Journal on Satisfiability, Boolean Modeling and Computation 3 (2007) 141–224
Lazy Satisfiability Modulo Theories
Roberto Sebastiani
∗
roberto.sebastiani@disi.unitn.it
Dipartimento di Ingegneria e Scienza dell’Informazione (DISI)
Università di Trento
Italy
Abstract
Satisfiability Modulo Theories (SMT) is the problem of deciding the satisfiability of a
first-order formula with respect to some decidable first-order theory T (SMT (T )). These
problems are typically not handled adequately by standard automated theorem provers.
SMT is being recognized as increasingly important due to its applications in many domains
in different communities, in particular in formal verification. An amount of papers with
novel and very efficient techniques for SMT has been published in the last years, and some
very efficient SMT tools are now available.
Typical SMT (T ) problems require testing the satisfiability of formulas which are Boolean
combinations of atomic propositions and atomic expressions in T , so that heavy Boolean
reasoning must be efficiently combined with expressive theory-specific reasoning. The dominating approach to SMT (T ), called lazy approach, is based on the integration of a SAT
solver and of a decision procedure able to handle sets of atomic constraints in T (T -solver),
handling respectively the Boolean and the theory-specific components of reasoning.
Unfortunately, neither the problem of building an efficient SMT solver, nor even that
of acquiring a comprehensive background knowledge in lazy SMT, is of simple solution.
In this paper we present an extensive survey of SMT, with particular focus on the lazy
approach. We survey, classify and analyze from a theory-independent perspective the most
effective techniques and optimizations which are of interest for lazy SMT and which have
been proposed in various communities; we discuss their relative benefits and drawbacks;
we provide some guidelines about their choice and usage; we also analyze the features for
SAT solvers and T -solvers which make them more suitable for an integration.
The ultimate goals of this paper are to become a source of a common background
knowledge and terminology for students and researchers in different areas, to provide a
reference guide for developers of SMT tools, and to stimulate the cross-fertilization of
techniques and ideas among different communities.
Keywords: propositional satisfiability, satisfiability modulo theories, decision procedures
Submitted April 2007; revised December 2007; published December 2007
∗ This survey work has benefited from important discussions with A. Armando, C. Barrett, M. Bozzano,
R. Bruttomesso, A. Cimatti, A. Franzen, L. de Moura, S. Ghilardi, A. Griggio, S. Krstic, R. Nieuwenhuis,
A. Oliveras, S. Ranise, M. Roveri, O. Strichman, A. Tacchella, C. Tinelli, to whom I am very grateful.
A particular thank goes to all past and present members of the KSAT and MathSAT teams.
Some material discussed here was presented at the ESSLI’02 course and IJCAI’03 and CADE’03 Tutorials “SAT Beyond Propositional Satisfiability” (disi.unitn.it/~rseba/DIDATTICA/Tutorials/Slides_
tutorial_cade03.pdf), at the course “Efficient Boolean Reasoning” at 2003-2005 Int. ICT school of
Trento and at 2006 Int. BIT School in Brixen (disi.unitn.it/~rseba/DIDATTICA/SAT_BASED06/), and
at my invited talk at FroCoS’07 [154]. This work has been partly supported by ORCHID, a project
sponsored by Provincia Autonoma di Trento, and by a grant from Intel Corporation.
c 2007 Delft University of Technology and the authors.
R. Sebastiani
Contents
1 Introduction
1.1 Satisfiability Modulo Theories - SMT .
1.2 Lazy SMT = SAT + T -solvers . . . .
1.3 Motivations and goals of the paper . .
1.4 Content of the paper . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
2 Theoretical background
2.1 Background on first-order logic and theories . . .
2.1.1 Combination of theories . . . . . . . . . .
2.2 Truth assignments and propositional satisfiability
2.3 Enumerators and T -solvers . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
144
144
144
145
147
. . .
. . .
in T
. . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
148
148
149
150
151
.
.
.
.
.
.
.
.
3 Basics on SAT solvers
153
3.1 Modern conflict-driven DPLL . . . . . . . . . . . . . . . . . . . . . . . . . . 153
3.2 The Abstract-DPLL logical framework . . . . . . . . . . . . . . . . . . . . . 157
4 Basics on theory solvers
4.1 Important features of T -solvers . . . . . . . .
4.1.1 Model generation . . . . . . . . . . . .
4.1.2 Conflict set generation . . . . . . . . .
4.1.3 Incrementality and Backtrackability .
4.1.4 Deduction of unassigned literals . . . .
4.1.5 Deduction of interface equalities . . .
4.2 Some relevant theories and T -solvers . . . . .
4.2.1 Equality and Uninterpreted Functions
4.2.2 Linear arithmetic . . . . . . . . . . . .
4.2.3 Difference logic . . . . . . . . . . . . .
4.2.4 Unit-Two-Variable-Per-Inequality . . .
4.2.5 Bit vectors . . . . . . . . . . . . . . .
4.2.6 Other theories of interest . . . . . . .
4.3 Layered T -solvers . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
159
159
159
159
160
160
161
161
161
162
163
165
166
166
167
5 Integrating DPLL and T -solvers
5.1 A basic integration schema . . . . . . . . . . . . . . . .
5.2 The offline approach to integration . . . . . . . . . . . .
5.3 The online approach to integration . . . . . . . . . . . .
5.4 The Abstract-DPLL Modulo Theories logical framework
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
169
169
170
171
174
6 Optimizing the integration of DPLL and T -solvers
6.1 Normalizing T -atoms. . . . . . . . . . . . . . . . . .
6.2 Static learning . . . . . . . . . . . . . . . . . . . . .
6.3 Early pruning . . . . . . . . . . . . . . . . . . . . . .
6.3.1 Selective or intermittent early pruning . . . .
6.3.2 Weakened early pruning . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
176
177
177
178
179
179
142
.
.
.
.
.
.
.
.
.
.
Lazy Satisfiability Modulo Theories
6.4
6.5
6.6
6.7
6.8
6.9
6.10
6.11
6.3.3 Eager early pruning
T -propagation . . . . . . .
T -backjumping . . . . . . .
T -learning . . . . . . . . . .
Splitting on demand . . . .
Clustering . . . . . . . . . .
Reduction of assignments to
Pure-literal filtering . . . .
T -deduced-literal filtering .
. . . . . . . . . .
. . . . . . . . . .
. . . . . . . . . .
. . . . . . . . . .
. . . . . . . . . .
. . . . . . . . . .
prime implicants
. . . . . . . . . .
. . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
7 Discussion
7.1 Guidelines and tips . . . . . . . . . . . . . . . . . .
7.1.1 Some general guidelines . . . . . . . . . . .
7.1.2 Offline vs. online integration . . . . . . . .
7.1.3 To T -propagate or not to T -propagate? . .
7.2 Problems of using modern conflict-driven DPLL in
7.2.1 Generating partial assignments . . . . . . .
7.2.2 Avoiding ghost literals . . . . . . . . . . . .
7.2.3 Drawbacks of modern T -backjumping . . .
7.2.4 Implementing T -propagation . . . . . . . .
7.2.5 DPLL branching heuristics for SMT . . . .
8 Lazy SMT for combinations of theories
8.1 The Nelson-Oppen formal framework . . . . .
8.2 The Nelson-Oppen combination procedure . .
8.3 The Delayed Theory Combination procedure
8.4 SMT(EU F ∪ T ) via Ackermann’s expansion .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . . .
. . . .
. . . .
. . . .
SMT
. . . .
. . . .
. . . .
. . . .
. . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
180
180
181
183
184
185
185
185
186
.
.
.
.
.
.
.
.
.
.
187
187
187
188
188
189
189
190
191
193
193
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
194
194
196
200
204
9 Related approaches for SMT
9.1 Alternative Enumerators for lazy SMT . . . . .
9.1.1 Why DPLL? . . . . . . . . . . . . . . . . .
9.1.2 OBDD-based SMT solvers . . . . . . . . . .
9.1.3 Circuit-based techniques . . . . . . . . . . .
9.2 The rewrite-based approach for building T -solvers
9.3 The eager approach to SMT . . . . . . . . . . . . .
9.4 Mixed eager/lazy approaches . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
206
206
206
206
207
207
209
210
.
.
.
.
.
.
.
.
143
R. Sebastiani
1. Introduction
In this paper we present an extensive survey of Satisfiability Modulo Theories (SMT), with
particular focus on the currently-most-effective approach to SMT, the lazy approach.
1.1 Satisfiability Modulo Theories - SMT
Satisfiability Modulo Theories is the problem of deciding the satisfiability of a first-order formula with respect to some decidable first-order theory T (SMT (T )). Examples of theories of
interest are those of Equality and Uninterpreted Functions (EU F), Linear Arithmetic (LA),
both over the reals (LA(Q)) and the integers (LA(Z)), its subclasses of Difference Logic
(DL) and Unit-Two-Variable-Per-Inequality (UT VPI), the theories of bit-vectors (BV), of
arrays (AR) and of lists (LI). These problems are typically not handled adequately by
standard automated theorem provers —like, e.g., those based on resolution calculus— because the latter cannot satisfactorily deal with the theory-specific interpreted symbols (i.e.,
constants, functions, predicates). 1.
SMT is being recognized as increasingly important due to its applications in many
domains in different communities, ranging from resource planning [185] and temporal reasoning [5] to formal verification, the latter including verification of pipelines and of circuits
at Register-Transfer Level (RTL) [49, 141, 36], of proof obligations in software systems
[144, 81], of compiler optimizations [26], of real-time embedded systems [12, 66, 11].
An amount of papers with novel and very efficient techniques for SMT has been published in the last years, and some very efficient SMT tools are now available (e.g., Ario
[158], BarceLogic [133], CVCLite/CVC3 [17], DLSAT [123], haRVey [144], MathSAT
[37], Sateen [108], SDSAT [83] Simplify [70], TSAT++ [6], UCLID [117], Yices [71],
Verifun [79], Zapato [16]), Z3 [63]. An amount of benchmarks, mostly derived from verification problems, is available at the SMT-LIB official page [147, 148]. A workshop devoted
to SMT 2. and an official competition on SMT tools 3. are run yearly.
1.2 Lazy SMT = SAT + T -solvers
All applications mentioned above require testing the satisfiability of formulas which are
(possibly-big) Boolean combinations of atomic propositions and atomic expressions in some
theory T , so that heavy Boolean reasoning must be efficiently combined with expressive
theory-specific reasoning.
On the one hand, in the last decade we have witnessed an impressive advance in the
efficiency of propositional satisfiability techniques, SAT [163, 28, 129, 95, 75, 74]). As a consequence, some hard real-world problems have been successfully solved by encoding them
into SAT. SAT solvers are now a fundamental tool in most formal verification design flows
for hardware systems, both for equivalence, property checking, and ATPG [30, 126, 168];
other application areas include, e.g., the verification of safety-critical systems [167, 34], and
AI planning in its classical formulation [106], and in its extensions to non-deterministic do1. E.g., even handling a simple formula in LA(Z) like (x ≤ y) → (x ≤ y + 1024) could be a problem for
a resolution-based theorem prover, because it would need an axiomatic formalization of the interpreted
symbols “1024”, “+” and “≤”. See, e.g., [146] for some more discussion on this issue.
2. SMT’07, previously called “PDPAR”. See http://www.lsi.upc.edu/~oliveras/smt07/.
3. SMT-COMP05/06/07 [18]. See http://http://www.smtcomp.org/.
144
Lazy Satisfiability Modulo Theories
mains [50, 98]. Plain Boolean logic, however, is not expressive enough for representing many
other real-world problems (including, e.g., the verification of pipelined microprocessors, of
real-time and hybrid control systems, and the analysis of proof obligations in software verification); in other cases, such as the verification of RTL designs or assembly-level code, even
if Boolean logic is expressive enough to encode the verification problem, it does not seem to
be the most effective level of abstraction (e.g., words in the data path are typically treated
as collections of unrelated Boolean variables).
On the other hand, decision procedures for much more expressive decidable logics
have been conceived and implemented in different communities, like, e.g., automated theorem proving, operational research, knowledge representation and reasoning, AI planning,
CSP, formal verification. In particular, since the pioneering work of Nelson & Oppen
[130, 131, 138, 139] and Shostak [161, 162], efficient procedures have been conceived and
implemented which are able to check the consistency of sets/conjunctions of atomic expressions in decidable F.O. theories. (We call these procedures, Theory Solvers or T -solvers.)
To this extent, most effort has been concentrated in producing T -solvers of increasing expressiveness and efficiency and, in particular, in combining them in the most efficient way
(e.g., [130, 131, 138, 139, 161, 162, 78, 25, 157]). These procedures, however, deal only
with conjunctions of atomic constraints, and thus cannot handle the Boolean component of
reasoning.
In the last ten years new techniques for efficiently integrating SAT solvers with logicspecific or theory-specific decision procedures have been proposed in different communities
and domains, producing big performance improvements when applied (see, e.g., [92, 100, 5,
185, 66, 19, 9, 176, 123, 79, 85, 37, 160]). Most such systems have been implemented on top of
SAT techniques based on variants of the DPLL algorithm [60, 59, 163, 28, 129, 95, 75, 74]. 4.
In particular, the dominating approach to SMT (T ), which underlies most state-of-theart SMT (T ) tools, is based on the integration of a SAT solver and one (or more) T -solver(s),
respectively handling the Boolean and the theory-specific components of reasoning: the SAT
solver enumerates truth assignments which satisfy the Boolean abstraction of the input
formula, whilst the T -solver checks the consistency in T of the set of literals corresponding
to the assignments enumerated. This approach is called lazy, in contraposition to the
eager approach to SMT (T ), consisting on encoding an SMT formula into an equivalentlysatisfiable Boolean formula, and on feeding the result to a SAT solver (see, e.g., [181, 47,
171, 170, 156]). All the most extensive empirical evaluations performed in the last years
[85, 65, 133, 38, 18, 164, 165] confirm the fact that currently all the most efficient SMT
tools are based on the lazy approach.
1.3 Motivations and goals of the paper
The writing of this survey paper is motivated by the following facts.
First, the problem of efficiently combining modern SAT solvers and state-of-the-art
decision procedures into a lazy SMT solver is not of simple solution. In fact, the efficiency
4. Notice that the main pattern for integrating decision procedures and DPLL, and many techniques
for optimizing this integration, were conceived and implemented much earlier, mostly in the domain of
modal and description logics [7, 92, 100, 89], and have been imported into the SMT domain only lately
[5]. See [154] for more details on this fact.
145
R. Sebastiani
of a combined procedure does not come straightforwardly from the efficiency of its two
components: a naive integration of extremely-efficient SAT solvers and T -solvers may end
up into very inefficient tools if the integration is not done properly. For instance, a naivelyintegrated SAT solver may cause big amounts of redundant calls to the T -solver (see §6).
Moreover, with lazy SMT the choice of the suitable procedures for the SAT solvers or
T -solvers is not always straightforward. In fact, the features which make a SAT solver or a
T -solver suitable for an efficient integration are often different from those which make them
efficient as standalone solvers. For instance, some features which contribute to improve
the efficiency of a modern DPLL solver may have some drawbacks when used within a lazy
SMT solver (see §7.2); moreover, some features of a T -solver which allow for maximizing
the synergy with the SAT solver (see §4.1) are often more important than the efficiency of
the T -solver itself.
Second, acquiring a comprehensive background knowledge in lazy SMT from the literature may be a complicate task. In fact, the information on techniques of interest is scattered into a plethora of papers from heterogeneous research communities (e.g., Automated
Reasoning, CSP, EDA, Formal Verification, Knowledge Representation & Reasoning, Planning, Operational Research, SAT), because lazy SMT borrows ideas and techniques from
many disciplines (e.g., automated reasoning in modal & description logics, F.O. theorem
proving, graph algorithms, linear and integer programming, SAT, ...), some of which have
hardly anything to do with logic or even with symbolic computation. For instance, for
theories involving arithmetic (e.g., LA(Q), LA(Z), DL) the most efficient T -solvers are
based on numerical algorithms borrowed from linear programming, integer programming
and shortest-path (see §4.2), which have been adapted to work in a logic context.
Moreover, in many papers the description of the integration techniques is mixed up with
(and often hidden by) lots of domain-specific information, and it is described with domainspecific notation and terminology, so that it may prevent or discourage researchers from
other areas to access it. On the whole, there has been a general lack of cross-fertilization
among different communities, which is witnessed by the fact that some techniques have been
“reinvented” from scratch several times in different contexts. For instance, the technique
called “T -backjumping” (see §6) has been invented for description logics [100], and then
“reinvented” in both the communities of resource planning [185] and formal verification
[172, 67], in different moments and without cross-citations.
We notice also that the code of most SMT tools is not publicly available, and that some
techniques which are implemented in these tools are not really described in the papers, so
that it is often difficult for an outsider to access to this knowledge. (E.g., a significant
amount of the author’s knowledge comes from his experience in developing the KSAT and
MathSAT tools, from discussions with collaborators and from personal communications
from the authors of other tools.)
In this paper we survey, classify and analyze from a theory-independent perspective
the most effective techniques and optimizations which are of interest for lazy SMT and
which have been proposed in various communities; we discuss their relative benefits and
drawbacks; we provide some guidelines about their choice and usage; we also analyze the
features for SAT solvers and T -solvers which make them more suitable for an integration.
People with a background in SAT may learn from this paper how to extend SAT solvers
to work with much more expressive logics; people with a background on decision procedures
146
Lazy Satisfiability Modulo Theories
may learn how to handle Boolean reasoning efficiently; people with background on neither
area may learn about lazy SMT from scratch. To this extent, the paper is written with
a didactic style, explaining basic concepts from scratch and presenting many examples, so
that to be at the reach also of students and of researchers from other communities.
The ultimate goals of this paper are to become a source of a common background knowledge and terminology for students and researchers in different areas, to provide a reference
guide for developers of SMT tools, and to stimulate the cross-fertilization of techniques and
ideas among different communities.
1.4 Content of the paper
The rest of the paper is organized as follows.
• In §2 we provide the necessary theoretical background. We recall some basic concepts
about first-order logic and theories, and provide some formal definitions and results
which justify the correctness and completeness of lazy SMT procedures.
• In §3 we report some basic concepts about SAT, surveying the main techniques and
optimizations of modern DPLL solvers which are of interest for lazy SMT.
• In §4 we report some basic concepts about T -solvers. We discuss the features of
T -solvers which are most important for lazy SMT, and briefly survey the most interesting theories and their relative T -solvers.
• In §5 we introduce the basic integration schemata between DPLL and T -solvers.
• In §6 we survey and analyze the most effective techniques and optimizations available in the literature, which allow for optimizing the interaction between DPLL and
T -solver.
• In §7 we provide some guidelines and tips about the choice and usage of such techniques. We also overview a list of problems one may encounter while implementing a
lazy SMT tool on top of a modern DPLL implementation, and propose some solutions.
• In §8 we address the case where T is the combination of two or more different theories.
We present and discuss the main techniques for integrating two or more T -solvers into
a lazy SMT tool.
• In §9 we present the related work. First, we present and discuss possible alternatives
to the usage of DPLL in lazy SMT. Then we survey and discuss the main alternative
approaches to SMT, including the rewrite-based approach, the eager approach, and
some recent attempt of combining the lazy and eager approaches.
147
R. Sebastiani
2. Theoretical background
In this section we recall some basic theoretical concepts, mostly from [155, 93, 153, 10, 40],
providing the theoretical background and terminology for this paper.
2.1 Background on first-order logic and theories
In order to make the paper self-contained, we recall some basic notions and terminology
about first-order theories. We assume the usual syntactic notions of first-order logic with
equality as defined, e.g., in [69].
In the following, let Σ be a first-order signature containing function and predicate symbols with their arities, and V be a set of variables. A 0-ary function symbol c is called
a constant. A 0-ary predicate symbol A is called a Boolean atom. A Σ-term is either a
variable in V or it is built by applying function symbols in Σ to Σ-terms. If t1 , . . . , tn are
Σ-terms and P is a predicate symbol, then P (t1 , . . . , tn ) is a Σ-atom. If l and r are two
Σ-terms, then the Σ-atom l = r is called a Σ-equality and ¬(l = r) (also written as l 6= r)
is called a Σ-disequality. A Σ-formula ϕ is built in the usual way out of the universal and
existential quantifiers ∀, ∃, the Boolean connectives ∧, ¬, and Σ-atoms. We use the standard Boolean abbreviations: “ϕ1 ∨ ϕ2 ” for “¬(¬ϕ1 ∧ ¬ϕ2 )”, “ϕ1 → ϕ2 ” for “¬(ϕ1 ∧ ¬ϕ2 )”,
“ϕ1 ← ϕ2 ” for “¬(¬ϕ1 ∧ ϕ2 )”, “ϕ1 ↔ ϕ2 ” for “¬(ϕ1 ∧ ¬ϕ2 ) ∧ ¬(ϕ2 ∧ ¬ϕ1 )”, “⊤” [resp. “⊥”
] for the true [resp. false] constant. A Σ-literal is either a Σ-atom (a positive literal) or its
negation (a negative literal). The set of Σ-atoms and Σ-literals occurring in ϕ are denoted
by Atoms(ϕ) and Lits(ϕ) respectively. We call a Σ-formula quantifier-free if it does not
contain quantifiers, and a sentence if it has no free variables. A quantifier-free formula is in
conjunctive normal form (CNF) if it is written as a conjunction of disjunctions of literals.
A disjunction of literals is called a clause.
Notationally we use the Greek letters ϕ, ψ to represent Σ-formulas, the capital letters
Ai ’s and Bi ’s to represent Boolean atoms, and the Greek letters α, β, γ to represent Σatoms in general, the letters li ’s to represent Σ-literals. If l is a negative Σ-literal ¬β, then
by “¬l” we conventionally
write
W a clause in the
V
W We sometimes
V meanWβ ratherWthan ¬¬β.
form of an implication: i li → j lj for i ¬li ∨ j lj and i li → ⊥ for i ¬li .
We also assume the usual first-order notions of interpretation, satisfiability, validity,
logical consequence, and theory, as given, e.g., in [76]. We write Γ |= ϕ to denote that the
formula ϕ is a logical consequence of the (possibly infinite) set Γ of formulae. A Σ-theory is
a set of first-order sentences with signature Σ. All the theories we consider are first-order
theories with equality, which means that the equality symbol = is a predefined predicate
and it is always interpreted as the identity on the underlying domain. Consequently, = is
interpreted as a relation which is reflexive, symmetric, transitive, and it is also a congruence.
Since the equality symbol is a predefined predicate, it will not be included in any signature
Σ considered in this paper.
A Σ-structure I is a model of a Σ-theory T if I satisfies every sentence in T . A Σ-formula
is satisfiable in T (or T -satisfiable) if it is satisfiable in a model of T . We write Γ |=T ϕ to
denote T ∪ Γ |= ϕ. Two Σ-formulas ϕ and ψ are T -equisatisfiable iff ϕ is T -satisfiable iff
ψ is T -satisfiable. We call Satisfiability Modulo (the) Theory T , SMT (T ), the problem of
establishing the T -satisfiability of Σ-formulae, for some background theory T . The SMT (T )
148
Lazy Satisfiability Modulo Theories
problem is NP-hard, since it subsumes the problem of checking the satisfiability of Boolean
formulae.
In this paper we restrict our attention to quantifier-free Σ-formulae on some Σ-theory
T . 5. We call a theory solver for T (T -solver) any procedure establishing whether any
given finite conjunction of quantifier-free Σ-literals (or equivalently, any given finite set of
Σ-literals) is T -satisfiable or not.
Henceforth, for simplicity and if not specified otherwise, we may omit the “Σ-” prefix
from term, formula, theory, models, etc. Moreover, by “formulas”, “atoms” and “literals”
we implicitly refer to quantifier-free formulas, atoms and literals respectively.
2.1.1 Combination of theories
Here we introduce some concepts which are of primary interest for SMT (T ) when T is a
combination of theories (see §8).
Wn
A conjunction Γ of T -literals in a theory T is convex iff for each
Wn disjunction i=1 xi = yi
(where xi , yi are variables and i = 1, ..., n) we have that Γ |=T i=1 xi = yi iff Γ |=T xi = yi
for some i ∈ {1, ..., n}; a theory T is convex iff all the conjunctions of literals are convex in
T . A theory T is stably-infinite iff for each T -satisfiable formula ϕ, there exists a model
of T whose domain is infinite and which satisfies ϕ. Notice that any convex theory whose
models are non-trivial (i.e., the domains of the models have all cardinality strictly greater
than one) is stably-infinite (see [25]).
In the sequel, let Σ1 and Σ2 be two disjoint signatures (i.e., Σ1 ∩ Σ2 = ∅) and T i will
be a theory in Σi for i = 1, 2. We consider Σ := Σ1 ∪ Σ2 and T := T1 ∪ T2 . We call
SMT (T1 ∪ T2 ) the problem of establishing the T1 ∪ T2 -satisfiability of Σ1 ∪ Σ2 -formulae. 6.
A Σ1 ∪ Σ2 -term t is an i-term iff either it is a variable or it has the form f (t1 , ..., tn ),
where f is in Σi . Notice that a variable is both a 1-term and a 2-term. A non-variable
subterm s of an i-term t is alien if s is a j-term, and all superterms of s in t are i-terms,
where i, j ∈ {1, 2} and i 6= j. An i-term is i-pure if it does not contain alien subterms.
An atom (or a literal) is i-pure if it contains only i-pure terms and its predicate symbol is
either equality or in Σi . A Σ1 ∪ Σ2 -formula ϕ is said to be pure if every atom occurring in
the formula is i-pure for some i ∈ {1, 2}. Intuitively, ϕ is pure if each atom can can be seen
as belonging to one theory Ti only.
If ϕ is a pure Σ1 ∪ Σ2 -formula, then v is an interface variable for ϕ iff it occurs in both
1-pure and 2-pure atoms of ϕ. An equality (vi = vj ) is an interface equality for ϕ iff vi ,
vj are interface variables for ϕ. Henceforth we denote the interface equality (vi = vj ) by
“eij ”. (For simplicity and w.l.o.g., we assume that identities like vi = vi are simplified into
⊤, and that vi = vj and vj = vi are uniquely represented as vi = vj s.t. vi ≺ vj for some
total order ≺.)
5. Notice that in SMT (T ), the variables are implicitly existentially quantified, and hence equivalent to
Skolem constants.
6. For simplicity in this paper we refer to combinations of two theories only, but all the discourse can be
easily generalized to combination of many signature-disjoint theories T 1 ∪ ... ∪ T n .
149
R. Sebastiani
2.2 Truth assignments and propositional satisfiability in T
We consider a generic quantifier-free decidable First-Order Theory T on a signature Σ.
Notationally, we will often use the prefix “T -” to denote “in the theory T ”: e.g., we call a
“T -formula” a formula in (the signature of) T , “T -model” a model in T , and so on.
We call a truth assignment µ for a T -formula ϕ a truth value assignment to the T -atoms
of ϕ. A truth assignment is total if it assigns a value to all atoms in ϕ, partial otherwise.
Syntactically identical instances of the same T -atom are always assigned identical truth
values; syntactically different T -atoms, e.g., (t1 ≥ t2 ) and (t2 ≤ t1 ), are treated differently
and may thus be assigned different truth values.
To this extent, we introduce a bijective function T 2B (“Theory-to-Boolean”) and its inverse B2T := T 2B −1 (“Boolean-to-Theory”), s.t. T 2B maps Boolean atoms into themselves
and non-Boolean T -atoms into fresh Boolean atoms —so that two atom instances in ϕ are
mapped into the same Boolean atom iff they are syntactically identical— and distributes
with sets and Boolean connectives. T 2B and B2T are also called Boolean abstraction and
Boolean refinement respectively.
We represent a truth assignment µ for ϕ as a set of T -literals
{α1 , . . . , αN , ¬β1 , . . . , ¬βM , A1 , . . . , AR , ¬AR+1 , . . . , ¬AS },
(1)
αi ’s, βj ’s being Σ-atoms and Ai ’s being Boolean propositions. Positive literals αi , Ak mean
that the corresponding atom is assigned to true, negative literals ¬βi , ¬Ak mean that the
corresponding atom is assigned to false. If µ2 ⊆ µ1 , then we say that µ1 extends µ2 and
that µ2 subsumes µ1 . Sometimes we represent a truth assignment (1) also as the formula
given by the conjunction of its literals:
α1 ∧ . . . ∧ αN ∧ ¬β1 ∧ . . . ∧ ¬βM ∧ A1 ∧ . . . ∧ AR ∧ ¬AR+1 ∧ . . . ∧ ¬AS .
(2)
Notationally, we use the Greek letters µ, η to represent truth assignments.
We say that a total truth assignment µ for ϕ propositionally satisfies ϕ, written µ |=p ϕ,
if and only if T 2B(µ) |= T 2B(ϕ), that is, for all sub-formulas ϕ1 , ϕ2 of ϕ:
µ |=p ϕ1 , ϕ1 ∈ Atoms(ϕ) ⇐⇒ ϕ1 ∈ µ,
µ |=p ¬ϕ1
⇐⇒ µ 6|=p ϕ1 ,
µ |=p ϕ1 ∧ ϕ2
⇐⇒ µ |=p ϕ1 and µ |=p ϕ2 .
We say that a partial truth assignment µ propositionally satisfies ϕ if and only if all the
total truth assignments for ϕ which extend µ propositionally satisfy ϕ. (Henceforth, if not
specified, when dealing with propositional T -satisfiability we do not distinguish between
total and partial assignments.)
Intuitively, if we consider a T -formula ϕ as a propositional formula in its atoms, then |=p
is the standard satisfiability in propositional logic. Thus, for every ϕ1 and ϕ2 , we say that
ϕ1 |=p ϕ2 if and only if µ |=p ϕ2 for every µ s.t. µ |=p ϕ1 . We say that ϕ is propositionally
satisfiable if and only if there exist an assignment µ s.t. µ |=p ϕ. We also say that |=p ϕ (ϕ
is propositionally valid ) if and only if µ |=p ϕ for every assignment µ for ϕ. Thus ϕ1 |=p ϕ2
if and only if |=p ϕ1 → ϕ2 , and |=p ϕ iff ¬ϕ is propositionally unsatisfiable.
Notice that |=p is stronger than |=T , that is, if ϕ1 |=p ϕ2 , then ϕ1 |=T ϕ2 , but not vice
versa. E.g., (x1 ≤ x2 ) ∧ (x2 ≤ x3 ) |=LA (x1 ≤ x3 ), but (x1 ≤ x2 ) ∧ (x2 ≤ x3 ) 6|=p (x1 ≤ x3 ).
