Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified n g , k i p r o a p m a g n a o t i i s o i n c b e l u d i s e l d o d i m n g . . . SAT UNSAT . . . player player p g r o n s o i d i f b l s b u i y a l c a k n j u a m t c p l i i n f g n , c o 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT b ⇒ a player player p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT ? a b ⇒ a player player p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT ? a b b ⇒ a player player p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g conflict a ⇒ b b ⇒ a a ⇒ b SAT UNSAT ? a b b ⇒ a player player p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT a b ⇒ a player player a conflict p g fixed r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT a b b ⇒ a player player a p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g conflict a ⇒ b b ⇒ a a ⇒ b SAT UNSAT a b b ⇒ a player player a p g r o n o i d f l b u i 6/30
Conflict-driven reasoning 2-player game to determine whether a formula is satisfiable. It involves a trail where a putative model is being specified. It relies on a notion of conflict between the putative model and the formula it should satisfy. Archetype of conflict-driven reasoning: CDCL a conflict occurs when a clause is falsified b e l u d i l d o i m n g a ⇒ b b ⇒ a a ⇒ b SAT UNSAT b ⇒ a player player a ⊥ p g r o n o i d f l b u i 6/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 Then l 0 yields lower bound x > 0 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 Then l 0 yields lower bound x > 0 Together with l 2 , range of possible values for x is empty What to do? just undo y ← 0 and remember that y � = 0? 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 Then l 0 yields lower bound x > 0 Together with l 2 , range of possible values for x is empty What to do? just undo y ← 0 and remember that y � = 0? ◮ No! Clash of bounds suggests a better conflict explanation, l 3 � �� � by inferring l 0 + 2 l 2 , i.e., ( − y < − 2) It rules out y ← 0, but also many values that would fail for the same reasons. 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 Then l 0 yields lower bound x > 0 Together with l 2 , range of possible values for x is empty What to do? just undo y ← 0 and remember that y � = 0? ◮ No! Clash of bounds suggests a better conflict explanation, l 3 � �� � by inferring l 0 + 2 l 2 , i.e., ( − y < − 2) It rules out y ← 0, but also many values that would fail for the same reasons. ◮ Now undo the guess but keep l 3 . 7/30
Conflict-driven reasoning can be used for (other) theories l 0 l 1 l 2 � �� � � �� � � �� � ( − 2 · x − y < 0) , ( x + y < 0) , ( x < − 1) unsatisfiable in Linear Rational Arithmetic (LRA). ◮ Guess a value, e.g., y ← 0 Then l 0 yields lower bound x > 0 Together with l 2 , range of possible values for x is empty What to do? just undo y ← 0 and remember that y � = 0? ◮ No! Clash of bounds suggests a better conflict explanation, l 3 � �� � by inferring l 0 + 2 l 2 , i.e., ( − y < − 2) It rules out y ← 0, but also many values that would fail for the same reasons. ◮ Now undo the guess but keep l 3 . ◮ and so on. . . (when there is no guess to undo, problem is UNSAT) 7/30
Traditional architecture of SMT-solving T 1 T 2 SAT-solver (CDCL) Comb. ∗ T 3 T 5 T 4 * e.g. equality sharing / Nelson-Oppen [NO79] 8/30
