On Shostak s Combination of Decision Procedures

Transcription

1 On Shostak s Combination of Decision Procedures H Rueß N Shankar A Tiwari Computer Science Laboratory SRI International 333 Ravenswood Menlo Park CA 9402 Shostak s Combination p of 2)

2 The Combination Problem Verification conditions typically are in combination of many theories Theory of equality Arithmetic constraints Lists Arrays Bitvectors Examples Shostak s Combination p2 of 2)

3 West-Coast Theorem Proving Theorem provers which rely heavily on decision procedures for automating proofs Historical Stanford Pascal Verifier Boyer-Moore Theorem Prover Shostak s Theorem Prover STP) Current Outline) Simplify ava/esc Stanford Temporal Prover STeP) Stanford Validity Checker SVC) PVS Shostak s Combination p3 of 2)

4 Backend Decision Procedures Decision procedures used as prover backend Logical context stored in a database Communication via ask/tell interface Decision procedure for equality in a combination of theories based on Nelson and Oppen s 979] Shostak s 984] These combination algorithms use variants of congruence closure algorithms Shostak s Combination p4 of 2)

5 Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p of 2)

6 Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p6 of 2)

7 ! " ' Language: Signatures A signature is a finite set of Function Symbols : Predicate Symbols : along with an arity function #$&% Function symbols with arity are called constants and denoted by with possible subscripts A countable set of variables is assumed disjoint of Shostak s Combination p7 of 2)

8 ) 0 0 " 2 Language: Terms The set +*- *- */ */ of terms is the smallest set st and whenever and #$&% The set of ground terms is defined as Shostak s Combination p8 of 2)

9 " 0 Language: Atomic Formulas An atomic formula is an expression of the form *3 +* where is a predicate in st * * #$&% and If are ground terms then ground atomic) formula * */ * */ is called a Mostly we assume a special binary predicate present in to be Shostak s Combination p9 of 2)

10 Language: Logical Symbols The set of quantifier-free formula over ) is the smallest set st Every atomic formula is in If 0 then 4 0 If 0 then An atomic formula or its negation is a literal Shostak s Combination p0 of 2)

11 8 9 0 Language: Sentence Theory The closure of under existential ) and universal ) quantification defines the set of first-order) formulas A sentence is a FO formula with no free variables A first-order) theory over a signature ) is a set of deductively closed) set of sentences over and ) A theory is consistent if Due to completeness of first-order logic we can identify a a FO theory with the class of all models of Shostak s Combination p of 2)

12 0 ' " : 0 " : 0 0 Semantic Characterization A model is defined by a Domain : set of elements Interpretation :; for each with #$ % Interpretation for each! with #$ % Assignment for each variable A formula is true in a model if it evaluates to true under the given interpretations over the domain If all sentences in a are true in a model then is a model for the theory Shostak s Combination p2 of 2)

13 < < = >? < < 9 < 0 >? >? Satisfiability and Validity A formula model of in which is satisfiable in a theory if there is a ie there exists a model for evaluates to true denoted by < 8 This is also called -satisfiability A formula is valid in a theory if ie evaluates to true in every model of -validity is denoted by is -unsatisfiable if it is not the case that Shostak s Combination p3 of 2)

14 < < < 9 A A B A C C A C C Getting Started Checking validity of -satisfiability of -satisfiability of -satisfiability of -satisfiability of -satisfiability of -satisfiability of in a theory : PNF) Skolemize) Instantiate) DNF) : conjunction of literals : Theory of equality over UIFs Shostak s Combination p4 of 2)

15 Pure Theory of Equality = uninterpreted) = Deductive closure of axioms of equality Theorem Satisfiability of quantifier-free) conjunction of literals is decidable in -time G DFE Shostak s Combination p of 2)

16 H H 6 6 Pure Theory of Equality = uninterpreted) = Deductive closure of axioms of equality Theorem Satisfiability of quantifier-free) conjunction of literals is decidable in -time G DFE Example Let I I I I Consider Shostak s Combination p of 2)

17 6 6 Illustration: -rules and -rules -rules represent the term DAG: LK B B +N +M +M LO N Equations are represented as: LO LK PN Shostak s Combination p6 of 2)

18 Illustration: -rules and -rules -rules represent the term DAG: QK LK B B +N +M +M LO B LO N -rules represent an equivalence relation on vertices: +N LO LK PN M Shostak s Combination p6 of 2)

19 Illustration: -rules and -rules -rules represent the term DAG: QK LK B B +N +M +M LO B LO N -rules represent an equivalence relation on vertices: +N LO LK PN M Shostak s Combination p6 of 2)

20 Illustration: -rules and -rules -rules represent the term DAG: LK +N B +M B +M LO N LO QK B +N -rules represent an equivalence relation on vertices: LO LK PN M Thus ie QK is a contradiction Shostak s Combination p6 of 2)

21 R S = 2 = W = = = Abstract Congruence Closure Formalizing the procedure: : set of new constants denoted by : Subset of used until now : ordering on : Finite sets of ground equations over : State of derivation : Initial state Extension: T W T VU U if and VU Shostak s Combination p7 of 2)

22 Other Inference Rules Simplification: = T * W = * = T W = * Orientation: = R = R if S R Deletion: = * * Shostak s Combination p8 of 2)

23 * R S R = T X X Other Inference Rules R * = if Deduction: * R X R T = A if Collapse: R T = R * = R * = Composition: R Shostak s Combination p9 of 2)

24 = ) Definition A ground rewrite system congruence closure over and is an abstract) ) for if Shostak s Combination p20 of 2)

25 = ) 0 * * 0 Definition A ground rewrite system congruence closure over and is an abstract) ) for if For every constant st YZ there exists a term Shostak s Combination p20 of 2)

26 = ) 0 * * 0 T * T ] Definition A ground rewrite system congruence closure over and is an abstract) ) for if For every constant st YZ there exists a term 2 is a terminating and confluent rewrite system there is no infinite rewrite sequence using and whenever it is also the case that * Y\Z * * * Shostak s Combination p20 of 2)

27 = ) 0 * * 0 * 0 T T T Definition A ground rewrite system congruence closure over and is an abstract) ) for if For every constant st YZ there exists a term 2 is a terminating and confluent rewrite system 3 and induce the same equational theory over ie for all terms we have: * Y ^ if and only if Y Z * Shostak s Combination p20 of 2)