150
Lazy Satisfiability Modulo Theories
Example 2.1. Consider the following LA(Q)-formula ϕ and its Boolean abstraction T 2B(ϕ):
ϕ :=
∧
∧
∧
∧
∧
∧
T 2B(ϕ) :=
{¬(2x2 − x3 > 2) ∨ A1 }
∧
{¬A2 ∨ (x1 − x5 ≤ 1)}
∧
{(3x1 − 2x2 ≤ 3) ∨ A2 }
∧
{¬(2x3 + x4 ≥ 5) ∨ ¬(3x1 − x3 ≤ 6) ∨ ¬A1 }
∧
{A1 ∨ (3x1 − 2x2 ≤ 3)}
∧
{(x2 − x4 ≤ 6) ∨ (x5 = 5 − 3x4 ) ∨ ¬A1 }
∧
{A1 ∨ (x3 = 3x5 + 4) ∨ A2 }
{¬B1 ∨ A1 }
{¬A2 ∨ B2 }
{B3 ∨ A2 }
{¬B4 ∨ ¬B5 ∨ ¬A1 }
{A1 ∨ B3 }
{B6 ∨ B7 ∨ ¬A1 }
{A1 ∨ B8 ∨ A2 }
We consider the partial truth assignment µ:
{¬(2x2 − x3 > 2), ¬A2 , (3x1 − 2x2 ≤ 3), ¬(3x1 − x3 ≤ 6), (x2 − x4 ≤ 6), (x3 = 3x5 + 4)},
which is the Boolean refinement of the assignment T 2B(µ) = {¬B1 , ¬A2 , B3 , ¬B5 , B6 , B8 }.
(Notice that the two occurrences of (3x1 − 2x2 ≤ 3) in rows 3 and 5 of ϕ are both assigned
true.) µ is a partial assignment which propositionally satisfies ϕ (i.e., T 2B(µ) |= T 2B(ϕ)),
as it assigns to true one literal of every disjunction in ϕ.
Following [155], we say that a collection M := {µ1 , . . . , µn } of (possibly partial) assignments propositionally satisfying ϕ is complete if and only if,
_
µj .
(3)
|=p ϕ ↔
µj ∈M
M := {µ1 , . . . , µn } is complete in the sense that, for for every total assignment η s.t.
η |=p ϕ, there exists µj ∈ M s.t. µj ⊆ η. Thus M can be seen as a compact representation
of the whole set of total assignments propositionally satisfying ϕ. The following fact can be
proved straightforwardly (see [155]).
Proposition 2.2. Let ϕ be a T -formula and let M := {µ1 , . . . , µn } be a complete collection
of truth assignments propositionally satisfying ϕ. Then, ϕ is T -satisfiable if and only if µj
is T -satisfiable for some µj ∈ M.
Finally, we also notice the following fact (see [153]).
Proposition 2.3. Let α be a non-Boolean atom occurring only positively [resp. negatively]
in ϕ. Let M be a complete set of assignments satisfying ϕ, and let
M′ := {µj \ {¬α}| µj ∈ M}
[resp. {µj \ {α} | µj ∈ M}].
Then (i) for every µ′j ∈ M′ , µ′j |=p ϕ, and (ii) ϕ is T -satisfiable if and only if there exist a
T -satisfiable µ′j ∈ M′ .
2.3 Enumerators and T -solvers
By proposition 2.2, the problem of establishing the T -satisfiability of ϕ can be decomposed
into two orthogonal components: one Boolean component, consisting in searching for (up
151
R. Sebastiani
to a complete set of) propositional models µ’s propositionally satisfying ϕ, and one theorydependent component, consisting in checking the T -consistence of µ (that is, for the set of
T -literals in µ). This suggests that an SMT (T ) solver can be seen as a combination of two
basic ingredients: a Truth Assignment Enumerator and a Theory Solver for T .
We call a Truth Assignment Enumerator (Enumerator henceforth) a total function
which takes as input a T -formula ϕ and returns a complete collection M := {µ1 , . . . , µn }
of assignments propositionally satisfying ϕ.
As in §2.1, we call a Theory Solver for T (T -solver) a procedure which takes as input a
collection of T -literals µ and decides whether µ is T -satisfiable; optionally, it can return a
T -model satisfying µ, or N ull if there is none.(It can return also some other information,
which we will discuss in §4.1.)
Examples of calls to T -solver for different theories T are: 7.
DL: DL-solver({(x − y = 3), (y − z ≤ 4), ¬(x − z ≤ 8)}) returns Unsat;
EU F: EU F-solver({a = b, b = f (c), ¬(g(a) = g(f (c)))}) returns Unsat;
LA(Q): LA(Q)-solver({(x − 2y = 3), (4y − 2z < 9), ¬(x − z ≤ 7)}) returns Sat;
LA(Z): LA(Z)-solver({(x − 2y = 3), (4y − 2z < 9), ¬(x − z ≤ 7)}) returns Unsat;
BV: BV-solver({(w[31:0]>>16 ) != 016 :w[31:16] }) returns Unsat;
AR: AR-solver({ ¬(a1=a2,), ¬(read(M,a2)=read(write(M,a1,x),a2)) }) returns Unsat.
Notice that T can be a combination of sub-theories, and hence T -solver be a combined
solver, as, e.g., in [130, 161, 78, 25, 157].
Remark 2.4. For better readability, in all the examples of this paper we will use the theory of linear arithmetic on rational numbers (LA(Q)) because of its intuitive semantics.
Nevertheless, analogous examples can be built with all other theories of interest.
7. These theories will be described in details in §4.2.
152
Lazy Satisfiability Modulo Theories
3. Basics on SAT solvers
A SAT solver is a procedure which decides whether an input Boolean formula ϕ is satisfiable,
and returns a satisfying assignment if this is the case. Notice the difference between a
SAT solver and a truth assignment enumerator: the former has to find only one satisfying
assignment —or to decide there is none— while the latter has to find a complete collection
of satisfying assignments.
Most state-of-the-art SAT procedures are evolutions of the Davis-Putnam-LogemannLoveland ( DPLL) procedure [60, 59]. Unlike with “classic” representation of DPLL [60,
59], modern conflict-driven DPLL implementation are non-recursive, and are based on
very efficient data structures to handle Boolean formulas and assignments. They benefit of
sophisticated search techniques, smart decision heuristics, highly-engineered data structures
and cute implementation tricks, and smart preprocessing techniques. (We refer the reader
to [193] for an overview.)
Remark 3.1. Modern DPLL engines can be partitioned into two main families: conflictdriven DPLL [163], in which the search is driven by the analysis of the conflicts at every
failed branch, and look-ahead DPLL [122], in which the search is driven by a look-ahead
procedure evaluating the reduction effect of the selection of each variable in a group. In
lazy SMT, however, it seems that all modern tools we are aware of have adopted the former
schema for their embedded SAT engine (see §5.3). Although (to the best of our knowledge)
this issue has never been explicitly discussed in the SMT literature, we conjecture that the
main reason for this fact is that the conflict-driven schema fits more naturally with the lazy
SMT schema, in which the Boolean component of search is driven by the theory conflicts
which are found by specialized solvers (see §5.3, §6.5 and §6.6). The possibility of adopting
a look-ahead schema within a lazy SMT solver is still an open research issue, as hinted in
§7.2.5. For these reasons, hereafter we restrict our discussion to the conflict-driven DPLL
schema, and in the next sections we often omit the adjective “conflict-driven” when referring
to DPLL.
3.1 Modern conflict-driven DPLL
A high-level schema of a modern conflict-driven DPLL engine, adapted from [193], is reported in Figure 1. The Boolean formula ϕ is in CNF; the assignment µ is initially empty,
and it is updated in a stack-based manner.
preprocess(ϕ, µ) simplifies ϕ into a simpler and equi-satisfiable formula, and updates
µ if it is the case. 8. If the resulting formula is unsatisfiable, then DPLL returns Unsat.
In the main loop, decide next branch(ϕ, µ) chooses an unassigned literal l from ϕ
according to some heuristic criterion, and adds it to µ. (This operation is called decision, l
is called decision literal and the number of decision literals in µ after this operation is called
the decision level of l.)
In the inner loop, deduce(ϕ, µ) iteratively deduces literals l deriving from the current
assignments (i.e., ϕ ∧ µ |=p l) and updates ϕ and µ accordingly; this step is repeated until
either µ satisfies ϕ, or µ falsifies ϕ, or no more literals can be deduced, returning Sat,
8. More precisely, if ϕ, µ, ϕ′ , µ′ are the formula and the assignment before and after preprocessing
respectively, then ϕ′ ∧ µ′ is equisatisfiable to ϕ ∧ µ.
153
R. Sebastiani
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
SatValue DPLL (Bool formula ϕ, assignment & µ) {
if (preprocess(ϕ, µ)==Conflict);
return Unsat;
while (1) {
decide next branch(ϕ, µ);
while (1) {
status = deduce(ϕ, µ);
if (status == Sat)
return Sat;
else if (status == Conflict) {
blevel = analyze conflict(ϕ, µ);
if (blevel == 0)
return Unsat;
else backtrack(blevel,ϕ, µ);
}
else break;
} } }
Figure 1. Schema of a modern conflict-driven DPLL engine.
Conflict and Unknown respectively. (The iterative application of Boolean deduction steps in
deduce is also called Boolean Constraint Propagation, BCP.)
In the first case, DPLL returns Sat. If the second case, analyze conflict(ϕ, µ) detects
the subset η of µ which caused the conflict (conflict set) and the decision level blevel to
backtrack. If blevel==0, then a conflict exists even without branching, so that DPLL
returns Unsat. Otherwise, backtrack(blevel,ϕ, µ) adds ¬η to ϕ (learning) and backtracks
up to blevel (backjumping), updating ϕ and µ accordingly. In the third case, DPLL exits
the inner loop, looking for the next decision.
We look at these steps with some more detail.
preprocess implements simplification techniques like, e.g., detecting and inlining Boolean
equivalences among literals, applying resolutions steps to selected pairs of clauses, detecting
and dropping subsumed clauses (see, e.g., [41, 13, 74]). It may also apply BCP if this is the
case.
decide next branch implements the key non-deterministic step in DPLL, for which
many heuristic criteria have been conceived. Old-style heuristics like MOMS and JeroslowWang [102] used to select a new literal at each branching point, picking the literal occurring
most often in the minimal-size clauses (see, e.g., [99]). The heuristic implemented in SATZ
[121] selects a candidate set of literals, performs BCP, chooses the one leading to the smallest
clause set; this maximizes the effects of BCP, but introduces big overheads. When formulas
derive from the encoding of some specific problem, it is sometimes useful to allow the encoder
to provide to the DPLL solver a list of “privileged” variables on which to branch first (e.g.,
action variables in SAT-based planning [91], primary inputs in bounded model checking
[169]). Modern conflict-driven DPLL solvers adopt evolutions of the VSIDS heuristic [129,
154
Lazy Satisfiability Modulo Theories
95, 75], in which decision literals are selected according to a score which is updated only
at the end of a branch, and which privileges variables occurring in recently-learned clauses;
this makes decide next branch state-independent (and thus much faster, because there
is no need to recomputing the scores at each decision) and allows it to take into account
search history, which makes search more effective and robust.
deduce is mostly based on the iterative application of unit-propagation. Highly-engineered
data structures and cute implementation tricks (like the two-watched-literal scheme [129])
allow for extremely efficient implementations. Other forms of deductions (and formula simplification) are, e.g., pure literal rule (now obsolete), on-line equivalence reasoning [120],
and variable and clause elimination [74].
It is important to notice that most modern conflict-driven DPLL solvers do not return
Sat when all clauses are satisfied, but only when all variables are assigned truth values. 9. As
a consequence, modern conflict-driven SAT solvers typically return total truth assignments,
even though the formulas are satisfied by partial ones. (We will further discuss this issue in
§7.2.1.)
analyze conflict and backtrack work as follows [163, 28, 192, 193]. Each literal is
tagged with its decision level, that is, the literal corresponding to the nth decision and the
literals derived by unit-propagation after that decision are labeled with n; each non-decision
literal l in µ is tagged by a link to the clause Cl causing its unit-propagation (called the
antecedent clause of l). When a clause C is falsified by the current assignment —in which
case we say that a conflict occurs and C is the conflicting clause— a conflict clause C ′ is
computed from C s.t. C ′ contains only one literal lu which has been assigned at the last
decision level. C ′ is computed starting from C ′ = C by iteratively resolving C ′ with the
antecedent clause Cl of some literal l in C ′ (typically the last-assigned literal in C ′ , see
[193]), until some stop criterion is met. E.g., with the 1st UIP strategy it is always picked
the last-assigned literal in C ′ , and the process stops as soon as C ′ contains only one literal
lu assigned at the last decision level; with the last UIP strategy, lu must be the last decision
literal.
Graphically, building a conflict set/clause corresponds to (implicitly) building and analyzing the implication graph corresponding to the current assignment. An implication graph
is a DAG s.t. each node represents a variable assignment (literal), the node of a decision literal has no incoming edges, all edges incoming into a non-decision-literal node l are labeled
Cl
Cl
with the antecedent clause s.t. Cl , s.t. l1 7−→
l,...,ln 7−→
l if and only if Cl = ¬l1 ∨...∨¬ln ∨l.
When both l and ¬l occur in the implication graph we have a conflict; given a partition of
the graph with all decision literals on one side and the conflict on the other, the set of the
source nodes of all arcs intersecting the borderline of the partition represents a conflict set.
A node lu in an implication graph is a unique implication point (UIP) for the last decision
level iff any path from the last decision node to both the conflict nodes passes through lu ; 10.
the most recent decision node is a UIP (the last UIP); the most-recently-assigned UIP is
called the 1st UIP. E.g., the last [resp. 1st] UIP strategy corresponds to using as conflict
set a partition corresponding to the last [resp. 1st] UIP.
9. This is mostly due to the fact that the two-watched-literal scheme [129] does not allow for an easy
check of clause satisfaction. (E.g., if a non-watched literal l in the clause C ∨ l is true, then the clause
it satisfied but DPLL is not informed of this fact.)
10. An UIP is also called an articulation point in graph theory (see, e.g., [53]).
155
R. Sebastiani
c1
c2
c3
c4
c5
c6
c7
c8
c9
...
: {¬A1 ∨ A2 }
: {¬A1 ∨ A3 ∨ A9 }
: {¬A2 ∨ ¬A3 ∨ A4 }
: {¬A4 ∨ A5 ∨ A10 }
: {¬A4 ∨ A6 ∨ A11 }
: {¬A5 ∨ ¬A6 }
: {A1 ∨ A7 ∨ ¬A12 }
: {A1 ∨ A8 }
: {¬A7 ∨ ¬A8 ∨ ¬A13 }
√
√
√
√
√
¬A10
¬A11
A12
A13
×
√
√
¬A10
A13
¬A9
1st UIP
¬A4
A2
A12
A5
c6
c3
c1
c4
A4
A1
c2
A1
A2
A3
A4
A5
A6
c4
last UIP
c3
¬A6
c5
A6
A3
c2
¬A9
Conflict!
c5
¬A11
=⇒Conflict set: {¬A10 , ¬A11 , A4 }, learn c10 := A10 ∨ A11 ∨ ¬A4
Figure 2. Example of learning and backjumping based on the 1st UIP stategy.
After analyze conflict has computed the conflict clause C ′ and added it to the formula, backtrack pops all assigned literals out of µ up to a decision level blevel deriving
from C ′ , which is computed by analyze conflict according to different strategies. In
modern conflict-driven implementations, DPLL backtracks to the highest point in the stack
where the literal lu in the learned clause C ′ is not assigned, and unit-propagates lu . We
refer the reader to [192] for an overview on backjumping and learning strategies.
Example 3.2. Consider a Boolean formula containing the clauses c1 . . . c9 in Figure 2,
and assume at some point µ := {. . . , ¬A9 , . . . , ¬A10 , . . . , ¬A11 , . . . , A12 , . . . , A13 , . . . , A1 }. 11.
After applying BCP on c1 . . . c8 a conflict on c6 occurs. Starting from the conflicting clause
c6 , the conflict clause/set is computed by iteratively resolving the current clause C ′ each
time with the antecedent clause of the last-assigned literal l in C ′ , until it contains only one
literal assigned at the current decision level (1st UIP):
c5
c4
z
}|
{
¬A4 ∨ A5 ∨ A10
¬A
|{z}4
1st U IP
conf licting clause
z
}|
{
}|
{
z
¬A4 ∨ A6 ∨ A11
¬A5 ∨ ¬A6
¬A4 ∨ ¬A5 ∨ A11
(A5 )
∨A10 ∨ A11
(A6 )
This corresponds to the 1st UIP cut of the implication graph in Figure 2. Then DPLL
learns the conflict clause c10 := A10 ∨ A11 ∨ ¬A4 , and backtracks up to below ¬A11 , it
unit-propagates ¬A4 on c10 , and proceeds.
Learning must be used with some care, because it may cause an explosion in the size
of ϕ. To avoid this problem, modern conflict-driven DPLL tools implement techniques for
11. Here and in other examples “...” mean that there may be possibly many other literals in the assignment,
which play no direct role in the discourse.
156
Lazy Satisfiability Modulo Theories
Unit-Propagate: hµ | ϕ, C ∨ li ⇒ hµ, l | ϕ, C ∨ li if
Decide:
hµ | ϕi
⇒ hµ, l | ϕi
if
Fail:
hµ | ϕ, Ci
⇒ f ail
if
Backjump:
hµ, l, µ′ | ϕ, Ci ⇒ hµ, l′ | ϕ, Ci
if
Learn:
hµ | ϕi
⇒ hµ | ϕ, Ci
if
Discharge:
Restart:
hµ | ϕ, Ci
hµ | ϕi
⇒ hµ | ϕi
⇒ h∅ | ϕi
if
µ |= ¬C
l
is undef ined in µ
l or ¬l occurs in ϕ
l is undef ined in µ
µ |= ¬C
no decision literals
µ contains
′ |= ¬C
µ,
l,
µ
there is some clause C ′ ∨ l′ s.t. :
ϕ, C |= C ′ ∨ l′ and µ |= ¬C ′
l′ is undef ined in µ
l′ or ¬l′ occurs in ϕ or
in µ ∪ {l} ∪ µ′
all atoms in C occur in ϕ or in µ
ϕ |= C
ϕ |= C
Figure 3. The Abstract-DPLL logical framework from [136]. In the Backjump rule, C and
C ′ ∨ l′ represent the conflicting and the conflict clause respectively.
discharging learned clauses when necessary [163, 28]. Moreover, in order to avoid getting
stuck into hard portions of the search space, most DPLL tools restart the search from
scratch in a controlled manner [96]; the clauses which have been learned avoid exploring
the same search tree again. Clause discharging and restarts are substantially orthogonal to
our discussion on SMT and come for free by using state-of-the-art DPLL solvers, so that
they will not be discussed any further.
Modern conflict-driven DPLL procedures can be used as truth assignment enumerators,
by modifying rows 8-9 in Figure 1 so that, when a satisfying assignment µ is generated,
DPLL stores µ and backtracks. This issue will be discussed in §5.3.
3.2 The Abstract-DPLL logical framework
[176, 135, 133, 136] proposed an abstract rule-based formulation of DPLL (Abstract DPLL)
and of DPLL-based lazy SMT systems (Abstract DPLL Modulo Theories), which are represented as control strategies applied to a set of formal rules. This allows for expressing
and reasoning about most variants of these procedures in a formal way.
In the Abstract-DPLL framework, DPLL is modeled as a transition system. A state is
either f ail or a pair hµ | ϕi, ϕ being a CNF Boolean formula and µ being a set of annotated
literals, representing the current truth assignment. All DPLL steps are seen as transitions
in the form hµ | ϕi ⇒ hµ′ | ϕ′ i, and are applications of the conditioned transition rules
described in Figure 3. 12.
12. The formalization of the rules in [135, 133, 136] changes slightly from paper to paper. Here we report
the most-recent one from [136]. We have adapted the notation to that used in this paper.
157
R. Sebastiani
The first five rules represent respectively the unit-propagation step of deduce, the literal
selection in decide next branch, the failure step of row 12-13 in Figure 1, the backjumping
and learning mechanisms of analyze conflict and backtrack. The last two rules represent
the discharging and restart mechanisms described, e.g., in [28] and [96].
The only non-obvious rule is Backjump, which deserves some more explanation: if a
branch µ ∪ {l} ∪ µ′ falsifies one clause C (the conflicting clause), and a conflict clause
C ′ ∨ l′ 13. can be computed from C s.t. (C ′ ∨ l′ ) is entailed by ϕ ∧ C, ¬C ′ ⊆ µ, l′ 6∈ µ, and
l′ or ¬l′ occur in ϕ or in µ ∪ {l} ∪ µ′ , then it is possible to backjump up to µ, and hence
unit-propagate l′ on the conflict clause (C ′ ∨ l′ ).
Example 3.3. Consider the problem in Example 3.2 and Figure 2. The execution can be
represented in Abstract-DPLL as follows:
...
h.., ¬A9 , .., ¬A10 , .., ¬A11 , .., A12 , .., A13 , ..
|c1 , ..., c9 i
⇒ (Decide A1 )
h.., ¬A9 , .., ¬A10 , .., ¬A11 , .., A12 , .., A13 , .., A1
|c1 , ..., c9 i
⇒ (U nitP. A2 )
h.., ¬A9 , .., ¬A10 , .., ¬A11 , .., A12 , .., A13 , .., A1 , A2
|c1 , ..., c9 i
⇒ (U nitP. A3 )
...
h.., ¬A9 , .., ¬A10 , .., ¬A11 , .., A12 , .., A13 , .., A1 , A2 , A3 , A4 , A5 , A6|c1 , ..., c9 i
⇒ (Learn c10 )
h.., ¬A9 , .., ¬A10 , .., ¬A11 , .., A12 , .., A13 , .., A1 , A2 , A3 , A4 , A5 , A6|c1 , ..., c9 , c10 i ⇒ (Backjump)
h.., ¬A9 , .., ¬A10 , .., ¬A11 , ¬A1
|c1 , ..., c9 , c10 i ⇒ (...)
...
c1 , ..., c10 being the clauses in Figure 2.
If a finite sequence h∅ | ϕi ⇒ hµ1 | ϕ1 i ⇒ . . . ⇒ f ail is found, then the formula is
unsatisfiable; if a finite sequence h∅ | ϕi ⇒ . . . ⇒ hµn | ϕn i is found so that no rule can
be further applied, then the formula is satisfiable. Different strategies in applying the rules
correspond to different variants of the algorithm. [135, 136] provide a group of results
about termination, correctness and completeness of various configurations. Importantly,
notice only the second, third and fourth rules are strictly necessary for correctness and
completeness [135]. We refer the reader to [135, 133, 136] for further details. The AbstractDPLL Modulo Theories framework will be described in §5.4.
13. Also called the backjump clause in [136].
158
Lazy Satisfiability Modulo Theories
4. Basics on theory solvers
As stated in §2, in its simplest form a T -solver is a procedure establishing whether any given
finite set/conjunction of quantifier-free Σ-literals is T -satisfiable or not. Starting from the
pioneering works by Nelson, Oppen and Shostak [130, 131, 161, 162], many algorithms have
been conceived for T -solvers in many theories of interest. In this section we discuss the
features of T -solvers which are most important for SMT (T ), and briefly survey the most
interesting theories and the relative T -solvers.
As it will be made clear in the next sections, two main features of a T -solver concur in
achieving the maximum efficiency of an SMT (T ) solver: the effectiveness of its synergical
interaction with the DPLL solver, and its efficiency in time and memory. The effectiveness
of the interaction depends on the capability of the T -solver of producing, exchanging and
exploiting fruitful information with DPLL, and will be discussed in §4.1. The efficiency
in time and memory of T -solver strongly depends on the theory T . (E.g., the problem of
deciding the T -satisfiability of sets of literals is O(n · log(n)) for EU F and NP-complete for
LA(Z).) This will be briefly discussed in §4.2 for some theories of interest.
4.1 Important features of T -solvers
In this section we overview the main capabilities of a general T -solver which are of interest
for their usage within an SMT procedure.
4.1.1 Model generation
A key issue for T -solver, whenever it is invoked on an T -consistent assignment µ, is its
ability to produce a T -model I for µ witnessing its consistency, i.e., I |=T µ. Substantially
most T -solvers for all theories of interest are able to produce a model on demand.
Example 4.1. Let µ be {¬(2v2 − v3 > 2), (3v1 − 2v2 ≤ 3), (v3 = 3v5 + 4)}. A LA(Q)-solver
decides that µ is LA(Q)-satisfiable, and may return I := {v1 = v2 = v3 = 0, v5 = −4/3}.
Notice that sometimes producing a model may require extra computation effort. This
is mostly due to the fact that the T -solvers may perform satisfiability-preserving transformations on the input literals, which must be reversed when building the model.
4.1.2 Conflict set generation
Given a T -unsatisfiable assignment µ, we call a theory conflict set (simply “conflict set”
when this causes no ambiguity) a T -unsatisfiable sub-assignment µ′ ⊆ µ; we say that µ′ is
a minimal theory conflict set if all strict subsets of µ′ are T -consistent. 14. A key efficiency
issue for T -solver, whenever it is invoked on an T -inconsistent assignment µ, is its ability
to produce the (possibly minimal) conflict set of µ which has caused its inconsistency.
Example 4.2. Consider the LA(Q)-formula ϕ in Example 2.1, and suppose LA(Q)-solver
is called on µ. As µ is not LA(Q)-satisfiable, LA(Q)-solver will return Unsat, and may also
return a (minimal) conflict set causing the conflict:
{(3x1 − 2x2 ≤ 3), ¬(2x2 − x3 > 2), ¬(3x1 − x3 ≤ 6)}.
(4)
14. Theory conflict sets are also called reasons, justifications, proofs or infeasible sets by some authors;
minimal theory conflict sets are also called irreducible infeasible sets in [188].
159
R. Sebastiani
For instance, there exist conflict-set-producing variants for the Bellman-Ford algorithm
for DL, [52], for the Simplex LP procedures for LA(Q) [15] and for the congruence closure
algorithm for EU F [132]. (See §4.2.)
4.1.3 Incrementality and Backtrackability
It is often the case that T -solver is invoked sequentially on incremental assignments, in a
stack-based manner, like in the following trace (left column first, then right) [37]:
T -solver
T -solver
T -solver
T -solver
(µ1 )
(µ1 ∪ µ2 )
(µ1 ∪ µ2 ∪ µ3 )
(µ1 ∪ µ2 ∪ µ3 ∪ µ4 )
=⇒
=⇒
=⇒
=⇒
Sat
Sat
Sat
Unsat
Undo µ4 , µ3 , µ2
T -solver (µ1 ∪ µ′2 )
T -solver (µ1 ∪ µ′2 ∪ µ′3 )
...
=⇒ Sat
=⇒ Sat
Thus, a key efficiency issue of T -solver is that of being incremental and backtrackable. 15.
Incremental means that T -solver “remembers” its computation status from one call to the
other, so that, whenever it is given in input an assignment µ1 ∪ µ2 such that µ1 has just
been proved T -satisfiable, it avoids restarting the computation from scratch by restarting
the computation from the previous status. Backtrackable means that it is possible to undo
steps and return to a previous status on the stack in an efficient manner.
For instance, there are incremental and backtrackable versions of the congruence closure
algorithm for EU F [132], of the Bellman-Ford algorithm for DL [52, 133], and of the Simplex
LP procedure for LA(Q) [15, 71]. (See §4.2.)
4.1.4 Deduction of unassigned literals
For many theories it is possible to implement T -solver so that, when returning Sat, it can
also perform a set of deductions in the form η |=T l, s.t. η ⊆ µ and l is a literal on a
not-yet-assigned atom in ϕ. We say that T -solver is deduction-complete if it can perform
all possible such deductions, or say that no such deduction can be performed.
Example 4.3. Consider the LA(Q)-formula ϕ in Example 2.1, and suppose LA(Q)-solver
is called on {¬(2x2 − x3 > 2), ¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4)} (1st, 4th and 7th rows in
ϕ); then LA(Q)-solver returns Sat and may perform and return the deduction
{¬(2x2 − x3 > 2), ¬(3x1 − x3 ≤ 6)} |=LA(Q) ¬(3x1 − 2x2 ≤ 3).
(5)
For instance, for EU F, the computation of congruence closure allows for efficiently
deducing positive equalities [132]; for DL, a very efficient implementation of a deductioncomplete T -solver has been presented by [133, 54]; for LA the task is much harder, and only
T -solvers capable of incomplete forms of deduction have been presented [71]. (See §4.2.)
Notice that, in principle, every T -solver has deduction capabilities, as it is always possible to call T -solver(µ ∪ {¬l}) for every unassigned literal l. We call this technique, plunging
[70]. In practice, apart from some application [5], plunging is very inefficient.
15. The latter feature is also called resettable in other contests (e.g., in [130]).
160
Lazy Satisfiability Modulo Theories
4.1.5 Deduction of interface equalities
Similarly to deduction of unassigned literals, for most theories it is possible to implement
T -solver so that , when returning Sat, it can also
W perform a set of deductions in the form
µ |=T e (if T is convex) or in the form µ |=T j ej (if T is not convex) s.t. e, e1 , ..., en
are equalities between variables occurring in µ. In accordance with the notation in §2.1.1,
and because typically e, e1 , ..., en are interface equalities, we call these forms of deductions
eij -deductions, and we say that a T -solver is eij -deduction-complete if it can perform all
possible such deductions, or say that no such deduction can be performed.
Example 4.4. If an eij -deduction complete LA(Z)-solver is given as input a consistent
assignment {. . . , (v1 ≥ 0), (v1 ≤ 1), (v3 = 0), (v4 = 1), . . .}, then it will deduce from it the
disjunction of equalities (v1 = v3 ) ∨ (v1 = v4 ).
Notice that, unlike with the deduction of unassigned literal described in §4.1.4, here the
deduced equalities need not occur in the input formula ϕ.
eij -deduction is often (implicitly) implemented by means of canonizers [162]. Intuitively,
a canonizer canonT for a theory T is a function which maps a term t into another term
canonT (t) in canonical form, that is, canonT maps terms which are semantically equivalent
in T into the same term. Thus, if xt1 , xt2 are interface variables labeling the terms t1 and
t2 respectively, then the interface equality (xt1 = xt2 ) can be deduced in T if and only if
canonT (t1 ) and canonT (t2 ) are syntactically identical.
4.2 Some relevant theories and T -solvers
We briefly overview some of the theories of interest, with some information about the relative
T -solvers. (See also [124].) We assume the notions of stably-infinite and convex theories
described in §2.1.1.
As stated in §2, all the theories we consider are first-order theories with equality, in
which “=” is a predefined predicate and it is always interpreted as the identity on the
underlying domain. In particular, “=” represents a relation which is reflexive, symmetric,
transitive, and it is also a congruence. Thus, the following equality (6) and congruence (7)
axioms are implicit in all theories, for every function symbol f and predicate symbol P :
∀x. (x = x), ∀x, y. (x = y → y = x), ∀x, y, z. ((x = y ∧ y = z) → x = z) (6)
V
∀x1 , ..., xn , y1 , ..., yn . ((Vni=1 xi = yi ) → f (x1 , ..., xn ) = f (y1 , ..., yn ))
(7)
∀x1 , ..., xn , y1 , ..., yn . (( ni=1 xi = yi ) → (P (x1 , ..., xn ) ↔ P (y1 , ..., yn ))).
For simplicity and w.l.o.g., we can assume that identities like t = t are simplified into ⊤
and atoms like t1 = t2 have been sorted s.t. t1 ≺ t2 for some total order ≺. Thus the first
two axioms in (6) are useless.
4.2.1 Equality and Uninterpreted Functions
The theory of Equality and Uninterpreted Functions (EU F) 16. is the quantifier-free F.O.
theory with equality with no restrictions on Σ. Semantically, no axioms other than (6)
16. Simply called “the theory of equality” by some authors (e.g., [124]).
161
R. Sebastiani
and (7) are provided. If Σ contains no uninterpreted functions or predicates, then (7) are
not needed, and we denote the resulting restricted theory by E. EU F is stably-infinite and
convex. The EU F-satisfiability of sets of quantifier-free literals is decidable and polynomial
[1].