In CDSAT . . . the theory combination is organised directly in the main conflict-driven loop: As in MCSAT, trail contains Bool ◮ Boolean assignments T 2 a ← true l b e u d i l d o i m n ◮ First-order assignments g T 1 T 1 y ← 3 / 4 . . . T 2 . . . p g r n o i o d f i l b u Bool 9/30
In CDSAT . . . the theory combination is organised directly in the main conflict-driven loop: As in MCSAT, trail contains Bool ◮ Boolean assignments T 2 a ← true l b e u d i l d o i m n ◮ First-order assignments g T 1 T 1 y ← 3 / 4 . . . T 2 . . . Features of conflict-driven satisfiability: p g r n o i ◮ Boolean theory can have the o d f i l b u Bool same status as other theories. ◮ Theory-specific reasoning often consists of fine-grained reasoning inferences, e.g., Fourier-Motzkin resolution for LRA: ( t 1 < x ) , ( x < t 2 ) ⊢ ⊢ ⊢ t 1 < t 2 9/30
2. The CDSAT system - with learning 10/30
What is a theory module? A set of inferences of the form ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ ⊢ T ( l ← b ) where ◮ each t i ← c i is a single T -assignment (a term t i and a T -value c i of matching sorts) ◮ l ← b is a single Boolean assignment (a term l of sort Bool and a truth value b ) 11/30
What is a theory module? A set of inferences of the form ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ ⊢ T ( l ← b ) where ◮ each t i ← c i is a single T -assignment (a term t i and a T -value c i of matching sorts) ◮ l ← b is a single Boolean assignment (a term l of sort Bool and a truth value b ) Abbreviations: ( l ← true) as l and ( l ← false) as l 11/30
What is a theory module? A set of inferences of the form ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ ⊢ T ( l ← b ) where ◮ each t i ← c i is a single T -assignment (a term t i and a T -value c i of matching sorts) ◮ l ← b is a single Boolean assignment (a term l of sort Bool and a truth value b ) Abbreviations: ( l ← true) as l and ( l ← false) as l ◮ Soundness requirement: Every model of the premisses is a model of the conclusion: ( t 1 ← c 1 ) , . . . , ( t k ← c k ) | = ( l ← b ) 11/30
What is a theory module? A set of inferences of the form ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ ⊢ T ( l ← b ) where ◮ each t i ← c i is a single T -assignment (a term t i and a T -value c i of matching sorts) ◮ l ← b is a single Boolean assignment (a term l of sort Bool and a truth value b ) Abbreviations: ( l ← true) as l and ( l ← false) as l ◮ Soundness requirement: Every model of the premisses is a model of the conclusion: ( t 1 ← c 1 ) , . . . , ( t k ← c k ) | = ( l ← b ) Examples: √ √ ⊢ ( x ← 2) , ( y ← 2) ⊢ ⊢ NLRA ( x · y ≃ 2) (evaluation inference) ( l 1 ∨ · · · ∨ l n ) , l 1 . . . , l n − 1 ⊢ ⊢ ⊢ Bool l n (unit propagation) 11/30
What is a theory module? (Equality inferences) All theory modules have the equality inferences: ⊢ t 1 ← c 1 , t 2 ← c 2 ⊢ ⊢ T t 1 ≃ t 2 if c 1 and c 2 are the same value t 1 ← c 1 , t 2 ← c 2 ⊢ ⊢ ⊢ T t 1 �≃ t 2 if c 1 and c 2 are distinct values ⊢ T ⊢ ⊢ t 1 ≃ t 1 reflexivity t 1 ≃ t 2 ⊢ ⊢ ⊢ T t 2 ≃ t 1 symmetry ⊢ t 1 ≃ t 2 , t 2 ≃ t 3 ⊢ ⊢ T t 1 ≃ t 3 transitivity 12/30
CDSAT states Search states: simply trails. A trail is a stack of justified assignments H ⊢ ( t ← c ) and decisions ? ( t ← c ) coming from different theories Justification H : a set of assignments that appear earlier on the trail 13/30
