Combined Satisfiability Modulo Parametric Theories

Intel 07 p.1/39 Combined Satisfiability Modulo Parametric Theories Sava Krstić*, Amit Goel*, Jim Grundy*, and Cesare Tinelli** *Strategic CAD Labs, Intel **The University of Iowa

Intel 07 p.2/39 This Talk Based on work in S. Krstić, A. Goel, J. Grundy, and C. Tinelli. Combined Satisfiability Modulo Parametric Theories. TACAS 07, 2007. S. Krstić and A. Goel. Architecting Solvers for SAT Modulo Theories: Nelson-Oppen with DPLL. FroCoS, 2007.

Intel 07 p.3/39 Contribution Nelson-Oppen framework for theories in parametrically polymorphic logics a fresh foundation for design of SMT solvers Highlights Endowing SMT with a rich typed input language that can model arbitrarily nested data structures Completeness of a Nelson-Oppen-style combination method proved for theories of all common datatypes Troublesome stable infiniteness condition replaced by a natural notion of type parametricity Issue of handling finite-cardinality constraints exposed as crucial for completeness

Intel 07 p.4/39 SAT Modulo Theories (SMT) There are decision procedures for (fragments of) logical theories of common datatypes Use them to decide validity/satisfiability of queries, quantifier-free formulas, that involve symbols from several theories f(x) = x f(2x f(x)) = x [T UF + T Int ] head(a) = f(x) + 1... [T UF + T Int + T List ] The underlying logic is classical (unsorted or many-sorted) first-order logic

Intel 07 p.5/39 SMT Solvers over Multiple Theories G. Nelson, D. C. Oppen Simplification by cooperating decision procedures, 1979 Input: Output: theories T 1,...,T n with disjoint signatures Σ 1,...,Σ n decision procedures P i for the T i -satisfiability of sets of Σ i -literals a decision procedure for (T 1 + + T n )-satisfiability of sets of (Σ 1 + + Σ n )-literals.

Intel 07 p.6/39 SMT Solvers over Multiple Theories Input: Output: theories T 1,...,T n with disjoint signatures Σ 1,...,Σ n decision procedures P i for the T i -satisfiability of sets of Σ i -literals a decision procedure for (T 1 + + T n )-satisfiability of sets of (Σ 1 + + Σ n )-literals. Main Idea: 1. Input S is purified into equisatisfiable S 1,...S n ; 2. each P i works on S i but propagates to the others any entailed equalities between shared variables.

Intel 07 p.7/39 Nelson-Oppen: Example T 1 = theory of lists T 2 = linear arithmetic Input set: Purified sets: S = 8 l 1 l 2, >< head(l 2 ) x, l = tail(l 2 ), l 1 = x :: l, >: head(l) head(tail l 1 ) + x head(l 2 ) S 1 = 8 l 1 l 2, >< y 1 = head(l 2 ), l = tail(l 2 ), l 1 = x :: l, >: y 2 = head(l), y 3 = head(tail l 1 ) S 2 = 8 < y 1 x, : y 2 y 3 + x y 1

Intel 07 p.8/39 Nelson-Oppen: Example S 1 S 2 l 1 l 2 y 1 x y 1 = head(l 2 ) y 2 y 3 + x y 1 l = tail(l 2 ) l 1 = x :: l y 2 = head(l) y 3 = head(tail l 1 )

Intel 07 p.8/39 Nelson-Oppen: Example S 1 S 2 l 1 l 2 y 1 x y 1 = head(l 2 ) y 2 y 3 + x y 1 l = tail(l 2 ) l 1 = x :: l y 2 = head(l) y 3 = head(tail l 1 ) y 2 = y 3

Intel 07 p.8/39 Nelson-Oppen: Example S 1 S 2 l 1 l 2 y 1 x y 1 = head(l 2 ) y 2 y 3 + x y 1 l = tail(l 2 ) l 1 = x :: l y 2 = head(l) y 3 = head(tail l 1 ) y 2 = y 3 x = y 1

Intel 07 p.8/39 Nelson-Oppen: Example S 1 S 2 l 1 l 2 y 1 x y 1 = head(l 2 ) y 2 y 3 + x y 1 l = tail(l 2 ) l 1 = x :: l y 2 = head(l) y 3 = head(tail l 1 ) y 2 = y 3 x = y 1 Unsatisfiable!