An E-solver can be simply implemented on top of the standard Union-Find algorithm
(see, e.g., [134]). Efficient EU F-solvers have been implemented on top of congruence-closure
data structures, they are incremental and backtrackable, can efficiently perform conflict-set
generation and deduction of (positive) unassigned equalities and of interface equalities (see,
e.g., [70, 132, 134]). The algorithm in [132] extends EU F with offset values (that is, it can
represent expression like (t1 = t2 + k), t1, t2 being EU F terms and k being a constant
integer value) and it is probably the most efficient algorithm currently available.
4.2.2 Linear arithmetic
The theory of Linear Arithmetic (LA) on the rationals (LA(Q)) and on the integers (LA(Z))
is the quantifier-free F.O. theory with equality whose atoms are written in the form (a1 ·x1 +
... + an · xn ⊲⊳ a0 ), s.t. ⊲⊳ ∈ {≤, <, 6=, =, ≥, >}, the ai s are (interpreted) constant symbols,
each labeling one value in Q and Z respectively. 17. The atomic expressions are interpreted
according to the standard semantics of linear arithmetic on Q and Z respectively. (See, e.g.,
[124] for a more formal definition of LA(Q) and LA(Z).)
LA(Q) is stably-infinite and convex. The LA(Q)-satisfiability of sets of quantifier-free
literals is decidable and polynomial [107]. The main algorithms used are variant of the wellknown Simplex and Fourier-Motzkin algorithms.Efficient incremental and backtrackable
algorithms for LA(Q)-solvers have been conceived, which can efficiently perform conflictset generation and deduction of unassigned equalities and of interface equalities (see, e.g.,
[35, 68, 70, 151, 71]).
LA(Z) is stably-infinite and non-convex. 18. The LA(Z)-satisfiability of sets of quantifierfree literals is decidable and NP-complete [140]. Many algorithms have been conceived,
involving techniques like Euler’s reduction, Gomory-cuts application, Fourier-Motzkin algorithm, branch-and-bound [118]. Notably, the Omega library [137] provides a LA(Z)-solver
based on a combination of Euler’s reduction, Fourier-Motzkin algorithm, and smart optimizations like real and dark shadow [143]. Incremental and backtrackable algorithms for
LA(Z)-solvers have been conceived, which can perform conflict-set generation and deduction
of interface equalities (see, e.g., [29, 71]).
Remark 4.5. It is very important to remark that, in order to avoid incorrect results due to
numerical errors and to overflows, all T -solvers for LA(Q), LA(Z) and their subtheories
which are based on numerical algorithms must be implemented on top of infinite-precisionarithmetic software packages.
There are two main relevant sub-theories of LA: the theory of differences and the UnitTwo-Variable-Per-Inequality theory.
17. Notice that in LA(Q) we can assume w.l.o.g. that all constant symbols ai are in Z because, if this is
not so, then we can multiply all coefficients ai s in every atom by their greatest common denominator.
18. E.g., let µ be {x − z ≥ 0, x − z ≤ 1, x0 − z = 0, x1 − z = 1}. Thus, µ |=LA(Z) ((x = x0 ) ∨ (x = x1 )), but
µ 6|=LA(Z) (x = x0 ) and µ 6|=LA(Z) (x = x1 ).
162
Lazy Satisfiability Modulo Theories
4.2.3 Difference logic
The theory of differences (DL) 19. on the rationals (DL(Q)) and the integers (DL(Z)) is the
sub-theory of LA(Q) [resp. LA(Z) ] whose atoms are written in the form (x1 − x2 ⊲⊳ a), s.t.
⊲⊳ ∈ {≤, <, 6=, =, ≥, >}, and the a is an (interpreted) constant symbol labeling one value in
Q and Z respectively. 20.
All DL literals can be rewritten in terms of positive difference inequalities (x − y ≤ a)
only. First, all literals are rewritten into Boolean combinations of difference inequalities,
by applying rules like, e.g., (x − y = a) =⇒ ((x − y ≤ a) ∧ (y − x ≤ −a)), (x − y > a) =⇒
¬(x − y ≤ a), (x − y 6= a) =⇒ (¬(x − y ≤ a) ∨ ¬(y − x ≤ −a)). Negated differences are then
rewritten into positive ones by applying ¬(x − y ≤ a) =⇒ (y − x ≤ −a − 1) (DL(Z) case)
or ¬(x − y ≤ a) =⇒ (y − x ≤ −a − ǫ) (DL(Q) case), for a sufficiently-small ǫ [6]. Notice
that disequalities may require being split into the disjunction of two difference inequalities.
(With DL(Q), this step can be avoided, as described below.)
DL(Q) is stably-infinite and convex. The DL(Q)-satisfiability problem of sets of quantifierfree difference inequalities is decidable and polynomial; thanks to the convexity of DL(Q),
the DL(Q)-satisfiability of sets of quantifier-free difference inequalities, equalities and disequalities —and hence the problem of deducing interface equalities— is also polynomial.
Equalities can be split into a conjunction of inequalities, as above. As with LA(Q), in
DL(Q) disequalities can instead be treated
separately and handled one-by-one. In fact,
S
thanks to the convexity of DL(Q), µ ∪ i {(ti 6= si )} is DL(Q)-consistent iff µ ∪ {(ti 6= si )}
—and hence µ ∪ {(ti < si ) ∨ (ti > si )}— is DL(Q)-consistent for every i.
The main algorithms encode the DL(Q)-satisfiability of sets of difference inequalities
into the problem of finding negative cycles into a weighted oriented graph, called constraint graph, by using variants of the Bellman-Ford shortest-path algorithm (see, e.g.,
[52]). Intuitively, a node of the graph represents univocally one variable xi , and a laa
beled arc x1 7−→ x2 represents the difference inequality (x2 − x1 ≤ a), meaning “the
length of the shortest path from x1 to x2 is smaller or equal to a”. The graph represents an inconsistent set of difference inequalities if and only if it contains a negative cycle
Pn
an−1
a0
a1
an
x0 7−→
x1 7−→
... 7−→ xn 7−→
x0 s.t.
i=0 ai < 0, corresponding to a DL-inconsistent
Sn−1
subset η =def i=0 {xi+1 − xi ≤ ai } ∪ {x0 − xn ≤ an }. Is so, then η is the conflict set which
is returned by the DL(Q)-solver.
Let µ be a set of difference inequalities on the variables x1 , ..., xN . First, µ is augmented
with all the constraints (xi − x0 ≤ 0) s.t. i ∈ 1, ..., N and x0 is a fresh variable, representing
a “fake” source node. 21. In a nutshell, the algorithm tries to find the tree of the paths from
x0 to all the other nodes xi which minimize the distance d0i from x0 to xi (hereafter denoted
d
as “x0 0i xi ”). This is done by maintaining the current value of d0i and the antecedent
node p(xi ) in the current version of the tree, and iteratively updating them as follows: if for
a
some arc xi 7−→ xj we have that d0j > a + d0i , then xi becomes the new antecedent of xj
19. Also called difference logic or separation logic. Notice the overlapping with the notion of “separation
logic” defined in [149], where this term indicates an extension of Hoare logic for reasoning about programs
that use shared mutable data structures.
20. Notice that also in DL(Q) we can assume w.l.o.g. that all constant symbols a occurring in the formula
are in Z because, if this is not so, then we can rewrite the whole formula into an equivalently-satisfiable
one by multiplying all constant symbols occurring in the formula by their greatest common denominator.
21. The fake source node x0 is added so that to guarantee that all nodes are reachable from the source node.
163
R. Sebastiani
[−4, x3 ]
0
[-6,x3 ]
[0, x0 ]
−1
x1
0
x2
[-4,x1 ]
x2
−1
x1
2
0
x0
[0, x0 ]
0
−1
−2
[0,x0 ]
0
0
x0
3
−1
0
6
x3
x4
[−2, x4 ] −2
[-5,x2 ]
[0, x0 ]
3
−2
0
−1
x3
−1
6
−2
x4
[0,x0 ]
Figure 4. Constraint graphs for the problems of Example 4.6. For each xi , values in square bracka
ets represent [d0i , p(xi )], and thick arcs incoming into xi represents antecedence arcs p(xi ) 7−→ xi .
d
a
and d0j = a + d0i because x0 0i xi 7−→ xj is a shorter path fro x0 to xj than the previous
a
shortest one. This process, called relaxation of the arc xi 7−→ xj , is repeated according to
some strategy until some sufficient termination condition is met. A very basic strategy
is to repeat N times the process of relaxing all arcs in the graph; hence the graph has a
a
negative cycle if and only if, for some arc xi 7−→ xj , d0j > a + d0i (see e.g. [53]). If this is
the case, then a negative cycle can be found starting from xi and following backward the
antecedents, until a loop is found. Otherwise, I =def {d0i | i ∈ 1, ..., N } is a model for the
set of constraints. (Much more efficient strategies are presented in [52].)
Example 4.6. Consider the set of difference inequalities
µ = { (x4 − x2 ≤ 3), (x4 − x3 ≤ 6), (x1 − x2 ≤ −1), (x1 − x3 ≤ −2), (x1 − x4 ≤ −1),
(x3 − x2 ≤ −1), (x3 − x4 ≤ −2) }.
0
After adding the fake source node x0 and the arcs x0 7−→ xi , the corresponding constraint
graph is represented in Figure 4 (left). After running Bellman-Ford algorithm with the basic
a
strategy described above, no arc xi 7−→ xj is s.t. d0j > a+d0i , so that µ is DL(Q)-consistent,
and I =def {x1 = −4, x2 = 0, x3 = −2, x4 = 0} is a model for µ.
Consider now the set
µ′ = { (x4 − x2 ≤ 3), (x4 − x3 ≤ 6), (x1 − x2 ≤ −1), (x1 − x3 ≤ −2), (x1 − x4 ≤ −1),
(x2 − x1 ≤ 2), (x3 − x2 ≤ −1), (x3 − x4 ≤ −2) }
(that is, µ′ = µ ∪ {(x2 − x1 ≤ 2)}) and the corresponding constraint graph represented in
2
−1
−2
Figure 4 (right), which contains the negative cycle x1 7−→ x2 7−→ x3 7−→ x1 . After running
Bellman-Ford algorithm with the basic strategy described above (each loop analyzing the
−2
3
edges in the order they are listed in µ′ ), the two arcs x3 7−→ x1 and x4 7−→ x2 are such
that d01 > −2 + d03 and d04 > 3 + d02 respectively. Thus, starting from either x3 or x2 and
following backwards the antecedents, the algorithm tracks the negative cycle, corresponding
to the conflict set {(x3 − x2 ≤ −1), (x2 − x1 ≤ 2), (x1 − x3 ≤ −2)}.
164
Lazy Satisfiability Modulo Theories
Efficient incremental algorithms for DL(Q)-solvers have been conceived, which can efficiently perform minimal conflict-set generation [52], T -deduction of unassigned literals
[133, 54] and of interface equalities (see, e.g., [116]). In a nutshell, an efficient and incremental algorithm able to T -deduce unassigned literals works as follows [133]: each time a
a
new arc xi 7−→ xj is added so that the resulting graph is still consistent, then two instances
of (an optimized version of) Bellman-Ford algorithm are run to find the minimal paths
from xj to all other nodes and from all other nodes to xi ; then, for every path in the form
d
a
djm
xl li xi 7−→ xj
xm , it is possible to deduce every unassigned literal (xm − xl ≤ b) s.t.
b ≥ dli + a + djm and every unassigned literal ¬(xl − xm ≤ c) s.t. −c > dli + a + djm .
DL(Z) is stably-infinite and non-convex. 22. As with DL(Q), the DL(Z)-satisfiability of
sets of quantifier-free difference inequalities is decidable and polynomial; as before, adding
equalities does not affect the complexity of the problem. Instead, and due to the nonconvexity of DL(Z), the DL(Z)-satisfiability of sets of quantifier-free difference inequalities, equalities and disequalities —and hence that of deducing (disjunctions of) interface
equalities— is NP-complete [115]. Once the problem is rewritten as a set of difference inequalities, the algorithms used for DL(Z)-solvers are the same as for DL(Q) [52, 133, 54].
Interesting results have also been obtained by implementing “mixed” techniques combining
a lazy approach with “eager” encodings of DL(Z) into SAT (§9.3) [184, 83, 108].
4.2.4 Unit-Two-Variable-Per-Inequality
The Unit-Two-Variable-Per-Inequality (UT VPI) theory is a subcase of LA(Z) whose atoms
can be written in the form (±x2 ± x1 ≤ c). Notice that DL(Z) is a sub-theory of UT VPI.
UT VPI is stably-infinite and non-convex. 23. The DL(Q)-satisfiability of sets of quantifierfree difference inequalities is decidable and polynomial, and UT VPI is the most expressive
sub-theory of LA(Z) with this feature (see [97]).
Many UT VPI-solvers are based on the iterative transitive closure [97]: as soon as a new
constraint is added into the system, all possible consequences of the input are computed,
until either a pair of contradictory constraints are generated, or a fixpoint is reached. [115]
proposed instead one non-incremental though asymptotically faster algorithm based on
negative cycle detection on an extended constraint graph. 24. This algorithm can efficiently
perform conflict-set generation and deduction of unassigned equalities, and some form of
deduction of interface equalities. As with DL(Z), we are not aware of any specialized
algorithm for UT VPI-solvers able to efficiently deduce disjunctions of interface equalities.
22. Same example as in Footnote 18..
23. Same example as in Footnote 18..
24. Intuitively, the set of U T VPI constraints is encoded into an equi-satisfiable set of DL(Z) problems by
introducing two variables x+ and x− for each original variable x, representing x and −x respectively,
and encoding each constraint with a pair of DL(Z) constraint (e.g., (x+ − y − ≤ a) and (y + − x− ≤ a)
for (x + y ≤ a)).
165
R. Sebastiani
4.2.5 Bit vectors
The theory of fixed-width bit vectors (BV) 25. is a F.O. theory with equality which aims at
representing Register Transfer Level (RTL) hardware circuits, so that components such as
data paths or arithmetical sub-circuits are considered as entities as a whole, rather than
being encoded into purely propositional sub-formulas (“bit blasting”). BV can also be used
to encode software verification problems (see e.g. [84]).
In BV terms indicate fixed-width bit vectors, and are built from variables (e.g., x[32]
indicates a bit vector x of 32 bits) and constants (e.g., 0[16] denotes a vector of 16 0’s) by
means of interpreted functions representing standard RTL operators: word concatenation
(e.g., 0[16] ◦ z[16] ), sub-word selection (e.g., (x[32] [20 : 5])[16] ), modulo-n sum and multiplication (e.g., x[32] +32 y[32] and x[16] ·16 y[16] ), bitwise-operators andn , orn , xorn , notn (e.g.,
x[16] and16 y[16] ), left and right shift <<n , >>n (e.g., x[32] <<4 ). Atomic expressions can be
built from terms by applying interpreted predicates like ≤n , <n (e.g., 0[32] ≤32 x[32] ) and
equality.
BV is non-convex and non-stably infinite. The BV-satisfiability of sets of quantifierfree literals is decidable and NP-complete. Different approaches for BV-satisfiability have
been proposed: some authors (e.g. [104, 125, 72, 84])) apply word-level preprocessing
algorithms, and then encode the result into pure SAT (“bit blasting”); some authors (e.g,
[77, 191, 42, 141, 36]) encode bits, bit vectors and (most of) their operators into LA(Z);
[43] propose a layered (see §4.3) BV-solver base on a hierarchy of rewriting steps, and a final
call to a LA(Z)-solver; others [49, 58, 128, 24] provide canonizers and T -solvers explicitly
for (sub-theories of) BV, which are integrated by means of Nelson-Oppen/Shostak-style
schema (see §8.2). The quest for suitable algorithms for efficient BV-solvers is currently a
hot research topic.
4.2.6 Other theories of interest
We very briefly recall some other theories of interest, in particular in the field of software
verification. Here we provide only a very high-level description, and point the reader to the
reported bibliography (e.g., to [124]) for a more detailed description.
The theory of arrays (AR) 26. aims at modeling the behavior of arrays/memories. The
signature consists in the two interpreted function symbols write and read, s.t. write(a, i, e)
represents (the state of) the array resulting from storing an element e into the location of
address i of an array a, and read(a, i) represents the element contained in the array a at
location i. AR is formally characterized by the following axioms (see [124]):
∀a.∀i.∀e. (read(write(a, i, e), i) = e),
∀a.∀i.∀j.∀e. ((i 6= j) → read(write(a, i, e), j) = read(a, j)),
∀a.∀b. (∀i.(read(a, i) = read(b, i)) → (a = b)).
(8)
(9)
(10)
(8) and (9), called McCarthy’s axioms, characterize the intended meaning of write and
read, whilst (10), called the extensionality axiom, requires that, if two arrays contain the
25. We should better say the theories of bit vectors, because many variants of BV have been proposed. Like
in [124], here we simply aim at summing up into one theory the main concepts related to these theories.
The same comment holds also for the theories mentioned in §4.2.6.
26. See Footnote 25..
166
Lazy Satisfiability Modulo Theories
same values in all locations, than they must be the same array. Theories of arrays are
called extensional if they include (10), non-extensional otherwise. Although many practical
problems do not require extensionality, the latter is explicitly required, e.g., in some software
verification problems, in order to represent assignments or comparisons between arrays (e.g.,
C++ vector variables).
The AR-satisfiability of sets of quantifier-free literals is decidable and NP-complete
[173]. AR is typically handled in combination with other theories, by means of NelsonOppen/Shostak-style integration schema (see §8.2). Decision procedures for AR have been
presented, e.g., in [130, 70, 173]. We refer the reader to [173] for an overview.
The theory of lists (LI) aims at modeling the behavior of lists. The signature consists
in the three interpreted function symbols cons, car, cdr representing the standard LISP
constructor and selectors for lists. LI is formally characterized by the following axioms
(see [124]):
∀x. (cons(car(x), cdr(x)) = x),
∀x.∀y. (car(cons(x, y)) = x), ∀x.∀y. (cdr(cons(x, y)) = y),
(11)
(12)
∀x.(car(x) 6= x), ∀x.(cdr(x) 6= x), ∀x.(car(car(x)) 6= x), ∀x.(car(cdr(x)) 6= x), . . . .(13)
(11) and (12), called construction and selection axioms respectively, characterize the intended meaning of cons, car and cdr, whilst (the infinite sequence of) the acyclicity axioms
(13) force the list to be acyclic. The LI-satisfiability of sets of quantifier-free literals is
decidable and linear in time [139]. LI is a subcase of the theory of recursive datatypes
(RDT ), which introduce more general kinds of constructors and selectors, and for which
decision procedures have been developed. We refer the readers, e.g., to [139, 21, 32] for
more details.
4.3 Layered T -solvers
In many calls to T -solver, a general solver for T is not needed: very often, the unsatisfiability
of the current assignment µ can be established in less expressive, but much easier, subtheories. Thus, T -solver may be organized in a layered hierarchy of solvers of increasing
solving capabilities [9, 37, 158, 55, 43]. If a higher level solver finds a conflict, then this
conflict is used to prune the search at the Boolean level; if it does not, the lower level solvers
are activated.
The general idea consists in stratifying the problem over N layers L0 , L1 , . . . , LN −1 of
increasing complexity, and searching for a solution “at a level as simple as possible”. In
our view, each level Ln considers only an abstraction of the problem, that is, a subset
µn of the input set of constraints µ s.t. µ0 ⊆ µ1 ⊆ . . . ⊆ µN −1 = µ which is analyzed
for consistency in a subtheory T n of signature Σn s.t Σ0 ⊆ Σ1 ⊆ . . . ⊆ ΣN −1 = Σ and
T 0 ⊂ T 1 ⊂ . . . ⊂ T N −1 = T . Since Ln refines Ln−1 , if the problem does not admit a
solution at level Ln (i.e., µn |=T n ⊥) then it does not admit a solution at all (i.e., µ |=T ⊥),
and the whole T -solver can return Unsat. If indeed a solution S exists at Ln , either n equals
N − 1, in which case S solves the problem, or a refinement of S must be searched at Ln+1 .
In this way, much of the reasoning can be performed at a high level of abstraction. This
results in an increased efficiency in the search of the solution, since low-level searches, which
are often responsible for most of the complexity, are avoided whenever possible.
167
R. Sebastiani
sat
sat
reals
Congruence sat
Closure
unsat
Belman−Ford
unsat
sat
sat
Simplex
unsat
Disequality
Handler
unsat
sat
sat
int’s
Branch and
cut
sat
time
out
unsat
FM ELIM
unsat
unsat
EUF
DL
LA(Q)
LA(Z)
Figure 5. Example of a layered T -solver: the LA(Z)-solver in MathSAT [38].
The simple and general idea above maps to an N -layered architecture of the solver. In
general, a layer Ln is called by layer Ln−1 to refine a (maybe partial) solution S of the
problem. Ln must check for unsatisfiability of S and (a) return failure if no refinement can
be found, or (b) invoke Ln+1 upon a refinement S ′ , unless n equals N − 1. An explanation
for failure can be added in case (a), to help higher levels “not to try the same wrong solution
twice”. The schema can be further enhanced by allowing each layer Ln infer novel equalities
and inequalities and to pass them down to the next layer Li+n , so that to better drive its
search [158, 159, 55].
For example, Figure 5 describes the control flow of the LA(Z)-solver in MathSAT [38].
Four logical components can be distinguished. First, the current assignment µ is passed to
the EU F-solver, which implements the congruence closure algorithm in [132]. The solver
considers as uninterpreted all arithmetical functions and predicates in the atoms, detecting
inconsistencies due to the properties of equality and to the congruence properties (e.g.,
{(x = y), (z = x + w), (v = y + w), (z 6= v)}). Second, T -solver tries to find a conflict over
the DL inequalities by means of a Bellman-Ford procedure. Third, if this solver does not
find a conflict, T -solver tries to find a conflict over the equalities and inequalities in LA(Q)
by means of a Simplex procedure; if this is not enough, an ad hoc device is invoked which
applies also to disequalities. Finally, if the current assignment is also satisfiable over the
rationals and the variables are to be interpreted over the integers, Euler reduction and a
simple form of branch-and-cut are carried out, to search for solutions over the integers. 27.
If branch-and-cut does not find either an integer solution or a conflict within a small,
predetermined amount of search, the Omega constraint solver [143, 137], based on FourierMotzkin elimination, is called on the current assignment.
27. Notice that we can assume w.l.o.g. that ΣLA(Q) ⊆ ΣLA(Z) and ΣDL(Q) ⊆ ΣDL(Z) because we can also
assume w.l.o.g. that with LA(Q) and DL(Q) all formulas contain only integer coefficients, as explained
in Footnotes 17. and 20..
168
Lazy Satisfiability Modulo Theories
Sat/Unsat
ϕ: T -formula
ϕp : boolean formula
[C p : boolean clauses]
[lp : boolean literals]
[I: model]
µ: list of T -literals
µp : boolean assignment
Enumerator
Sat/Unsat
[I: model]
[µ′ : conflict set]
[η |=T l: deductions]
T -solver
Figure 6. Basic architectural schema of a lazy SMT (T ) procedure.
5. Integrating DPLL and T -solvers
Different representations and variants of SMT procedures integrating DPLL and T -solvers
have been presented. Following [79], we partition all such procedures into two main categories: the offline procedures, in which DPLL is used as a SAT solver which is re-invoked
from scratch each time an assignment is found T -unsatisfiable (e.g., [19, 67]), and the online procedures, in which DPLL is modified to be used directly as an enumerator (e.g.,
[92, 185, 5, 9, 79, 85, 40]). We also recall from [135, 133] the Abstract-DPLL Modulo
Theories logical framework, which allows for expressing and reasoning about most variants
of lazy DPLL-based procedures in a formal way.
In §5.1 we present a general, high-level integration schema between DPLL and T -solver.
In §5.2 and §5.3 we present the offline and online integration schemata respectively. (The
offline and online schemata will be further discussed in §7.1.2.) Finally, in §5.4 we recall
the main concepts of the Abstract-DPLL Modulo Theories logical framework.
5.1 A basic integration schema
A basic architectural schema of a typical lazy DPLL-based SMT (T ) procedure, which we
generically call T -DPLL henceforth, is reported in Figure 6. T -DPLL takes as input a T formula ϕ, and builds its Boolean abstraction ϕp =def T 2B(ϕ). (Notationally, we frequently
use the superscript p to denote Boolean abstractions, i.e., given a T -expression e, we write
ep to denote T 2B(e).) Notice that both T 2B and B2T can be implemented so that to
require constant time to map a literal from one representation to the other. 28.
ϕp is given as input to Enumerator, which enumerates truth assignments in a complete
collection {µp1 , .., µpn } for ϕp . Each time a new µp is generated, its corresponding list of
T -literals µ =def B2T (µp ) is fed to T -solver. (If µ contains also Boolean literals, then
they are dropped because they do not contribute to the T -satisfiability of µ. ) If µ is
found T -satisfiable, then the procedure returns Sat, possibly returning also the model I
produced. If not, a new assignment is generated by Enumerator. The process is repeated
28. In practice, it is often necessary or convenient that B2T maps literals rather than atoms, i.e., that
B2T (¬Ai ) is syntactically different from ¬B2T (Ai ). E.g., if T is DL(Z), we may have that B2T (Ai ) =
(x − y ≤ 3) and that B2T (¬Ai ) = (y − x ≤ −4).
169
R. Sebastiani
1.
2.
3.
4.
5.
6.
7.
8.
9.
SatValue T -DPLL (T -formula ϕ) {
ϕp = T 2B(ϕ);
while (DPLL(ϕp , µp ) == Sat) {
if (T -solver(B2T (µp )) == Sat)
return Sat;
p
ϕ = ϕp ∧ ¬µp ;
};
return Unsat;
};
Figure 7. A simplified offline integration schema for lazy SMT (T ) procedures.
until either one T -satisfiable assignment is found, or no more assignments are generated by
Enumerator. In the former case ϕ is T -satisfiable, in the latter it is not.
As discussed in §4.1, T -solver can also return one or more theory conflict set(s) µ′ (if
µ is T -unsatisfiable) or one or more deduction(s) η |=T l (if µ is T -satisfiable). If so,
Boolean clauses like C p =def T 2B(¬µ′ ) or C p =def T 2B(¬η ∨ l), and deduced Boolean
literals lp =def T 2B(l), can be passed back to Enumerator, so that to drive its Boolean
search. Moreover, T -solver can be invoked also on intermediate assignments during their
construction, so that to prune the Boolean search. These issues will be discussed in detail
in §6 and §7.
5.2 The offline approach to integration
Offline schemata for integrating DPLL and T -solver have been independently proposed by
[19] and by [67]. 29. In its naivest form, the idea works as described in Figure 7.
The propositional abstraction ϕp of the input formula ϕ is given as input to a SAT
solver, which either decides that ϕp is unsatisfiable, and hence ϕ is T -unsatisfiable, or it
returns a satisfying assignment µp ; in the latter case, B2T (µp ) is given as input to T -solver.
If B2T (µp ) is found T -consistent, then ϕ is T -consistent. If not, ¬µp is added as a clause
to ϕp 30. , and the SAT solver is restarted from scratch on the resulting formula. Notice
that here DPLL is used as a black-box SAT solver, and that the loop 3.-7. works as a
(non-redundant) Enumerator, because step 6. prevents DPLL from finding the same
assignment more than once.
A way more efficient form is when T -solver is able to return the conflict set η which
caused the T -inconsistency of B2T (µp ). If this is the case, then T 2B(¬η) is added as a
clause to ϕ instead of ¬µp . As typically the former is way smaller than the latter, this
drastically reduces the search space. This and other optimizations will be discussed in §6.
29. The offline approach is also called lemmas on demand approach in [67].
30. µp is called blocking clause, because it blocks the future generation of every assignment containing
µp , or cube, borrowing a term used in the domain of digital circuit synthesys (see e.g. [61]), because it
represents a (hyper)cube of counter-assignments.
170
Lazy Satisfiability Modulo Theories
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
SatValue T -DPLL (T -formula ϕ, T -assignment & µ) {
if (T -preprocess(ϕ, µ) == Conflict);
return Unsat;
p
ϕ = T 2B(ϕ); µp = T 2B(µ);
while (1) {
T -decide next branch(ϕp , µp );
while (1) {
status = T -deduce(ϕp , µp );
if (status == Sat) {
µ = B2T (µp );
return Sat; }
else if (status == Conflict) {
blevel = T -analyze conflict(ϕp , µp );
if (blevel == 0)
return Unsat;
else T -backtrack(blevel,ϕp , µp );
}
else break;
} } }
Figure 8. An online schema of T -DPLL based on modern DPLL.
5.3 The online approach to integration
Several procedures exploiting the online integration schema have been proposed in different
communities and domains (see, e.g., [92, 185, 5, 9, 79, 85, 40]). In the online integration
schema, T -DPLL is a variant of the DPLL procedure, modified to work as an enumerator
of truth assignments, whose T -satisfiability is checked by a T -solver.
Figure 8 represents the schema of an online T -DPLL procedure based on a modern
DPLL engine, like that of Figure 1. The input ϕ and µ are a T -formula and a reference to
an (initially empty) set of T -literals respectively. The DPLL solver embedded in T -DPLL
reasons on and updates ϕp and µp , and T -DPLL maintains some data structure encoding
the set Lits(ϕ) and the bijective mapping T 2B/B2T on literals. 31.
T -preprocess simplifies ϕ into a simpler formula, and updates µ if it is the case, so
that to preserve the T -satisfiability of ϕ ∧ µ. If this process produces some conflict, then
T -DPLL returns Unsat. T -preprocess combines most or all the Boolean preprocessing
steps described in §3.1 with some theory-dependent rewriting steps on the T -literals of ϕ.
(The latter will be described in details in §6.1. and §6.2.)
Example 5.1. Suppose that initially ϕ = (x > 0) ∧ (A1 ∨ (x ≤ 0)) ∧ (¬A1 ∨ (x ≤ 0)), and
µ = ∅. Then T -preprocess may rewrite the literal (x > 0) into ¬(x ≤ 0), so that ϕ is
31. Hereafter we implicitly assume that all functions called in T -DPLL have direct access to Lits(ϕ) and
to T 2B/B2T , and that both T 2B and B2T require constant time for mapping each literal.
171
R. Sebastiani
rewritten into ¬(x ≤ 0) ∧ (A1 ∨ (x ≤ 0)) ∧ (¬A1 ∨ (x ≤ 0)), and hence find a Boolean conflict
by applying BCP. Thus ϕ is T -unsatisfiable.
T -decide next branch plays the same role as decide next branch in DPLL (see Figure 1), but it may take into consideration also the semantics in T of the literals to select.
(This will be discussed with more details in §7.2.5.)
T -deduce, in its simplest version, behaves similarly to deduce in DPLL: it iteratively
deduces Boolean literals lp which derive propositionally from the current assignment (i.e.,
s.t. ϕp ∧ µp |=p lp ) and updates ϕp and µp accordingly, until one of the following facts
happens:
(i) µp propositionally violates ϕp (µp ∧ ϕp |=p ⊥). If so, T -deduce behaves like deduce in
DPLL, returning Conflict.
