12 (+ t11 2)) (<= (+ t12 1) 8)))
(assert (and (>= t21 0) (>= t22 (+ t21 3)) (<= (+ t22 1) 8)))
(assert (and (>= t31 0) (>= t32 (+ t31 2)) (<= (+ t32 3) 8)))
(assert (or (>= t11 (+ t21 3)) (>= t21 (+ t11 2))))
(assert (or (>= t11 (+ t31 2)) (>= t31 (+ t11 2))))
(assert (or (>= t21 (+ t31 2)) (>= t31 (+ t21 3))))
(assert (or (>= t12 (+ t22 1)) (>= t22 (+ t12 1))))
(assert (or (>= t12 (+ t32 3)) (>= t32 (+ t12 1))))
(assert (or (>= t22 (+ t32 3)) (>= t32 (+ t22 1))))
(check-sat)
(get-model) ; display the model  

Linear Arithmetic Example

Algorithmic Fragments of Arithmetic

Other Fragments of Arithmetic

• NIA - There is no decision procedure for integer polynomial constraints

  • Z3 falls back to incomplete heuristics
  • NIA over bounded integers may get translated to bit-vector constraints

  
  Other theories that admit custom solvers:

• Bi-linear real arithmetic

• Non-unit two-variable per inequality

• At most one unit positive variable per inequality (Horn)

Bellman-Ford - a selection

(set-logic QF_IDL) ; optional in Z3
(declare-fun t11 () Int)
(declare-fun t12 () Int)
(declare-fun t21 () Int)
(declare-fun t22 () Int)
(declare-fun t31 () Int)
(declare-fun t32 () Int)

(assert (and (>= t11 0) ...))
(assert (and (>= t21 0) ...))
(assert (and (>= t31 0) (>= t32 (+ t31 2)) (<= (+ t32 3) 8)))
(assert (or ... (>= t21 (+ t11 2))))
(assert (or (>= t21 (+ t31 2)) ...))
(check-sat)
(get-model) ; display the model  

Bellman-Ford

Solve difference logic using graph Bellman-Ford network flow algorithm. Negative cycle unsat.

General form Simplex [20]

General form and

Only bounds (e.g., ) are asserted during search.

From Definitions to a Tableau

- are basic (dependent)
- are non-basic

Pivoting

• Value of non-basic variable can be chosen between and .
• Value of basic variable is a function of non-basic variable values.
• Pivoting swaps basic and non-basic variables.
  • used to get values of basic variables within bounds.

Pivoting example

- are basic (dependent)
- are non-basic

Initial values:

Bounds :

, make non-basic.
- are basic (dependent)
- are non-basic

Arrays

(define-sort A () (Array Int Int))
(declare-fun x () Int)
(declare-fun y () Int)
(declare-fun a1 () A)

(push)
(assert (= (select a1 x) x))
(assert (= (store a1 x y) a1))
(check-sat)
(get-model)
(assert (not (= x y)))
(check-sat)
(pop)

(define-fun all1_array () A ((as const A) 1))
(simplify (select all1_array x))

(define-sort IntSet () (Array Int Bool))
(declare-fun a () IntSet)
(declare-fun b () IntSet)
(declare-fun c () IntSet)
(push) ; illustrate map
(assert (not (= ((_ map and) a b) ((_ map not) ((_ map or) ((_ map not) b) ((_ map not) a))))))
(check-sat)
(pop)    

Arrays

Arrays as Combinators [39]

  A = Array(Index, Elem) # array sort 
  
  a[i]             # index array 'a' at index 'i'
                   # Select(a, i)
  
  Store(a, i, v)   # update array 'a' with value 'v' at index 'i'
                   # = lambda j: If(i == j, v, a[j])
    
  Const(v, A)      # constant array
                   # = lambda j: v
  
  Map(f, a)        # map function 'f' on values of 'a'
                   # = lambda j: f(a[j])

  Ext(a, b)        # Extensionality
                   # Implies(a[Ext(a, b)] == b[Ext(a, b)], a == b)

Array Decision Procedure

Example Store(a, i, v)

• Each occurrence of Store(a, i, v) and b[j],
  • Assert Store(a, i, v)[j] == If(i == j, v, a[j])

  • Assert Store(a, i, v)[i] == v

• Each shared occurrences of :
  • Assert .

Array Decision Procedure (2)

Example Store(a, i, v)

• Each occurrence of Store(a, i, v) and b[j],
  • Assert Store(a, i, v)[j] == If(i == j, v, a[j])

  • Assert Store(a, i, v)[i] == v

• Each shared occurrences of :

  • Assert .