CDSAT states Search states: simply trails. A trail is a stack of justified assignments H ⊢ ( t ← c ) and decisions ? ( t ← c ) coming from different theories Justification H : a set of assignments that appear earlier on the trail Example (trail grows from left to right): √ ∅⊢ ( x ≃ z ) , ∅⊢ ( y ≃ z ) , ? ( x ← 2) , ? ( y ← blue) , ? ( x ← red) , H ⊢ ( x � = y ) where H is { ( y ← blue) , ( x ← red) } Everything is on the trail, including assertions from the input problem, with empty justifications (e.g., ∅⊢ ( C ← true) for an input clause C ), 13/30
CDSAT states Search states: simply trails. A trail is a stack of justified assignments H ⊢ ( t ← c ) and decisions ? ( t ← c ) coming from different theories Justification H : a set of assignments that appear earlier on the trail Example (trail grows from left to right): √ ∅⊢ ( x ≃ z ) , ∅⊢ ( y ≃ z ) , ? ( x ← 2) , ? ( y ← blue) , ? ( x ← red) , H ⊢ ( x � = y ) where H is { ( y ← blue) , ( x ← red) } Everything is on the trail, including assertions from the input problem, with empty justifications (e.g., ∅⊢ ( C ← true) for an input clause C ), Conflict states: � Γ; H � , trail Γ + set H of trail assignments that are in conflict 13/30
CDSAT states Search states: simply trails. A trail is a stack of justified assignments H ⊢ ( t ← c ) and decisions ? ( t ← c ) coming from different theories Justification H : a set of assignments that appear earlier on the trail Example (trail grows from left to right): √ ∅⊢ ( x ≃ z ) , ∅⊢ ( y ≃ z ) , ? ( x ← 2) , ? ( y ← blue) , ? ( x ← red) , H ⊢ ( x � = y ) where H is { ( y ← blue) , ( x ← red) } Everything is on the trail, including assertions from the input problem, with empty justifications (e.g., ∅⊢ ( C ← true) for an input clause C ), Conflict states: � Γ; H � , trail Γ + set H of trail assignments that are in conflict In this paper , new rule for solving/exiting conflicts: Learn 13/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. Rule Learn can exit the conflict with trail Γ 0 , ? A 1 , ? l 2 , H ⊢ l 4 where H is { ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 } 14/30
Example: exiting a conflict without learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. Rule Learn can exit the conflict with trail Γ 0 , ? A 1 , ? l 2 , H ⊢ l 4 where H is { ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 } 14/30
Example: exiting a conflict learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. Rule Learn can exit the conflict and learn a clause: Γ 0 , ? A 1 , ? l 2 , H ′ ⊢ ( ¬ l 2 ∨ ¬ l 4 ) where H ′ is { ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) } 14/30
Example: exiting a conflict learning a clause Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. Rule Learn can exit the conflict and learn a clause: Γ 0 , ? A 1 , ? l 2 , H ′ ⊢ ( ¬ l 2 ∨ ¬ l 4 ) where H ′ is { ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) } Then Deduce can derive l 4 as before: H ′ ⊢ ( ¬ l 2 ∨ ¬ l 4 ) , Γ 0 , ? A 1 , ? l 2 , { ( ¬ l 2 ∨ ¬ l 4 ) , l 2 }⊢ l 4 14/30