(ii) µp propositionally satisfies ϕp (µp |=p ϕp ). If so, T -deduce invokes T -solver on
B2T (µp ): if the latter returns Sat, then T -deduce returns Sat; otherwise, T -deduce
returns Conflict.
(iii) no more literals can be deduced. If so, T -deduce returns Unknown. A slightly more
elaborated version of T -deduce can invoke T -solver on B2T (µp ) also at this intermediate stage: if T -solver returns Unsat, then T -deduce returns Conflict. (This enhancement, called early pruning, will be discussed with more details in §6.3.)
A much more elaborated version of T -deduce can be implemented if T -solver is able to
perform deductions of unassigned literals η |=T l s.t. η ⊂ µ, as in §4.1.4. If so, T -deduce can
iteratively deduce also literals l which can be inferred in T (i.e., s.t. B2T (µp ) |=T B2T (l)).
(This enhancement, called T -propagation, will be discussed with more details in §6.4.)
T -analyze conflict is an extension of analyze conflict of DPLL in §3.1: if the conflict produced by T -deduce is caused by a Boolean failure (case (i) above), then T -analyze
conflict produces a Boolean conflict set η p and the corresponding value of blevel, as described in §3.1; if instead the conflict is caused by a T -inconsistency revealed by T -solver
(case (ii) or (iii) above), then T -analyze conflict produces as a conflict set the Boolean
abstraction η p of the theory conflict set η produced by T -solver (i.e., η p := T 2B(η)), or
computes a mixed Boolean+theory conflict set by a backward-traversal of the implication
graph starting from the conflicting clause ¬T 2B(η) (see §6.5). If T -solver is not able to
return a theory conflict set, the whole assignment µ may be used, after removing all Boolean
literals from µ. Once the conflict set η p and blevel have been computed, T -backtrack
behaves analogously to backtrack in DPLL: it adds the clause ¬η p to ϕp and backtracks
up to blevel. (These features, called T -backjumping and T -learning, will be discussed with
more details in §6.5 and §6.6.)
On the whole, T -DPLL differs from the DPLL schema of Figure 1 because it exploits:
• an extended notion of deduction of literals: not only Boolean deduction (µp ∧ϕp |=p lp ),
but also theory deduction (B2T (µp ) |=T B2T (lp ));
• an extended notion of conflict: not only Boolean conflict (µp ∧ ϕp |=p ⊥), but also
theory conflict (B2T (µ) |=T ⊥), or even mixed Boolean+theory conflict (B2T (µp ∧
ϕp ) |=T ⊥). See 6.5.
172
Lazy Satisfiability Modulo Theories
¬B5
B8
B6
¬B1
¬B3 T
A1
A2
B2
¬B2
¬A2
B3
c8 : B5 ∨ ¬B8 ∨ ¬B2
Figure 9. Boolean search (sub)tree in the scenario of Example 5.2. (A diagonal line, a vertical line
and a vertical line tagged with “T ” denote literal selection, unit propagation and T -propagation
respectively; a bullet “•” denotes a call to T -solver.)
Example 5.2. Suppose T -DPLL implements all the enhancements described above, and
consider the LA(Q)-formula ϕ in Example 2.1, (which we repeat here for convenience):
c1
c2
c3
c4
c5
c6
c7
: ϕ=
:
:
:
:
:
:
{¬(2x2 − x3 > 2) ∨ A1 }
{¬A2 ∨ (x1 − x5 ≤ 1)}
{(3x1 − 2x2 ≤ 3) ∨ A2 }
{¬(2x3 + x4 ≥ 5) ∨ ¬(3x1 − x3 ≤ 6) ∨ ¬A1 }
{A1 ∨ (3x1 − 2x2 ≤ 3)}
{(x2 − x4 ≤ 6) ∨ (x5 = 5 − 3x4 ) ∨ ¬A1 }
{A1 ∨ (x3 = 3x5 + 4) ∨ A2 }
ϕp = {¬B1 ∨ A1 }
{¬A2 ∨ B2 }
{B3 ∨ A2 }
{¬B4 ∨ ¬B5 ∨ ¬A1 }
{A1 ∨ B3 }
{B6 ∨ B7 ∨ ¬A1 }
{A1 ∨ B8 ∨ A2 }
Consider the Boolean search (sub)tree in Figure 9. Suppose T -decide next branch selects,
in order, ¬B5 , B8 , B6 , ¬B1 (in c4 , c7 , c6 , and c1 ). T -deduce cannot unit-propagate any literal. By the enhanced version of step (iii), it invokes T -solver on B2T ({¬B5 , B8 , B6 , ¬B1 }):
{¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), (x2 − x4 ≤ 6), ¬(2x2 − x3 > 2)}.
The enhanced T -solver not only returns Sat, but also it deduces ¬(3x1 − 2x2 ≤ 3) (c3 and
c5 ) as a consequence of the first and last literals. The corresponding Boolean literal ¬B3 ,
is added to µp and propagated (T -propagation). Hence A1 , A2 and B2 are unit-propagated
from c5 , c3 and c2 .
By step (iii), T -deduce invokes T -solver on B2T ({¬B5 , B8 , B6 , ¬B1 , ¬B3 , A1 , A2 , B2 }):
{¬(3x1 −x3 ≤ 6),(x3 = 3x5 + 4),(x2 −x4 ≤ 6),¬(2x2 −x3 > 2),¬(3x1 −2x2 ≤ 3),(x1 −x5 ≤ 1)}
which is inconsistent because of the 1st, 2nd, and 6th literals, so that returns Unsat, and
hence T -deduce returns Conflict. Then T -analyze conflict and T -backtrack learn the
corresponding Boolean conflict clause
c8 =def B5 ∨ ¬B8 ∨ ¬B2
173
R. Sebastiani
T -Propagate: hµ | ϕi
⇒ hµ, l | ϕi
if
T -Backjump: hµ, l, µ′ | ϕ, Ci ⇒ hµ, l′ | ϕ, Ci if
T -Learn:
hµ | ϕi
T -Discharge: hµ | ϕ, Ci
⇒ hµ | ϕ, Ci
if
⇒ hµ | ϕi
if
µ |=T l
l is undef ined in µ
occurs in ϕ
l or ¬l
′
µ, l, µ |=p ¬C
there is some clause C ′ ∨ l′ s.t. :
ϕ, C |=T C ′ ∨ l′ and µ |=p ¬C ′
l′ is undef ined in µ
l′ or ¬l′ occurs in ϕ or
in µ ∪ {l} ∪ µ′
all atoms in C occur in ϕ
ϕ |=T C
ϕ |=T C
The Abstract-DPLL Modulo Theories logical framework from [136]. In the T Backjump rule, C and C ′ ∨ l′ represent the conflicting and the conflict clause respectively.
Figure 10.
and backtrack, popping from µp all literals up to {¬B5 , B8 }, and then unit-propagate ¬B2
on c8 (T -backjumping and T -learning). Then, starting from {¬B5 , B8 , ¬B2 }, also ¬A2 and
B3 are unit-propagated on c2 and c3 respectively, and the search proceeds from there.
5.4 The Abstract-DPLL Modulo Theories logical framework
As hinted in §3.2, [176, 135, 133, 136] proposed an abstract rule-based formulation of DPLLbased lazy SMT systems, the Abstract DPLL Modulo Theories. This allows for expressing
and reasoning about most variants of these procedures in a formal way. In particular, [133]
used such a framework to describe new DPLL-based procedures.
The Abstract-DPLL Modulo Theories extends the Abstract-DPLL framework of §3.2
by adding the set of rules Figure 10 [135] to these of Figure 3. (Notice that here all literals,
assignments and formulas are in the language of T , and that here the symbol “|=” in Figure 3
must be interpreted as “|=p ”.) The first three rules match the notion of T -propagation,
T -backjumping and T -learning introduced in §5.3 (but see also §6.4, §6.5 and §6.6). The
fourth rule matches the fact that T -learned clauses may be discharged when necessary, in
order to avoid an explosion in size of the input formula. 32. The only rule deserving some
more explanation is T -Backjump: if a branch µ ∪ {l} ∪ µ′ falsifies propositionally one clause
C (the conflicting clause), and a conflict clause C ′ ∨ l′ 33. can be computed from C s.t.
(C ′ ∨ l′ ) is entailed by ϕ ∧ C in T , ¬C ′ ⊆ µ, l′ 6∈ µ, and l′ or ¬l′ occur in ϕ or in µ ∪ {l} ∪ µ′ ,
then it is possible to backjump up to µ, and hence unit-propagate l′ on the conflict clause
(C ′ ∨ l′ ).
32. As already remarked in §3.2, the formalization of the rules in [135, 133, 136] changes slightly from paper
to paper. Here we report the most-recent one from [136]. We have adapted the notation to that used in
this paper.
33. Also called the backjump clause in [136].
174
Lazy Satisfiability Modulo Theories
Example 5.3. Consider the formula and the scenario of Example 5.2. The execution can
be represented in Abstract-DPLL Modulo Theories as follows:
h
|ϕi
Decide ¬B5 , B8 , B6 , ¬B1 ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), (x2 − x4 ≤ 6), ¬(2x2 − x3 > 2)
|ϕi
Theory-propagate ¬B3 ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), (x2 − x4 ≤ 6), ¬(2x2 − x3 > 2), ¬(3x1 − 2x2 ≤ 3)
|ϕi
Unit-propagate A1 , A2 , B2 ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), (x2 − x4 ≤ 6), ¬(2x2 − x3 > 2), ¬(3x1 − 2x2 ≤ 3), A1 , A2 , (x1 − x5 ≤ 1)|ϕi
T -Learn c8 ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), (x2 − x4 ≤ 6), ¬(2x2 − x3 > 2), ¬(3x1 − 2x2 ≤ 3), A1 , A2 , (x1 − x5 ≤ 1)|ϕ, c8 i
T -Backjump ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), ¬(x1 − x5 ≤ 1)
|ϕ, c8 i
Unit-propagate ¬A2 , B1 ⇒
h¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), ¬(x1 − x5 ≤ 1), ¬A2 , (3x1 − 2x2 ≤ 3)
|ϕ, c8 i
...
As in Abstract-DPLL, if a finite sequence h∅ | ϕi ⇒ hµ1 | ϕ1 i ⇒ . . . ⇒ f ail is found,
then the formula is unsatisfiable; if a finite sequence h∅ | ϕi ⇒ . . . ⇒ hµn | ϕn i is found so
that no rule can be further applied, then the formula is satisfiable. Different strategies in
applying the rules correspond to different variants of the algorithm. [135, 136] provide a
group of results about termination, correctness and completeness of various configurations.
We refer the reader to [135, 133, 136] for further details. A very recent improvement of the
Abstract-DPLL Modulo Theories framework has been presented in [112].
Strictly related to the Abstract-DPLL Modulo Theories framework is the notion of
DPLL(T ) and DPLL(X) [85]. A DPLL(T ) system consists of a general DPLL(X) engine,
very similar in nature to a SAT solver, whose parameter “X” can be instantiated with a
T -solver for the theory T of interest. [85] provides a common application programming
interface (API) for the T -solvers: once the DPLL(X) engine has been implemented, new
theories can be dealt with by simply plugging in new T -solvers which conform to the API.
We refer the reader to [85] for further details.
175
R. Sebastiani
6. Optimizing the integration of DPLL and T -solvers
In the basic integration schema of §5.1 (and hence in these of §5.2 and §5.3), even assuming Enumerator and T -solver are extremely efficient as stand-alone procedures, their
combination can be extremely inefficient. This is due to a couple of intrinsic problems.
• Enumerator assigns truth values to (the Boolean abstraction of) T -atoms in a blind
way, receiving no information from T -solver about their semantics. This may cause
up to an huge amount of calls to T -solver on assignments which are obviously T inconsistent, or whose T -inconsistency could have been easily derived from that of
previously-checked assignments.
• T -solver is used as a memoryless subroutine, in a master-slave fashion. Therefore
T -solver may be called on assignments that are subsets of, supersets of or similar to
assignments it has already checked, with no chance of reusing previous computations.
It is essential to improve the basic integration schema of §5.1 so that the Enumerator
(DPLL) is driven in its Boolean search by T -dependent information provided by T -solver,
whilst the latter is able to take benefit from information provided by the former, and it is
given a chance of reusing previous computation.
In this section we describe in detail the most effective techniques which have been proposed in various communities in order to optimize the interaction between DPLL and
T -solver. (Some techniques, like normalizing T -atoms (§6.1), early pruning (§6.3), T propagation (§6.4), T -backjumping (§6.5) and T -learning (§6.6), have already been introduced in part in §5.3 and §5.4.) We coarsely distinguish four main categories of techniques.
Preprocessing Rewrite the input T -formula ϕ into a T -equivalent or T -equisatisfiable one
which is supposedly easier to solve for T -DPLL. Among them we have normalizing
T -atoms (§6.1) and static learning (§6.2).
Look-ahead Analyze the current status of the search and get from it as much information
as possible which is useful to prune the remaining search space. Among them we have
early pruning (§6.3), T -propagation (§6.4), and branching heuristics (§7.2.5).
Look-back When recovering from a failure, try to understand the cause of that failure
and use such an information to improve future search. Among them we have T backjumping (§6.5) and T -learning (§6.6).
Assignment simplification T -DPLL can provide useful information to make the assignment smaller or simpler for T -solver. Among them we have clustering (§6.8), reduction
of assignments to prime implicants (§6.9), pure-literal filtering (§6.10) and T -literal
filtering (§6.11).
Remark 6.1. The techniques described in this section have been collected from an heterogeneous bibliography (including, e.g., some on modal and description logics), “cleaned” from
any information related to the specific theory/logic, and grouped according to the form of
interaction between DPLL and T -solver. To this extent, we remark a few facts. First,
techniques focused only on pure Boolean reasoning or on pure theory-specific reasoning have
176
Lazy Satisfiability Modulo Theories
been briefly discussed in §3 and §4, and they are not further considered here. Second, the
names we adopted here for the various techniques may differ from those used by some of
the authors. (E.g., T -propagation (§6.4) is called forward reasoning in [5], enhanced early
pruning in [9], theory-propagation in [135, 133], theory-driven deduction or T -deduction
in [37].) Third, we may present separately techniques which some authors present as one
technique. (E.g., early pruning (§6.3) and T -propagation (§6.4) are sometimes described as
one technique [85].) Finally, the description of some technique may differ significantly from
that given by some authors. (E.g., [135, 133] describe their procedures in terms of inference
rules and control strategies; most authors instead prefer a pseudo-code description.)
6.1 Normalizing T -atoms.
The idea of normalizing the T -atoms was introduced in the very first DPLL-based procedures for modal logics [92], and it is adopted to some extent in substantially all lazy SMT
procedures.
One potential source of inefficiency for T -DPLL is the occurrence in the input T -formula
of pairs of syntactically-different T -atoms which are T -equivalent (e.g., (x1 + (x3 − x2 ) = 1)
and ((x1 + x3 ) − 1 = x2 )), or s.t. one is T -equivalent to the negation of the other (e.g.
(2x1 − 6x2 ≤ 4) and (3x2 + 2 < x1 )). If two T -atoms ψ1 , ψ2 are s.t. ψ1 6= ψ2 and
|=T ψ1 ↔ ψ2 [resp. ψ1 6= ¬ψ2 and |=T ψ1 ↔ ¬ψ2 ], then they are mapped into distinct
Boolean atoms B1 =def T 2B(ψ1 ) and B2 =def T 2B(ψ2 ), which may be assigned different
[resp. identical] truth values by Enumerator. This may cause the useless generation of
many T -unsatisfiable assignments and the corresponding useless calls to T -solver (e.g., up
to 2|Atoms(ϕ)|−2 calls on assignments like {(2x1 − 6x2 ≤ 4), (3x2 + 2 < x1 ), ...}).
In order to avoid these problems, it is wise to preprocess atoms so that to map as many
as possible T -equivalent literals into syntactically identical ones. This can be achieved by
applying some rewriting rules, like, e.g.:
• Drop dual operators: (x1 < x2 ), (x1 ≥ x2 ) =⇒ ¬(x1 ≥ x2 ), (x1 ≥ x2 ).
• Exploit associativity: (x1 + (x2 + x3 ) = 1), ((x1 + x2 ) + x3 ) = 1) =⇒ (x1 + x2 + x3 = 1).
• Sort: (x1 + x2 − x3 ≤ 1), (x2 + x1 − 1 ≤ x3 ) =⇒ (x1 + x2 − x3 ≤ 1)).
• Exploiting specific properties of T : (x1 ≤ 3), (x1 < 4) =⇒ (x1 ≤ 3) if T is LA(Z).
The applicability and effectiveness of these mappings depends on the theory addressed.
Notice that here normalization is not used to make atom representations simpler to handle
(which can be done inside the T -solvers); rather, its goal is to “recognize” as many as
possible equivalent literals, so that Boolean abstraction can map them into the same Boolean
literal.
Although rather straightforward, normalizing atoms is an essential step which may drastically reduce the global amount of search [92]. As we described in §5.3, it can be effectively
combined with standard Boolean preprocessing (like in Example 5.1).
6.2 Static learning
The following idea was proposed by [5] for a lazy SMT procedure for DL. Similar such
techniques were generalized and used in [12, 38, 188].
177
R. Sebastiani
On some specific kind of problems, it is possible to quickly detect a priori short and
“obviously T -inconsistent” assignments to T -atoms in Atoms(ϕ) (typically pairs or triplets).
Some examples are:
• incompatible value assignments (e.g., {x = 0, x = 1}),
• congruence constraints (e.g., {(x1 = y1 ), (x2 = y2 ), ¬(f (x1 , x2 ) = f (y1 , y2 ))}),
• transitivity constraints (e.g., {(x − y ≤ 2), (y − z ≤ 4), ¬(x − z ≤ 7)}),
• equivalence constraints ({(x = y), (2x − 3z ≤ 3), ¬(2y − 3z ≤ 3)}).
If so, the clauses obtained by negating the assignments (e.g., ¬(x = 0) ∨ ¬(x = 1)) can
be added a priori to the formula before the search starts. Whenever all but one literal in
the inconsistent assignment are assigned, the negation of the remaining literal is assigned
deterministically by unit-propagation, which prevents the solver generating any assignment
which include the inconsistent one. This technique may significantly reduce the Boolean
search space, and hence the number of calls to T -solver, producing very relevant speed-ups
[5, 12, 38, 188].
Intuitively, one can think of static learning as suggesting a priori some small and “obvious” T -valid lemmas relating some T -atoms of ϕ, which drive DPLL in its Boolean search.
Notice that, unlike the extra clauses added in “per-constraint” eager approaches [171, 156]
(see §9.3), the clauses added by static learning refer only to atoms which already occur in
the original formula, so that the Boolean search space is not enlarged, and they are not
needed for correctness and completeness: rather, they are used only for pruning the Boolean
search space.
6.3 Early pruning
The following family of optimizations, here generically called early pruning – EP,34. was
introduced by [92] in procedures for modal logics; [185, 9, 19, 85] developed similar ideas in
procedures for many SMT problems.
In its simplest form, EP is based on the empirical observation that most assignments
which are enumerated by T -DPLL, and which are found Unsat by T -solver, are such that
their T -unsatisfiability is caused by much smaller subsets. Thus, if the T -unsatisfiability
of an assignment µ is detected during its construction, then this prevents checking the
T -satisfiability of all the up to 2|Atoms(ϕ)|−|µ| total truth assignments which extend µ.
This suggests to introduce an intermediate call to T -solver on intermediate assignment
µ, (at least) before each decision. (I.e., in the T -DPLL of Figure 8, this is represented by
the “slightly more elaborated” version of step (iii) of T -deduce.). If T -solver(µ) returns
Unsat, then all possible extensions of µ are unsatisfiable; therefore T -DPLL returns Unsat
and backtracks, avoiding a possibly big amount of useless search.
Example 6.2. Consider the formula ϕ of Example 5.2. Suppose that, after four decisions,
T -DPLL builds the intermediate assignment:
µ = {¬(2x2 − x3 > 2), ¬A2 , (3x1 − 2x2 ≤ 3), ¬(3x1 − x3 ≤ 6)},
34. Also called intermediate assignment checking in [92] and eager notification in [19].
178
(14)
Lazy Satisfiability Modulo Theories
(rows 1, 2, 3 and 5, 4 of ϕ respectively). If T -solver is invoked on µ, it returns Unsat, and
T -DPLL backtracks without exploring any further extension of µ.
In general, early pruning may introduce a very relevant reduction of the Boolean search
space, and consequently of the number of calls to T -solvers. Unfortunately, as EP may
cause useless calls to T -solver, the benefits of the pruning effect may be partly counterbalanced by the overhead introduced by the extra EP calls. Anyway, we notice that all
EP calls to T -solver are incremental, as described in §4.1.3; thus, if we use an incremental
T -solver, the overhead of the extra calls is much reduced.
Many variants and improvements of early pruning have been proposed in the literature.
We recall the most important ones.
6.3.1 Selective or intermittent early pruning
Some heuristic criteria can be introduced in order to reduce the number of redundant calls to
T -solver in early pruning steps. One way is avoid invoking T -solver when it is very unlikely
that, since the last call, the new literals added to µ can cause inconsistency. For instance,
this is the case when they are added only literals which either are purely-propositional [92]
or contain new variables [9]. Another way is to call T -solver every k branching steps, k
being an user-defined integer parameter [6].
6.3.2 Weakened early pruning
In order to further reduce the overhead due to early pruning, another idea is to use, for
intermediate checks only, weaker but faster versions of T -solver [38]. This is possible because
intermediate checks are not necessary for the correctness and completeness of the procedure.
The notion of “weaker T -solver” depends on the theory T we are dealing with. Some general
ideas are:
• in case of Sat response, avoid reconstructing the satisfying assignments and models
(§4.1.1), which are not used in intermediate checks;
• check only easier-to-check subsets of µ. E.g., as DL is much easier than LA, if µ is
{(x − y ≤ 4), (z − x ≤ −6)(z − y = 0), (x − y = z − w)}, then we may test only the
sub-assignment dealing with DL-literals (e.g., the first three literals in µ, which are
DL-inconsistent) and backtrack if this is inconsistent; 35.
• check µ only on some easier-to-check sub-theory T ′ ⊂ T (i.e., s.t., if ϕ is inconsistent in
T ’ then ϕ is inconsistent in T ). For example, as LA(Z)-satisfiability is way harder than
LA(Q)-satisfiability (see [31]), we may want to check the consistency of an assignment
on LA(Q) rather than on LA(Z), and backtrack if the LA(Q)-solver return Unsat.
To these extends, notice that weakened EP fits naturally with layered theory solvers (§4.3)
because, during intermediate checks, it is possible w.l.o.g. to involve only some of the layers.
On the whole, there is a tradeoff between the benefits from reducing the overhead and
the drawbacks of reducing the pruning effect.
35. This situation is frequent in the domain of bounded model checking for timed systems, where we have a
big majority of DL(Q)-literals, and only very few LA(Q)-literals (see, e.g., [12]).
179
R. Sebastiani
6.3.3 Eager early pruning
Some DPLL-based SMT procedures for various theories (e.g., [185, 172, 85, 133]) perform
a more eager form of early pruning, in which the theory solver is invoked every time a
new T -atom is added to the assignment (including those added by unit-propagation). If
so, we may avoid performing unit propagations at the cost of extra calls to T -solver. In
some sense, the eager approach privileges theory reasoning wrt. (deterministic) Boolean
reasoning.
In some cases (e.g., [172, 85]) T -solver works as a fully-incremental deduction process,
so that an eager interaction with the SAT solver comes natural. However, if this is not the
case, then eager early pruning can be extremely expensive due to the possibly big amount
of calls to T -solver.
6.4 T -propagation
T -propagation 36. was introduced in its simplest form (plunging, see §4.1.4) by [5] for DL; [9]
proposed an improved technique for LA; however, T -propagation showed its full potential
in [176, 85, 133], where it was applied aggressively.
As discussed in §4.1.4, for some theories it is possible to implement T -solver so that a
call to T -solver(µ) returning Sat can also perform one or more deduction(s) in the form
η |=T l, s.t. η ⊆ µ and l is a literal on a not-yet-assigned atom in ϕ. If this is the case, then
T -solver can return l to T -DPLL, so that T 2B(l) is unit-propagated. This may induce new
literals to be assigned, new calls to T -solver, new assignments deduced, and so on, possibly
causing a beneficial loop between T -propagation and unit-propagation.
Notice that T -solver can return the deduction(s) performed η |=T l to T -DPLL, which
can add the deduction clause T 2B(η → l) to ϕp , either temporarily and permanently. The
deduction clause will be used for the future Boolean search, with benefits analogous to those
of T -learning (see §6.6).
Example 6.3. Consider Figure 11 and the scenario at the end of Example 5.2: the current
branch is {¬B5 , B8 , ¬B2 , ¬A2 , B3 }, corresponding to the set of LA(Q)-literals
{¬(3x1 − x3 ≤ 6), (x3 = 3x5 + 4), ¬(x1 − x5 ≤ 1), (3x1 − 2x2 ≤ 3)}.
Then the T solver may perform another T -propagation step:
{¬(3x1 − x3 ≤ 6), (3x1 − 2x2 ≤ 3)} |=T (2x2 − x3 > 2)
from which B1 is propagated, and hence A1 is unit-propagated on c1 .
Instead, suppose that, after the first T -propagation of Example 5.2, T -DPLL had added
to ϕp the corresponding deduction clause
c9 : B5 ∨ B1 ∨ ¬B3 .
If so, then B1 and A1 could have been obtained directly by unit propagation on c9 and c1
respectively, saving one call to T -solver and one (possibly expensive) T -propagation step.
36. Also called forward reasoning in [5], enhanced early pruning in [9], theory-propagation in [135, 133] theorydriven deduction or T -deduction in [37, 38].
180
Lazy Satisfiability Modulo Theories
¬B5
¬B5
B8
B8
c1
c2
c3
c4
c5
c6
c7
:
:
:
:
:
:
:
{¬B1 ∨ A1 }
{¬A2 ∨ B2 }
{B3 ∨ A2 }
{¬B4 ∨ ¬B5 ∨ ¬A1 }
{A1 ∨ B3 }
{B6 ∨ B7 ∨ ¬A1 }
{A1 ∨ B8 ∨ A2 }
B6
¬B1
¬B3 T
A1
A2
B2
¬B2
¬A2
B3
T B1
A1
c8 : B5 ∨ ¬B8 ∨ ¬B2
B6
¬B1
¬B3 T
A1
A2
B2
¬B2
¬A2
B3
B1
A1
c9 : B5 ∨ B1 ∨ ¬B3
c8 : B5 ∨ ¬B8 ∨ ¬B2
Figure 11. Left: Boolean search tree in the scenario of Example 6.3. Right: same situation, with
learning of deduction clause c9 . A bullet “•” denotes a call to T -solver.
As T -propagation is performed during the intermediate calls to T -solver, it is always
related to early pruning. Like with early pruning, T -propagation can be applied either in
a lazy way, before any new branching [9, 37], or, more eagerly, every time a new T -atom is
added to the assignment (including those added by unit-propagation) [5, 176, 27, 85]. As
with early pruning, the eager approach benefits of a more aggressive pruning, but pays for
extra overhead.
More generally, there are different strategies by which T -propagation can be applied.
We will further discuss this point in §7.1.3.
6.5 T -backjumping
This technique, which generalizes that of backjumping in standard DPLL, was introduced
by [100] for description logics; [185, 67, 172, 9, 85, 37] adopted variants or improvements of
the same idea for many other theories.
T -backjumping is based on the assumption that, when T -solver is invoked on a T inconsistent assignment µ, it is able to return also the conflict set η ⊆ µ causing the
T -unsatisfiability of µ. If so, T -DPLL can use η p =def T 2B(η) as if it were a Boolean
conflict set to drive the backjumping mechanism of DPLL: the conflict clause ¬η p is added
to ϕp (either temporarily or permanently, see §6.6) and the procedure backtracks to the
branching point suggested by η p .
Different backtracking strategies are possible. Older tools [100, 185] used to jump up to
the most recent branching point s.t. at least one literal lp ∈ η p is not assigned. Intuitively,
all open subbranches departing from the current branch at a lower decision point contain
η, so that there is no need to explore them; this allows for pruning all these subbranches
from the search tree. (Notice that these strategies do not explicitly require adding the
learned clause ¬η p to ϕp .) Most modern implementations [85, 37] inherit the backjumping
mechanism of current DPLL tools described in §3.1: T -DPLL learns the conflict clause
181
R. Sebastiani
¬B5
¬B5
B8
B8
c1
c2
c3
c4
c5
c6
c7
:
:
:
:
:
:
:
{¬B1 ∨ A1 }
{¬A2 ∨ B2 }
{B3 ∨ A2 }
{¬B4 ∨ ¬B5 ∨ ¬A1 }
{A1 ∨ B3 }
{B6 ∨ B7 ∨ ¬A1 }
{A1 ∨ B8 ∨ A2 }
B6
¬B1
B1
A1
¬B3 T
A1
A2
B2
c′8 : B5 ∨ ¬B8 ∨ B1
B6
¬B1
¬B2
¬A2
B3
B1
A1
¬B3 T
A1
A2
B2
c8 : B5 ∨ ¬B8 ∨ ¬B2
c′8 : B5 ∨ ¬B8 ∨ B1
Figure 12. Left: Boolean search tree in the scenario of Example 6.4. Right: same situation,
learning both c8 and c′8 , as in Example 6.5. A bullet “•” denotes a call to T -solver.
¬η p and backtracks to the highest point in the stack where one lp ∈ η p is not assigned, and
unit-propagates ¬ld on ¬η p . Intuitively, DPLL backtracks to the highest point where it
would have done something different if it had known the conflict clause ¬η p in advance.
In substance, T -backjumping differs from standard Boolean backjumping only for the
notion of conflict set used: whilst a Boolean conflict set µ is an assignment which causes a
propositional inconsistency if conjoined to ϕ (i.e, s.t. µ ∧ ϕ |=p ⊥), a theory conflict set is
a set of T -literals which in intrinsically inconsistent in T (i.e, s.t. µ |=T ⊥), no matter ϕ.
As hinted in §5.3, it is also possible to have mixed Boolean+theory conflicts sets, i.e.,
assignments η s.t. an inconsistency can be inferred from η ∧ ϕ by means of a combination
of Boolean and theory reasoning (i.e., s.t. η ∧ ϕ |=T ⊥) [135]. Such conflict sets/clauses can
be obtained starting from the theory conflicting clause T 2B(¬η) by applying the backwardtraversal of the implication graph described in §3.1, until one of the standard conditions
(e.g., 1UIP) is achieved. In this process, a T -propagation can be considered as a unitpropagation on the corresponding deduction clause (see §7.2.4).
Example 6.4. The scenario depicted in Examples 5.2 and 6.3 represents a form of modern
T -backjumping, in which the conflict clause c8 used is a pure LA(Q) conflict clause (i.e.,
B2T (c8 ) is LA(Q)-valid).