• Suppose we are given a model satisfying all asserted equalities.
  • assigns values to terms.
  • Extend:
  • Claim: satisfies Store axioms.

Efficient Array Decision Procedures

• Use current partial interpretation to guide axiom instantiation.

• Rough sketch:

  • If (congruent) in current state
    • Assert .
  • If in current state
    • Assert

• Also important to limit set of pairs.

  • Z3 uses relevancy propagation to prune don't care literals
  • Boolector uses dual propagation to extract small implicant

Bit-Vectors

(define-fun is-power-of-two ((x (_ BitVec 4))) Bool 
  (= #x0 (bvand x (bvsub x #x1))))
(declare-const a (_ BitVec 4))
(assert 
 (not (= (is-power-of-two a) 
         (or (= a #x0) 
             (= a #x1) 
             (= a #x2) 
             (= a #x4) 
             (= a #x8)))))
(check-sat)

Bit-Vectors

Floating point example

(declare-fun X () (_ FloatingPoint 11 53))

(assert (fp.isNormal X))
(assert (not (fp.isSubnormal X)))
(assert (not (fp.isZero X)))
(assert (not (fp.isInfinite X)))
(assert (not (fp.isNaN X)))
(assert (not (fp.isNegative X)))
(assert (fp.isPositive X))

(check-sat)
(get-model)

Floating Points demo

Sequence Example

(declare-const a String)
(declare-const b String)
(declare-const c String)
(assert (str.prefixof b a))
(assert (str.suffixof c a))
(assert (= (str.len a) (+ (str.len b) (str.len c))))
(assert (not (= a (str.++ b c))))
(check-sat)  

Sequences and Strings

Queues

Algebraic Data-types

   (declare-datatypes () ((Tree Empty (Node (left Tree) (data Int) (right Tree)))))

   (declare-const t Tree)
   (assert (not (= t Empty)))
   (check-sat)
   (get-model)

sat
(model 
  (define-fun t () Tree
    (Node Empty 0 Empty))
)

Algebraic Data-types demo

Non-linear Arithmetic [29]

NLSAT demo

Duality - model/proof repair

Duality - connecting glue

Duality - propagation

CDCL(T) by example

CDCL(T) by example (2)

CDCL(T) by example (3)

CDCL(T) by example (4)

Modern SAT solving

DPLL [19]

    

    

  

CDCL: Modern Search [46]

• Efficient indexing (two-watch literal)

• Non-chronological backtracking (backjumping)

• Lemma learning

• Variable and phase selection

• Garbage collection, restarts

CDCL Milestones

CDCL: State [42]

- atomic predicates.

- literals over atoms.

- partial consistent assignment.

- a clause - disjunction of literals.

- a decision literal.

- () - a literal with explanation .

- a set of clauses.

CDCL lemma learning .

CDCL lemma learning ..

CDCL lemma learning …

CDCL lemma learning ….

CDCL lemma learning …..

CDCL lemma learning ……

CDCL: as rewrites [5]

CDCL(T)

Models and Proofs

CDCL realizes the dichotomy by interleaving model and consequence finding:

Realizing the dichotomy

Main invariants preserved by CDCL:

• Conflict state: For the state it is the case that and .

• Propagation: For the state and , whenever , then and .

Illustrating the invariants

if

• Finds First Unique Implication Point (FUIP)
  • minimizes number of decision literals in .
  • maximizes propagated literals in

An invitation to optimization

Type error localization using MaxSMT

Optimization

    (maximize (+ x (* 2 y)))


    (minimize (bvadd u v))




    (assert-soft (> x y) :weight 4)

Soft constraints as 0-1 optimization

Equilvalent formulations

   (assert-soft  :weight 3)
   (assert-soft  :weight 4)

   (minimize (+ (if  0 3) (if  0 4)))

Optimizing Assertions

x, y = Ints('x y')
opt = Optimize()
opt.set(priority='pareto')
opt.add(x + y == 10, x >= 0, y >= 0)
mx = opt.maximize(x)
my = opt.maximize(y)
while opt.check() == sat:
    print mx.value(), my.value()

Optimization Extensions

• MaxSAT solver

• Primal simplex optimization

  • Applied on feasible tableau

Multiple Objectives

Optimization as an extension of core SMT solving

MaxSMT

• Typical definition: Minimize the number of violated soft assertions.

• Is built-in, based on MaxSAT algorithms.