28 @ Example: Abstract Closure Let Then Shostak s Combination p2 of 2)

29 Example: Abstract Closure Then QK B B QO QK +N QO +N N M +M Inference Rule Used: Extension Simplification Orientation Shostak s Combination p2 of 2)

30 Example: Abstract Closure Then QK B B QO QK +N QO +N N M +M N Inference Rule Used: Collapse Shostak s Combination p2 of 2)

31 Example: Abstract Closure Then QK B B QO QK +N QO +N N M +M N LO Inference Rule Used: Deduction Shostak s Combination p2 of 2)

32 Example: Abstract Closure Then QK B B QO QK +N QO +N N M +M N LO The final abstract congruence closure Shostak s Combination p2 of 2)

33 2 _ > > S S _ d S _ d d e e f Correctness: Statement If is a finite set of equations of size then Any derivation starting from reaches a saturated state in a finite number steps 2 The set 3 2 _ is an abstract congruence closure for and if chain induced by over 4 Using a standard trick G DFE For special cases Sa` ` ` then cb can be bounded by Size of is the length of string representing is required to successfully orient all generated equations of is the longest Shostak s Combination p22 of 2)

34 X = * = 0 T T _ Correctness: Soundness/Completeness Extension: If is obtained from using Extension then X 9 T * Z Yg^ih iff * Zj Yg^j h All other rules are standard Knuth-Bendix completion rules Equations in can always be removed by extension orientation or deletion Every rewrite rule in reduction ordering By correctness of completion is decreasing in a suitable is convergent Shostak s Combination p23 of 2)

35 > > k _ > > = > > = k > > k _ Correctness Proof: Complexity Number of -symbols in never increases and Extension always decreases it is increased by Extension alone after all Extension steps Consider a rewrite rule in VU Superposition Collapse Composition inference rules simplify one of or rewrite the LHS VU Shostak s Combination p24 of 2)

36 > > k _ > > = > > = k > > k _ l d l S S S p k o Correctness Proof: Complexity Number of -symbols in never increases and Extension always decreases it is increased by Extension alone after all Extension steps Consider a rewrite rule in VU If inferences are applied at each position then nm S B Shostak s Combination p24 of 2)

37 > > k _ > > = > > = k > > k _ d q Correctness Proof: Complexity Number of -symbols in never increases and Extension always decreases it is increased by Extension alone after all Extension steps Consider a rewrite rule in VU This rule contributes at most inferences Shostak s Combination p24 of 2)

38 > > k _ > > = > > = k > > k _ > > d Correctness Proof: Complexity Number of -symbols in never increases and Extension always decreases it is increased by Extension alone after all Extension steps The set can contribute at most Superposition Collapse and Composition inferences Shostak s Combination p24 of 2)

39 > > k _ > > = > > = k > > k _ > > d d k Correctness Proof: Complexity Number of -symbols in never increases and Extension always decreases it is increased by Extension alone after all Extension steps The set can contribute at most Superposition Collapse and Composition inferences Number of Extension Simplification Orientation and Deletion steps is derivation length = Shostak s Combination p24 of 2)

40 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants PN QO +r +M QK B Shostak s Combination p2 of 2)

41 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: PN QO +r +M QK B Shostak s Combination p2 of 2)

42 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: B PN QO +r +M QK B Shostak s Combination p2 of 2)

43 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: B PM PN PN QO +r +M QK B Shostak s Combination p2 of 2)

44 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: B PM PN O Pr PN QO +r +M QK B Shostak s Combination p2 of 2)

45 d S Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: B PM PN O Pr PN LO PN QO +r +M QK B Shostak s Combination p2 of 2)

46 d S d Efficient Variants Choosing at run-time so that is small: Consider the set +r of eight constants Say we generate equations which need to be oriented in the following order: B PM PN O Pr PN LO N PN QO +r +M QK B Therefore G DFE Shostak s Combination p2 of 2)

47 Y Y Y } = { z st { y z u ` ` vu x G Y Y = { z { s } z u ` Y Y } w = z ` z Specialized Algorithms Shostak s dynamic congruence closure: w Y ` Y Y ` ws Downey-Sethi-Tarjan s Algorithm: uses the trick with D E w Y ` ws Y ` ~ = Nelson and Oppen s Algorithm: { Y ` ws where NODed rule corresponds to superposition modulo Shostak s Combination p26 of 2)

48 Shostak s Combination p27 of 2) Example: Shostak s

49 Example: Shostak s CC Shostak s Combination p27 of PM PM

50 Shostak s Combination p27 of 2) Example: Shostak s PM PM

51 Example: Shostak s CC Shostak s Combination p27 of PM PM B B

52 Example: Shostak s PM PM B B Final congruence closure B B PM PM Shostak s Combination p27 of 2)

53 Shostak s Combination p28 of 2) Example: DST

54 O LK N Shostak s Combination p28 of 2) Example: DST O PN

55 LO +N Shostak s Combination p28 of 2) Example: DST LK PN O PN +M +N QO +N +N

56 LO +N Shostak s Combination p28 of 2) Example: DST LK PN O PN +M +N QO +N +N QO QK

57 LO +N Shostak s Combination p28 of 2) Example: DST LK PN O PN +M +N QO +N +N QO QK B LO LO

58 Example: DST LO LK PN O PN +N +M +N QO +N +N QO QK B LO LO Final congruence closure is: +N +N +M +N M QK B B QO LO LK LO PN LO Shostak s Combination p28 of 2)

59 Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p29 of 2)

60 = = Combination of Theories = : Theories over and = Deductive closure of Problem Is consistent? Problem2 Given satisfiability procedures for quantifier-free) conjunction of literals in and decide satisfiability in? how to Problem3 What is the complexity of the combination procedure? Shostak s Combination p30 of 2)

61 7 9 8 = Stably-Infinite Theories A theory is stably-infinite if every satisfiable QFF is satisfiable in an infinite model Example Theories with only finite models are not stably infinite Thus theory induced by the axiom is not stably-infinite 7 Proposition If is an equational theory then is stably-infinite Proof If is a model then is a model as well Hence by compactness there is an infinite model Proposition The union of two consistent disjoint stably-infinite theories is consistent Proof Later! Shostak s Combination p3 of 2)