However, T -analyze conflict could instead look for a mixed Boolean+theory conflict
clause by treating c8 as a conflicting clause and backward-traversing the implication graph,
that is, by resolving backward c8 with c2 and c3 , (i.e., with the antecedent clauses of B2 and
A2 ) and with the deduction clause c9 (which “caused” the propagation of ¬B3 ):
182
Lazy Satisfiability Modulo Theories
c8 : theory conf licting clause
c2
z
}|
{
z }| {
B5 ∨ ¬B8 ∨ ¬B2
¬A2 ∨ B2
(B2 )
B5 ∨ ¬B8 ∨ ¬A2
B5 ∨ ¬B8 ∨ B3
c3
z }| {
B3 ∨ A2
(¬A2 )
B ∨ ¬B8 ∨ B1
{z
}
|5
c9
}|
{
z
B5 ∨ B1 ∨ ¬B3
(B3 )
c′8 : mixed Boolean+theory conf lict clause
finding the mixed Boolean+theory conflict clause c′8 : B5 ∨¬B8 ∨B1 . (Notice that, B2T (c′8 ) =
(3x1 − x3 ≤ 6) ∨ ¬(x3 = 3x5 + 4) ∨ (2x2 − x3 > 2) is not LA(Q)-valid.)
If so (Figure 12, left.), then T -backtrack pops from µp all literals up to {¬B5 , B8 },
and then unit-propagates B1 on c′8 . Then, starting from {¬B5 , B8 , B1 }, also A1 is unitpropagated on c1 .
6.6 T -learning
This technique, which generalizes that of learning in standard DPLL procedures, was introduced by [185] for linear arithmetic; [67, 172, 9, 79] proposed the same idea for many other
theories. Although T -backjumping and T -learning were originally conceived in different
moments, in modern tools they are always related.
The rationale of T -learning is the same as with standard Boolean learning: when a
conflict set η is found, the clause T 2B(¬η) is added in conjunction to ϕp . Since then,
T -DPLL will never again generate any branch containing η. In fact, as soon as |η| − 1
literals in η are assigned to true, the remaining literal will be immediately assigned to false
by unit-propagation on T 2B(¬η).
As with T -backjumping, the only difference wrt. standard DPLL learning is in the
notion of conflict set/clause used: both theory and mixed Boolean+theory clauses can be
used. Notice also that theory-conflict clauses and mixed Boolean+theory conflict clauses
can be computed and used contemporarily.
Example 6.5. Consider the scenario of Example 6.4 and of Figure 12. If both c8 and c′8
were added to ϕp , then ¬B2 , ¬A2 and B3 would be unit-propagated on c8 , c2 and c3 , and B1
and A1 would be unit-propagated on c′8 and c1 , obtaining the same result as in Example 6.3,
although here we do not need assuming that the deduction clause c9 is learned.
Notice that, whilst for T -backjumping the best conflict set is that which forces the highest
jump in the stack, for T -learning the best conflict set is the one which causes the pruning of
most future branches. In practice, these are the shortest conflict sets and those containing
most atoms occurring in future branches (relevant atoms). To this extent, techniques to
force T -solver to return shorter conflict sets have been proposed in [186, 6, 68] for different
theories.
Like all learning techniques, T -learning must be used with some care, because it may
cause an explosion in size of ϕ. To avoid this, one has to introduce techniques for discarding
learned clauses when necessary [28]. Luckily, by using one modern DPLL implementation
from the shelf, one gets this feature for free.
183
R. Sebastiani
As with static learning, the clauses added by T -learning refer only to atoms which
already occur in the original formula, so that no new atom is added. [79] proposed an
interesting generalization of T -learning, in which at each consistency check more than one
clause may be added, which may contain also new atoms. To overcome the consequent
enlargement of the search space, they proposed to restrict splitting to the original atoms.
[39, 40] used a similar idea to improve the efficiency of Delayed Theory Combination (see
§8.3); [20] used the same idea in the context of the splitting-on-demand approach (see §6.7);
[183] proposed similar ideas for a SMT(DL) tool, in which new atoms can be generated
selectively according to an ad-hoc heuristic.
6.7 Splitting on demand
A noteworthy case of T -learning in which clauses may contain new atoms is that performed
in the Splitting on demand technique proposed in [20]. 37. This work is built on top of
the observation that for many theories, in particular for non-convex ones, T -solvers must
perform lots of internal case-splits in order to decide the satisfiability of a set of literals.
Unfortunately most T -solvers cannot handle Boolean search internally, so that they cannot do anything better then doing naive case-splitting on all possible combinations of the
alternatives.
With splitting on demand, whenever the T -solver encounters the need of a case-split,
it gives back the control to the DPLL engine by returning (the Boolean abstraction of)
a clause encoding the alternatives, which is learned and split upon by the DPLL engine.
(Notice that the atoms encoding the alternatives in the learned clause may not occur in the
original formula.) This is repeated until the T -solver can decide the T -satisfiability of its
input literals without case-splitting. Therefore the T -solver delegates the Boolean search
induced by the case-splits to the DPLL solver, which presumably handles it in a much more
efficient way.
Example 6.6. [20]. Suppose an AR-solver is given in input a set of literals containing a
certain number of equalities in the form
(read(write(a, i, e), j) = read(a, j)),
(15)
meaning that storing the value e in the i-th cell of array a does not affect the value of the
j-th cell (see §4.2.6). (15) holds in two possible situations: when the indexes differ: (i 6= j);
when the value of the i-th location in a is already e: read(a, i) = e. Thus, for every literal
like (15), the AR-solver must consider the two alternatives separately. With splitting on
demand, instead, it may return (the Boolean abstraction of ) the clause
(read(write(a, i, e), j) = read(a, j)) → (¬(i = j) ∨ (read(a, i) = e)))
(16)
to the DPLL solver, forcing it to split on one of the last two literals. Notice that the latter
literals do not necessarily occur in the original formula.
Notice that, to this extent,
W a T -solver invoked on an assignment µ can produce also clauses
in the form T 2B(µ∗ → i ei ) s.t. µ∗ ⊆ µ and the ei ’s are interface equalities.
37. A preliminary form of this technique was briefly described in §3.5.1 of [23] and is implemented in CVC
and CVCLite [56, 57].
184
Lazy Satisfiability Modulo Theories
6.8 Clustering
This technique was proposed in [37] for of EU F and LA, and was implicit in DPLL-based
procedures for modal and description logics (see, e.g., [93]).
At the beginning of the search, the set of T -atoms of ϕ is partitioned into a set of disjoint
clusters C1 . . . Ck , s.t. atoms which do not interfere to each-other’s T -satisfiability belong
to different clusters. (I.e., two atoms belong to the same cluster if they share a variable.)
Consequently, every assignment µ can be partitioned into k disjoint sub-assignments µi ,
one for each cluster, so that µ is T -satisfiable iff each µi is. Based on this idea, instead of
having a single, monolithic solver, T -solver is instantiated (up to) k different times: each is
responsible for the handling of the reasoning within a single cluster.
The advantage of this “divide-and-conquer” approach is manifold. First, k solvers running on k disjoint problems are typically faster then running one solver monolithically on
the union of the problems. Second, the solvers are activated in a lazy way: if one returns
Unsat, there is no need to call the others. Third, the construction of smaller conflict sets
becomes easier, and this may result in significant gain in the overall search.
6.9 Reduction of assignments to prime implicants
The following technique was proposed for DL in [6].
Let µ be an assignment propositionally satisfying the input formula ϕ. Sometimes µ
may not be a prime implicant for ϕ, that is, some of the literals in µ may be unnecessary to
propositionally satisfy ϕ (i.e., µ \ {l} |=p ϕ for some l ∈ µ). The typical case is when more
than two literals in the same clause are satisfied by µ. Thus T -solver may eliminate such
literals l’s from µ.
There are a couple of potential benefits for this behavior. Let µ′ be the reduced version
of µ. First, µ′ might be T -satisfiable despite µ is T -unsatisfiable. If so, T -DPLL can stop.
Second, if both µ′ and µ are T -unsatisfiable, checking the consistency of µ′ rather than that
of µ can be faster and cause smaller conflict sets, so that to improve the effectiveness of
T -backjumping and T -learning.
Example 6.7. Consider the following scenario with the T -formula ϕ in Example 5.2: T DPLL generates the following assignment µ, which propositionally satisfies ϕ:
{¬(2x2 − x3 > 2), ¬A2 , (3x1 − 2x2 ≤ 3), ¬(3x1 − x3 ≤ 6), ¬A1 , (x3 = 3x5 + 4)}.
If T -solver is invoked on µ without reduction, then it will return Unsat due to the conflict set
{¬(2x2 −x3 > 2), (3x1 −2x2 ≤ 3), ¬(3x1 −x3 ≤ 6)}. We notice that the literal ¬(3x1 −x3 ≤ 6)
is unnecessary for satisfying ϕ, because the 4th clause is satisfied also by ¬A1 . Thus, if we
drop it from µ, we obtain a T -satisfiable assignment µ′ s.t. µ′ |=p ϕ, so that T -DPLL can
return Sat without further backtracking.
6.10 Pure-literal filtering
This technique, which we call pure-literal filtering,38. was implicitly proposed by [185] and
then generalized by [90, 9, 38].
38. Also called triggering in [9].
185
R. Sebastiani
The idea is that, if we have non-Boolean T -atoms occurring only positively [resp. negatively] in the input formula, we can safely drop every negative [resp. positive] occurrence of
them from the assignment to be checked by T -solver. (The correctness and completeness of
this process is a consequence of Proposition 2.3 in §2.2.) Moreover, if both T -propagation
and pure-literal filtering are implemented, then the filtered literals must be dropped not
only from the assignment, but also from the list of literals which can be T -deduced by
T -solver, so that to avoid the T -propagation of literals which have been filtered away.
We notice first that pure-literal filtering has the same two benefits described for reduction to prime implicants in §6.9. Moreover, this technique is particularly useful in some
situations. For instance, in DL(Z) and LA(Z) many solvers cannot efficiently handle disequalities (e.g., (x1 − x2 6= 3)), so that they are forced to split them into the disjunction of
strict inequalities (x1 − x2 > 3) ∨ (x1 − x2 < 3). (This is done either off-line, by rewriting
all equalities [resp. disequalities] into a conjunction of inequalities [resp. a disjunction of
strict inequalities], or on-line, at each call to T -solver.) This causes an enlargement of the
search, because the two disjuncts must be investigated separately.
However, in many problems it is very frequent that many equalities (t1 = t2 ) occur
with positive polarity only. If so, pure-literal filtering avoids adding (t1 6= t2 ) to µ when
T 2B((t1 = t2 )) is assigned to false by T -DPLL, so that no split is needed [9].
6.11 T -deduced-literal filtering
This technique has been proposed by [38, 55] to further reduce the amount of T -literals
given to T -solver.
If the literal l is T -propagated by T -solver, or if l is unit-propagated on a learned T -valid
clause C =def (l1 ∧ · · · ∧ ln ) → l 39. s.t. {l1 , ..., ln } ⊆ µ, then there is no need to pass l to
T -solver, because µ is T -equisatisfiable to µ ∪ {li }. (In order to detect these cases, T -valid
clauses can be marked with a flag when they are learned.) As with pure-literal filtering, if
T -propagation is implemented, then the filtered literal l must be dropped also from the list
of literals which can be T -deduced by T -solver.
Notice that combining different filtering methods requires some care because, in order
to safely apply T -deduced-literal filtering to l, all literals l1 , . . . , ln must have been explicitly
passed to T -solver (i.e., they must not have been filtered).
39. I.e., a T -valid clause C s.t. T 2B(C) has been added to ϕp via static learning (§6.2), T -propagation
(§6.4) or T -learning (§6.6).
186
Lazy Satisfiability Modulo Theories
7. Discussion
For most of the techniques described in §6, the applicability and the benefits of their application depend on many factors.
First, some techniques require as necessary conditions some of the specific features of
T -solver described in §4.1. E.g., you cannot use T -backjumping and T -learning if your
solver is not capable of producing good-enough conflict sets; the benefits of T -propagation
depend only on the deduction capabilities of T -solver, and on their efficiency.
Second, the effects of the different integration techniques are not mutually independent,
and are thus difficult to evaluate as stand-alone ones. Some techniques can share part of
their benefits. (E.g., in Examples 6.3 and 6.5, the enhanced versions of T -propagation
and T -learning may produce similar effects.) Some other can interact negatively. (E.g.,
pure-literal filtering can reduce the pruning power of early pruning, because it may drop
literals causing T -inconsistencies, and thus some pruning of the Boolean search.) Some other
techniques are pairwise related. (E.g., T -propagation is associated with early pruning; both
T -backjumping and T -learning benefit from the conflict sets generated by T -solver, and are
thus implemented together in most solvers. )
Third, and most important, the benefits of many integration techniques, like early pruning and T -propagation, depend on the theory T addressed and, in particular, on the tradeoff
between the cost of T -solving (and T -propagation) and the benefits of reducing Boolean
search space. Notice that “reducing the Boolean search” means not only reducing the time
spent on Boolean reasoning but also, and much more importantly, reducing the size of the
Boolean search tree, and consequently the number of calls to T -solver. As discussed in §4,
for some theories (e.g., EU F and DL) T -solving is relatively cheap, so that it is typically
worth performing extra calls to T -solver if this allows for pruning the Boolean search; for
some other theories instead (e.g., LA(Z) and BV) T -solving may be very expensive, so that
trading T -solver calls for Boolean-search reduction is not always a good deal.
7.1 Guidelines and tips
With very few exceptions, there is no universal, theory-independent recipe for choosing the
right integration techniques to apply. In this section we provide some guidelines and tips,
based on both theoretical analysis and practical experience.
7.1.1 Some general guidelines
There are very few suggestions which can be given for most or even all situations, no matter
which theory T or T -solver we are dealing with.
• Normalize T -atoms in the input formulas according to the lines of §6.1. This is a very
cheap process and may avoid lots of branches and useless calls to T -solver.
• Use some form of early pruning. In fact, T -unsatisfiable branches are typically much
bigger than the conflict sets causing their unsatisfiability, so that using no EP techniques may result into a huge number of branches and useless calls to T -solver.
• Use T -backjumping and T -learning. In fact, if these techniques are not used, many
branches containing the same conflict sets can be enumerated by T -DPLL, causing
187
R. Sebastiani
up to huge amounts of useless calls to T -solver. Despite potential problems of memory
blowup, it is a common experience of the authors of state-of-the-art solvers that both
techniques drastically improve the performance when applied.
All state-of-the-art lazy SMT solvers we are aware of comply to the suggestions above.
7.1.2 Offline vs. online integration
As described in §5.2, in the offline integration schema the SAT solver is restarted from
scratch each time on augmented Boolean formulas. On the one hand, this allows for using
a SAT solver from the shelf with minimal or no modification to its source code, whilst the
online approach requires a tighter integration of the source codes of the SAT solver and
T -solver. On the other hand, as remarked in [79], in the offline approach each call to the
SAT solver may repeat some or much of the search already performed by previous calls. In
the online approach, instead, after each call to T -solver the Boolean search recovers from
the point it was interrupted, without redoing any work. Moreover, notice that in the offline
approach (see Figure 7) it is strictly necessary to keep the theory-conflict clauses learned
in order to guarantee the completeness of the approach, whilst in the online approach (see
Figure 8) T -learning is just a technique for improving efficiency, so that theory-conflict
clauses can be learned and discharged at will. To this extent, [79] showed in an empirical
test a relevant performance superiority of the online approach wrt. the offline one. 40.
The effect of passing from the “naive” offline SAT solving of §5.2 to its more effective
version exploiting conflict sets is analogous to that of using T -backjumping and T -learning
with online SAT solving, and the effect of the “eager notification” version of the offline
approach described in by [19] is that of (eager) early pruning. The last improvement,
however, requires a tighter integration of the source code of the SAT solver and T -solver.
In general, the choice between the offline and online schemata relies on a tradeoff between
efficiency and the effort of implementation, in particular that of modifying and integrating
with the source code of a SAT solver. Offline integration is suitable for prototyping, whilst
online integration is recommendable for building more efficient and stable tools.
7.1.3 To T -propagate or not to T -propagate?
As hinted in §4.1, for some theories (e.g., EU F, DL) T -solvers with powerful deduction
capabilities are available, so that T -propagation can be implemented in very efficient ways
[85, 133, 71]. In other cases, however, things are not so nice and we have to seriously take
into account the tradeoff between the actual benefits of reducing the Boolean search space
and the overhead costs introduced.
Many different application strategies for T -propagation are possible. The main choices
one has to deal with are the following:
• apply T -propagation exhaustively [85, 133] (i.e., always try to deduce as many literals
as possible) or more selectively [9, 183] (e.g., deduce only easy-to-deduce literals).
40. Notice that one can pass from the offline to the online schema by storing the status of the SAT solver (e.g.,
stack, implication graph) and retrieve it at the next restart. We consider this as a variant implementation
of the online schema, as it shares the same advantages (no repeated Boolean search, no need of keeping
all the theory-conflict clauses learned) and drawbacks (requires significant modifications to the source
code of the SAT solver).
188
Lazy Satisfiability Modulo Theories
The former can prune the Boolean search space more aggressively at the expense of
a bigger computational effort for T -solver, and vice versa;
• privilege T -propagation wrt. unit-propagation [133] (e.g., apply T -propagation until
possible, and then apply unit-propagation), or vice-versa [37]. The former trades more
T -solver work for less BCP effort, and vice versa;
• learn deduction clauses lazily [133] (e.g., only when strictly necessary to backwardtraversing the implication graph) or eagerly [37] (e.g., learn either temporarily or
permanently the deduction clauses at every T -propagation performed). Again, the
former trades more T -solver work for less Boolean reasoning effort, and vice versa;
• in case of layered T -solvers (§4.3), how to interleave the hierarchical calls to the
different layers and the T -propagation of the literals T -deduced by each layer. E.g.,
when an unassigned literal l is T -deduced at level Li , it may either be returned to
the SAT solver, so that to be unit-propagated, or be passed down to layer Li+1 , so
that to produce more information for the lower layers. These issues, combined with
the role of T -deduced-literal filtering (§6.11), have been investigated in detail in [55].
In the Abstract DPLL Modulo Theories framework of §3.2 and §5.4, the different alternatives described above may correspond to different strategies by which to apply the Theorypropagate rule wrt. other rules like Decide, Unit-propagate, (T )-Learn and (T -)Discharge.
7.2 Problems of using modern conflict-driven DPLL in SMT
As pointed out in §3, a SAT solver is very different from an Enumerator, so that what
makes a DPLL solver efficient is not enough for making an SMT tool efficient, and what
causes only an irrelevant overhead for SAT may be a major source of inefficiency in SMT.
Thus, we overview a list of problems one may encounter while implementing a lazy SMT
tool on top of a modern DPLL implementation, and propose some solutions.
7.2.1 Generating partial assignments
All SMT schemata of §5 are based on the statement (Property 2.2) that ϕ is T -satisfiable
iff a T -satisfiable partial assignment µ propositionally satisfies ϕ. (Notice that it is enough
to assume that µ propositionally satisfies the original formula ϕ, i.e., there is no need that
µ satisfies also the learned clauses. 41. )
In §3.1 we remarked that, due to the two-watched-literal scheme [129], in modern implementations DPLL returns Sat only when all variables are assigned truth values, thus
returning total assignments, even though the formulas can be satisfied by partial ones. Thus,
when a partial assignment µ is found which satisfies ϕ, this causes an unnecessary sequence
of decisions and unit-propagations for assigning the remaining variables.
In SAT, this scenario causes no extra Boolean search because every extension of µ
satisfies propositionally ϕ, so that the overhead introduced is negligible.
41. Every clause C which has been learned is such that ϕ |=T C, so that, if µ is T -satisfiable and µ |=p ϕ,
then ϕ is T -satisfiable by Prop. 2.2, and hence ϕ ∧ C is T -satisfiable. Thus, there is no need to check
also that µ |=p C.
189
R. Sebastiani
In SMT, instead, many total assignments extending µ may be T -inconsistent even
though µ is T -consistent, so that many useless Boolean branches and calls to T -solvers
may be required (up to 2|Atoms(ϕ)|−|µ| − 1). If early pruning (§6.3) is implemented, then the
effects of this problem are drastically reduced, because the procedure backtracks as soon as
a partial assignment is generated which is unsatisfiable in T ; if weakened only early pruning
(§6.3.2) is implemented, however, then the problem arises also when a partial assignment is
generated which is unsatisfiable in T (e.g., LA(Z)) but satisfiable in the “weaker” theory
T ’ (e.g., LA(Q)). The problem is relevant also in Delayed Theory Combination (DTC) [39],
as it will be made clear in §8.3.
Example 7.1. Consider the simple LA(Z)-formula
c1 : ϕ = {(x1 < 1) ∨ (x2 > 1)}
c2 :
{(x2 < 2) ∨ (x1 > 0)}
ϕp = T 2B(ϕ) = {B1 ∨ B2 }
{B3 ∨ B4 }.
(17)
Suppose that T -DPLL has generated the (intermediate) partial assignment µp =def {B1 , B3 }.
As µ =def B2T (µp ) is LA(Z)-consistent, this should be enough to state that ϕ is LA(Z)satisfiable. However, if T -DPLL enumerates total assignments only, then it may have to
generate and check up to four total assignments extending µ before finding the only LA(Z)satisfiable one, i.e., B2T ({B1 , B3 , ¬B2 , ¬B4 }).
Suppose instead that T -DPLL has generated the partial assignment µp =def {B1 , B4 }.
As µ =def B2T (µp ) is LA(Z)-inconsistent, early-pruning would cause a LA(Z)-solver call
on µ, forcing T -DPLL to backtrack. With weakened early pruning s.t. T ’ is LA(Q),
instead, the weaker LA(Q)-solver would be invoked on µ. As µ is LA(Q)-consistent, this
would cause enumerating up to the four total assignments extending µ, which would be found
LA(Z)-inconsistent by the LA(Z)-solver in the complete calls.
In order to overcome these problems, it is sufficient to implement some device monitoring
the satisfaction of all original clauses in ϕ. E.g., one can introduce a “watch” for one not-yetsatisfied original clause. 42. Moreover, one can obtain it as a byproduct of the techniques for
avoiding ghost literals described in §7.2.2. Although these devices may cause some overhead
in handling the Boolean component of reasoning, this may reduce the overall Boolean search
space and the number of calls to T -solver consequently, in particular when weakened early
pruning or Dtc are used.
7.2.2 Avoiding ghost literals
As stated in §3.1, in modern DPLL tools decide next branch selects a new literal according to a score which is updated only at the end of every branch, and is never changed until
the end of the next branch. Consequently, decide next branch may select also literals
which occur only in clauses which have already been satisfied (which we call ghost literals).
In SAT, the selection of ghost literals in the assignment µ may cause some overhead
but it causes no extra Boolean search, because it does not interfere with the detection of
(un)satisfiability and with the construction of the implication graph.
42. That is, one maintains a pointer to one original clause which is not satisfied by the current assignment.
When it becomes satisfied, a new such clause is looked for: if none is found, then the formula is satisfied.
190
Lazy Satisfiability Modulo Theories
In SMT, instead, the presence of ghost T -literals in µ causes useless extra work to the
T -solver and may affect the T -satisfiability of µ, forcing unnecessary backtracks and causing
unnecessary Boolean search and hence useless calls to the T -solver.
Example 7.2. Suppose that T -DPLL implements early pruning and does not implements
T -propagation, and consider again the simple LA(Z)-formulas of Example 7.1:
c1 : ϕ = {(x1 < 1) ∨ (x2 > 1)}
c2 :
{(x2 < 2) ∨ (x1 > 0)}
ϕp = T 2B(ϕ) = {B1 ∨ B2 }
{B3 ∨ B4 },
(18)
and the intermediate assignment µp =def {B1 }. Suppose decide next branch selects the
literals in lexicographic order B1 ...B4 without detecting ghost literals: it selects the ghost
literal B2 , causing the unnecessary EP call to T -solver on B2T ({B1 , B2 }), and hence B3 ,
causing the call of T -solver on B2T ({B1 , B2 , B3 }), which returns Unsat and forces backtracking on the conflict clause ¬B2 ∨ ¬B3 . If decide next branch realizes that B2 is a
ghost literal and skips it, it will select B3 instead, and find the T -satisfiable assignment
B2T ({B1 , B3 }). This saves one call to T -solver and one T-backjumping and T -learning
step, and makes the only one call to T -solver easier to solve.
In order to overcome these problems, it is sufficient to implement some device monitoring
the satisfaction of the (original) clauses in ϕ in which the selected literal occurs. A simple
way of doing that is to associate a priori to every literal l a list of the original clauses
C1 , ..., Ck in which l occurs. Every time a new decision literal l is assigned, then if all
C1 , ..., Ck are already satisfied, then l is ghost. 43. Again, although this may cause some
overhead in handling the Boolean component of reasoning, this may significantly reduce the
overall Boolean search space, and the number of calls to the T -solver consequently.
7.2.3 Drawbacks of modern T -backjumping
As stated in §6.5, unlike older forms of T -backjumping [100, 185], most modern implementations adopt or inherit the backjumping mechanism of modern DPLL tools, so that
T -DPLL learns the conflict clause C p and backtracks to the highest point in the stack
where one lp ∈ η p is not assigned, and unit-propagates ¬lp on C p . Thus, the backtrack
mechanism allows for jumping high in the Boolean search tree, typically allowing for a very
relevant reduction in the number of branches.
However, as noticed in [88, 142] for CSP and plain SAT, this form of “far backtracking”
may have some drawbacks. In fact, it may often happen that one conflicting branch contains
one (or more) set of literals l1 , ..., ln satisfying a subset of clauses C1 , ..., Ck which do not
interfere with those causing the conflict, and that l1 , ..., ln are skipped by the jump in the
backtracking step. If so, after T -backjumping and unit-propagating on the conflict clause,
it is possible that T -DPLL redoes all or part of the same decisions, unit-propagations,
early-pruning calls and T -propagations regarding l1 , ..., ln (e.g., reaching the same status he
would have reached with a lower jump like, e.g., with the “old” T -backjumping approach
43. Notice that one can restrict this test to T -literals only, which typically have very few occurrences each.
Notice also that one can extend the test also to literals which have been T -deduced or unit-propagated
on non-original clauses (there is no need to check l if l has been unit-propagated on one original clause,
because it is obviously non-ghost). See also the related issue of T -deduced-literal filtering of §6.11.
191
R. Sebastiani
¬B5
¬B5
B8
B8
c1 :
c2 :
c3 :
c4 :
c5 :
c6 :
c7 :
... :
{¬B1 ∨ A1 }
{¬A2 ∨ B2 }
{B3 ∨ A2 }
{¬B4 ∨ ¬B5 ∨ ¬A1 }
{A1 ∨ B3 }
{B6 ∨ B7 ∨ ¬A1 }
{A1 ∨ B8 ∨ A2 }
h other clauses i
B6
l1 , ..., ln
¬B1
¬B3 T
A1
A2
B2
¬B2
¬A2
B3
B6
l1 , ..., ln
c8 : B5 ∨ ¬B8 ∨ ¬B2
B6
l1 , ..., ln
¬B1
¬B2
¬B3 T ¬A2
B3
A1
A2
B2
c8 : B5 ∨ ¬B8 ∨ ¬B2
Figure 13. Boolean search trees in the scenarios of Example 7.3. Left: modern T -backjumping.
Right: comparison with the “old-style” T -backjumping. A bullet “•” denotes a call to T -solver.
of [100, 185]). As a consequence, the effort of finding a solution to (a subpart of) the
“subproblem” C1 , ..., Ck may be unnecessarily repeated several times in different branches.
Example 7.3. Consider the case where the formula ϕ of Example 5.2 is extended with many
other clauses which contain no atoms occurring in c1 , ..., c7 . We assume a scenario similar
to that of Example 5.2: T -DPLL selects {¬B5 , B8 , B6 , l1 , ..., ln , ¬B1 }, it T -propagates ¬B3
and unit-propagates, A1 , A2 , B2 , causing a conflict and learning the conflict clause c8 . (Here
“l1 , ..., ln ” is a possibly-big sequence of assignments on atoms not occurring in c1 , ..., c7 ,
which we assume do not interfere with the other assignments, but may independently require
an amount of early-pruning calls to T -solver and T -propagations.)
With a modern T -backjumping strategy T -DPLL jumps up above B6 and hence unitpropagates ¬B2 , ¬A2 and B3 on c8 , c2 and c3 . (Figure 13 left.) By construction, ¬B2 , ¬A2
and B3 do not interfere with the T -consistency of B5 , B8 , B6 . If the presence of ¬B2 , ¬A2
and B3 does not influence the literal selection heuristic, then T -DPLL may select B6 and
may find from scratch the assignments l1 , ..., ln of the previous branch.
As a comparison, notice that, if T -DPLL adopted an old-style T -backjumping strategy,
then it would jump up above ¬B1 , unit-propagate ¬B2 on c8 and hence ¬A2 and B3 on c2
and c3 , ending up in the same status as in the previous case. (Figure 13 right.)
In plain SAT (and CSP), this fact can cause some overhead due to useless branching
and unit-propagation steps (see [88, 142]). In SMT the effects of this problem may be even
worse, because the repeated reasoning on l1 , ..., ln involves also useless early-pruning calls
to the T -solvers and T -propagation steps, which may be much more expensive than plain
Boolean inference steps.
There seems to be no panacea to this problem so far. As typically we do not want to give
up the benefits of modern T -backjumping in terms of number of branches explored, some
other solution should be explored. One partial solution is that of adopting a literal-selection
192
Lazy Satisfiability Modulo Theories
heuristic which promotes the “locality” of search (e.g., those which select first the literals
which have had an actual role in the building of the last conflict) so that to avoid analyzing
l1 , ..., ln until (and unless) all relevant atoms have been explored. 44. As possible research
directions, one might want to explore the possibility of adapting to lazy SMT techniques
like Dynamic Backtracking [88] or the Lightweight Component Caching Scheme of [142].
7.2.4 Implementing T -propagation
As remarked in [85], implementing T -propagation on top of a modern DPLL algorithm
can be tricky, because, by construction, the implication graph in DPLL described in §3.1
does not keep track of T -propagations. Therefore, if a T -propagated literal l is encountered
during the backward traversal of the implication graph (e.g., when building a Boolean
conflict set), the information on the T -propagation η |=T l must be recovered in order
to complete the process. In [85], the set of antecedents η of the deduction are computed
on demand only in these situations. In [37], the deduction clause T 2B(η → l) is always
computed and added to ϕp , either temporarily or permanently, and the process handles a
T -propagated literal as if it were the result of a unit-propagation on the deduction clause.
7.2.5 DPLL branching heuristics for SMT
In general, good literal-selection heuristics for “pure” DPLL are not necessary good for
T -DPLL-like procedures as well. First, a heuristic which is good to search for one assignment is not necessary good for enumerating up to a complete collection of them. More
importantly, traditional DPLL heuristics are not “theory-aware”, in the sense that they do
not take into account the T -semantics of the literals.
So far there seem to be no really-satisfactory proposal in the direction of building theoryaware heuristics, and most tools simply use standard DPLL heuristics. One of the main
reason for this fact may be that the problem is trickier then one would expect: in order
to be effective, a theory-aware heuristic should not only take into account the T -semantics
of the literal chosen, but also that of all the literals that are assigned as a deterministic
consequence (unit propagation, T -propagation) of that choice. For instance, with some
problems it is often the case that Boolean literals are better choices than others, because
they cause longer chains of unit propagations [12].