Intel 07 p.9/39 Correctness of Nelson-Oppen The combination procedure is sound for any T 1,...,T n : if it returns Unsatisfiable, then its input S is unsatisfiable in T 1 + + T n

Intel 07 p.9/39 Correctness of Nelson-Oppen The combination procedure is sound for any T 1,...,T n : if it returns Unsatisfiable, then its input S is unsatisfiable in T 1 + + T n It is complete when

Intel 07 p.9/39 Correctness of Nelson-Oppen The combination procedure is sound for any T 1,...,T n : if it returns Unsatisfiable, then its input S is unsatisfiable in T 1 + + T n It is complete when 1. T 1,...,T n are pairwise signature-disjoint, and

Intel 07 p.10/39 The Notorious Stable Infiniteness Restriction A first-order theory T is stably infinite if every T -satisfiable ground formula is satisfiable in an infinite model of T.

Intel 07 p.10/39 The Notorious Stable Infiniteness Restriction A first-order theory T is stably infinite if every T -satisfiable ground formula is satisfiable in an infinite model of T. Helps guarantee that models of pure parts of a query ϕ can be amalgamated into a model of ϕ Yields completeness of N-O, but it s not immediate to prove it s not true in some important cases (e.g., bit vectors) General understanding: the condition doesn t matter much if you know what you are doing

Intel 07 p.11/39 Why Stable Infiniteness is Needed Purified Input: T 1 = theory of uninterpreted functions T 2 = theory of Boolean rings (not stably-infinite) S 1 S 2 f(x 1 ) x 1 x 1 = 0 f(x 1 ) x 2 x 2 = 1 There are no equations to propagate: the procedure returns satisfiable Is that correct?

Intel 07 p.12/39 Our Main Points In combining theories of different data types 1. a typed logic (with parametric types) is a more adequate underlying logic than unsorted logic 2. parametricity is the key notion not stable infiniteness

Intel 07 p.13/39 Parametricity, Not Stable Infiniteness: Example Φ List = tail l 1 = tail l 2 x 1 = headl 1 x 2 = headl 2 x = head(tail l 1 ) Φ Int = x = x 1 + z x 2 = x 1 + z = x = x 2 x x 1

Intel 07 p.13/39 Φ List = Parametricity, Not Stable Infiniteness: Example tail l 1 = tail l 2 x 1 = headl 1 x 2 = headl 2 x = head(tail l 1 ) x 1 x 2 x l 1 l 2 [, ] [, ] Φ Int = = TList Φ List x = x 1 + z x 2 = x 1 + z x 1 x 2 x z 1 2 2 1 = x = x 2 x x 1 = TInt Φ Int T List knows nothing about Z and cannot distinguish (, ) from any pair (m, n) of distinct integers:

Intel 07 p.14/39 Real Issue in NO Combination Not so much getting stable-infiniteness right, but getting underlying logic right

Intel 07 p.14/39 Real Issue in NO Combination Not so much getting stable-infiniteness right, but getting underlying logic right Our proposal FOLP: A first order logic with parametrized type constructors and type variables Essentially, the applicative fragment of HOL

Intel 07 p.15/39 FOLP Syntax Types V, an infinite set of type variables Ex: α, β, α 1, β 1,... O, a set of type operators, symbols with associated arity n 0 Ex: Bool/0, Int/0, List/1, Arr/2, /2,... Types(O, V ), set of types, terms over O, V Ex: Int, List(α), List(Int), Arr(Int, List(α)), List(α) Int,...

Intel 07 p.16/39 FOLP Syntax First-order Types: Types over O \ { }, V Constants: K, set of symbols each with an associated principal type τ Ex: Bool, Bool Bool, = α,α Bool, + Int,Int Int, cons α,list(α) List(α), read Arr(α,β),α β,... Term Variables: X τ, for each τ Types(O, V ), an infinite set of symbols annotated with τ Ex: x α, y List(β), z α α, x Arr(Int,Bool),...