62 p 6 p p 7 p Convexity A theory is convex if whenever a conjunction of literals implies a disjunction of atomic formulas it also implies one of the disjuncts Example The theory of integers over a signature containing is not convex The formula implies but it does not imply either or independently Example The theory of rationals over the signature is convex Example Equational theories are convex but need not be stably-infinite Shostak s Combination p32 of 2)

63 = 8 = Convexity: Observation Proposition A convex theory with no trivial models is stably-infinite Proof If not then for some QFF has only finite models Thus implies a disjunction without implying any disjunct Example If stably-infinite C ƒ 7 C h ƒ is an equational theory then has no trivial models and hence it is Shostak s Combination p33 of 2)

64 Nelson-Oppen Combination Result Theorem Let and be consistent stably-infinite theories over disjoint countable) signatures Assume satisfiability of quantifier-free) conjunction of literals can be decided in and time respectively Then The combined theory is consistent and stably infinite 2 Satisfiability of quantifier-free) conjunction of literals in can be decided in time 3 If in and is in Proof Later are convex then so is K and satisfiability time Shostak s Combination p34 of 2)

65 = = p p p Examples Convexity is important for point 3) above Signature Satisfiability Note that G DFE is not convex NP-complete! We can allow a add constant operator in signature of Atomic formulae are of the form for some constant and satisfiability can be tested by searching for negative cycles in a difference graph For NP-completeness of the union theory see Pratt77] Shostak s Combination p3 of 2)

66 = 6 C C B 6 6 B B 6 C Nelson-Oppen Result: Correctness Recall the theorem Initial State : The combination procedure: is a conjunction of literals over Purification : Preserving satisfiability transform st is over Interaction : Guess a partition of into disjoint subsets Express it as a conjunction of literals Example The partition is represented as Component Procedures : Use individual procedures to decide if is satisfiable Return : If both answer yes return yes No otherwise to Shostak s Combination p36 of 2)

67 6 T T * 6 6 T X X Separating Concerns: Purification Purification: * if is not a variable * Proposition Purification is satisfiability preserving: if is obtained from by purification then is satisfiable in the union theory iff is satisfiable in the union theory Proposition Purification is terminating Proposition Exhaustive application results in conjunction where each conjunct is over exactly one signature Shostak s Combination p37 of 2)

68 Š Shostak s Combination p38 of 2) Purification: Illustration ˆ Œ

69 Purification: Illustration ˆ Š Œ W ˆ Š W Shostak s Combination p38 of 2)

70 Purification: Illustration ˆ Š Œ W ˆ Š W ˆ Š Ž W W W Shostak s Combination p38 of 2)

71 Purification: Illustration ˆ Š Œ W ˆ Š W ˆ Š Ž W W B W W W W B Shostak s Combination p38 of 2)

72 NO Procedure Soundness Each step is satisfiability preserving Say is satisfiable in the combination) Shostak s Combination p39 of 2)

73 6 k NO Procedure Soundness Each step is satisfiability preserving Say is satisfiable in the combination) Purification: is satisfiable Shostak s Combination p39 of 2)

74 6 k 6 6 k NO Procedure Soundness Each step is satisfiability preserving Say is satisfiable in the combination) Purification: 2 Interaction: satisfiable is satisfiable for some partition is Shostak s Combination p39 of 2)

75 6 k 6 6 k 6 6 k NO Procedure Soundness Each step is satisfiability preserving Say is satisfiable in the combination) Purification: 2 Interaction: satisfiable is satisfiable for some partition 3 Components Procedures: and both satisfiable in component theories is are Therefore if the procedure returns unsatisfiable then the formula is indeed unsatisfiable Shostak s Combination p39 of 2)

76 NO Procedure Correctness Suppose the procedure returns satisfiable Shostak s Combination p40 of 2)

77 NO Procedure Correctness Suppose the procedure returns satisfiable Let be the partition and and be models of and Shostak s Combination p40 of 2)

78 k NO Procedure Correctness Suppose the procedure returns satisfiable Let be the partition and and be models of and Component theories are stably-infinite assume models are infinite of same cardinality) Let be a bijection between and st for each shared variable We can do this of : Shostak s Combination p40 of 2)

79 k o o : NO Procedure Correctness Suppose the procedure returns satisfiable Let be the partition and and be models of and Component theories are stably-infinite assume models are infinite of same cardinality) Let be a bijection between and st for each shared variable We can do this of Extend to by interpretations of symbols in : : m m Such an extended is a model of Shostak s Combination p40 of 2)

80 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

81 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

82 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

83 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

84 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

85 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

86 6 C C B B K M Model Construction Picture Consider -models and of : K B K B K M Shostak s Combination p4 of 2)

87 NO Procedure Complexity Proposition The non-deterministic procedure can be determinised to give a -time algorithm Proof Shostak s Combination p42 of 2)

88 p 6 NO Procedure Complexity Proposition The non-deterministic procedure can be determinised to give a -time algorithm Proof Number of purification steps is and size of resulting Shostak s Combination p42 of 2)

89 p 6 p NO Procedure Complexity Proposition The non-deterministic procedure can be determinised to give a -time algorithm Proof Number of purification steps is 2 Number of partition of a set with and size of resulting variables: Shostak s Combination p42 of 2)

90 p 6 p NO Procedure Complexity Proposition The non-deterministic procedure can be determinised to give a -time algorithm Proof Number of purification steps is 2 Number of partition of a set with 3 For each take and size of resulting variables: choices the component procedures and -time respectively Shostak s Combination p42 of 2)

91 6 C C 6 C C C NO Deterministic Procedure Instead of guessing we can deduce the equalities to be shared The new combination procedure: Purification : As before Interaction : Deduce an equality : Update And vice-versa Repeat until no further changes to get _ Component Procedures : Use individual procedures to decide if _is satisfiable Note iff is not satisfiable in Shostak s Combination p43 of 2)

92 k Deterministic Version: Correctness Each step is satisfiability preserving soundness follows Shostak s Combination p44 of 2)

93 k C Deterministic Version: Correctness Each step is satisfiability preserving soundness follows Assume that the theories are convex Let _be satisfiable Shostak s Combination p44 of 2)