Example 7.4. Consider the T -formula ϕ in Example 5.2. Branching on the Boolean literal
¬A1 causes the assignment of ¬(2x2 − x3 > 2) and (3x1 − 2x2 ≤ 3) by unit propagation and
hence of (3x1 − x3 ≤ 6) by T -propagation (rows 1, 5 and hence 3).
Unfortunately, the whole sets of deterministic consequences of a branch choice are difficult to predict a priori. One possible research direction is to adopt look-ahead SAT techniques (see §3) and to perform explicitly all propagations on the candidate literals in turn
[121, 122]. Another direction is, as with the pure Boolean case, to provide to T -DPLL
solver a list of “privileged” variables on which to branch on first [12].
44. E.g., MathSAT adopts one such heuristic from the MiniSAT solver.
193
R. Sebastiani
8. Lazy SMT for combinations of theories
In many practical applications of SMT, the theory T is a combination of two or more
theories T1 ,...,T n . For instance, an atom of the form f (x + 4y) = g(2x − y), that combines
uninterpreted function symbols (from EU F) with arithmetic functions (from LA(Z)), could
be used to naturally model in a uniform setting the abstraction of some functional blocks in
an arithmetic circuit (see e.g. [42, 36]). In the following, we discuss the main approaches to
the development of lazy SMT (T ) tools where T is the combination of two or more theories.
The work on combining decision procedures (i.e., T -solvers in our terminology) for distinct theories was pioneered by Nelson and Oppen [130, 138] and Shostak [162]. 45. In particular, Nelson and Oppen established the theoretical foundations onto which most current
combined procedures are still based on (hereafter Nelson-Oppen (N.O.) formal framework,
§8.1). They also proposed a general-purpose procedure for integrating Ti -solvers into one
combined T -solver (hereafter Nelson-Oppen (N.O.) procedure, §8.2). This procedure is then
extended to SMT by integrating the combined T -solver with DPLL according to the lazy
paradigm of §5. More recently Bozzano et al. [39, 40] proposed Delayed Theory Combination, DTC (§8.3), a novel combination procedure which builds a combined SMT solver
directly by exploiting DPLL also for theory combination. For the very specific case in which
EU F is combined with one theory T , a viable alternative is that of applying Ackermann’s
expansion [1] (§8.4).
Variants and evolutions of N.O. procedure were implemented in the SVC/CVC/CVCLite
[17], ICS [64], Simplify [70], Verifun [79], Zapato [16]) lazy SMT tools. Variants or evolutions of DTC procedure are currently implemented in the MathSAT [40], Yices [73],
and Z3 [62] lazy SMT tools; CVC3 [22] combines ideas from Dtc and splitting-on-demand
(§6.7). Ackermann’s expansion for EU F ∪ T is implemented in BarceLogic [133] and in
MathSAT [40].
In what follows we assume all the notions described in §2.1.1, in particular those of
stably-infinite and convex theories, of alien subterms, of pure formulas and of interface
variables and equalities. As in §2.1.1, for simplicity we refer to combinations of two theories
T1 ∪ T2 only; however, all the discourse can be easily generalized to combination of many
theories T 1 ∪ ... ∪ T n .
8.1 The Nelson-Oppen formal framework
Consider two decidable stably-infinite theories with equality T1 and T2 and disjoint signatures Σ1 and Σ2 (often called Nelson-Oppen theories) and consider a pure conjunction of
T1 ∪ T2 -literals µ =def µT1 ∧ µT2 s.t. µT1 is i-pure for each i. Nelson&Oppen’s key observation is that µ is T1 ∪ T2 -satisfiable if and only if it is possible to find two satisfying
interpretations I1 and I2 s.t. I1 |=T1 µT1 and I2 |=T2 µT2 which agree on all equalities on
the shared variables. This is stated in the following theorem. 46.
45. Nowadays there seems to be a general consensus on the fact that Shostak’s method should not be
considered as an independent combination method, rather as a collection of ideas on how to implement
Nelson-Oppen’s combination method efficiently [150, 25, 70].
46. Since [130] many different formulations of N.O. correctness and completeness results have been presented
(e.g. [130, 138, 177, 178]). Here we adopt a notational variant of that in [177].
194
Lazy Satisfiability Modulo Theories
Theorem 8.1. Let T1 and T2 be two stably-infinite theories with equality and disjoint signatures; let µ =def µT1 ∧ µT2 be a conjunction of T1 ∪ T2 -literals s.t. µTi is i-pure for each
i. Then µT1 ∧ µT2 is T1 ∪ T2 -satisfiable if and only if there exists some equivalence relation
e(., .) over V ars(µT1 ) ∩ V ars(µT2 ) s.t. µTi ∧ µe is T i -satisfiable for every i, where:
^
^
¬(vi = vj ).
(19)
µe =def
(vi = vj ) ∧
(vi ,vj ) ∈ e(.,.)
(vi ,vj ) 6∈ e(.,.)
µe is called the arrangement of e(., .).
Overall, Nelson-Oppen results reduce the T1 ∪ T2 -satisfiability problem of a set of pure
literals µ to that of finding (the arrangement of) an equivalence relation on the shared
variables which is consistent with both pure parts of µ.
Example 8.2. [45] Consider the following pure conjunction of EU F ∪LA(Z)-literals µ =def
µEU F ∧ µLA(Z) s.t.
µEU F :
¬(f (v1 ) = f (v2 )) ∧ ¬(f (v2 ) = f (v4 )) ∧ (f (v3 ) = v5 ) ∧ (f (v1 ) = v6 )
µLA(Z) : (v1 ≥ 0) ∧ (v1 ≤ 1) ∧ (v5 = v4 − 1) ∧ (v3 = 0) ∧ (v4 = 1)∧
(v2 ≥ v6 ) ∧ (v2 ≤ v6 + 1).
(20)
Here v1 , . . . , v6 are interface variables, because they occur in both EU F and LA(Q)-pure
terms. We consider the arrangement
^
µe =def (v1 = v4 ) ∧ (v3 = v5 ) ∧
¬(vi = vj ).
(vi =vj )6∈{(v1 =v4 ),(v3 =v5 )}
It is easy to see that µEU F ∧ µe is EU F-consistent (because no equality or congruence constraint is violated) and that µLA(Z) ∧ µe is LA(Z)-consistent (e.g., v3 = v5 = 0, v1 = v4 = 1,
v2 = 4, v6 = 3 is a LA(Z)-model). Thus, by Theorem 8.1, µ is EU F ∪ LA(Z)-consistent.
The condition of having only pure conjunctions as input allows to partition the problem
into two independent Ti -satisfiability problems µTi ∧ µe . This condition is easy to address,
because every non-pure T1 ∪ T2 -formula ϕ can be converted into a T1 ∪ T2 -equisatisfiable and
pure one by recursively replacing each alien subterm t by a new variable vt and conjoining
the equality vt = t with ϕ. E.g., if T 1 is EU F and T 2 is LA(Q), then:
(f (x + 4y) = g(2x − y)) =⇒ (f (vx+4y ) = g(v2x−y )) ∧ (vx+4y = x + 4y) ∧ (v2x−y = 2x − y).
This process is called purification, and the size of the resulting formula is linear in that of
ϕ.
The condition of having stably-infinite theories is sufficient to guarantee enough values in the domain to allow the satisfiability of every possible set of disequalities one may
encounter. 47. This fact is illustrated by the following example (adapted from [177]).
47. More formally, if I1 |= (T1 ∧µT1 ∧µe ) and I2 |= (T2 ∧µT2 ∧µe ) and both Ti ’s are stably infinite, then there
exist other two models I1′ and I2′ of infinite cardinality s.t. I1′ |= (T1 ∧ µT1 ∧ µe ) and I2′ |= (T2 ∧ µT2 ∧ µe ).
Thus it is possible to find an isomorphism between I1′ and I2′ and hence build a common model I s.t.
I |= (T1 ∧ T2 ∧ µT1 ∧ µT2 ∧ µe ).
195
R. Sebastiani
Example 8.3. Let T1 be EU F and T2 be BV [1] (the theory of bit-vectors of length 1).
Clearly BV [1] , and hence EU F ∪ BV [1] , admits only models of cardinality 2 and thus it is
not stably-infinite, so that Theorem 8.1 cannot be applied to these theories.
Consider the following pure conjunction of EU F ∪ BV [1] -literals µ =def µEU F ∧ µBV [1] :
µEU F : ¬(f (v2 ) = f (v3 )) ∧ ¬(f (v1 ) = f (v3 )) ∧
µBV [1] : ¬( not v1 = not v2 ).
Here f is an uninterpreted function symbol in EU F and not represents the inverter gate
in BV [1] . v1 and v2 are interface variables, and v1 = v2 is the only interface equality.
On the one hand, it is easy to see that µ is EU F ∪ BV [1] -unsatisfiable. In fact, we have
that µ |=EU F∪BV [1] (¬(v1 = v2 ) ∧ ¬(v2 = v3 ) ∧ ¬(v2 = v3 )), so that µ can be satisfied only
by models of cardinality greater or equal than 3, whilst EU F ∪ BV [1] admits only models of
cardinality 2.
On the other hand, if we ignored the stably-infinite precondition and tried to apply Theorem 8.1, we could consider the arrangement µe =def {¬(v1 = v2 )}, so that µEU F ∧ µe is
EU F-satisfiable and µBV [1] ∧ µe is BV [1] -satisfiable, from which we could conclude that µ is
EU F ∪ BV [1] -satisfiable.
A significant research effort has been paid to extend N.O. framework by releasing the
conditions it is based on (purity the of inputs, stably-infiniteness and signature-disjointness
of the theories.) We briefly overview some of them. 48.
First, [25] shows that the purity condition is not really necessary in practice. Intuitively,
one may consider alien terms as if they were variables, and consider equalities between alien
terms as interface equalities. We refer the reader to [25] for details.
Many approaches have been presented in order to release the condition of stablyinfiniteness (e.g., [189, 190, 80, 179, 145, 33]). In particular, [190, 179] proposed a method
which extends the N.O. framework by reasoning not only on interface equalities, but also
on particular cardinality constraints; this method has been extended to many-sorted logics
in [145]; the problem has been further explored theoretically in [33], and related to that of
combining rewrite-based decision procedures (see §9.2). Finally, the paradigm in [179] has
been recently extended in [113] so that to handle also parametric theories.
A few approaches have been proposed also to release the condition of signature-disjointness
[178, 86]. A theoretical framework addressing this problem was proposed in [178], which allowed for producing semi-decision procedures. [86] proposed a general theoretical framework
based on classical model theory. An even more general framework for combining decision
procedures, which captures that in [86] as a subcase, has been recently presented in [87].
All these results, however, involve a level of theoretical analysis which is way out of the
scope of this survey, so that we refer the reader to the cited bibliography for further details.
8.2 The Nelson-Oppen combination procedure
In [130] Nelson Oppen proposed also a general-purpose combination procedure for combining
two (or more) Ti -solvers into one T1 ∪ T2 -solver. (The T1 ∪ T2 -solver is then integrated
with DPLL as described in §5.) The combined decision procedure T1 ∪ T2 -solver works
48. The list of references and approaches listed here is by no means intended to be exhaustive.
196
Lazy Satisfiability Modulo Theories
BOOLEAN MODEL
ENUMERATOR (DPLL)
BOOLEAN MODEL
ENUMERATOR (DPLL)
Atoms(ϕ)
Atoms(ϕ) ∪ {eij }ij
µT1 ∪ µT2
Sat/Unsat
T1 -solver
T1 ∪ T2 -solver
T1 -deduce W
T1 -solve
eij
T2 -solver
T2 -solve
T2 -deduce
Figure 14. A basic architectural schema
of SMT (T1 ∪ T2 ) via the N.O. procedure.
Sat/Unsat
W
[µ′T1 →
eij ]
µT1
µe
µT2
T1 -solver
T1 -solve
[T1 -deduce ]
Sat/Unsat
W
[µ′T2 →
eij ]
T2 -solver
T2 -solve
[T2 -deduce ]
Figure 15. A basic architectural schema
of SMT (T1 ∪ T2 ) via the Dtc procedure.
by performing a structured interchange of interface equalities (disjunctions of interface
equalities if Ti is non-convex) which are inferred by either Ti -solver and then propagated
to the other, until convergence is reached. (Here we provide only a high-level description of
this procedure. The reader may refer, e.g., to [130, 161, 78, 25, 157, 70] for more details.)
A basic architectural schema of SMT (T1 ∪ T2 ) via N.O. is described in Figure 14. Both
Ti ’s are N.O. theories s.t. their respective Ti -solvers are eij -deduction complete (see §4.1.5).
We consider first the case in which both theories are convex. The combined T1 ∪ T2 -solver
receives from DPLL a pure set of literals µ, and partitions it into µT1 ∪ µT2 , s.t. µTi is
i-pure, and feeds each µTi to the respective Ti -solver. Each Ti -solver, in turn:
(i) checks the Ti -satisfiability of µTi ,
(ii) deduces all the interface equalities deriving from µTi ,
(iii) passes them to the other T -solver, which adds it to his own set of literals.
This process is repeated until either one Ti -solver detects inconsistency (µ1 ∪ µ2 is T1 ∪ T2 unsatisfiable), or no more eij -deduction is possible (µ1 ∪ µ2 is T1 ∪ T2 -satisfiable).
Example 8.4. [45] Consider the following EU F ∪ LA(Q) pure formula ϕ
EU F :
(v3 = h(v0 )) ∧ (v4 = h(v1 )) ∧ (v6 = f (v2 )) ∧ (v7 = f (v5 ))∧
LA(Q) : (v0 ≥ v1 ) ∧ (v0 ≤ v1 ) ∧ (v2 = v3 − v4 ) ∧ (RESET5 → (v5 = 0))∧
Both :
(¬RESET5 → (v5 = v8 )) ∧ ¬(v6 = v7 ).
(21)
v0 , v1 , v2 , v3 , v4 , v5 are interface variables, v6 , v7 , v8 are not. (Thus, e.g., (v0 = v1 ) is an
interface equality, whilst (v0 = v6 ) is not.) RESET5 is a Boolean variable.
Consider the search tree in Fig. 16. After the first run of unit-propagations, assume DPLL
selects the literal RESET5 , resulting in the assignment µ =def µEU F ∪ µLA(Q) s.t.
µEU F =
{(v3 = h(v0 )), (v4 = h(v1 )), (v6 = f (v2 )), (v7 = f (v5 )), ¬(v6 = v7 )}
µLA(Q) = {(v0 ≤ v1 ), (v0 ≥ v1 ), (v2 = v3 − v4 ), (v5 = 0)},
(22)
197
R. Sebastiani
Branch 1
RESET5
v3 = h(v0)
v4 = h(v1)
v6 = f (v2)
v7 = f (v5)
¬(v6 = v7)
v0 = v1
heij -deductioni
v3 = v4
v2 = v5
EUF LA(Q)
v0 ≥ v1
v0 ≤ v1
v2 = v3 − v4
v5 = 0
heij -deductioni
v0 = v1
v3 = v4
heij -deductioni
v2 = v5
Branch 2
¬RESET5
v3 = h(v0) EUF
v4 = h(v1)
v6 = f (v2)
v7 = f (v5)
¬(v6 = v7)
v0 = v1
heij -deductioni
v3 = v4
LA(Q)
v0 ≥ v1
v0 ≤ v1
v2 = v3 − v4
v5 = v8
heij -deductioni
v0 = v1
v3 = v4
EUF ∪ LA(Q)-Satisfiable!
Figure 16. Search tree for the formula of Example 8.4
which propositionally satisfies ϕ. Now, the set of literals µEU F is given to the EU F-solver,
which reports its consistency and deduces no new interface equality. Then the set µLA(Q)
is given to the LA(Q)-solver, which reports consistency and deduces the interface equality
v0 = v1 , which is passed to the EU F-solver. The new set µEU F ∪ {(v0 = v1 )} is still EU Fconsistent, but this time the EU F-solver can deduce from it the equality (v3 = v4 ), which
is in turn passed to the LA(Q)-solver, which deduces (v2 = v5 ). The EU F-solver is then
invoked again to check the EU F-consistency of the assignment µEU F ∪{(v0 = v1 ), (v2 = v5 )}:
since this check fails, the Nelson-Oppen procedure reports the EU F ∪ LA(Q)-unsatisfiability
of the whole assignment µ. At this point, then, DPLL backtracks and tries assigning false
to RESET5 , resulting in the new assignment µ′ =def µEU F ∪ µ′LA(Q) s.t.
µEU F =
{(v3 = h(v0 )), (v4 = h(v1 )), (v6 = f (v2 )), (v7 = f (v5 )), ¬(v6 = v7 )}
′
µLA(Q) = {(v0 ≤ v1 ), (v0 ≥ v1 ), (v2 = v3 − v4 )(v5 = v8 )},
(23)
which is found EU F ∪ LA(Q)-satisfiable with a similar process (see Fig. 16).
In the case of non-convex theories, the N.O. procedure becomes more complicated,
because the two solvers need to exchange arbitrary disjunctions of interface equalities. As
each Ti -solver can handle only conjunctions of literals, the disjunctions must be managed
by means of case splitting and of backtrack search. Thus, the N.O. procedure must explore
a number of branches to check the consistency of a set of literals which depends on how
many disjunctions of equalities are exchanged at each
W step: if the current set of literals is
µ, and one of the Ti -solver sends the disjunction nk=1 (eij )k to the other, the latter must
further investigate up to n branches to check the consistency of each of the µ ∪ {(eij )k } sets
separately.
Example 8.5. [45] Consider the conjunction of literals µ =def µEU F ∧ µLA(Z) (20) of
Example 8.2:
µEU F :
¬(f (v1 ) = f (v2 )) ∧ ¬(f (v2 ) = f (v4 )) ∧ (f (v3 ) = v5 ) ∧ (f (v1 ) = v6 )∧
µLA(Z) : (v1 ≥ 0) ∧ (v1 ≤ 1) ∧ (v5 = v4 − 1) ∧ (v3 = 0) ∧ (v4 = 1)∧
(v2 ≥ v6 ) ∧ (v2 ≤ v6 + 1).
198
(24)
Lazy Satisfiability Modulo Theories
LA(Z)
µLA(Z)
v1 ≥ 0
v5 = v4 − 1
v3 = 0
v1 ≤ 1
v2 ≥ v6
v4 = 1
v2 ≤ v6 + 1
EUF
µEU F
¬(f (v1) = f (v2))
¬(f (v2) = f (v4))
f (v3) = v5
f (v1) = v6
heij -deductioni
v3 = v5
v3 = v5
heij -deductioni
v1 = v3 ∨ v1 = v4
v5 = v6
heij -deductioni
v2 = v3 ∨ v2 = v4
v1 = v3
heij -deductioni
v5 = v6
v2 = v3
v1 = v4
EU F ∪ LA(Z)-Satisfiable!
v2 = v4
Figure 17. The N.O. search tree for the formula of Example 8.5
Here all the variables (v1 , . . . , v6 ) are interface ones. µ contains only unit clauses, so after
the first run of unit-propagations, DPLL generates the assignment µ which is simply the
set of literals in µ. One possible run of the N.O. procedure is depicted in Fig. 17. 49.
First, the sub-assignment µEU F is given to the EU F-solver, which reports its consistency
and deduces no interface equality. Then, the sub-assignment µLA(Z) is given to the LA(Z)solver, which reports its consistency and deduces first (v3 = v5 ) and then the disjunction
(v1 = v3 ) ∨ (v1 = v4 ), which are both passed to th EU F-solver. Whilst the first produces no
effect, the second forces a case-splitting so that the two equalities (v1 = v3 ) and (v1 = v4 )
must be analyzed separately by the EU F-solver. The first branch, corresponding to selecting
(v1 = v3 ), is opened: then the set µEU F ∪ {(v1 = v3 )} is EU F-consistent, and the equality
(v5 = v6 ) is deduced. After that, the assignment µLA(Z) ∪{(v5 = v6 )} is passed to the LA(Z)solver, that reports its consistency and deduces another disjunction, (v2 = v3 )∨(v2 = v4 ). At
this point, another case-splitting is needed in the EU F-solver, resulting in the two branches
µEU F ∪ {(v1 = v3 ), (v2 = v3 )} and µEU F ∪ {(v1 = v3 ), (v2 = v4 )}. Both of them are found
inconsistent, so the whole branch previously opened by the selection of (v1 = v3 ) is found
inconsistent.
At this point, the other case of the branch (i.e. the equality (v1 = v4 )) is selected, and
since the assignment µEU F ∪ {(v1 = v4 )} is EU F-consistent and no new interface equality
is deduced, the Nelson-Oppen method reports the EU F ∪ LA(Z)-satisfiability of µ under the
whole assignment µ.
Notice that the ability to carry out eij -deductions (see §4.1.5) is crucial: each solver
must be eij -deduction complete, that is, it must be able to derive the (disjunctions of)
interface equalities eij which are entailed by its current facts ϕ.
49. Notice that there may be different runs depending on the order in which the eij -deductions are performed.
199
R. Sebastiani
We also notice that, in a standard N.O.-style SMT procedure, the DPLL solver is not
aware of the interface equalities eij , so that the latter cannot occur in conflict clauses. Therefore, in order to construct the T1 ∪ T2 -conflict clause, it is necessary to resolve backwards
the last conflict clause with (the deduction clauses corresponding to) the eij -deductions
performed by each Ti -solver.
Example 8.6. Consider the scenario of the left branch in Example 8.4 and Fig. 16. Starting
from the final EU F conflict, and resolving backwards wrt. the deductions performed, it is
possible to obtain a final EU F ∪ LA(Q)-conflict clause as follows:
EU F − conf lict :
LA(Q) − deduction :
EU F − deduction :
LA(Q) − deduction :
=⇒
EU F ∪ LA(Q) − conf lict :
((v6
((v2
((v3
((v0
= f (v2 )) ∧ (v7 = f (v5 )) ∧ ¬(v6 = v7 ) ∧ (v2 = v5 )) → ⊥
= v3 − v4 ) ∧ (v5 = 0) ∧ (v3 = v4 )) → (v2 = v5 )
= h(v0 )) ∧ (v4 = h(v1 )) ∧ (v0 = v1 )) → (v3 = v4 )
≥ v1 ) ∧ (v0 ≤ v1 )) → (v0 = v1 )
((v6 = f (v2 )) ∧ (v7 = f (v5 )) ∧ ¬(v6 = v7 ) ∧ (v2 = v3 − v4 )∧
(v5 = 0) ∧ (v3 = h(v0 )) ∧ (v4 = h(v1 )) ∧ (v0 ≥ v1 )) → ⊥.
Notice that the novel conflict clause simply causes the propagation of ¬(v5 = 0) and of
¬RESET5 , and provides no help for pruning search in the right branch.
We refer the reader to [130, 161, 78, 25, 157, 70] for a more detailed description of N.O.
procedure and its implementation.
8.3 The Delayed Theory Combination procedure
Delayed Theory Combination ( Dtc) is a more recent general-purpose procedure for tackling
the problem of theory combination directly in the context of lazy SMT [39, 40, 45]. Dtc
works by performing Boolean reasoning on interface equalities, possibly combined with T propagation. As with N.O. procedure, Dtc is based on Theorem 8.1, and thus considers
signature-disjoint stably-infinite theories with their respective Ti -solvers, and pure input
formulas (although most of the considerations on releasing purity and stably-infiniteness in
§8.1 hold for Dtc as well). Importantly, no assumption is made about the eij -deduction
capabilities of the Ti -solvers (§4.1.5): for each Ti -solver, every intermediate situation from
complete eij -deduction to no eij -deduction capabilities is admitted.
A basic architectural schema of Dtc is described in Figure 15. In Dtc, each of the two
Ti -solvers interacts directly and only with the Boolean enumerator, so that there is no direct
exchange of information between the Ti -solvers. The Boolean enumerator is instructed to
assign truth values not only to the atoms in Atoms(ϕ), but also to the interface equalities
eij ’s. Consequently, each assignment enumerated by DPLL µp is partitioned into three
components µpT1 , µpT2 and µpe , s.t. each µTi is the set of i-pure literals and µe is the set of
interface (dis)equalities in µ, so that each µTi ∪ µe is passed to the respective Ti -solver.
An implementation of Dtc [40, 45] is based on the online schema of Figure 8 in §5.3,
exploiting early pruning (§6.3), T -propagation (§6.4), T -backjumping (§6.5) and T -learning
(§6.6). Each of the two Ti -solvers interacts with the DPLL engine by exchanging literals
via the assignment µ in a stack-based manner. The T -DPLL algorithm of Figure 8 in §5.3
is modified to the following extents [40, 45]:
200
Lazy Satisfiability Modulo Theories
(i) T -DPLL is instructed to assign truth values not only to the atoms in ϕ, but also to
the interface equalities not occurring in ϕ. B2T and T 2B are modified accordingly.
(ii) T -decide next branch is modified to select also interface equalities eij ’s not occurring
in the formula yet 50. , after the current assignment propositionally satisfies ϕ.
(iii) T -deduce is modified to work as follows: for each Ti , µT i ∪ µe , is fed to the respective
Ti -solver. If both return Sat, then T -deduce returns Sat, otherwise it returns Conflict.
(iv) T -analyze conflict and T -backtrack are modified so that to use the conflict set
returned by one Ti -solver for T -backjumping and T -learning. Importantly, such conflict
sets may contain interface (dis)equalities.
(v) Early-pruning and T -propagation are performed. If one Ti -solver performs the eij W
deduction µ∗ |=Ti kj=1 ej s.t. µ∗ ⊆ µT i ∪ µe , each ej being an interface equality, then
W
the deduction clause T 2B(µ∗ → kj=1 ej ) is learned.
(vi) [If and only if both Ti -solvers are eij -deduction complete.] If an assignment
µ which propositionally satisfies ϕ is found Ti -satisfiable for both Ti ’s, and neither
Ti -solver performs any eij -deduction from µ, then T -DPLL stops returning Sat. 51.
In order to achieve efficiency, other heuristics and strategies have been further suggested in
[39, 40, 45], and more recently in [73, 62].
In short, in Dtc the embedded DPLL engine not only enumerates truth assignments for
the atoms of the input formula, but it also assigns truth values for the interface equalities
that the T -solver’s are not capable of inferring, and handles the case-split induced by the
entailment of disjunctions of interface equalities in non-convex theories. The rationale is
to exploit the full power of a modern DPLL engine by delegating to it part of the heavy
reasoning effort previously due to the Ti -solvers. In particular, we highlight the following
facts.
First, due to (ii), the Boolean search tree is divided into two parts: the top part,
performed on the atoms currently occurring in the formula, in which a (partial) truth
assignment µ propositionally satisfying ϕ is searched, and the bottom part, performed on
the eij ’s which do not yet occur in the formula, which checks the T1 ∪ T2 -satisfiability of µ
by building a candidate arrangement µe . Thus, in every branch the reasoning on eij ’s is
not performed until (and unless) it is strictly necessary. 52. E.g., if in one branch µ is such
that one µTi component is Ti -unsatisfiable, no reasoning on eij ’s is performed.
To this extent, it is important to exploit the issue of partial assignments described in
§7.2.1: when the current partial assignment µ propositionally satisfies the input formula ϕ,
the remaining atoms occurring in ϕ can be ignored and only the new eij ’s are then selected.
Importantly, if µ is a partial assignment, then it is sufficient that µe assigns only the eij ’s
which have an actual interface role in µ. 53.
Second, thanks to (iv) and (v), the interface equalities eij ’s are included in the learned
clauses derived by T -conflicts and T -deduction. Therefore, the reasoning steps on eij ’s
which are performed in order to decide the T1 ∪ T2 -consistency of one branch µ (both
50.
51.
52.
53.
Notice that an interface equality occurs in the formula after a clause containing it is learned, see (iv).
This is identical to the T1 ∪ T2 -satisfiability termination condition of N.O. procedure.
From which the name “Delayed Theory Combination”.
E.g., if µ is partial and v is an interface variable in ϕ but it occurs in no 1-pure literal in µ, then v has
no “interface role” for µ, so that every interface equality containing v can be ignored by µe .
201
R. Sebastiani
Boolean search on eij ’s and eij -deduction steps) are saved in the form of clauses and thus
they can be reused to check the T1 ∪ T2 -consistency of all subsequent branches. This allows
from pruning search and prevents redoing the same search/deduction steps from scratch.
Third, in case of non-convex theories, the case-splits caused by the deduction of disjunctions of eij ’s by the Ti -solvers are handled directly by the DPLL engine. (Notice that,
unlike with splitting on demand in §6.7, here we refer to the case-splits which are necessary
to handle the deductions performed by the other Ti -solver, rather to those which may be
necessary to perform such deductions.)
Fourth, Dtc allows for using Ti -solvers with partial or no eij -deduction capability,
because part of or all the eij -deductions can be substituted by extra Boolean search on
the eij ’s performed by the DPLL engine. Thus, by adopting T -solvers with different eij deduction power, one can trade part or all the (possibly very expensive) eij -deduction effort
for extra Boolean search.
[45] analyzes the enlargement of the Boolean search space in Dtc wrt. N.O. procedure,
and proves the following facts.
1. Under the same working hypotheses of N.O. procedure (stably-infinite theories, incremental, backtrackable and eij -deduction-complete Ti -solvers), there is a “N.O.mimicking” strategy for Dtc s.t. no extra Boolean search on the eij ’s is performed
wrt. N.O procedure: in case of convex theories, no extra Boolean search on eij ’s
is performed; in case on non-convex theories, the only Boolean search on eij ’s performed is that caused by the case-splits induced by the disjunctions of eij ’s (which
N.O. procedure must perform internally to the combined T -solver).
2. If some Ti -solver is not eij -deduction complete, then the “N.O.-mimicking” strategy
for Dtc mimics the eij -deductions performed by N.O. procedure via T -backjumping,
and the cost in terms of Boolean search can be controlled in terms of the “quality”
of the T -conflict sets η returned by the Ti -solvers: the more redundant ¬eij ’s are
removed from η, the more branches are pruned; if the η’s contain no redundant ¬eij ,
then the Boolean search reduces to only one branch for every eij -deduction mimicked.
Result 1 states that, under the same working hypotheses, the Dtc procedure is “at least as
good as the N.O. procedure” in terms of Boolean search space. Result 2 states that, if the
Ti -solver have partial or no eij -deduction capabilities, then the amount of extra Boolean
search required can be reduced down to a negligible amount by reducing the presence of
redundant negated disequalities in the T -conflict sets returned by the T -solvers.
We illustrate all these facts with the following examples.
first the case in which both Ti -solvers are eij -complete.
54.
As in §8.2, we consider
Example 8.7. [45] Consider again the EU F ∪ LA(Q) formula ϕ of Example 8.4. Figure 18
illustrates a Dtc execution when both T i -solvers are eij -deduction complete.
54. In all the following examples Dtc adopts the “N.O.-mimicking strategy” described in [45]. Notationally,
µ′T i , µ′′T i , µ′′′
T i denote generic subsets of µT i s.t. Ti ∈ {EU F , LA(Q), LA(Z)}, and “Cij ” denotes either
the T -deduction clause causing the T -propagation of (vi = vj ) or the conflicting clause causing the
backjump to (vi = vj ).