Intel 07 p.17/39 FOLP Syntax Signatures: pairs Σ = O K with O always containing and Bool K always containing = α,α Bool, ite Bool,α,α α, and the usual logical constants Bool Bool, Bool,Bool Bool,... Σ-Terms of First-order Type τ: T τ (K, X), defined as usual Ex: x Int Bool y Int, (read a Arr(Int,List(β)) i Int ) = x List(β), First-order (Quantifier-free) Formulas: Terms in T Bool (K, X)

Intel 07 p.18/39 FOLP Semantics Structures of signature Σ = O K Pair S of 1. an interpretation (_) S of type operators F as set operators 2. an interpretation (_) S of constants f as set-indexed families of functions (with index determined by TypeVars(τ) where f τ ) s.t. Bool,, and =, ite,,... are the interpreted in the usual way. Ex 1: Int S List S Arr S equals the integers maps an input set A to the set of finite lists over A maps input sets I and A to the set of arrays with index set I and element set A

Intel 07 p.18/39 FOLP Semantics Structures of signature Σ = O K Pair S of 1. an interpretation (_) S of type operators F as set operators 2. an interpretation (_) S of constants f as set-indexed families of functions (with index determined by TypeVars(τ) where f τ ) s.t. Bool,, and =, ite,,... are the interpreted in the usual way. Ex 2: head S family {head[a 1 ] A 1 is a set} (since head List(α) α ) read S family {read[a 1, A 2 ] A 1, A 2 are sets} (since read Arr(α 1,α 2 ),α 1 α 2 ) + S singleton family (since + Int,Int Int )

Intel 07 p.19/39 FOLP Semantics For every signature Σ = O K, Σ-structure S, type environment ι, term environment ρ, and Σ-formula ϕ, we can define [_] S ι,ρ (as expected) to map Σ-formulas to {true, false} Satisfiability ϕ is satisfied in S by ι and ρ, written ι, ρ = S ϕ, if [ϕ] S ι,ρ = true ϕ is satisfiable in S if ι, ρ = S ϕ for some ι and ρ

Intel 07 p.20/39 The Equality Structure Let K Eq = = α,α Bool, Bool, Bool Bool, ite Bool,α,α α,... Σ Eq = Bool, K Eq S Eq = the unique Σ Eq -structure

Intel 07 p.20/39 The Equality Structure Let K Eq = = α,α Bool, Bool, Bool Bool, ite Bool,α,α α,... Σ Eq = Bool, K Eq S Eq = the unique Σ Eq -structure Note: S Eq models the logical constants of FOL= and the uninterpreted functions data type, by means of higher-order term variables (x α 1,...,α n α )

Intel 07 p.21/39 Parametricity [TACAS 07] A structure is parametric if it interprets all its type operators, except, as parametric set operators and all its constants as parametric function families

Intel 07 p.21/39 Parametricity [TACAS 07] A structure is parametric if it interprets all its type operators, except, as parametric set operators and all its constants as parametric function families Parametricity of type operators and constants similar (but not comparable) to Reynold s parametricity Natural property of data types States precisely the informal notion that certain type operators and function symbols have a uniform interpretation over the possible values of the type variables

Parametric Structures Fact: All structures of practical interest are parametric in our sense Σ Int = Int 0 Int, 1 Int, + Int2 Int, Int2 Int, Int2 Int, Int2 Bool,... Σ Arr = Arr mk_arr β Arr(α,β), read [Arr(α,β),α] β, write [Arr(α,β),α,β] Arr(α,β) Σ List = List cons [α,list(α)] List(α), nil List(α), head List(α) α, tail List(α) List(α) Σ = _, _ [α,β] α β, fst α β α, snd α β β Σ BitVec32 =... Σ Sets =... Σ Multisets =... (All the above signatures implicitly include the signature Σ Eq ) Intel 07 p.22/39

Intel 07 p.23/39 Combining Signatures and Structures Disjoint Signatures Signatures that share exactly the symbols of Σ Eq

Intel 07 p.23/39 Combining Signatures and Structures Disjoint Signatures Signatures that share exactly the symbols of Σ Eq Combination of Disjoint Signatures Σ 1, Σ 2 Σ 1 + Σ 2 = O 1 O 2 K 1 K 2 where Σ i = O i K i Combination of Signature-Disjoint Structures S 1, S 2 (Σ 1 + Σ 2 )-structure S 1 + S 2 that interprets Σ i -symbols exactly like S i for i = 1, 2.