94 k C C C _ Deterministic Version: Correctness Each step is satisfiability preserving soundness follows Assume that the theories are convex Let _be satisfiable If identified U is the set of variables not yet m ƒ Shostak s Combination p44 of 2)

95 k C C C _ C C ƒ _ Deterministic Version: Correctness Each step is satisfiability preserving soundness follows Assume that the theories are convex Let _be satisfiable If identified By convexity U is the set of variables not yet m ƒ F m m ƒ Shostak s Combination p44 of 2)

96 k C C C _ C C ƒ _ 6 C k ƒ _ Deterministic Version: Correctness Each step is satisfiability preserving soundness follows Assume that the theories are convex Let _be satisfiable If identified By convexity U F m is the set of variables not yet ƒ m m ƒ F m m ƒ is satisfiable The proof is now identical to the previous case Shostak s Combination p44 of 2)

97 C C Deterministic Version: Complexity For convex theories the combination procedure runs in time: K Identifying if an equality time is implied by 2 Since there are possible equalities between variables fixpoint is reached in iterations takes Modularity of convexity: Unsatisfiability is signaled when any one procedures signals unsatisfiable Shostak s Combination p4 of 2)

98 8 = 7 = NO: Equational Theory Version Equational theories are always consistent 2 If also stably-infinite is consistent then this theory is 3 Equational theories are convex If then consider the initial algebra induced by an extended signature) 4 Often decision procedures based on standard Knuth-Bendix completion can be used to deduce equalities Therefore satisfiability procedures can be combined with only a polynomial time overhead over Shostak s Combination p46 of 2)

99 Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p47 of 2)

100 k C C Application: Theory of Equality = uninterpreted) = Deductive closure of axioms of equality is a stably-infinite equational theory Congruence closure decides satisfiability of QFF in congruence closure for disjoint in polynomial time can be combined If congruence closure algorithm over a singleton described using completion we get an abstract congruence closure for the combination is Shostak s Combination p48 of 2)

101 Commutative Semigroup = = Axioms of equality + AC axioms for Treat as variable arity Flatten all equations and do completion modulo Shostak s Combination p49 of 2)

102 Commutative Semigroup All rules are of the form Collapse guarantees termination of completion via Dickson s lemma Using an appropriate ordering on multisets we get a algorithm to construct convergent systems and decide satisfiability of QFF) Shostak s Combination p0 of 2)

103 Example: Commutative Semigroup we can use orientation If superposition modulo ) collapse to get a convergent modulo ) rewrite system B B B B B B B B B Shostak s Combination p of 2)

104 = 0 0 Application: Ground AC-theories = = Axioms of equality + AC axioms for each Use Extension inference rule to purify equations Use abstract congruence closure on Use completion modulo on each Combine by sharing equations between constants Time Complexity: Similarly -symbols can be added G D E Shostak s Combination p2 of 2)

105 = ` ` Gröbner Bases = = Polynomial ring over field Given a finite set of polynomial equations new equations between variables) can be deduced using Gröbner basis construction Main inference rules is superposition For eg ` The equations are simplified and oriented st the maximal monomial occurs on LHS for eg Shostak s Combination p3 of 2)

106 Gröbner Bases: Contd Collapse simplifies LHS of rewrite rules ` which simplifies to a contradiction Using suitable ordering on monomials and sums of monomials a convergent rewrite system modulo the polynomial ring axioms) called a Gröbner basis can be constructed in finite steps Termination is established using Dickson s lemma as before Shostak s Combination p4 of 2)

107 = = = š 0 0 š Application: Gröbner Bases Plus = = Union of the respective theories Use NO combination with the following decision procedures to deduce equalities: Use abstract congruence closure on Use completion modulo Use completion modulo on each on each Use Gröbner basis algorithm on equations over Since each theory is convex and stably-infinite we get a polynomial time combination over the individual theories Shostak s Combination p of 2)

108 œ < 9 < 9 Summary The Nelson-Oppen theorem combines satisfiability procedures for conjunctions of literals in disjoint and stably-infinite theories This is equivalent to deciding the validity of clauses: where are AND/OR of atomic formulas Using Purification it is easy to see that we can restrict to contain atomic formulae over variables By definition if is convex and is the only predicate symbol then validity above is equivalent to horn validity: This motivates the definition of convexity Shostak s Combination p6 of 2)

109 Summary Convexity allows optimization Convexity is also necessary for completeness of deterministic version of the NO procedure In the second part additional assumptions grouped under the name Shostak theories will allow for further optimized implementations of the deterministic NO procedure Stably-infiniteness is required for completeness ie if the component procedures return satisfiable it allows construction of the fusion model Shostak s Combination p7 of 2)

110 Special Case: Theory with UIFs Theorem Let be a theory over a signature Let be a disjoint set of function symbols with pure theory of equality over it If satisfiability of quantifier-free) conjunction of literals can be decided in time in then The combined theory is consistent 2 Satisfiability of quantifier-free) conjunction of literals in can be decided in time 3 If in and is in are convex then so is K G D E G DFE and satisfiability time Shostak s Combination p8 of 2)

111 Single Theory with UIFs We modify the deterministic and non-deterministic procedures as follows: purification is applied until all disequations over terms in are reduced to disequations between variables all variables introduced by purification are considered shared between the two theories rest is identical to the NO procedure Stably-infiniteness was required to get a bijection between the two models Since there exist models of any cardinality above a minimum which is communicated to in completeness holds Shostak s Combination p9 of 2)

112 = Combination for the Word Problem The word problem concerns with validity of an atomic formula NO result can be modified to give a modularity result for this case NO result can not be used as such because the generated satisfiability checks may not be equivalent to word problems If and are non-trivial equational theories over disjoint signatures with decidable word problems then the word problem for is decidable with a polynomial time overhead Shostak s Combination p60 of 2)

113 ` Non-Disjoint Signatures Word problem in the union may not be decidable : semigroup presentation with undecidable word problem : Theory induced by with uninterpreted decided by congruence closure) : Theory of semigroups decided by flattening) Satisfiability in the union may not be decidable : : : Theory of semi-groups Shostak s Combination p6 of 2)

114 = Non-Disjoint Signatures If is a model for theory then a model for and respectively Define fusion of models as well Define a bijection between interpretations accordingly and and Œ and is st converse hold and give Generalize stably-infiniteness : Identify conditions under which two models can be fused Kinds of assumptions: - is identical to - or a subset thereof generates both ž Œ ž Œ and - Examples Theories which admit constructors Shostak s Combination p62 of 2)