202
Lazy Satisfiability Modulo Theories
µEU F :
{(v3 = h(v0 )), (v4 = h(v1 )), ¬(v6 = v7 ),
(v6 = f (v2 )), (v7 = f (v5 ))}
RESET5
(v5 = 0)
LA(Q)-deduce (v0 = v1 )
learn C01 (v0 = v1 )
EU F-deduce (v3 = v4 ) (v3 = v4 )
learn C34
LA(Q)-deduce (v2 = v5 ) (v2 = v5 )
learn C25
EU F-unsat
C¬RESET5
µLA(Q) :
{(v0 ≥ v1 ), (v0 ≤ v1 ),
(v2 = v3 − v4 )}
¬RESET5
Search for an assignment µ
propositionally satisfying ϕ
(v5 = v8 )
LA(Q)-deduce (v0 = v1 )
Search on eij ’s:
(v0 = v1 )
′
learn C01
check the T1 ∪ T2 (v3 = v4 )
consistency of µ
C01 : (µ′LA(Q) ) → (v0 = v1 )
Satisfiable
C34 : (µ′EUF ∧ (v0 = v1 )) → (v3 = v4 )
C25 : (µ′′LA(Q) ∧ (v5 = 0) ∧ (v3 = v4 )) → (v2 = v5 )
C¬RESET5 : (µ′′EU F ∧ (v2 = v5 )) → ⊥
Figure 18. DTC execution of Example 8.7, with eij -deduction-complete Ti -solvers.
On the left branch (when RESET5 is selected), after the unit-propagation of (v5 = 0),
the LA(Q)-solver deduces (v0 = v1 ), and thus by (v) the clause C01 is learned and (v0 = v1 )
is unit-propagated. Consequently, the EU F-solver can deduce (v3 = v4 ), causing the learning
of C34 and the unit-propagation of (v3 = v4 ), which in turn causes the LA(Q)-deduction of
(v2 = v5 ), the learning of C25 and the unit-propagation of (v2 = v5 ).
At this point, µ′′EU F ∪ {(v2 = v5 )} is found EU F-inconsistent, so that the EU F-solver
returns (the negation of ) the clause C¬RESET5 , which is resolved backward with the clauses
C25 , C34 , C01 , and (RESET5 → (v5 = 0)) forcing Dtc to backjump up to the last branching
point and to unit-propagate ¬RESET5 . Hence (v5 = v8 ) is unit-propagated on the clause
¬RESET5 → (v5 = v8 ), which produces another assignment propositionally satisfying ϕ.
Then, (v0 = v1 ) and hence (v3 = v4 ) are unit-propagated on C01 and C34 respectively,
with no need to call the T -solvers. 55. At this point, since neither Ti -solver can deduce any
new eij , by (vi) Dtc concludes that ϕ is EU F ∪ LA(Q)-satisfiable.
Notice that the left branch of the Dtc search tree of Figure 18 mimics directly that of
the N.O. execution of Figure 16. No extra Boolean search is performed by Dtc. In the right
branch of the Dtc search tree, instead, all values are assigned directly by unit-propagation.
Thus, Dtc “remembers” in form of clauses the eij -deductions performed in the first branch
and reuses them in the subsequent branch so that to avoid redoing them from scratch.
Example 8.8. [45] Consider again the conjunction of literals µ =def µEU F ∧ µLA(Z) of
Examples 8.2 and 8.5. We assume here that both the EU F- and LA(Z)-solver’s have no
eij -deduction capabilities, and that they always return conflict sets which do not contain
redundant negated interface equalities. One possible session of Dtc is depicted in Fig. 19.
Initially, both µLA(Z) and µEU F are found consistent in each of the theories by the
respective Ti -solvers. Then Dtc starts selecting new ¬eij ’s, and proceeds without causing
conflicts, until it selects ¬(v3 = v5 ) , which causes a LA(Z) conflict on the conflicting clause
C35 , and forces Dtc to backjump and to unit-propagate (v3 = v5 ).
Then, in short, T -DPLL performs a Boolean search on (the negated values of ) eij ’s,
backjumping also on the T -conflicting clauses C13 , C56 , C23 , C24 and C14 , which in the
55. Here we assume for simplicity that µ′LA(Q) in C01 does not contain the redundant literal (v5 = 0). If this
is not the case, one more T -propagation of (v0 = v1 ) is needed.
203
R. Sebastiani
µEU F :
¬(f (v1) = f (v2))
¬(f (v2) = f (v4))
f (v3) = v5
f (v1) = v6
µLA(Z):
v1 ≥ 0
v5 = v4 − 1
v1 ≤ 1
v3 = 0
v2 ≥ v6
v4 = 1
v2 ≤ v6 + 1
v3 = v5
¬(v3 = v5)
v1 = v4
LA(Z)-unsat, C35
¬(v1 = v4)
Satisfiable
v1 = v3
¬(v1 = v3)
v5 = v6
LA(Z)-unsat, C13
v2 = v4
EUF-unsat, C14
¬(v5 = v6)
EU F-unsat, C56
¬(v2 = v4)
v2 = v3
¬(v2 = v3)
EU F-unsat, C24
LA(Z)-unsat, C23
Search for an assignment µ
propositionally satisfying ϕ
Search on eij ’s:
check the T1 ∪ T2consistency of µ
C35 : µ′LA(Z) → (v3 = v5)
C13 : µ′′LA(Z) → ((v1 = v3) ∨ (v1 = v4))
C56 : (µ′EU F ∧ (v1 = v3)) → (v5 = v6)
C23 : (µ′′′
LA(Z) ∧ (v5 = v6 )) → ((v2 = v3 ) ∨ (v2 = v4 ))
C24 : (µ′′EU F ∧ (v1 = v3) ∧ (v2 = v3)) → ⊥
C14 : (µ′′′
EU F ∧ (v1 = v3 ) ∧ (v2 = v4 )) → ⊥
Figure 19. The Dtc search tree for Example 8.8 on LA(Z) ∪ EUF , with no eij -deduction.
end causes the unit-propagation of (v1 = v4 ). Then, T -DPLL selects a sequence of ¬eij ’s
without generating conflicts, and concludes that the formula is T1 ∪ T2 -satisfiable.
Comparing Figures 17 and 19, we notice that here Dtc mimics the behaviour of N.O.
procedure in the sense that the backjumping steps on the clauses C35 , C13 , C56 , and C23
mimic the effects of performing the corresponding eij -deductions in Figure 17. We also
notice that the case-splits induced by th eij -deductions in LA(Z) are handled within the
DPLL search in Dtc. Moreover, we notice that in Figure 19 Dtc explores only seven
branches, four for mimicking the corresponding eij -deductions and three for mimicking the
three case-split branches in Figure 17.
We refer the reader to [39, 40, 45] for a more detailed description of Dtc and for an
analytical comparison between N.O. and Dtc procedures.
8.4 SMT(EU F ∪ T ) via Ackermann’s expansion
When one of the theories Ti is EU F, one further approach to the SMT (T1 ∪ T2 ) problem
is to eliminate uninterpreted function symbols by means of Ackermann’s expansion [1] so
that to obtain an SMT (T ) problem with only one theory. The method works by replacing
every function application occurring in the input formula ϕ with a fresh variable and then
adding to ϕ all the needed functional congruence constraints. The new formula ϕ′ obtained
is equisatisfiable with ϕ, and contains no uninterpreted function symbols.
First, each distinct function application f (t1 , . . . , tn ) is replaced by a fresh variable
vf (t1 ,...,tn ) . Then, for every pair of distinct applications of the same function, f (t1 , . . . , tn )
204
Lazy Satisfiability Modulo Theories
and f (u1 , . . . , un ), a congruence constraint
arity(f )
^
i=1
(ack(ti ) = ack(ui )) → (vf (t1 ,...,tn ) = vf (u1 ,...,un ) ),
(25)
is added, where ack is a function that maps each function application g(w1 , . . . , wn ) into
the corresponding variable vg(w1 ,...,wn ) , each variable into itself and is homomorphic wrt.
the interpreted symbols. The atom (ack(ti ) = ack(ui )) is not added if the two sides of the
equality are syntactically identical; if so, the corresponding implication in (25) is dropped.
Example 8.9. Consider the EU F ∪ LA(Q) pure formula ϕ of examples 8.4 and 8.7:
EU F :
(v3 = h(v0 )) ∧ (v4 = h(v1 )) ∧ (v6 = f (v2 )) ∧ (v7 = f (v5 ))∧
LA(Q) : (v0 ≥ v1 ) ∧ (v0 ≤ v1 ) ∧ (v2 = v3 − v4 ) ∧ (RESET5 → (v5 = 0))∧
Both :
(¬RESET5 → (v5 = v8 )) ∧ ¬(v6 = v7 ).
(26)
By replacing every function application with a fresh variable, and adding all the functional
consistency constraints, we obtain the SMT(LA(Q)) formula:
LA(Q) :
(v3 = vh(v0 ) ) ∧ (v4 = vh(v1 ) ) ∧ (v6 = vf (v2 ) ) ∧ (v7 = vf (v5 ) )∧
(v0 ≥ v1 ) ∧ (v0 ≤ v1 ) ∧ (v2 = v3 − v4 ) ∧ (RESET5 → (v5 = 0))∧
(¬RESET5 → (v5 = v8 )) ∧ ¬(v6 = v7 )∧
Congruence : ((v0 = v1 ) → (vh(v0 ) = vh(v1 ) )) ∧ ((v2 = v5 ) → (vf (v2 ) = vf (v5 ) )),
(27)
which can be solved by a SMT(LA(Q)) solver. Notice that four new equalities and two
congruence constraints have been added.
Notice that in Example 8.9 we have considered a pure formula ϕ, which might be the result
of purifying some non-pure formula ϕ′ . If so, applying Ackermann’s expansion directly to
ϕ′ might result into a more compact formula than (27). [44] presents a comparison between
Dtc and Ackermann’s expansion on SMT(EU F ∪ T ).
An interesting variant of Ackermann’s expansion has been introduced for eager encodings
(see §9.3) in [48]. This method differs from that in [1] because it replaces each term with
a nested series of if-then-else constraints. This allows for effectively exploiting the presence
of positive equalities. (We refer the reader to [48] for details.)
205
R. Sebastiani
9. Related approaches for SMT
All the most extensive empirical evaluations performed in the last years [85, 65, 133, 38, 18,
164, 165] seem to confirm the fact that currently all the most efficient SMT tools are based
on the lazy approach combining state-of-the-art DPLL implementations with specialized
Ti -solvers. In this section we discuss this fact, and survey the current alternatives.
9.1 Alternative Enumerators for lazy SMT
Most state-of-the-art lazy SMT tools use DPLL as Enumerator. We first try to motivate
this fact (§9.1.1), and then we survey some promising alternatives (§9.1.2 and §9.1.3).
9.1.1 Why DPLL?
We believe there are a few facts which contribute to the popularity of DPLL as Enumerator in lazy SMT tools.
From a theoretical viewpoint, DPLL has some important properties which make it very
suitable for implementing an Enumerator [93, 10]. First, DPLL performs a depth-firstsearch on assignments, so that it requires a polynomial amount of memory. 56. This is
not the case, e.g., of OBDD’s [46]. Second, DPLL allows for implementing Enumerators which are intrinsically non-redundant, in the sense that they avoid generating partial
assignments which cover areas of the Boolean search space which are already covered by
previously-generated assignments. This is not the case, e.g., of semantic tableaux [166]. We
refer the reader to [10] for a more detailed explanation on these issues.
From a more practical perspective, a few other facts contribute to the success of DPLL
in lazy SMT. First, most efficient (complete) SAT solvers are DPLL implementations, and
the source code of extremely efficient implementations of DPLL is available from the shelf.
In particular, by integrating a state-of-the-art DPLL solver, one can benefit for free of all
the enhancements briefly described in §3.1. Second, there is a wide and detailed literature on
efficient DPLL solvers, involving both high-level algorithmical issues and implementation
tricks, so that one can achieve all the information needed to successfully implement an
efficient DPLL-based Enumerator in-house. Third, DPLL is more a family of algorithms
than one single algorithm: a plethora of variants of DPLL can be constructed on, e.g.,
different literal selection heuristics, different forms of preprocessing and simplification, and
different strategies for restarts, conflict-set generation, clause learning and discharging. This
gives a wide choice of possibilities for customizing an ad-hoc variant of DPLL.
9.1.2 OBDD-based SMT solvers
In the Model Checking community there has been some work on integrating Ordered Binary Decision Diagrams - OBDD’s [46] with theory-information in order to handle complex
verification problems. [51] integrated OBDD’s with an (incomplete) quadratic constraint
solver to verify transition systems with integer data values; [127] developed Difference Decision Diagrams (DDDs), OBDD-like data structures handling Boolean combinations of
temporal constraints, and used them to verify timed systems; [94] developed OBDD-based
56. Here we assume that a proper strategy of clause learning and discharging is implemented to avoid
learning an exponential number of clauses. See §3.
206
Lazy Satisfiability Modulo Theories
procedures for EU F; [187] developed a library of procedures combining OBDD’s and a
solver for Pressburger arithmetic, and used them to verify infinite-state systems. 57. [144]
combine OBDDs with superposition theorem provers (see also §9.2). In a more general
perspective, [2] introduced an optimized way to efficiently integrate OBDD’s with solvers
for decidable theories. Notably, all these approaches adopt a technique similar to early
pruning (§6.3) to reduce the size of the final OBDD. Unfortunately, all these approaches
inherit from OBDD’s the drawback of requiring exponential space in worst case.
9.1.3 Circuit-based techniques
In the recent years, alternative Boolean solvers which are specialized for reasoning directly
on Boolean circuits, rather than on CNF formulas, have been proposed (see, e.g., [105,
114, 82, 101, 175, 119, 103]). Unlike DPLL on CNF-ized representation of circuits, these
techniques benefit from the structure of the circuit representation, and can perform efficient
Boolean constraint propagation, including that of don’t care values. In particular, [82]
proposed a mixed Circuit-based and DPLL-based approach, combining the power of DPLL
learning with Circuit-based Boolean value propagation and structure-driven search; [175]
generalized the two-watched-literals technique to Boolean circuits.
[119, 103] focused on the problem of enumerating complete sets of assignments for
Boolean circuit representations: [119] developed a group of very efficient techniques, including a mixed conflict/success-driven learning scheme, a form of quantified backjumping
and a practical method for storing solutions into OBDD’s; [103] developed a technique for
the enumeration of prime clauses, which allow for significantly reducing the overall Boolean
search space. Although these techniques were mostly conceived in the context of SATbased unbounded model checking [126], we believe they may find a natural application in
lazy SMT. With some noteworthy exception (e.g., [141] extended the circuit-based solver
in [101] to the domain of BV), the application of circuit-based techniques to lazy SMT is
still ongoing research work.
9.2 The rewrite-based approach for building T -solvers
A relatively-recent and promising approach for building T -solvers is that referred as rewritebased 58. approach [8, 144, 4, 109, 33, 110]. The main idea is that of producing Ti -solvers for
finitely-axiomatizable theories Ti and for their combinations by customizing an equational
FOL theorem prover, in particular one based on the superposition calculus 59. . This is done
by incorporating the axioms of the theory and by introducing ad-hoc control strategies in
order to drive the search.
The key issue for this approach is proving termination: in order to obtain a T -solver,
it is necessary to prove that theorem-proving strategy is bound to terminate on satisfiability problem in the theories of interest. In [8] a refutationally-complete rewrite-based
inference system was shown to generate finitely-many clauses on satisfiability problems in a
57. The list of references presented here is not intended to be exhaustive; rather, it aims at providing some
representative samples of the OBDD-based approach in the literature.
58. Also referred as superposition-based approach.
59. The superposition calculus [14] is a calculus for reasoning in equational FOL, which combines first-order
resolution with ordering-based equality handling. Most current state-of-the-art theorem provers are
based on the superposition calculus (e.g., the superposition-based equational theorem prover E [152]).
207
R. Sebastiani
bunch of theories. [4, 109, 33, 110] extended these results to some more theories and, more
importantly, showed how to apply the methods also to combinations of theories. These
termination results show that, at least in principle, rewrite-based theorem provers could be
used off-the-shelf as validity checkers. To this extent, [4] performed an empirical comparison, showing performances comparable to those of CVCLite. The empirical evaluation of
these techniques, however, is still at a preliminary stage.
We notice that, for this approach, the desirable features of T -solvers described in §4.1
depend on the specific features of the FOL theorem prover used.
• Model generation (§4.1.1) derives straightforwardly from the capability of the FOL
theorem prover of returning a model when the formula is satisfiable. Unfortunately,
superposition-based theorem provers are not always able to do that.
• Conflict set generation (§4.1.2) is achievable, as most provers are capable of producing
a proof for the unsatisfiability of a set of literals, whose leaves can be grouped into a
conflict set.
• Incrementality (§4.1.3) can be achieved, in principle, by means of an incremental FOL
theorem prover. Unfortunately, incrementality is not a typical item in the agenda
of FOL theorem provers developers. This problem is discussed in [109], where it is
proposed a solution by means of an incremental congruence-closure algorithm.
• Deduction of unassigned literal (§4.1.4) is still an open problem, as far as we are aware.
• Deduction of interface equalities (§4.1.5) can be implemented by means of the techniques described in [109, 110].
On the whole the rewrite-based approach has, at least in principle, some very nice
features. First, it is conceptually simple and elegant. Second, it benefits automatically and
nearly for free of the improvements in the technology of superposition-based FOL theorem
provers. Third, the task of proving the correctness is reduced to the (typically simpler)
task of proving the termination for the rules of superposition calculus [8]. Fourth, and
probably most important, under some sufficient conditions [4], a combined T1 ∪ T2 -solver
can be obtained from T1 -solver and T2 -solver by providing the union of the axiomatizations
of T1 and T2 .
On the negative side, we notice that, in order to get extra functionalities (e.g., incrementality, deduction of unassigned literals) one must put the hands into the code of FOL
theorem provers, which are typically very sophisticated and complicated tools. Finally, the
approach is not completely mature yet and, although promising, the performances are not
yet comparable with those of state-of-the-art lazy tools implementing specialized T -solvers.
Currently, the approach has focused on theories of interest for the verification of software
programs, including AR (with and without extensionality) and LI (§4.2), and other theories
not explicitly mentioned in this paper — like those of records, finite sets, integer offsets—
and of their combination. We refer the reader to [3] for a more detailed survey.
208
Lazy Satisfiability Modulo Theories
9.3 The eager approach to SMT
For some theories T , a different approach to the usage of SAT tools for SMT(T ) is that of
reducing T -satisfiability to SAT: the input T -formula is translated into an equi-satisfiable
Boolean formula, and a SAT solver is used to check its satisfiability. (This approach is often
called eager, in contra-position to the lazy approach described in §5 and §6. 60. )
Effective encodings into SAT have been conceived for a significant amount of first-order
theories of interest for formal verification, including EU F, CLU 61. , DL, SUF 62. , LA,
and AR [181, 47, 171, 170, 156]. In particular, two main families of encodings are worthmentioning:
• in the small-domain encoding, SD [47, 174], for each variable v in a finite model
an appropriate range of values |v| is found. Then each v is encoded into a vector of
⌈log2 (|v|)⌉ Boolean variables. Binary arithmetic is then used to transform the original
input formula into a Boolean formula;
• in the per-constraint-encoding [94, 171, 170] a new Boolean variable Aψ is introduced
for every atom ψ in the input formula ϕ (i.e., Aψ := T 2B(ψ)). Then ϕ is encoded
into a Boolean formula ϕp ∧ ϕT , ϕp being T 2B(ϕ) and ϕT being a Boolean formula
encoding a set of constraints over the variables in ϕp which mimic the constraints
induced in T on the corresponding T -atoms. (E.g., transitivity constraints.) Notice
that, unlike with static learning in lazy SMT (§6.2), ϕT may contain many Boolean
variables which do not occur in ϕp . E.g., if T is DL and ϕ contains (x ≤ y) and
(y ≤ z) but not (x ≤ z), then the new Boolean atom A(x≤z) must be introduced and
ϕEU F will contain the clause (A(x≤y) ∧ A(y≤z) ) → A(x≤z) .
A mixed method [156] combines the strengths of the two encoding schemata, producing a
very significant performance improvements over both of them.
The eager approach, which has been pioneered by the UCLID tool [156, 180, 117],
leverages on the accuracy of the encodings and on the effectiveness of propositional SAT
solvers. In particular, it presents some nice features.
• It is relatively easy to implement: once the encoding has been formally defined, the
whole implementation reduces to that of an encoder, as the whole search can be
performed by some state-of-the-art SAT solver.
• The proof of soundness and completeness of the whole procedure reduces to proving
the fact that the encoding is satisfiability preserving.
60. The adjectives “lazy” and “eager” derive from the fact that, in the former approach the theory information is used “lazily” during the search, as the Boolean models are abstracted and checked for
T -consistency one-by-one, whilst in the latter approach the whole theory information is used “eagerly”
from the beginning, as the whole input formula is converted one-shot into a Boolean formula, so that its
Boolean models are abstracted and searched altogether.
61. CLU is the theory of Counter arithmetic with Lambda expressions and Uninterpreted functions. This
theory generalizes EU F with constrained lambda expressions, ordering, and successor and predecessor
functions [47].
62. SU F is the logic of Separation predicates and Uninterpreted Functions, combining EU F and DL [156].
209
R. Sebastiani
• It benefits automatically and for-free of all improvements in the efficiency of state-ofthe-art SAT solvers.
In particular, the UCLID tool has achieved important results in the formal verification of
pipelined microprocessors (see, e.g., [48, 181, 182]).
However, the eager approach often suffers from a blow-up in the encoding to propositional logic. The bottleneck is even more evident in the case of theories involving arithmetic,
such as DL and LA [171, 170]. E.g., although SMT(DL) and SMT(LA) are NP-complete,
the encodings proposed in [171] and [170] blow up exponentially and doubly-exponentially
respectively, because they mimic the Fourier-Motzkin expansion of DL constraints and linear inequalities respectively. In fact, in recent papers UCLID has been totally outperformed
by DPLL-based lazy tools [85, 65, 38, 133], and no eager SMT tool took part at the SMT
competitions [18, 164, 165]. As a consequence, there seems to be a general consensus that
the eager approach is no more at the state-of-the-art of SMT tools, at least in terms of
efficiency.
9.4 Mixed eager/lazy approaches
Recently, some mixed eager/lazy approaches have been proposed.
In [111] some of the UCLID authors have explored a mixed eager/lazy approach for
LA, based on an alternation of SD encoding and lazy SMT. In brief, the technique works
as follows. Starting from a small range, the SD encoding ϕ∗ of the input formula ϕ is
produced. If ϕ∗ is satisfiable, then ϕ is T -satisfiable. Otherwise, the unsatisfiable core ψ p
of ϕ∗ is produced, and the corresponding T -formula ψ is given in input to a lazy SMT solver.
(Notice that ψ is a subformula of ϕ, possibly much smaller than ϕ.) If ψ is T -unsatisfiable,
then ϕ is T -unsatisfiable. Otherwise, a solution for ϕ is used to compute a new (bigger)
range, and the loop proceeds. The process is guaranteed to terminate because (if ϕ is T satisfiable) a sufficiently big range is eventually reached and (if ϕ is T -unsatisfiable) only a
finite number of ψ’s can be generated.
[83] presented SDSAT, a mixed eager/lazy tool for DL. SDSAT works in two phases:
first (allocation phase) it allocates non-uniform SD ranges for each variable (without performing the SD encoding one-shot); then (solve phase) it uses a lazy refinement approach
for searching a model within the allocated ranges. A novel algorithm for range allocation
is also presented, which much better performances wrt. previous ones.
[108] presented a completely-different mixed eager/lazy approach. Within a standard
lazy framework, they proposed a novel T -solver for DL(Z), which is particularly focused on
efficiently handling disequalities. The T -solver is organized according to a layered schema
(§4.3): first, positive equalities are processed, equivalence classes are computed and variable
substitutions are performed, so that to eliminate them from the assignment; the remaining
inequalities are then entered a certain amount of graph-based procedures (including SCCpartitioning and standard negative-path detection): if a solution is found, it is checked
against the remaining disequalities. If also this technique fails, everything is encoded into
SAT by means of SD encoding and is is solved by an incremental SAT solver (which can
benefit from previous calls on other assignments). This technique showed good performances
wrt. state-of-the-art tools when lots of disequalities come into play.
210
Lazy Satisfiability Modulo Theories
References
[1] W. Ackermann. Solvable Cases of the Decision Problem. North Holland Pub. Co.,
Amsterdam, 1954.
[2] A. Armando. Simplifying OBDDs in Decidable Theories. In Proc. PDPAR’03., 2003.
[3] A. Armando, M. P. Bonacina, S. Ranise, , and S. Schulz. New results on rewrite-based
satisfiability procedures. ACM Transactions on Computational Logic (TOCL), 2008.
To appear.
[4] A. Armando, M. P. Bonacina, S. Ranise, and S. Schulz. On a rewriting approach
to satisfiability procedures: extension, combination of theories and an experimental
appraisal. In Proc. of FroCoS’2005, volume 3717 of LNCS. Springer, 2005.
[5] A. Armando, C. Castellini, and E. Giunchiglia. SAT-based procedures for temporal
reasoning. In Proc. European Conference on Planning, CP-99, 1999.
[6] A. Armando, C. Castellini, E. Giunchiglia, and M. Maratea. A SAT-based Decision
Procedure for the Boolean Combination of Difference Constraints. In Proc. SAT’04,
2004.
[7] A. Armando and E. Giunchiglia. Embedding Complex Decision Procedures inside
an Interactive Theorem Prover. Annals of Mathematics and Artificial Intelligence,
8(3–4):475–502, 1993.
[8] A. Armando, S. Ranise, and M. Rusinowitch. A Rewriting Approach to Satisfiability
Procedures. Journal of Information and Computation — Special Issue on Rewriting
Techniques and Applications (RTA’01), 183(2), June 2003.
[9] G. Audemard, P. Bertoli, A. Cimatti, A. Kornilowicz, and R. Sebastiani. A SAT Based
Approach for Solving Formulas over Boolean and Linear Mathematical Propositions.
In Proc. CADE’2002., volume 2392 of LNAI. Springer, July 2002.
[10] G. Audemard, P. Bertoli, A. Cimatti, A. Kornilowicz, and R. Sebastiani. Integrating
Boolean and Mathematical Solving: Foundations, Basic Algorithms and Requirements. In Proc. AIARSC’2002, volume 2385 of LNAI. Springer, 2002.
[11] G. Audemard, M. Bozzano, A. Cimatti, and R. Sebastiani. Verifying Industrial Hybrid
Systems with MathSAT. In Proc. BMC’04, volume 89/4 of ENTCS. Elsevier, 2003.
[12] G. Audemard, A. Cimatti, A. Kornilowicz, and R. Sebastiani. SAT-Based Bounded
Model Checking for Timed Systems. In Proc. FORTE’02., volume 2529 of LNCS.
Springer, November 2002.
[13] F. Bacchus and J. Winter. Effective Preprocessing with Hyper-Resolution and Equality Reduction. In Proc. Sixth International Symposium on Theory and Applications
of Satisfiability Testing, 2003.
[14] L. Bachmair and H. Ganzinger. Rewrite-Based Equational Theorem Proving with
Selection and Simplification. Journal of Logic and Computation, 3(4), 1994.
211
R. Sebastiani
[15] G. J. Badros and A. Borning. The Cassowary Linear Arithmetic Constraint Solving
Algorith. ACM Transactions on Computer Human Interaction, 8(4):267–306, december 2001.
[16] T. Ball, B. Cook, S. K. Lahiri, and L. Zhang. Zapato: Automatic Theorem Proving for
Predicate Abstraction Refinement. In Proc. CAV’04, volume 3114 of LNCS. Springer,
2004.
[17] C. Barrett and S. Berezin. CVC Lite: A New Implementation of the Cooperating
Validity Checker. In Proceedings of the 16th International Conference on Computer
Aided Verification (CAV ’04), volume 3114 of LNCS. Springer, 2004.
[18] C. Barrett, L. de Moura, and A. Stump. SMT-COMP: Satisfiability Modulo Theories
Competition. In Proc. CAV’05, volume 3576 of LNCS. Springer, 2005.
[19] C. Barrett, D. Dill, and A. Stump. Checking Satisfiability of First-Order Formulas by
Incremental Translation to SAT. In 14th International Conference on Computer-Aided
Verification, 2002.
[20] C. Barrett, R. Nieuwenhuis, A. Oliveras, and C. Tinelli. Splitting on Demand in SAT
Modulo Theories. In Proc. LPAR’06, volume 4246 of LNAI. Springer, 2006.
[21] C. Barrett, I. Shikanian, and C. Tinelli. An Abstract Decision Procedure for Satisfiability in the Theory of Recursive Data Types. In Proc. PDPAR’06, volume 174 of
ENTCS. Elsevier, 2007.
[22] C. Barrett and C. Tinelli. Cvc3. In Proc. CAV’07, volume 4590 of Lecture Notes in
Computer Science. Springer, 2007.
[23] C. W. Barrett. Checking Validity of Quantifier-Free Formulas in Combinations of
First-Order Theories. PhD thesis, Stanford University, january 2003.
[24] C. W. Barrett, D. L. Dill, and J. R. Levitt. A decision procedure for bit-vector
arithmetic. In Proc. DAC ’98. ACM Press, 1998.
[25] C. W. Barrett, D. L. Dill, and A. Stump. A generalization of Shostak’s method
for combining decision procedures. In Frontiers of Combining Systems (FROCOS),
LNAI. Springer, April 2002. S. Margherita Ligure, Italy.
[26] C. W. Barrett, Y. Fang, B. Goldberg, Y. Hu, A. Pnueli, and L. D. Zuck. TVOC: A
Translation Validator for Optimizing Compilers. In Proc. CAV’05, volume 3576 of
LNCS. Springer, 2005.
[27] P. Baumgartner and C. Tinelli. The Model Evolution Calculus. In F. Baader, editor,
Proc. CADE-19, volume 2741 of LNAI, pages 350–364. Springer, 2003.
[28] R. J. Bayardo and R. C. Schrag. Using CSP Look-Back Techniques to Solve RealWorld SAT instances. In Proc. AAAI’97, pages 203–208. AAAI Press, 1997.
212
Lazy Satisfiability Modulo Theories
[29] S. Berezin, V. Ganesh, and D. L. Dill. An online proof-producing decision procedure
for mixed-integer linear arithmetic. In TACAS’03, volume 2619 of LNCS, pages
521–536. Springer, 2003.
[30] A. Biere, A. Cimatti, E. Clarke, and Y. Zhu. Symbolic model checking without BDDs.
In Proc. CAV’99, 1999.
[31] A. Bockmayr and V. Weispfenning. Solving Numerical Constraints. In Handbook of
Automated Reasoning, pages 751–842. MIT Press, 2001.
[32] M. P. Bonacina and M. Echenim. Rewrite-Based Satisfiability Procedures for Recursive Data Structures. In Proc. PDPAR’06, volume 174 of ENTCS. Elsevier, 2007.
[33] M. P. Bonacina, S. Ghilardi, E. Nicolini, S. Ranise, and D. Zucchelli. Decidability and
Undecidability Results for Nelson-Oppen and Rewrite-Based Decision Procedures. In
Proc. of IJCAR’06, volume 4130 of LNAI, 2006.
[34] A. Borälv. A Fully Automated Approach for Proving Safety Properties in Interlocking Software Using Automatic Theorem-Proving. In Proceedings of the Second
International ERCIM Workshop on Formal Methods for Industrial Critical Systems,
1997.