Intel 07 p.24/39 Pure and Semipure Terms Let S 1,...,S n be structures with disjoint signatures Σ i = O i K i We call a (Σ 1 + + Σ n )-term i-semipure if it has signature O 1 O n K i i-pure if it has signature O i K i Ex Σ 1 = Int 0 Int, 1 Int, + Int,Int Int, Int Int, Int,Int Bool,... Σ 2 = Arr read Arr(α,β),α β, write Arr(α,β),α,β Arr(α,β) 1-semipure: read(a Arr(Int,Int), i Int ), a Arr(Int,β), a Arr(Int,Arr(Int,Int)) 1-pure: read(a Arr(α,α), i α ), a Arr(α,β), a Arr(α,Arr(β 1,β 2 ))

Intel 07 p.24/39 Pure and Semipure Terms Let S 1,...,S n be structures with disjoint signatures Σ i = O i K i We call a (Σ 1 + + Σ n )-term i-semipure if it has signature O 1 O n K i i-pure if it has signature O i K i Fact For each i-semipure term t we can compute a most specific pure generalization t pure of t Ex ϕ : read(a Arr(Int,Pair(Arr(Bool,Bool))), i Int ) = x Pair(Arr(Bool,Bool)) ϕ pure : read(a Arr(α,β), i α ) = x β

Pure and Semipure Terms Let S 1,...,S n be parametric structures with disjoint signatures Σ i = O i K i Proposition A set Φ i of i-semipure formulas is (S 1 + + S n )-satisfiable iff Φ pure i Φ card i is S i -satisfiable for some suitable set Φ card i from Φ i Ex of cardinality constraints computable Φ i : { read(a Arr(Int,Pair(Arr(Bool,Bool))), i Int ) = x Pair(Arr(Bool,Bool)) } Φ pure i : { read(a Arr(α,β), i α ) = x β } Φ card i : { β. = 16 } Intel 07 p.25/39

Intel 07 p.26/39 Why Cardinality Constraints are Needed Φ : {x List(α) i x List(α) j } 0 i<j 5 {tail(tail x List(α) i ) = nil} 1 i 5 Φ 1 : {x List(Int) i x List(Int) j } 0 i<j 5 {tail(tail x List(Int) i ) = nil} 1 i 5 Φ 2 : {x List(Bool) i x List(Bool) j } 0 i<j 5 {tail(tail x List(Bool) i ) = nil} 1 i 5 Φ and Φ 1 are (S Int + S List )-satisfiable, Φ 2 is not S List -solver can t take Φ 1 or Φ 2 as input: they are not Σ List -pure

Intel 07 p.27/39 Towards Nelson-Oppen Combination: Purification We turn each query Φ into the purified form where Φ B Φ E Φ 1 Φ n Φ B is a set of propositional formulas Φ E = {p Bool x τ = y τ } p Bool,x τ,y τ with τ Bool Φ i = {p Bool ψ} p Bool,ψ {x τ = t} x τ,t with ψ, t non-variables, i-semipure, and not containing logical constants Ex: f(x) = x f(2 x f(x)) > x becomes Φ B = {p q} Φ E = {p y = x}, Φ Eq = {y = f(x), u = f(z)} Φ Int = {q u > x z = 2 x y, }

Intel 07 p.28/39 Towards a Combination Theorem Let A be a set of propositional atoms (i.e., Bool-variables) X a set of of variables An assignment M of A is a consistent set of literals with atoms in A An arrangement of X is a set of equational literals corresponding to a well-typed partition of X Ex Partition: {{x τ 1, y τ 1, z τ 1 }, {u τ 2, v τ 2 }, {w τ 3 }} : {x τ 1 = y τ 1, x τ 1 = z τ 1, u τ 2 = v τ 2, x τ1 u τ 2, x τ1 w τ 3 }

Intel 07 p.29/39 Main Result: A Combination Theorem for FOLP Let S 1,...,S n be signature-disjoint, flexible structures

Intel 07 p.29/39 Main Result: A Combination Theorem for FOLP Let S 1,...,S n be signature-disjoint, flexible structures A query Φ = Φ B Φ E Φ 1 Φ n is (S 1 + + S n )-satisfiable iff