115 Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p63 of 2)

116 Ÿ l l Shostak theories A canonizable and solvable theory is a Shostak theory A canonizer maps terms to normal form terms st equal terms in the theory are mapped to same form A solver substitution maps an equation to an equivalent eg linear arithmetic Canonizer returns ordered sum-of-monomials Rational solver isolates say largest variable through scaling and cancellation Integral solver based on Euclid s algorithm l # where is fresh Shostak s Combination p64 of 2)

117 Ÿ > Ÿ A Ÿ " " Ÿ A Ÿ Ÿ A Ÿ A Canonizable Theories A theory is said to be canonizable if there is a computable such that iff? A term for every subterm of is said to be canonical if Canonizer for linear arithmetic Ÿ Shostak s Combination p6 of 2)

118 0 0 0 Equality Sets An equality set is of the form A implies is functional if : : otherwise Lookup: Apply: A solution set is a functional equality set of the form for ƒ " C with Shostak s Combination p66 of 2)

119 X X ª ª 0 X ª X X X " " X X > X >?? X > >?? Preservation A variable assignment Let for all extends and be sets of literals; then: if -preserves if for all -interpretations and assignments there is some extending such that iff In this case: iff This notion of preservation is sufficient for our purposes since no new function symbols introduced Shostak s Combination p67 of 2)

120 «««" ª «" Solvable Theories A theory is called solvable if there is a computable procedure iff is -unsatisfiable Otherwise where is a functional) solution set such that -preserves Notice that fresh variables that is variables not in might be introduced on right-hand sides Shostak s Combination p68 of 2)

121 Ÿ Theory of Lists Signature " " Theory of lists contains the initial models of: " " " " Canonizer is the normal form of the terminating and confluent TRS above Shostak s Combination p69 of 2)

122 «I I H µ H µ ¹ H ³ I I» I I H ²± I ³ Õ Õ Î Ñ > X «««= 0 ] List Solver consists of an equality set and a «A configuration solution set I ^ h µ H ³ h ²± H I ^ h º ¹ I h Decom fresh I ^ h H ³ º ¹ H I ^ h H ³ ¹ H I ^ h Hm h ²± H ³ I ^ih m h H ³ Solve I Ð ÍÏÎ ÌËÊ ÅÇÆÉÈ Ä ^ h ³ H ¼ ³ ¼ &à ÂIh À ¼Á H ^ H¾½ VarElim I ^ h ³ H ³ I H ^ih Triv I ^ h H ³ ÖÖÎ Æ ÒÔÓ Bot X«Ÿ XØ «where Shostak s Combination p70 of 2)

123 Ú Ù Ù Ÿ 6 Û 7 Û = d Booleans Signature $ " Canonizer returns eg a binary decision diagrams ordering on variables needed) instead of Solver process $ " d Ú Û s are fresh where the Shostak s Combination p7 of 2)

124 Example: Boolean Solver 6 4 Ú Ú $ " $ " = Ú $ " $ " Shostak s Combination p72 of 2)

125 ? >? # "Ü Þ Þ Ý Ý ««X X A Deciding a Shostak Theory Let be a Shostak theory with canonizer solver We consider the validity problem Ÿ? and Template for decision procedure Build a solution set using a finite number of -preserving transformations 2 Compute canonical forms 3 If then Yes else No «XØ ^ Þ Þ ÝÝ XØ Shostak s Combination p73 of 2)

126 «ÞÞ ÝÝ «0 «] «] «= ] «««] Deciding a Shostak Theory Cont) Canonization Ÿ? ÞÞ ÝÝ «Fusion > «Ôß Composition «Ôß For solved forms Shostak s Combination p74 of 2)

127 ««= ÞÞ ÝÝ ««# ^ >? ÞÞ X ÝÝ «A Deciding a Shostak Theory Cont) consists of an equality set and «Configuration a solution set Building a solution set 2 «"Ü "Ü «$ " "Ü «"Ü ÞÞ ÝÝ ««] $ " Y X«"Ü For ÞÞ X ÝÝ «iff or X«either Shostak s Combination p7 of 2)

128 # X > X«X «Õ æ Õ æ Í æ Í Õ à ñ ì ò ó ñ ì ì Soundness and Completeness ; "Ü X«^ Let -preserves that is for every -interpretation and an assignment iff there is a extending to the variables in ) such that X«X«> X " then Ÿ? A X «Ÿ? Soundness If é ä âè éðä âè éðä âè Î é ä âèæ Î âæ êéë êéë çîä âãåä á ð î íïî Thus Completeness By contraposition Construct a model such that but ð î íïî ó í î ó Shostak s Combination p76 of 2)

129 úù ø ð ù ø ó ý î ð ò ì ú ö ý ó ò ú ö ý ú ö ö ó î ò ý ó ì ý ù ó ý ñ ð î ì ì ú ö ò ì ñ ì Soundness and Completeness Cont) úùñ ø öý «ö ô ûü Ÿõô When ùñ ø ý í î ó st there is a -model ù ø ÿ ý in for variables î ò st ó to an assignment if Extend ó ùù øøý ú î í î ùñ ø ø ð î í î but í î ó -preserves ý ì Since ð î í î ó Shostak s Combination p77 of 2)

130 ò ò ú ö ý î ý î ñ ý ý û ò Shostak Theories in a NO Loop The solver and canonizer can be used to decide satisfiability of of equalities and disequalities in convex Shostak theories One way to do this: let ; if then return unsatisfiable if there is a disequality in st then return unsatisfiable Return satisfiable and set of newly inferred variable equalities) ð ñ ðî ì Thus convex and stably-infinite Shostak theories can be integrated with other disjoint convex stably-infinite theories using the NO result Shostak s Combination p78 of 2)

131 ò ò ò ò Outline Abstract Congruence Closure Nelson-Oppen Combination NO) Various Applications of NO Shostak Theories Shostak Combination Commented Bibliography Shostak s Combination p79 of 2)

132 ò ò ü ú ö ò ñ ð ð ò Combining Shostak Theories Problem Combination of the theory of equality over UIF with several disjoint Shostak theories Let and theory A term A term -term ð ì ÿ ÿ ð ìÿ is a pure be the canonizer and solver for is an -term if -term if every subterm of is an Shostak s Combination p80 of 2)