[35] A. Borning, K. Marriott, P. Stuckey, and Y. Xiao. Solving linear arithmetic constraints
for user interface applications. In Proc. UIST’97, pages 87–96. ACM, 1997.
[36] M. Bozzano, R. Bruttomesso, A. Cimatti, A. Franzen, Z. Hanna, Z. Khasidashvili,
A Palti, and R. Sebastiani. Encoding RTL Constructs for MathSAT: a Preliminary
Report. In Proc. PDPAR’05, volume 144 of ENTCS. Elsevier, 2006.
[37] M. Bozzano, R. Bruttomesso, A. Cimatti, T. Junttila, P.van Rossum, S. Schulz, and
R. Sebastiani. An incremental and Layered Procedure for the Satisfiability of Linear
Arithmetic Logic. In Proc. TACAS’05, volume 3440 of LNCS. Springer, 2005.
[38] M. Bozzano, R. Bruttomesso, A. Cimatti, T. Junttila, P.van Rossum, S. Schulz, and
R. Sebastiani. MathSAT: A Tight Integration of SAT and Mathematical Decision
Procedure. Journal of Automated Reasoning, 35(1-3), October 2005.
[39] M. Bozzano, R. Bruttomesso, A. Cimatti, T. Junttila, P. van Rossum, S. Ranise, and
R. Sebastiani. Efficient Satisfiability Modulo Theories via Delayed Theory Combination. In Proc. CAV 2005, volume 3576 of LNCS. Springer, 2005.
[40] M. Bozzano, R. Bruttomesso, A. Cimatti, T. Junttila, P. van Rossum, S. Ranise, and
R. Sebastiani. Efficient Theory Combination via Boolean Search. Information and
Computation, 204(10), 2006.
[41] R. Brafman. A simplifier for propositional formulas with many binary clauses. In
Proc. IJCAI01, 2001.
[42] R. Brinkmann and R. Drechsler. RTL-datapath verification using integer linear programming. In Proc. ASP-DAC 2002, pages 741–746. IEEE, 2002.
213
R. Sebastiani
[43] R. Bruttomesso, A. Cimatti, A. Franzen, A. Griggio, Z. Hanna, A. Nadel, A. Palti, and
R. Sebastiani. A Lazy and Layered SMT(BV) Solver for Hard Industrial Verification
Problems. In Proc. CAV’07, volume 4590 of LNCS. Springer, 2007.
[44] R. Bruttomesso, A. Cimatti, A. Franzén, A. Griggio, A. Santuari, and R. Sebastiani.
To Ackermann-ize or not to Ackermann-ize? On Efficiently Handling Uninterpreted
Function Symbols in SM T (EU F ∪ T ). In Proc. LPAR’06, volume 4246 of LNAI.
Springer, 2006.
[45] R. Bruttomesso, A. Cimatti, A. Franzén, A. Griggio, and R. Sebastiani. Delayed Theory Combination vs. Nelson-Oppen for Satisfiability Modulo Theories: a Comparative
Analysis. In Proc. LPAR’06, volume 4246 of LNAI. Springer, 2006.
[46] R. E. Bryant. Graph-Based Algorithms for Boolean Function Manipulation. IEEE
Transactions on Computers, 35(8):677–691, August 1986.
[47] R. E. Bryant, S. K. Lahiri, and S. A. Seshia. Modeling and Verifying Systems Using a
Logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions.
In Proc. CAV’02, volume 2404 of LNCS. Springer, 2002.
[48] R.E. Bryant, S. German, and M.N. Velev. Exploiting Positive Equality in a Logic
of Equality with Uninterpreted Functions. In Proc. CAV’99, volume 1633 of LNCS.
Springer, 1999.
[49] J. R. Burch and D. L. Dill. Automatic Verification of Pipelined Microprocessor Control. In Proc. CAV ’94, volume 818 of LNCS. Springer, 1994.
[50] C. Castellini, E. Giunchiglia, and A. Tacchella. SAT-based planning in complex domains: Concurrency, constraints and nondeterminism. Artificial Intelligence, 147(12):85–117, 2003.
[51] W. Chan, R. J. Anderson, P. Beame, and D. Notkin. Combining constraint solving and
symbolic model checking for a class of systems with non-linear constraints. In Proc.
CAV’97, volume 1254 of LNCS, pages 316–327, Haifa, Israel, June 1997. Springer.
[52] B. V. Cherkassky and A. V. Goldberg. Negative-cycle detection algorithms. Mathematical Programming, 85(2):277–311, 1999.
[53] . H. Cormen, C. E. Leiserson, and R. R. Rivest. Introduction to Algorithms. MIT
Press, 1998.
[54] S. Cotton and O. Maler. Fast and Flexible Difference Logic Propagation for DPLL(T).
In Proc. SAT’06, volume 4121 of LNCS. Springer, 2006.
[55] S. Cotton and O. Maler. Satisfiability Modulo Theory Chains with DPLL(T). Unpublished, 2006. Available from http://www-verimag.imag.fr/~maler/.
[56] CVC. http://verify.stanford.edu/CVC.
[57] CVCLite. http://verify.stanford.edu/CVCL.
214
Lazy Satisfiability Modulo Theories
[58] D. Cyrluk, M. Oliver Möller, and H. Ruess. An efficient decision procedure for the
theory of fixed-sized bit-vectors. In Proceedings of CAV’97, volume 1254 of LNCS,
pages 60–71. Springer, 1997.
[59] M. Davis, G. Logemann, and D. Loveland. A machine program for theorem proving.
Journal of the ACM, 5(7), 1962.
[60] M. Davis and H. Putnam. A computing procedure for quantification theory. Journal
of the ACM, 7:201–215, 1960.
[61] G. de Micheli. Synthesis of Digital Circuits. Stanford University, 1993.
[62] L. de Moura and N. Bjørner. Model-based Theory Combination. In Proc. of the 5th
Workshop on Satisfiability Modulo Theories SMT’07, 2007.
http://www.lsi.upc.edu/~oliveras/smt07/.
[63] L. de Moura and N. Bjørner. System Description: Z3 0.1. In 3rd Int. Competition of
Satisfiability Modulo Theories tools, 2007.
http://research.microsoft.com/projects/z3/smtcomp07.pdf.
[64] L. de Moura, S. Owre, H. Ruess, J. Rushby, and N. Shankar. The ICS Decision
Procedures for Embedded Deduction. In Proc. IJCAR’04, volume 3097 of LNCS,
pages 218–222. Springer, 2004.
[65] L. de Moura and H. Ruess. An Experimental Evaluation of Ground Decision Procedures. In Proc. CAV’04, volume 3114 of LNCS. Springer, 2004.
[66] L. de Moura, H. Rueß, and M. Sorea. Lazy Theorem Proving for Bounded Model
Checking over Infinite Domains. In Proc. of the 18th International Conference on
Automated Deduction, volume 2392 of LNCS, pages 438–455. Springer, July 2002.
[67] L. de Moura, H. Rueß, and M. Sorea. Lemmas on Demand for Satisfiability Solvers.
Proc. SAT’02, 2002.
[68] L. deMoura, H. Ruess, and N. Shankar. Justifying Equality. In Proc. PDPAR’04,
volume 68 of ENTCS. Elsevier, 2004.
[69] N. Dershowitz and J.-P. Jouannaud. Rewrite Systems. In J. van Leeuwen, editor,
Handbook of Theoretical Computer Science, pages 243–320. Elsevier and MIT Press,
1990.
[70] D. Detlefs, G. Nelson, and J. Saxe. Simplify: a theorem prover for program checking.
Journal of the ACM, 52(3):365–473, 2005.
[71] B. Dutertre and L. de Moura. A Fast Linear-Arithmetic Solver for DPLL(T). In Proc.
CAV’06, volume 4144 of LNCS. Springer, 2006.
[72] B. Dutertre and L. de Moura. System Description: Yices 1.0. In Proc. SMT-COMP’06,
2006.
215
R. Sebastiani
[73] B. Dutertre and L. de Moura. System Description: Yices 1.0. In Proc. on 2nd SMT
competition, SMT-COMP’06, 2006.
Available at yices.csl.sri.com/yices-smtcomp06.pdf.
[74] N. Een and A. Biere. Effective Preprocessing in SAT Through Variable and Clause
Elimination. In proc. SAT’05, volume 3569 of LNCS. Springer, 2005.
[75] N. Eén and N. Sörensson. An extensible SAT-solver. In Theory and Applications of
Satisfiability Testing (SAT 2003), volume 2919 of LNCS, pages 502–518. Springer,
2004.
[76] H.B. Enderton. A Mathematical Introduction to Logic. Academic Press, 1972.
[77] F. Fallah, S. Devadas, and K. Keutzer. Functional Vector Generation for HDL Models
Using Linear Programming and 3-Satisfiability. In Proc. DAC’98, pages 528–533,
1998.
[78] J.C: Filliâtre, S. Owre, H. Rueß, and N. Shankar. ICS: Integrated Canonizer and
Solver. Proc. CAV’2001, 2001.
[79] C. Flanagan, R. Joshi, X. Ou, and J. B. Saxe. Theorem Proving Using Lazy Proof
Explication. In Proc. CAV 2003, LNCS. Springer, 2003.
[80] P. Fontaine, S. Ranise, and C. G. Zarba. Combining lists with non-stably infinite
theories. In Proc LPAR’04, volume 3452 of LNCS. Springer, 2004.
[81] Anders Franzén. Using Satisfiability Modulo Theories for Inductive Verification of
Lustre Programs. In Proc. BMC’05, volume 144 of ENTCS. Elsevier, 2006.
[82] M. K. Ganai, P. Ashar, A. Gupta, L. Zhang, and S. Malik. Combining strengths of
circuit-based and CNF-based algorithms for a high-performance SAT solver. In Proc.
DAC’02. ACM Press, 2002.
[83] M. K. Ganai, M. Talupur, and A. Gupta. SDSAT: Tight integration of small domain
encoding and lazy approaches in a separation logic solver. In Proc. TACAS’06, volume
3920 of LNCS. Springer, 2006.
[84] V. Ganesh and D. L. Dill. A Decision Procedure for Bit-Vectors and Arrays. In Proc.
Computer Aided Verification, 19th International Conference, CAV 2007, volume 4590
of LNCS, pages 519–531, 2007.
[85] H. Ganzinger, G. Hagen, R. Nieuwenhuis, A. Oliveras, and C. Tinelli. DPLL(T): Fast
Decision Procedures. In Proc. CAV’04, volume 3114 of LNCS. Springer, 2004.
[86] S. Ghilardi. Model theoretic methods in combined constraint satisfiability. Journal
of Automated Reasoning, 33(3), 2005.
[87] S. Ghilardi, E. Nicolini, and D. Zucchelli. A comprehensive framework for combined
decision procedures. In Proc. FroCos’05, volume 3717 of LNCS. Springer, 2005.
216
Lazy Satisfiability Modulo Theories
[88] M. L. Ginsberg. Dynamic Backtracking. Journal of Artificial Intelligence Research
JAIR, 1, 1993.
[89] E. Giunchiglia, F. Giunchiglia, R. Sebastiani, and A. Tacchella. More evaluation
of decision procedures for modal logics. In Proc. Sixth International Conference on
Principles of Knowledge Representation and Reasoning (KR’98), Trento, Italy, 1998.
[90] E. Giunchiglia, F. Giunchiglia, and A. Tacchella. SAT Based Decision Procedures for
Classical Modal Logics. Journal of Automated Reasoning. Special Issue: Satisfiability
at the start of the year 2000, 2001.
[91] E. Giunchiglia, A. Massarotto, and R. Sebastiani. Act, and the Rest Will Follow:
Exploiting Determinism in Planning as Satisfiability. In Proc. AAAI’98, pages 948–
953, 1998.
[92] F. Giunchiglia and R. Sebastiani. Building decision procedures for modal logics from
propositional decision procedures - the case study of modal K. In CADE-13, LNAI,
New Brunswick, NJ, USA, August 1996. Springer Verlag.
[93] F. Giunchiglia and R. Sebastiani. Building decision procedures for modal logics from
propositional decision procedures - the case study of modal K(m). Information and
Computation, 162(1/2), October/November 2000.
[94] A. Goel, K. Sajid, H. Zhou, A. Aziz, and V. Singhal. BDD Based Procedures for a
Theory of Equality with Uninterpreted Functions. In Proc. CAV’98, volume 1427 of
LNCS. Springer, 1998.
[95] E. Goldberg and Y. Novikov. BerkMin: A Fast and Robust SAT-Solver. In Proc.
DATE ’02, page 142, Washington, DC, USA, 2002. IEEE Computer Society.
[96] C. P. Gomes, B. Selman, and H. Kautz. Boosting combinatorial search through
randomization. In Proceedings of the Fifteenth National Conference on Artificial Intelligence (AAAI’98), pages 431–437, Madison, Wisconsin, 1998.
[97] W. Harvey and P. Stuckey. A unit two variable per inequality integer constraint
solver for constraint logic programming. In Australian Computer Science Conference
(Australian Computer Science Communications), pages 102–111, 1997.
[98] J. Hoffmann and R. I. Brafman. Contingent Planning via Heuristic Forward Search
witn Implicit Belief States. In Proceedings of the Fifteenth International Conference
on Automated Planning and Scheduling (ICAPS 2005), pages 71–80. AAAI, 2005.
[99] John N. Hooker and V. Vinay. Branching Rules for Satisfiability. Journal of Automated Reasoning, 15(3):359–383, 1995.
[100] I. Horrocks and P. F. Patel-Schneider. Optimising propositional modal satisfiability
for description logic subsumption. In Proc. AISC’98, volume 1476 of LNAI. Springer,
1998.
217
R. Sebastiani
[101] M. K. Iyer, G. Parthasarathy, and K.-T. Cheng. SATORI - A Fast Sequential SAT
Engine for Circuits. In ICCAD ’03: Proceedings of the 2003 IEEE/ACM international
conference on Computer-aided design. IEEE Computer Society, 2003.
[102] R.G. Jeroslow and J. Wang. Solving Propositional Satisfiability Problems. Annals of
Mathematics and Artificial Intelligence, 1(1-4):167–187, 1990.
[103] H. Jin and F. Somenzi. Prime clauses for fast enumeration of satisfying assignments
to boolean circuits. In Proc. DAC’05. ACM Press, 2005.
[104] P. Johannsen and R. Drechsler. Speeding Up Verification of RTL Designs by Computing One-to-one Abstractions with Reduced Signal Widths. In VLSI-SOC, 2001.
[105] T. A. Junttila and I. Niemelä. Towards an Efficient Tableau Method for Boolean
Circuit Satisfiability Checking. In Proc. CL’00, volume 1861 of LNCS. Springer,
2000.
[106] H. Kautz, D. McAllester, and B. Selman. Encoding Plans in Propositional Logic. In
Proc. KR’96, 1996.
[107] L. G. Khachiyan. A polynomial algorithm in linear programming. Soviet Mathematics
Doklady, 20:191–194, 1979.
[108] H. Kim and F. Somenzi. Finite Instantiations for Integer Difference Logic. In proc
FMCAD’06. ACM Press, 2006.
[109] H. Kirchner, S. Ranise, C. Ringeissen, and D.-K. Tran. On Superposition-Based
Satisfiability Procedures and their Combination. In Proc.ICTAC’05, volume 3722 of
LNCS. Springer, 2005.
[110] H. Kirchner, S. Ranise, C. Ringeissen, and D. K. Tran. Automatic Combinability of
Rewriting-Based Satisfiability Procedures. In Proc. LPAR’06, volume 4246 of LNAI.
Springer, 2006.
[111] D. Kroening, J. Ouaknine, S. Seshia, and O. Strichman. Abstraction-Based Satisfiability Solving of Presburger Arithmetic. In Proc. CAV’04, volume 3114 of LNCS,
pages 308–320. Springer, 2004.
[112] S. Krstic and A. Goel. Architecting Solvers for SAT Modulo Theories: Nelson-Oppen
with DPLL. In Proc. Frontiers of Combining Systems, 6th International Symposium,
FroCoS 2007, volume 4720 of LNAI. Springer, 2007.
[113] S. Krstić, A. Goel, J. Grundy, and C. Tinelli. Combined Satisfiability Modulo Parametric Theories. In TACAS’07, volume 4424 of LNCS. Springer, 2007.
[114] A. Kuehlmann, M. K. Ganai, and V. Paruthi. Circuit-based Boolean Reasoning. In
Proc. DAC ’01. ACM Press, 2001.
[115] S. K. Lahiri and M. Musuvathi. An Efficient Decision Procedure for UTVPI Constraints. In Proc. of 5th International Workshop on Frontiers of Combining Systems
(FroCos ’05), volume 3717 of LNCS. Springer, 2005.
218
Lazy Satisfiability Modulo Theories
[116] S. K. Lahiri and M. Musuvathi. An Efficient Nelson-Oppen Decision Procedure for
Difference Constraints over Rationals. In Proc. Third Workshop on Pragmatics of
Decision Procedures in Automated Reasoning (PDPAR’05), volume 144 of ENTCS.
Elsevier, 2006.
[117] S. K. Lahiri and S. A. Seshia. The UCLID Decision Procedure. In Proc. CAV’04,
volume 3114 of LNCS, 2004.
[118] H. Land and A.G. Doig. An automatic method for solving discrete programming
problems. Econometrica, 28:497–520, 1960.
[119] B. Li, M. S. Hsiao, and S. Sheng. A Novel SAT All-Solutions Solver for Efficient
Preimage Computation. In Proc. DATE’04. IEEE Computer Society, 2004.
[120] C. M. Li. Integrating equivalency reasoning into davis-putnam procedure. In AAAI:
17th National Conference on Artificial Intelligence. AAAI / MIT Press, 2000.
[121] C. M. Li and Anbulagan. Heuristics based on unit propagation for satisfiability problems. In Proceedings of the 15th International Joint Conference on Artificial Intelligence (IJCAI-97), pages 366–371, 1997.
[122] Chu Min Li and Anbulagan. Look-Ahead Versus Look-Back for Satisfiability Problems. In Principles and Practice of Constraint Programming, volume 1330 of LNCS,
1997.
[123] M. Mahfoudh, P. Niebert, E. Asarin, and O. Maler. A Satisfibaility Checker for
Difference Logic. In Proceedings of SAT-02, pages 222–230, 2002.
[124] Z. Manna and C. Zarba. Combining Decision Procedures. In Formal Methods at the
Crossroads: from Panacea to Foundational Support, volume 2787 of LNCS. Springer,
2003.
[125] P. Manolios, S.K. Srinivasan, and D. Vroon. Automatic Memory Reductions for RTLLevel Verification. In Proc. ICCAD 2006. ACM Press, 2006.
[126] K. McMillan. Applying SAT Methods in Unbounded Symbolic Model Checking. In
Proc. CAV ’02, volume 2404 of LNCS. Springer, 2002.
[127] J. Moeller, J. Lichtenberg, H. R. Andersen, and H. Hulgaard. Fully symbolic model
checking of timed systems using difference decision diagrams. In Proc. Workshop on
Symbolic Model Checking (SMC), FLoC’99, Trento, Italy, July 1999.
[128] M. O. Möller and Harald Ruess. Solving bit-vector equations. In Proceedings of
FMCAD’98, 1998.
[129] M. W. Moskewicz, C. F. Madigan, Y. Z., L. Zhang, and S. Malik. Chaff: Engineering
an efficient SAT solver. In Design Automation Conference, 2001.
[130] C. G. Nelson and D. C. Oppen. Simplification by cooperating decision procedures.
TOPLAS, 1(2):245–257, 1979.
219
R. Sebastiani
[131] G. Nelson and D. C. Oppen. Fast Decision Procedures Based on Congruence Closure.
Journal of the ACM, 27(2):356–364, 1980.
[132] R. Nieuwenhuis and A. Oliveras. Congruence closure with integer offsets. In In 10th
Int. Conf. Logic for Programming, Artif. Intell. and Reasoning (LPAR), volume 2850
of LNAI, pages 78–90. Springer, 2003.
[133] R. Nieuwenhuis and A. Oliveras. DPLL(T) with Exhaustive Theory Propagation and
its Application to Difference Logic. In Proc. CAV’05, volume 3576 of LNCS. Springer,
2005.
[134] R. Nieuwenhuis and A. Oliveras. Proof-Producing Congruence Closure. In Proceedings
of the 16th International Conference on Term Rewriting and Applications, RTA’05,
volume 3467 of LNCS. Springer, 2005.
[135] R. Nieuwenhuis, A. Oliveras, and C. Tinelli. Abstract DPLL and Abstract DPLL
Modulo Theories. In Proc. LPAR’04, volume 3452 of LNCS. Springer, 2005.
[136] R. Nieuwenhuis, A. Oliveras, and C. Tinelli. Solving SAT and SAT Modulo Theories:
from an Abstract Davis-Putnam-Logemann-Loveland Procedure to DPLL(T). Journal
of the ACM, 53(6):937–977, November 2006.
[137] Omega. http://www.cs.umd.edu/projects/omega.
[138] D. C. Oppen. Complexity, Convexity and Combinations of Theories. Theoretical
Computer Science, 12:291–302, 1980.
[139] D.C. Oppen. Reasoning about Recursively Defined Data Structures. Journal of the
ACM, 27(3):403–411, 1980.
[140] C. H. Papadimitriou. On the complexity of integer programming. JACM, 28(4):765–
768, 1981.
[141] G. Parthasarathy, M. K. Iyer, K.-T. Cheng, and L.-C. Wang. An efficient finite-domain
constraint solver for circuits. In Proc. DAC’04. ACM Press, 2004.
[142] K. Pipatsrisawat and A. Darwiche. A Lightweight Component Caching Scheme for
Satisfiability Solvers. In Proc. SAT’07, volume 4501 of LNCS. Springer, 2007.
[143] W. Pugh. The Omega test: a fast and practical integer programming algorithm for
dependence analysis. In Supercomputing ’91: Proceedings of the 1991 ACM/IEEE
conference on Supercomputing, pages 4–13, New York, NY, USA, 1991. ACM Press.
[144] S. Ranise and D. Deharbe. Light-Weight Theorem Proving for Debugging and Verifying Units of Code-. In Proc. of the International Conference on Software Engineering
and Formal Methods SEFM03. IEEE Computer Society Press, 2003.
[145] S. Ranise, C. Ringeissen, and C. G. Zarba. Combining Data Structures with Nonstably
Infinite Theories Using Many-Sorted Logic. In Proc FroCos’05, volume 3717 of LNCS.
Springer, 2005.
220
Lazy Satisfiability Modulo Theories
[146] S. Ranise and C. Tinelli. Satisfiability Modulo Theories. In Trends and Controversies
- IEEE Intelligent Systems Magazine, 21(6):71–81, 2006.
[147] S. Ranise and C. Tinelli. The Satisfiability Modulo Theories Library (SMT-LIB).
http://www.SMT-LIB.org, 2006.
[148] S. Ranise and C. Tinelli. The SMT-LIB Standard: Version 1.2. Technical report,
Department of Computer Science, The University of Iowa, 2006.
Available at http://www.SMT-LIB.org.
[149] J. Reynolds. Separation logic: a logic for shared mutable data structures, 2002.
[150] H. Rueßand N. Shankar. Deconstructing Shostak. In Proc. LICS ’01. IEEE Computer
Society, 2001.
[151] H. Rueß and N. Shankar. Solving linear arithmetic constraints. Technical Report
CSL-SRI-04-01, SRI International, Computer Science Laboratory, 333 Ravenswood
Ave, Menlo Park, CA, 94025, January 2004. revised, August 2004.
[152] S. Schulz. E - A Brainiac Theorem Prover. Journal of AI Communications, 15(2/3),
2002.
[153] R. Sebastiani. Integrating SAT Solvers with Math Reasoners: Foundations and Basic
Algorithms. Technical Report 0111-22, ITC-IRST, Trento, Italy, November 2001.
http://sra.itc.it/tr/Seb01.pdf.
[154] R. Sebastiani. From KSAT to Delayed Theory Combination: Exploiting DPLL Outside the SAT Domain. In Proc. Frontiers of Combining Systems, FroCoS’07, volume
4720 of LNCS. Springer, 2007. Invited talk.
[155] R. Sebastiani and A. Villafiorita. SAT-based decision procedures for normal modal
logics: a theoretical framework. In Proc. AIMSA’98, volume 1480 of LNAI. Springer,
1998.
[156] S. A. Seshia, S. K. Lahiri, and R. E. Bryant. A Hybrid SAT-Based Decision Procedure
for Separation Logic with Uninterpreted Functions. In Proc. DAC’03, 2003.
[157] N. Shankar and Harald Rueß.
Floc’02/RTA’02, 2002.
Combining shostak theories.
Invited paper for
[158] H. M. Sheini and K. A. Sakallah. A Scalable Method for Solving Satisfiability of
Integer Linear Arithmetic Logic. In Proc. SAT’05, volume 3569 of LNCS. Springer,
2005.
[159] H. M. Sheini and K. A. Sakallah. A Progressive Simplifier for Satisfiability Modulo
Theories. In Proc. SAT’06, volume 4121 of LNCS. Springer, 2006.
[160] H. M. Sheini and K. A. Sakallah. From Propositional Satisfiability to Satisfiability
Modulo Theories. Invited lecture. In Proc. SAT’06, volume 4121 of LNCS. Springer,
2006.
221
R. Sebastiani
[161] R. Shostak. A Pratical Decision Procedure for Arithmetic with Function Symbols.
Journal of the ACM, 26(2):351–360, 1979.
[162] R.E. Shostak. Deciding Combinations of Theories. Journal of the ACM, 31:1–12,
1984.
[163] J. P. M. Silva and K. A. Sakallah. GRASP - A new Search Algorithm for Satisfiability.
In Proc. ICCAD’96, 1996.
[164] SMT-COMP’05: 1st Satisfiability Modulo Theories Competition, 2005.
http://www.csl.sri.com/users/demoura/smt-comp/2005/.
[165] SMT-COMP’06: 2nd Satisfiability Modulo Theories Competition, 2006.
http://www.csl.sri.com/users/demoura/smt-comp/.
[166] R. M. Smullyan. First-Order Logic. Springer-Verlag, NY, 1968.
[167] G. Stalmarck and M. Saflund. Modelling and Verifying Systems and Software in
Propositional Logic. Ifac SAFECOMP’90, 1990.
[168] P. Stephan, R. Brayton, , and A. Sangiovanni-Vincentelli. Combinational Test Generation Using Satisfiability. IEEE Transactions on Computer-Aided Design of Integrated
Circuits and Systems, 15:1167–1176, 1996.
[169] O. Strichman. Tuning SAT checkers for Bounded Model Checking. In Proc. CAV00,
volume 1855 of LNCS, pages 480–494. Springer, 2000.
[170] O. Strichman. On Solving Presburger and Linear Arithmetic with SAT. In Proc. of
Formal Methods in Computer-Aided Design (FMCAD 2002), LNCS. Springer, 2002.
[171] O. Strichman, S. Seshia, and R. Bryant. Deciding separation formulas with SAT. In
Proc. of Computer Aided Verification, (CAV’02), LNCS. Springer, 2002.
[172] A. Stump, C. W. Barrett, and D. L. Dill. CVC: A Cooperating Validity Checker. In
Proc. CAV’02, volume 2404 of LNCS. Springer Verlag, 2002.
[173] A. Stump, D. L. Dill, C. W. Barrett, and J. Levitt. A Decision Procedure for an Extensional Theory of Arrays. In Proc LICS ’01, pages 29–37. IEEE Computer Society,
2001.
[174] M. Talupur, N. Sinha, O. Strichman, and A. Pnueli. Range Allocation for Separation
Logic. In Proc. CAV’04, volume 3114 of LNCS. Springer, 2004.
[175] C. Thiffault, F. Bacchus, and T. Walsh. Solving Non-clausal Formulas with DPLL
Search. In proc. 7th Int. Conference on Theory and Applications of Satisfiability
Testing (SAT 2004), LNCS. Springer, 2004.
[176] C. Tinelli. A DPLL-based Calculus for Ground Satisfiability Modulo Theories. In
Proc. JELIA-02, volume 2424 of LNAI, pages 308–319. Springer, 2002.
222
Lazy Satisfiability Modulo Theories
[177] C. Tinelli and M. T. Harandi. A new correctness proof of the Nelson–Oppen combination procedure. In Proc. Frontiers of Combining Systems, FroCoS’06, Applied
Logic. Kluwer, 1996.
[178] C. Tinelli and C. Ringeissen. Unions of non-disjoint theories and combinations of
satisfiability procedures. Theoretical Computer Science, 290(1), 2003.
[179] C. Tinelli and C. Zarba. Combining nonstably infinite theories. Journal of Automated
Reasoning, 34(3), 2005.
[180] UCLID. http://www-2.cs.cmu.edu/~uclid.
[181] M. N. Velev and R. E. Bryant. Exploiting Positive Equality and Partial NonConsistency in the Formal Verification of Pipelined Microprocessors. In Design Automation Conference, pages 397–401, 1999.
[182] M. N. Velev and R. E. Bryant. Effective use of Boolean satisfiability procedures in
the formal verification of superscalar and VLIW microprocessors. Journal of Symbolic
Computation, 35(2):73–106, 2003.
[183] C. Wang, A. Gupta, and M. Ganai. Predicate learning and selective theory deduction
for a difference logic solver. In DAC ’06: Proceedings of the 43rd annual conference
on Design automation. ACM Press, 2006.
[184] C. Wang, F. Ivancic, M. K. Ganai, and A. Gupta. Deciding Separation Logic Formulae
by SAT and Incremental Negative Cycle Elimination. In Proc. LPAR’05, volume 3835
of LNCS, pages 322–336. Springer, 2005.
[185] S. Wolfman and D. Weld. The LPSAT Engine & its Application to Resource Planning.
In Proc. IJCAI, 1999.
[186] S. Wolfman and D. Weld. Combining linear programming and satisfiability solving
for resource planning. Knowledge Engineering Review, 2000.
[187] T. Yavuz-Kahveci, M. Tuncer, and T. Bultan. A Library for Composite Symbolic
Representation. In Proc. TACAS2001, volume 2031 of LNCS. Springer Verlag, 2000.
[188] Y. Yu and S. Malik. Lemma Learning in SMT on Linear Constraints. In Proc. SAT’06,
volume 4121 of LNCS. Springer, 2006.
[189] C. G. Zarba. A Tableau Calculus for Combining Non-disjoint Theories. In Proc.
Tableaux’02, volume 2381 of Lecture Notes in Computer Science, pages 315–329.
Springer, 2002.
[190] C. G. Zarba. Combining Sets with Integers. In FroCos’02, volume 2309 of Lecture
Notes in Computer Science, pages 103–116. Springer, 2002.
[191] Z. Zeng, P. Kalla, and M. Ciesielski. LPSAT: a unified approach to RTL satisfiability.
In Proc. DATE ’01. IEEE Press, 2001.
223
R. Sebastiani
[192] L. Zhang, C. F. Madigan, M. W. Moskewicz, and S. Malik. Efficient conflict driven
learning in boolean satisfiability solver. In ICCAD, pages 279–285, 2001.
[193] L. Zhang and S. Malik. The quest for efficient boolean satisfiability solvers. In Proc.
CAV’02, volume 2404 of LNCS, pages 17–36. Springer, 2002.
224