Example: exiting a conflict learning a clause & restarting Input problem H 0 including: ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) with l 4 = ( x ≤ y ) and l 5 = ( f ( x ) ≤ f ( y )) in a theory where f is monotonic Initial trail Γ 0 including: ∅⊢ ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) Search rules extend Γ 0 into Γ = Γ 0 , ? A 1 , ? l 2 , ? A 3 , ? l 4 , l 4 ⊢ l 5 (involving unrelated decisions A 1 and A 3 ) First conflict: � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 , l 5 � � Γ; ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) , l 2 , l 4 � Resolving l 5 : In first conflict, both l 4 and l 5 depend on the latest decision ? l 4 . After applying Resolve, only l 4 does. Time to stop conflict analysis. Rule Learn can exit the conflict and learn a clause, and restart: Γ 0 , H ′ ⊢ ( ¬ l 2 ∨ ¬ l 4 ) where H ′ is { ( ¬ l 2 ∨¬ l 4 ∨¬ l 5 ) } 14/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ “Clausal forms of H ” reify H in Boolean logic: (( � ( l ← true) ∈ H l ) ∧ ( � ( l ← false) ∈ H ¬ l )) ← false 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ “Clausal forms of H ” reify H in Boolean logic: (( � ( l ← true) ∈ H l ) ∧ ( � ( l ← false) ∈ H ¬ l )) ← false (( � ( l ← true) ∈ H ¬ l ) ∨ ( � ( l ← false) ∈ H l )) ← true 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ “Clausal forms of H ” reify H in Boolean logic: (( � ( l ← true) ∈ H l ) ∧ ( � ( l ← false) ∈ H ¬ l )) ← false (( � ( l ← true) ∈ H ¬ l ) ∨ ( � ( l ← false) ∈ H l )) ← true This rule ◮ generalises the CADE’2017 one (sufficient for completeness) ◮ models clause learning by reifying (Boolean parts of) conflicts ◮ models clause learning + restarts, a common practice in SAT/SMT-solving 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ “Clausal forms of H ” reify H in Boolean logic: (( � ( l ← true) ∈ H l ) ∧ ( � ( l ← false) ∈ H ¬ l )) ← false (( � ( l ← true) ∈ H ¬ l ) ∨ ( � ( l ← false) ∈ H l )) ← true This rule ◮ generalises the CADE’2017 one (sufficient for completeness) ◮ models clause learning by reifying (Boolean parts of) conflicts ◮ models clause learning + restarts, a common practice in SAT/SMT-solving Which version to apply depends on your search strategy (particularly for restarts) 15/30
The Learn rule introduced in this paper → Γ ′ , E ⊢ L � Γ; E ⊎ H � − if L is a “clausal form of H ”, L / ∈ Γ, L / ∈ Γ Γ ′ : a pruning of Γ undoing at least the latest decision involved, E ⊆ Γ ′ “Clausal forms of H ” reify H in Boolean logic: (( � ( l ← true) ∈ H l ) ∧ ( � ( l ← false) ∈ H ¬ l )) ← false (( � ( l ← true) ∈ H ¬ l ) ∨ ( � ( l ← false) ∈ H l )) ← true This rule ◮ generalises the CADE’2017 one (sufficient for completeness) ◮ models clause learning by reifying (Boolean parts of) conflicts ◮ models clause learning + restarts, a common practice in SAT/SMT-solving Which version to apply depends on your search strategy (particularly for restarts) All version are OK with respect to termination of CDSAT 15/30
3. Proof production 16/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . 17/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . Next step: keep track of invariant via proof-theoretical information 17/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . Next step: keep track of invariant via proof-theoretical information Let T be a theory with a specific T -module. Deduce − → Γ , J ⊢ ( t ← b ) if J ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, ⊢ Γ and t ← b is not in Γ 17/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . Next step: keep track of invariant via proof-theoretical information Let T be a theory with a specific T -module. Deduce − → Γ , J ⊢ ( t ← b ) if J ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, ⊢ Γ and t ← b is not in Γ Conflict Γ − → � Γ; J , ( t ← b ) � if J ⊢ ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, and t ← b is in Γ 17/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . Next step: keep track of invariant via proof-theoretical information Let T be a theory with a specific T -module. Deduce − → Γ , J ⊢ ( t ← b ) if J ⊢ ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, Γ and t ← b is not in Γ Conflict Γ − → � Γ; J , ( t ← b ) � if J ⊢ ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, and t ← b is in Γ Resolve � Γ; E ⊎ { A }� − → � Γ; E ∪ H � if H ⊢ A is in Γ 17/30
Soundness invariants, and rules that may affect them ◮ For every assignment H ⊢ A on the trail, H | = A ; ◮ For every conflict state � Γ; E � , E | = ⊥ . Next step: keep track of invariant via proof-theoretical information Let T be a theory with a specific T -module. Deduce − → Γ , J ⊢ ( t ← b ) if J ⊢ ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, Γ and t ← b is not in Γ Conflict Γ − → � Γ; J , ( t ← b ) � if J ⊢ ⊢ ⊢ T ( t ← b ) and J ⊆ Γ, and t ← b is in Γ Resolve � Γ; E ⊎ { A }� − → � Γ; E ∪ H � if H ⊢ A is in Γ Learn Γ ′ , E ⊢ L � Γ; E ⊎ H � − → if L is a “clausal form” of H ∈ Γ, and E ⊆ Γ ′ L / ∈ Γ, L / 17/30
Theory proofs To keep track of the soundness invariants, we need to refer to theory inferences 18/30
Theory proofs To keep track of the soundness invariants, we need to refer to theory inferences Each theory module comes with a “proof annotation system” ⊢ ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ T ( l ← b ) is annotated as a 1 ( t 1 ← c 1 ) , . . . , a k ( t k ← c k ) ⊢ ⊢ ⊢ T j T : ( l ← b ) 18/30
Theory proofs To keep track of the soundness invariants, we need to refer to theory inferences Each theory module comes with a “proof annotation system” ⊢ ( t 1 ← c 1 ) , . . . , ( t k ← c k ) ⊢ ⊢ T ( l ← b ) is annotated as a 1 ( t 1 ← c 1 ) , . . . , a k ( t k ← c k ) ⊢ ⊢ ⊢ T j T : ( l ← b ) Examples: √ √ a 1 ( x ← 2) , a 2 ( y ← ⊢ 2) ⊢ ⊢ NLRA eval( { a 1 , a 2 } ): ( x · y ≃ 2) (evaluation inference) a 0 ( l 1 ∨ · · · ∨ l n ) , a 1 ( l 1 ) , . . . , a k − 1 ( l n − 1 ) ⊢ ⊢ ⊢ Bool UP( a 0 , { a 1 , . . . , a n } ): l n (unit propagation) 18/30
Proof-terms and proof-carrying CDSAT ◮ A proof-carrying trail is a stack ◮ of justified assignments H ⊢ j : ( t ← c ) ◮ and decisions ? ( t ← c ) ◮ A proof-carrying conflict state is of the form � Γ; H ; c � . . . where j and c respectively range over Deduction proof terms j ::= in j T lem( H . c ) res( j , a A . c ) Conflict proof term c ::= cfl( j T , a ) in annotates an input assignment, j T ranges over theory proofs for T , used for Deduce lem( H . c ) annotates justified assignments that Learn places on trail (clausal forms of H ), binding the identifiers of H in c cfl( j T , a ) annotates a conflict when it is created by Conflict res( j , a A . c ) annotates a conflict resulting from the Resolve rule, binding a in c 19/30
Provability invariants that proof-terms keep track of ⊢ A is an input J ⊢ ⊢ ⊢ T j T : L E ⊎ H ⊢ ⊢ c : ⊥ L clausal form of H ⊢ J ⊢ ⊢ ⊢ j T : L E ⊢ ⊢ ⊢ lem( H . c ): L ∅ ⊢ ⊢ in: A E , a A ⊢ J ⊢ ⊢ ⊢ T j T : L H ⊢ ⊢ ⊢ j : A ⊢ ⊢ c : ⊥ J ∪ { a L } ⊢ ⊢ res( j , a A . c ): ⊥ ⊢ ⊢ cfl( j T , a ): ⊥ E ∪ H ⊢ ⊢ 20/30