133 ò ò "! ð û ð î ô ö ú ö ô "! ñ ' î ð ð î ò ú ö ñ ö ú ú ö î î ð ü î! ò ô ò Composable Shostak Theories Resolve possible semantic incompatibilities between Shostak theories Canonical Term model ú ð ö ô í ü ú ú ð ì ÿ ÿ ð ìÿ ö ö ô ü î ú ð ì ÿ ÿ ð ìÿ Example is canonizable ) and solvable Its canonical term model is it is only satisfiable in a two-element model î % #$ ð ü ì î & ÿ ñ ì ñ ü ì but " ÿ ÿ ìÿ ñ ì ð ì A Shostak theory is composable if the canonical model is isomorphic to) a -model -validity is convex for composable Shostak theories Shostak s Combination p8 of 2)

134 ) ' î ÿ ÿ - 77 à E = - - ë - > H K A - ë à éé é 8 E - ê ë ë C C à E - ë à Convexity of Composable Theories For a composable Shostak theory implies ' ÿ ) î ô íïî for some ) * î +* ô íïî -preserving) > = :<; / Let for all D C C çb? A ) wlog ë D C C çb? A then ë? H > 8IH FG éé> 8IH èè > / 8IH FG Construct H 8IH FG )) è B èèb FLG because for all D C C A? B FLG for all D C C MB? A Shostak s Combination p82 of 2) FG

135 ò PON ò ñ ' î ð ò Q R ò ò ú ö ú ö ð î î ì ÿ ÿ ÿì ) ú ñ ö ö ì ) ) î ì ÿ ÿ ÿì ò Is this good or bad news? Shostak s algorithm is complete for Shostak theories but a Shostak-like algorithm is not complete for the combination of Consider a Shostak theory with nonconvex Then but í î ô íïî ô Consider: î ð î ð ñ ' ÿ ÿ ÿ ñ for -validity î ì ð í î ô î úñ Can be shown to hold by case-splitting which Shostak does not do Shostak s Combination p83 of 2)

136 ò ü ú ö ð ò " ú í! V U ð ð î W ò ù ø ð û ð ð ü î ú ö ü î ú ú ú ö ú ú ö ö ð ü ü î ü ì ÿ ÿ ÿì Combining Canonizers is easy: Treat alien terms as variables and apply to canonize when Let be a chosen bijective equality set between the set of variables and S öt U Individual canonizers for impure terms ú ð ö ú ù ì ð ö ø üs when S The combined canonizer ú ð ö ö ü ö ð ì ÿ ÿ ð ìÿ Shostak s Combination p84 of 2)

137 ò ú ú ö \ Q Z X Y ] ^ _ ] ^ Combining Solvers: The Problem already shows up when combining Shostak theories Consider ö in The individual theories arithmetic) and have solvers and canonizers lists) Shostak s Combination p8 of 2)

138 ú ú ö \ Q Z X ú ú ö Z Q Z a ú Q Z ` ú Z Q ` a _ The Problem Cont) Assume a combined solver which treats alien terms as variables and applies component solvers or according to the top-level symbol ] ^ Example ö Y ö Y ` ú ] ö ú Z c a ö ö b ú ^ ö ú Z c a ö ö b ú ] ö occurs on the right but this is not a solved form: Shostak s Combination p86 of 2)

139 ú ý öý ý ý _ ] ^ f ý d ý ] e ý ^ f The Solution Shostak theories can be combined without combining solvers Key ideas Maintain theory-wise solution sets Communicate variable equalities as in NO Construct combined canonizer as required in a Shostak combination) For configurations of variable equalities in canonical form a solution set for the theory a solution set for the theory d c e c consist Shostak s Combination p87 of 2)

140 8 77 j 8q 3 8 k 77 q s 6 u3 r 674 j 8q x k j j > x H j à à > y H H à à x j H l H H H > 8 > 8? > - H > 8? > > 8 >> 8 > 8 Process / h> 0g > o > g 0g 8Ip / > o lnm k iij 0g >>>éék wwj g 8s q v 73 p 8Ip 6 8It > k g / p xk to get wrt Canonize and by a fresh 8y H{z : Replace xk HI} 2 Variable abstract Iteration yields to 8IH{z and ~ HI} to H adding xk from assuming i H ƒ ~ to yield into 3 Merge such that : When 4 Close into merge ~ 8IH ~ but > 8IH merge 8 H but ~ > 8IH ~ - into 8IH r ˆ4 7 6 Shostak s Combination p88 of 2)

141 ú ú ö \ Q Z X _ l z z à à à à à à i z 8 8 i z 3 ý ý _ e d ú ú ý ý e e 8 ž Ÿ Example to ö Y Variable abstract ŠŒ ŠŒ i H n n n n n n H œœ l n n š à H à n n à H ŽŽ > l : 3 > { à p { solve but not in are merged in in Š and Š Since Š Š l i n > n r ˆ4 7 6 Shostak s Combination p89 of 2)

142 " Z! a _ l z z à à à à à à i z Ÿ 8 8 i z 3 _ Š _ Example Cont) ŠŒ ŠŒ Result of solve was Compose result i H { { { n { { { H l n à n š à H à n n à H ŽŽ > l : 3 > n à p n No new variable equalities to be propagated The different solved forms of both and are tolerated since canonizer picks a solution that is appropriate to the context Š Shostak s Combination p90 of 2)

143 _ l z z à à à à à à i z Ÿ 8 8 i z 3 ú ú \ X X Z X Š _ ` ` ` ú ú \ \ \ Q Example Cont) Canonical state i H n n n n n n H l n à n š à H à n n à H ŽŽ > l : 3 > n à p n Š ` Š Š Y Y Š{ ` _ Š ` Š ` Shostak s Combination p9 of 2)

144 _ü ü _ éé> ww à à H à éé> ww à à à Canonizer -terms is only defined for pure is the extension of that deals with alien terms by treating them as variables _ü Canonizer for the combination of Shostak theories > 8IH ~ éé wwh when > à 8IH ~ j } 8 j y z >>éé> wwj} > à éé wwj z y x >>>éé wwj} > à éé wwj z y x j } 8 j y z Shostak s Combination p92 of 2)

