Topics in SMT

Local Search

Terms and values

Terms and Values Examples

Interpretations

Interpretations - Examples

Coherence

Given a formula , fix

• .

Invertible functions

Recall global pre-processing rules: If contains the subterm and this is the only occurrence of simplify to and remember that interpretation for should be repaired to .

• Many operators are invertible.

• Sometimes operators are not invertible, but weakly invertible: If . We cannot solve for or . But we can reset both to some values that solve for 1.

Repair by invertibility

Rehash

If , set to a new random value in .

Strong invertibility

If there is a value , such that , then set .

Symmetric for .

Weak invertibility

If there are values with , such that , set .

Symmetric for .

No invertibility

If there are no values , such that , then set to a new random value in .

Revert to Up

is allowed if .

Repair by gradients

• Compute a scoring function based on :

  • Number of false clauses
  • Distance for but .

• Pick false literal in false clause.

  • Compute moves for all variables in (moves for in literal ).
  • Prefer move with best global score

I found that using gradients is not as brittle as local repair. Gradients can exploit derivatives. But local repair is useful when there is not clear derivative for functions.

Challenges and Opportunities

• Combine Theory local search with Boolean local search (Zhang et al., 2024)

  • Best current solution runs Boolean SLS (in z3 it is ddfw) in alternation with theory repair.
  • Theory local search solvers are clause-aware structures.

• Use information from local search to speed up complete search

  • Variable priorties: keep track of frequency of variable flips
  • Variable phases:
    • For SAT: set the phase (and values of arithmetic variables) to the best model so far
    • For UNSAT: I haven't addressed this seriously yet

Project Topic

• Add a local theory search solver for finite sets.
• Z3 contains a plugin model for theory local search engines.
• The engine can add or remove elements to sets.
  • Added eleements can come from a pre-existing finite set of candidates.
  • Maybe grow the candidate set dynamically
• Add a range at a time for large sets?
• Initial metric for success: solve random benchmarks better than the complete solver.

Equality Saturation modulo Theories

• A fresh topic

• Egglog:

  • E-saturation modulo ground equalities and E-matching rules.
  • Datalog-like bottom-up saturation.

• Equality saturation in First-Order (Vampire):

  • E-matching is ground equality
  • Superposition works for .
  • then

Congruence Closure Modulo Theories

If we merge

We can infer that .

• Augment E-graph merge by ACI completion.

ACI completion

• A little subroutine that sits as a callback from E-graph merge.
• Maintains a work list of AC equations that have not been processed.
• Finds critical pairs, superposes, and adds new equalities.
• Reduces existing equalities modulo oriented equations.

Bit-vector equalities

• “Cut, dice, and slice” extract, concat, and bit-wise:  (Bruttomesso and Sharygina, 2009)

E-matching Modulo Theories

• Matching modulo AC and ACI

• Matching modulo Higher-Order functions

Both topics have established solutions.

For E-matching:

• Basic solutions: to implement top-down algorithm with the additional feature that you can iterate over an equivalence class of ground terms in each step.

CDCL(T) proofs

Theory solver offers two main services

CDCL(T) proofs (II)

Both cases rely on establishing -tautologies

• tautologies are justified using theory specific rules

• tautologies can be added to propositional RUP proofs as trusted assumptions

CDCL(T) proofs - justifying inferences

• EUF - we show how to justify EUF tautologies found by congruence closure

• Arithmetic - we illustrate extracting Farkas proofs

  • Many other inferences

• Other theories - many rely on instantiating axioms.

  • Trusted base (verified using ITP) using many axioms vs. trusted base with powerful checkers.

Combining Theory Solvers

• SMT solvers combine multiple -solvers into a single solver.

• Example: EUF + Arithmetic

• For proof generation, we have a nested scenario:

  • use -lemmas in CDCL solver
  • combine multiple lemmas into a lemma used by the SAT solver.

Using -lemmas in CDCL

• The CDCL solver by default logs -clauses after false unit literals have been removed

• Steps required to verify -clause :

  • Map to original -clause .
  • Verify is a tautology
  • Verify that follows from using RUP.

Combining lemmas (I)

T-solvers share and propagate equalities

Combining lemmas (II)

• Each internal -propagation is logged as a lemma.

• Assumed and propagated equalities are not known by CDCL(T) solver.

• Equality reasoning leaks to -solvers

• Checking -lemmas requires equality reasoning.

A brief overview of some efforts

References

• Aaron Stump (Stump and Dill, 2002; Stump, 2002, 2009; Stump et al., 2002, 2013; Wu et al., 2003; Appel et al., 2003; Stump and Tan, 2005; Klapper and Stump, 2005)

• CVC (Barbosa et al., 2022; Ozdemir et al., 2019; Hadarean et al., 2015; Katz et al., 2016)

• SMT4J (Fazekas, n.d.)