MaxSAT example

(declare-const a Bool)
(declare-const b Bool)
(declare-const c Bool)
(assert-soft a :weight 1)
(assert-soft b :weight 2)
(assert-soft c :weight 3)
(assert (= a c))
(assert (not (and a b)))
(check-sat)
(get-model)

MaxSAT flattened

(declare-const a Bool)
(declare-const b Bool)
(declare-const c Bool)
(assert-soft a :weight 1)
(assert-soft b :weight 1) (assert-soft b :weight 1)
(assert-soft c :weight 1) (assert-soft c :weight 1) (assert-soft c :weight 1) 
(assert (= a c))
(assert (not (and a b)))
(check-sat)
(get-model)

• NB. Implementations of MaxSAT typically flatten weights on demand.

MaxSAT flat form

• - hard constraints

• - soft constraints

MaxSAT with Cores [41]

A:

A':

Lemma: for any model of ,

Proof: min:

MaxSAT with MCS [11]

A:

A':


Lemma: for any model of ,

Proof: min:    

MaxSAT with Cores (python)

def add_def(s, fml):
    name = Bool("%s" % fml)
    s.add(name == fml)
    return name

def relax_core(s, core, Fs):
    prefix = BoolVal(True)
    Fs -= { f for f in core }
    for i in range(len(core)-1):
        prefix = add_def(s, And(core[i], prefix))
        Fs |= { add_def(s, Or(prefix, core[i+1])) }

def maxsat(s, Fs):
    cost = 0
    Fs0 = Fs.copy()
    while unsat == s.check(Fs):
        cost += 1
        relax_core(s, s.unsat_core(), Fs)    
    return cost, { f for f in Fs0 if tt(s, f) }

MaxSAT with MCS (python)

def relax_mcs(s, mcs, Fs):
    prefix = BoolVal(False)
    Fs -= { f for f in mcs }
    s.add(Or(mcs))
    for i in range(len(mcs)-1):
        prefix = add_def(s, Or(mcs[i], prefix))
        Fs |= { add_def(s, And(prefix, mcs[i+1])) }

def maxsat(s, Fs0):
    Fs = Fs0.copy()
    cost = len(Fs)
    while s.check() == sat:
        mss = { f for f in Fs if tt(s, f) }
        model1 = get_mss(s, mss, Fs)
        mcs = Fs - mss
        if cost > len(mcs):
           cost = len(mcs)
           model = model1
        relax_mcs(s, [ f for f in mcs ], Fs)
    return cost, [ f for f in Fs0 if is_true(model.eval(f)) ]

MCS alone is inefficient. In [11] we combine MUS and MCS steps.

Cores, Correction Sets, Satisfying Assignments

• (M)US (Minimal) unsatisfiable subset

  • (minimal) subset of assertions that are unsatisfiable. Also known as a core

• (M)SS (Maximal) satisfiable subset

  • (maximal) subset of assertions that are satisfiable.

• (M)CS (Minimal) correction set

  • complement of an (M)SS.

• (Prime) implicant

  • iff is a core for .

A Duality: MUS MCS [45]

All Cores and Correction Sets [33]

def ff(s, p): 
    return is_false(s.model().eval(p))

def marco(s, ps):
    map = Solver()
    while map.check() == sat:
        seed = {p for p in ps if not ff(map, p)}
        if s.check(seed) == sat:
           mss = get_mss(s, seed, ps)
           map.add(Or(ps - mss))
           yield "MSS", mss
        else:
           mus = get_mus(s, seed)
           map.add(Not(And(mus)))
           yield "MUS", mus

Cores and Correction sets Algorithm

def ff(s, p): 
    return is_false(s.model().eval(p))

def marco(s, ps):
    map = Solver()
    while map.check() == sat:
        seed = {p for p in ps if not ff(map, p)}
        if s.check(seed) == sat:
           mss = get_mss(s, seed, ps)
           map.add(Or(ps - mss))
           yield "MSS", mss
        else:
           mus = get_mus(s, seed)
           map.add(Not(And(mus)))
           yield "MUS", mus

Maximizing Satisfying Assignments [36]

def tt(s, f): 
    return is_true(s.model().eval(f))

def get_mss(s, mss, ps):
    ps = ps - mss
    backbones = set([])
    while len(ps) > 0:
       p = ps.pop()
       if sat == s.check(mss | backbones | { p }):
          mss = mss | { p } | { q for q in ps if tt(s, q) }
          ps  = ps - mss
       else:
          backbones = backbones | { Not(p) }
    return mss
          

Minimizing Cores [2, 14, 30, 34]

Use built-in core minimization:

s.set("sat.core.minimize","true")  # For Bit-vector theories
s.set("smt.core.minimize","true")  # For general SMT