145 P «ª _ ú ý ý N d _ ý d ú ý N ú ý ý ý d _ N ý _ d ú ý _ d ú ý d Congruence Closure Revisited = uninterpreted) = Deductive closure of axioms of equality Validity problem State consists of contains the variable equalities contains equalities contains the unprocessed input equalities c ÿ ÿ cÿ together form the solution state partitions the variables into equivalence classes are in the same equivalence class if and Shostak s Combination p93 of 2)

146 ú ý _ ú _ k j 8q 77 q s 6 u3 r 674 j 8q ±± û ª >>éék Template for Shostak CC Start state by iterating ý ý Compute h> 0g > = > g 8Ip > = 0g lnm k iij 0g wwj 0g 8s q v 73 p 8Ip 6 8It > k 0g p ±± «ý ý Check canonical forms: Present treatment a specific strategy of abstract CC Shostak s Combination p94 of 2)

147 ý «ª «ý «ª ª «ú ª ý d ú ý N «ª ý "!! ý ³ ² d N ú ú ý ý ý N û N ú ú ý ý ý û d d Congruence Closure Revisited Cont) For each input equality Canonize wrt 2 Variable abstract fresh and adding to 3 Merge 4 Close c ÿ ÿ cÿ into ý " c and state to get : Replace to and Iteration yields to yield : When such that merge into : assuming c ÿ ÿ cÿ by a from but Shostak s Combination p9 of 2)

148 _ ú ú ú ú ú _ ú ú ú ú ý _ Y! " Š! ` Example Validity problem " ú! c Start state " ú c! "! Abstraction "! Y µ ŠŒ Š Š c Š c Š c " Š Š Š c Š c Š Š Shostak s Combination p96 of 2)

149 "!! Š "! `! Š Example Cont) Š Š Š c Š Š c Š c " Š Š c Š c Š Š Š Š c Š Š c Š c ¹ º " Š Š c Š c Š Shostak s Combination p97 of 2)

150 _ ý ý d û d ý ý N û N _ "! Š! Example Cont) are incongruent if and Variables There are no incongruences in our running example Š Š c Š c Š c " ŠŒ Š Š c ŠŒ c Š Shostak s Combination p98 of 2)

151 "!! Š "!! "! Š! Example Cont) Š Š c Š Š c Š c " ŠŒ Š c Š c Š Processing of Canonization and orientation yield which is merged ŠŒ Š c Š Š c Š c " Š Š c ŠŒ c Š is fixed by close Š Š The incongruence between Š c c Š c ý " Š Š c ŠŒ c Š Shostak s Combination p99 of 2)

152 ±± ý ý ª ª _ 8y éé> y ww à à à 8y éé> y ww à à à _!! ±± ±± _ Example Cont) with respect to of a term Canonical form > 8IH ~ éé wwh éé> wwj} ééà wwj z H / H when > à 8IH ~ 8 j z j } otherwise > à éé wwj} ééà wwj z 8 j z j } Example " Š c Š c Š c ý " Š Š c Š c Š ý ý û û Now Shostak s Combination p00 of 2)

153 _ ½ _ «ª _ O Multi-Shostak Consider the union of the equality theory of for UIF and a set of disjoint composable Shostak theories ) An a ¼» R c ÿ ÿ Q cÿ -model of is a model whose reduct wrt -model for every Validity problem R c ÿ ÿ Q cÿ is Shostak s Combination p0 of 2)

154 k j 8q 77 q ~ s 6 u3 6 r 674 j 8q xk x j ±± «±± ý ý û ª Multi-Shostak: Process Decision procedure ý Compute h> 0g 64 ¾ / à > = 0g > = > g 8Ip > = g lnm k i j 0g x> > k x j 0g 8s q v 73 p 8Ip 8 t > k 0g p ééwwk ééà wwj where then Yes else No 2 If Shostak s Combination p02 of 2)

155 Canonical Solution States _ Invariants ý d is functional and idempotent ý is functional and normalized ý ³ ý d ý ) ý Œ À ) are functional) solution sets idempotent normalized ý ³ ý d ý ) _ A solution state ý is confluent if for all c ¹ ý d and À : ý d û ý d ý û ý _ A canonical solution state ý is confluent and satisfies the invariants above Shostak s Combination p03 of 2)

156 Y_ ý _ d "!! ý ý ý ³ ² d ` d N N _ ý ý ý ` _ d Multi-Shostak: Process Y µ with fresh -term to Replace maximal pure variable adding ¹ º ý " ¹ º ý ² ý to restore canonicity ¹ º or ¹ º Apply Shostak s Combination p04 of 2)

157 > 8q 8 H B 8q à à > k ÃÃ8 > j B à à k? H à ÍÍ«ÌÌ Ë ¹ Y _ Ñ Î _ À Multi-Shostak: Abstraction > à H 0g 8 H 0g q v 73 p p x à when >élwk i B é lwj H i B x g > k ¾ / H j 0g q v 73 p p 8¾ÆÅ ÄÄ Âp t or 8IHnz yá 8 B H} > à j m pˆ l à H i H ~ m x ~ l à B i H m x Ê? ¾ for È à xéè -term is a maximal pure ª by If in is replaced with and then { y = gx) z = fy) } is not idempotent Ï ÐÏ Î ) Ò Shostak s Combination p0 of 2)

158 r 674 r 674 / H à : H t4 à 8? > 8 >> u3 6 t 6 8 8? > ~ u3 6 t 6 8 r 674 z g Multi-Shostak: ¾ / when > 8 à ¾ à x à when x à > 8 > à ~ 8 and > à 8IH > à ~ > 8 H ~ Ç à 8¾ÆÅ H 0g 8 x or and > à > 8IH > à ~ 8IH ~ Ç à 8¾Ó >>> 8 ~ > 8IH ~ 0g 8 x otherwise > à r9öõ 6 p Ô t34 > 8 > ~ Ø g g ~ Á g ~ 8 > 8 r9 Õ 6 p Ô t34 Shostak s Combination p06 of 2)