Provability invariants that proof-terms keep track of ⊢ A is an input J ⊢ ⊢ ⊢ T j T : L E ⊎ H ⊢ ⊢ c : ⊥ L clausal form of H ⊢ J ⊢ ⊢ ⊢ j T : L E ⊢ ⊢ ⊢ lem( H . c ): L ∅ ⊢ ⊢ in: A E , a A ⊢ J ⊢ ⊢ ⊢ T j T : L H ⊢ ⊢ ⊢ j : A ⊢ ⊢ c : ⊥ J ∪ { a L } ⊢ ⊢ res( j , a A . c ): ⊥ ⊢ ⊢ cfl( j T , a ): ⊥ E ∪ H ⊢ ⊢ Rules of CDSAT are adapted so as to use those proof-terms, and the soundness invariants are materialised as: Theorem ◮ For every assignment H ⊢ j : A on the trail, H ⊢ ⊢ ⊢ j : A ◮ For every conflict state � Γ; E ; c � , E ⊢ ⊢ ⊢ c : ⊥ . 20/30
Provability invariants that proof-terms keep track of ⊢ A is an input J ⊢ ⊢ ⊢ T j T : L E ⊎ H ⊢ ⊢ c : ⊥ L clausal form of H ⊢ J ⊢ ⊢ ⊢ j T : L E ⊢ ⊢ ⊢ lem( H . c ): L ∅ ⊢ ⊢ in: A E , a A ⊢ J ⊢ ⊢ ⊢ T j T : L H ⊢ ⊢ ⊢ j : A ⊢ ⊢ c : ⊥ J ∪ { a L } ⊢ ⊢ res( j , a A . c ): ⊥ ⊢ ⊢ cfl( j T , a ): ⊥ E ∪ H ⊢ ⊢ Rules of CDSAT are adapted so as to use those proof-terms, and the soundness invariants are materialised as: Theorem ◮ For every assignment H ⊢ j : A on the trail, H ⊢ ⊢ ⊢ j : A ◮ For every conflict state � Γ; E ; c � , E ⊢ ⊢ ⊢ c : ⊥ . The proof system above can be seen as glueing a collection of ⊢ inference systems ( ⊢ ⊢ T ) T 20/30
Provability invariants that proof-terms keep track of ⊢ A is an input J ⊢ ⊢ T j T : L ⊢ E ⊎ H ⊢ ⊢ c : ⊥ L clausal form of H ⊢ J ⊢ ⊢ ⊢ j T : L E ⊢ ⊢ ⊢ lem( H . c ): L ∅ ⊢ ⊢ in: A E , a A ⊢ J ⊢ ⊢ ⊢ T j T : L H ⊢ ⊢ ⊢ j : A ⊢ ⊢ c : ⊥ J ∪ { a L } ⊢ ⊢ res( j , a A . c ): ⊥ ⊢ ⊢ cfl( j T , a ): ⊥ E ∪ H ⊢ ⊢ Rules of CDSAT are adapted so as to use those proof-terms, and the soundness invariants are materialised as: Theorem ◮ For every assignment H ⊢ j : A on the trail, H ⊢ ⊢ ⊢ j : A ◮ For every conflict state � Γ; E ; c � , E ⊢ ⊢ ⊢ c : ⊥ . The proof system above can be seen as glueing a collection of ⊢ inference systems ( ⊢ ⊢ T ) T CDSAT is a search procedure for the resulting system 20/30
Satisfiability Modulo Assignments (SMA) An SMT-problem with input clauses C 1 , . . . , C n is treated by running CDSAT on the initial trail ∅⊢ in: C 1 , . . . , ∅⊢ in: C n 21/30
Satisfiability Modulo Assignments (SMA) An SMT-problem with input clauses C 1 , . . . , C n is treated by running CDSAT on the initial trail ∅⊢ in: C 1 , . . . , ∅⊢ in: C n But the CDSAT system can accept inputs with first-order assignments, e.g: ∅⊢ in: ( x ← 3 / 4 ) , ∅⊢ in: ( x ≤ y ) , ∅⊢ in: ( y ≤ 0) Such problems are called SMA problems. 21/30
Satisfiability Modulo Assignments (SMA) An SMT-problem with input clauses C 1 , . . . , C n is treated by running CDSAT on the initial trail ∅⊢ in: C 1 , . . . , ∅⊢ in: C n But the CDSAT system can accept inputs with first-order assignments, e.g: ∅⊢ in: ( x ← 3 / 4 ) , ∅⊢ in: ( x ≤ y ) , ∅⊢ in: ( y ≤ 0) Such problems are called SMA problems. If there are no first-order inputs and the problem is unsat, then the final proof-term will not mention any deduction proof-term H ⊢ ⊢ ⊢ j : L nor any conflict proof H ⊢ ⊢ ⊢ c : ⊥ such that H contains a first-order assignment 21/30
Satisfiability Modulo Assignments (SMA) An SMT-problem with input clauses C 1 , . . . , C n is treated by running CDSAT on the initial trail ∅⊢ in: C 1 , . . . , ∅⊢ in: C n But the CDSAT system can accept inputs with first-order assignments, e.g: ∅⊢ in: ( x ← 3 / 4 ) , ∅⊢ in: ( x ≤ y ) , ∅⊢ in: ( y ≤ 0) Such problems are called SMA problems. If there are no first-order inputs and the problem is unsat, then the final proof-term will not mention any deduction proof-term H ⊢ ⊢ ⊢ j : L nor any conflict proof H ⊢ ⊢ ⊢ c : ⊥ such that H contains a first-order assignment Easy optimisation in that case: the construction of any such proof-term during the run can be omitted 21/30