Intel 07 p.29/39 Main Result: A Combination Theorem for FOLP Let S 1,...,S n be signature-disjoint, flexible structures A query is (S 1 + + S n )-satisfiable iff there is s.t. Φ = Φ B Φ E Φ 1 Φ n an assignment M of the atoms in Φ B and an arrangement of the non-bool variables in Φ 1. M = Φ B 2. M, = Φ E 3. (Φ i M ) pure Φ i card is S i -satisfiable for all i = 1,...,n

Intel 07 p.30/39 Main Theoretical Requirement: Flexible Structures A structure S is flexible if for every query Φ, every injective ι, ρ such that ι, ρ = S Φ, every α V, every κ > ι(α) there exist injective ι up(κ), ρ up(κ) and ι down, ρ down satisfying Φ s.t. ι up(κ) (β) = ι(β) = ι down (β) for every β α, and 1. ι up(κ) (α) has cardinality κ [up-flexibility] 2. ι down (α) is countable [down-flexibility]

Intel 07 p.31/39 Main Computational Requirement: Strong Solvers We call a solver for S-satisfiability strong if it can process queries with cardinality constraints. Typical S-solvers are not strong however, they can be effectively converted into strong solvers by preprocessing each query currently this can be done, specifically for a number of structures, as in [Ranise et al., FroCoS 05] we are working on a (possibly less efficient but) generic preprocessing mechanism

Intel 07 p.32/39 Closest Related Work [Ranise et al., FroCoS 05] Setting (2-theory case): Many-sorted logic (with sorts being 0-ary type operators) Signatures share at most a set of sorts One theory is polite over shared sorts, other theory is arbitrary Main Result: Theory solvers are combined, soundly and completely, with a Nelson-Oppen style method that also guesses equalities over some additional terms computed from the input query.

Intel 07 p.33/39 Comparisons with [Ranise et al., FroCoS 05] That work vs. This work Theory combinations via signature push-outs Theory combinations via type parameter instantiation Politeness assumption on theories Flexibility assumption on structures Politeness proven per theory Parametricity as general sufficient condition for flexibility Idea of parametricity is implicit in politeness Parametricity notion fully fleshed out Model finiteness issues addressed directly by combination method Model finiteness issues encapsulated into strong solvers

Intel 07 p.34/39 Some Future Work Method(s) for turning solvers into strong solvers Implementation (CVC3, DPT) Extension to non-disjoint combination (possibly built on combination framework of [Ghilardi et al., 2007])

Thank you Intel 07 p.35/39

Parametricity Intel 07 p.36/39

Intel 07 p.37/39 Parametric Type Operators Fix a signature Σ = O K and a Σ-structure S An n-ary operator F O is parametric in S if there exists a related n-ary operation F on binary relations

Intel 07 p.37/39 Parametric Type Operators Fix a signature Σ = O K and a Σ-structure S An n-ary operator F O is parametric in S if there exists a related n-ary operation F on binary relations such that for all partial bijections R 1 : A 1 B 1,..., R n : A n B n, S 1 : C 1 A 1,..., S n : C n A n, 1. F (R 1,...,R n ) is a partial bijection in F S (A 1,...,A n ) F S (B 1,...,B n ) 2. F (R 1,...,R n ) F (S 1,...,S n ) = F (R 1 S 1,...,R n S n ) 3. F (id A1,...,id A1 ) = id F(A1,...,A n )

Intel 07 p.38/39 Parametric Type Operators: Example Assume List O and List S is the list operator Define List so that for all R : A B List (R) : List S (A) List S (B) (l A, l B ) List (R) iff l A = [a 1,...,a n ], l B = [b 1,...,b n ] and (a i, b i ) R for all i. Then List is parametric in S: for all composable partial bjections R and S and sets C 1. List (R) is a partial bijection 2. List (R) List (S) = List (R S) 3. List (id C ) = id List S (C)

Intel 07 p.39/39 Parametric Structures Fix a signature Σ = O K and a Σ-structure S We can define a natural notion of parametricity for function symbols as well (see [Krstic et al., TACAS 07]) The structure S is parametric if every F O \ { } and every f K are parametric