159 > u3 6 t 6 8 > 8 > ~ u3 6 t 6 > Ú g z ~ u3 6 t 6 Ü q Ô ßÞ Multi-Shostak: Merge Ç à ¾Å where x à Hg 8 >>à 8IH r 7 ˆ4 6 ƒ x Ê à? ¾ for È à xéè ~ x ~ H 0g H 8 Û Ú Ø g Ù g Ú Á Ù g ƒ ~ 8 Hg 8 Û âiã àöá ÙÝÜ where Shostak s Combination p07 of 2)

160 ä d ç ç wwú à à Ú â Ú â â â à Ú â Ú â â â wwú à à à Multi-Shostak: Canonizer a combined ä è ç äæå Given a canonical state canonizer can be defined as: Û âiã Ú ~ Ü ééëê wwã Ú when Û à âiã Ú~ Ü éûé ê j } â y j z Ú ÛÛééÛ wwj} Ú éé Û à wwj z Ú y x Ü ã ÛÛÛéé wwj} Ú éé Û à wwj z Ú y x Ü éûé ê j } â y j z j Û Ü â j Ú Á and j Û Ü â j Á with Shostak s Combination p08 of 2)

161 ±± «ä ª _ «ï Y_ ä _ ä ¹ d Termination Öíî µì òó ôì ï is terminating ä ªñð is terminating terminates because the sum of the number of equivalence classes over variables in decreases in each iteration õ ó Shostak s Combination p09 of 2)

162 ö å ö ä ï ì ì íü ó ô ö ö ð ä ð Soundness and Completeness Theorem Let with signature be the union of the theory and theories Ò ð Furthermore let then: ½ ð ûð ú ù ø ç ç ç of UIF ú ù ø ù ç ç ç ; õ ÿ ý ) be disjoint composable Shostak and ð either iff or ä ä Shostak s Combination p0 of 2)

163 ï ì ì íü ó ô ö ä ä ö ä ä ä ð ð ö ä ð ö ð ð Proof Outline -preserves ä then õ ÿ ý ä ûð If then Soundness if ð ð ð ð Thus Completeness by contraposition: if then for canonical ä ä ð ä st -model but Construct an ä ð ù ù Shostak s Combination p of 2)

164 ö ä í ì î ù è ù ç ç çù è ù ç ç çù ö ð ð ø Ò Ò Ò ú ö Canonical Term Model Definition ä ûð ä ûð ÐÏ ä ûð ÐÏ Properties ä ä ù is isomorphic to is composable -model since ) and is an for each -validity is convex Corollary: Shostak s Combination p2 of 2)

165 Ò ö ð # ð ö Canonical Term Model Cont) The canonical term model canonical -model is isomorphic to the The isomorphism is defined between all S-canonical terms) and all -canonical terms) so that ð where ð ä!! $ ð! "! " Need to show that ð for Shostak s Combination p3 of 2)

166 ö ö ö ö ö Summary Decision procedure based on Shostak s ideas for the combination of equality over UIF and disjoint composable Shostak theories Key idea: separate solution sets for individual theories Variable dependencies can be cyclic across theories Shostak combination an instance of NO combination Added advantage is a global canonizer Shostak s Combination p4 of 2)

167 ö ö ö ICS: Integrated Canonizer and Solver A variant of the Shostak combination described here is implemented in ICS The theory supported by ICS currently includes: Equality and disequality Rational and integer linear arithmetic Theory of tuples S-expressions Boolean constants Array theory Theory of bitvectors Available free of charge for noncommercial applications under the ICS license agreement icscslsricom Shostak s Combination p of 2)

168 ö ö ö ö Bibliography Armando A Ranise S and Rusinowitch M A rewriting approach to satisfiability procedure IC 02 deriving decision procedures Baader F and Tinelli C Deciding the word problem in the union of equational theories IC 02 theories sharing constructors Bachmair L Tiwari A and Vigneron L Abstract congruence closure AR 02 Abstract CC specializations complexity Barrett C W Dill D L and Stump A A generalization of Shostak s method for combining decision procedures FroCoS 02 Shostak in NO procedure convexity and stably-infiniteness Shostak s Combination p6 of 2)

169 ö ö ö ö Bibliography Bjorner N S Integrating decision procedures for temporal verification PhD Thesis 98 general results plus proedures for individual theories Cyrluk D Lincoln P and Shankar N On Shostak s decision procedure for combination of theories CADE 96 Shostak s CC Single theory with UIF Downey P Sethi R and Tarjan R E Variations on the common subexpression problem ACM 80 CC + linear variant Ganzinger H Shostak Light CADE 2002 Th + UIFs convexity also necessary stably-infiniteness not required sigma-models indistinguishable Shostak s Combination p7 of 2)

170 ö ö ö ö Bibliography Halpern Y Presburger arithmetic with unary predicates is -complete SC 9 undecidability by adding predicates Kapur D Shostak s congruence closure as completion RTA 97 CC algorithm Kapur D A rewrite rule based framework for combining decision procedures FroCoS 02 Shostak combination Lynch C and Morawska B Automatic decidability LICS 02 deriving decision procedures and complexity Shostak s Combination p8 of 2)

171 ö ö ö ö Bibliography Nelson G and Oppen D Simplification by cooperating decision procedures ACM TOPLAS 79 Combination result specific theories Nelson G and Oppen D Fast decision procedures based on congruence closure ACM 80 CC theory of lists Oppen D C Complexity convexity and combination of theories TCS 80 NO main theorem complexity special theories Pratt V R Two easy theories whose combination is hard MIT TR 77 validity hard for a combination of non-convex PTIME theories Shostak s Combination p9 of 2)

172 ö ö ö ö Bibliography Rueß H and Shankar N Deconstructing Shostak LICS 0 Shostak theory + UIF the Shostak way Shankar N and Rueß H Combining Shostak theories RTA 02 Multiple Shostak theory combination Shostak R E An efficient decision procedure for arithmetic with function symbols SRI TR 77 arithmetic + UIFs Shostak R E Deciding combinations of theories ACM 84 Shostak theory + UIF Shostak s Combination p20 of 2)

173 ö ö ö Bibliography Stump A Dill D Barrett C and Levitt A decision procedure for extensional theory of arrays LICS 0 theory of arrays Tinelli C and Ringeissen C Unions of non-disjoint theories and combinations of satisfiability procedures Elveiser Science 0 New advances for non-disjoint combinations Tiwari A Decision procedures in automated deduction PhD Thesis 00 Shostak theories in NO framework Shostak s Combination p2 of 2)