Satisfiability Modulo Assignments (SMA) An SMT-problem with input clauses C 1 , . . . , C n is treated by running CDSAT on the initial trail ∅⊢ in: C 1 , . . . , ∅⊢ in: C n But the CDSAT system can accept inputs with first-order assignments, e.g: ∅⊢ in: ( x ← 3 / 4 ) , ∅⊢ in: ( x ≤ y ) , ∅⊢ in: ( y ≤ 0) Such problems are called SMA problems. If there are no first-order inputs and the problem is unsat, then the final proof-term will not mention any deduction proof-term H ⊢ ⊢ ⊢ j : L nor any conflict proof H ⊢ ⊢ ⊢ c : ⊥ such that H contains a first-order assignment Easy optimisation in that case: the construction of any such proof-term during the run can be omitted Theory modules do not have to provide theory proofs H ⊢ ⊢ ⊢ T j T : L if H contains a first-order assign. (typically: evaluation inferences) 21/30
Different views about proof objects Proof-carrying CDSAT can be considered exactly as defined above, where in , j T , lem( H . c ) , cfl( j T , a ) , res( j , a A . c ) are terms. 22/30
Different views about proof objects Proof-carrying CDSAT can be considered exactly as defined above, where in , j T , lem( H . c ) , cfl( j T , a ) , res( j , a A . c ) are terms. Another proof format is desired for output? Just interpret the terms in that format after the run (proof reconstruction) 22/30
Different views about proof objects Proof-carrying CDSAT can be considered exactly as defined above, where in , j T , lem( H . c ) , cfl( j T , a ) , res( j , a A . c ) are terms. Another proof format is desired for output? Just interpret the terms in that format after the run (proof reconstruction) Alternatively, proof-carrying CDSAT can directly manipulate proofs in the format, if equipped with the operations corresponding to the term constructs. The proof-terms denote the manipulated proofs, but are never constructed. 22/30
Example: resolution proofs If input contains no first-order assignments, resolution trees (or DAGs) form a proof format equipped with the right operations 23/30
Example: resolution proofs If input contains no first-order assignments, resolution trees (or DAGs) form a proof format equipped with the right operations Leaves of resolution proofs are labeled by ◮ either literals corresponding to input assignments ∅ ⊢ ⊢ ⊢ in: A ◮ or theory lemmas corresponding to theory proofs J ⊢ ⊢ ⊢ T j T : L Internal nodes are obtained by applying resolution rule, ⊢ res( j , a A . c ): ⊥ constructs. corresponding to H ⊢ ⊢ 23/30
Example: resolution proofs If input contains no first-order assignments, resolution trees (or DAGs) form a proof format equipped with the right operations Leaves of resolution proofs are labeled by ◮ either literals corresponding to input assignments ∅ ⊢ ⊢ ⊢ in: A ◮ or theory lemmas corresponding to theory proofs J ⊢ ⊢ ⊢ T j T : L Internal nodes are obtained by applying resolution rule, ⊢ res( j , a A . c ): ⊥ constructs. corresponding to H ⊢ ⊢ If input does contains first-order assignments (SMA problems) the resolution format has to be slightly extended, so that it manipulates guarded clauses of the form { ( t 1 ← c 1 ) , . . . , ( t n ← c n ) } ⇒ C where ( t 1 ← c 1 ) , . . . , ( t n ← c n ) are first-order assign. guarding clause C Details in the paper. 23/30
Recommend
More recommend