• SMTInterpol (Hoenicke and Schindler, 2022b, 2022a)

• VeriT (Bouton et al., 2009; Barbosa and Other, 2020)

• Z3 (Moura and Bjørner, 2008) Axiom Profiler (n.d., 34)

• Isabelle, Coq, LN (Blanchette et al., 2013; Böhme et al., 2011; Besson et al., 2011; Ekici et al., 2017)

• Format proposals (Besson et al., 2011; Schurr et al., 2021; Barrett et al., 2014)

• SMT3 (Brown et al., 2022)

R - LFSC - Logical Framework with Side Conditions (Stump, 2002)

• Variant of dependent type theory with built-ins for exceptions

  • Proof rules are described as dependent types
  • Proof terms are type checked

• First described in 2002, then several 2008, 2013, ..

• Noteworthy:

  • Integration with RUP (Oe, 2011)
  • On-the-fly checking theory lemmas
  • Part of CVC (Fx7, SVC) certification tool chain(s)

R - VeriT (Fontaine et al., 2006; Bouton et al., 2009; Barbosa and Other, 2020)

Pre-processing

• A general contextual rewrite functor

  • plug in transforms for let, var, bind, app

• So far unexplored in this work:

  • Global rewrites
  • Fixed to post-order traversals

R - CVC (Barbosa et al., 2022; Ozdemir et al., 2019; Hadarean et al., 2015; Katz et al., 2016; Stump et al., 2002; Barrett et al., 2014)

• Wide set of theories

  • Supported include: EUF, Arithmetic, ADT, Arrays, Strings, others

  • Unsupported only: Floats, sets, sequences

• Target a variety of backends

  • LFSC, LN, Coq, Isabelle

• Pre-processing proofs

R - SMTInterpol (Hoenicke and Schindler, 2022a)

• Trusted base of proof rules, see SMT Workshop 2022 paper.

• Proof rules for linear arithmetic, arrays, ADTs, EUF.

• Proof rules formulated mild extension of SMT3

• Self-contained checker

R - Z3 - existing (Moura and Bjørner, 2008)

• Proof terms as expressions.
  • Checks proof terms when they are created internally.
• Extract
  • Isabelle tactics (Blanchette et al., 2013)
  • HOL4 bit-vector proofs (Böhme et al., 2011)
  • For Z3-interpolate (McMillan, 2011)
  • Arithmetic proofs for SPACER

R - Z3 - existing - limitations

• Many built-in proof term constructors. Does not parse back.
• Not easy to maintain/extend when adding new pre-processing or inference rules
• Built-in proof tooling limited to normalization for SPACER
• Many bugs related to details
  • or is both a term builder and creates a clause. Sometimes a unit literal is an or.
  • Proofs are optional code paths and weave many places. Forget to weave and proofs go poof.
  • lack of lambda when proofs were first introduced leads to broken handling of nested quantifiers
  • SPACER includes band-aid for incomplete arithmetic proof terms

R - Z3 - RUP(T) for a new core

• Preference towards coarse-grained inferences
• Integrated self-checker
• Wishfull plans:
  • trim(T)
  • integrate with profiling tools (AxiomProfiler based on proof logs)
  • bridges to external formats and checkers (LN?)

Proof Formats

F - veriT proof format (Schurr et al., 2021)

(assume a0 (exists ((x A)) (f x)))
(anchor :step t1 :args (:= x vr))
(step t1.t1 (cl (= x vr)) :rule cong)
(step t1.t2 (cl (= (f x) (f vr))) :rule cong)
(step t1 (cl (= (exists ((x A)) (f x))
(exists ((vr A)) (f vr)))) :rule bind)
(step t2 (cl (not (= (exists ((vr A)) (f x)) 
             (exists ((vr A)) (f vr)))) (not (exists ((vr A)) (f x)))
(exists ((vr A)) (f vr))) :rule equiv_pos1)
(step t3 (cl (exists ((vr A)) (f vr))) :premises (a0 t1 t2) :rule resolution)
(define-fun X () A (choice ((vr A)) (f vr)))
(step t4 (cl (= (exists ((vr A)) (f vr)) (f X))) :rule sko_ex)
(step t5 (cl (not (= (exists ((vr A)) (f vr)) (f X))) 
             (not (exists ((vr A)) (f vr))) (f X)) :rule equiv_pos1)
(step t6 (cl (f X)) :premises (t3 t4 t5) :rule resolution)

F - CVC4 - LFSC

F - SMTInterpol (Hoenicke and Schindler, 2022a)

F - Z3 proof format (Moura and Bjørner, 2008)

(set-option :proof true)
(declare-fun f (Int) Int)
(declare-const x Int)
(assert (or (= (f (f (f x))) x) (= (f (f x)) x)))
(assert (not (= (f (f (f (f (f (f x)))))) x)))
(check-sat)
(get-proof)

F - Z3 proof format (II)

((proof
(let ((?x25 (f x)))
 (let ((?x26 (f ?x25)))
 (let ((?x27 (f ?x26)))
 (let ((?x32 (f ?x27)))
 (let ((?x33 (f ?x32)))
 (let ((?x34 (f ?x33)))
 (let (($x35 (= ?x34 x)))
 (let (($x29 (= ?x26 x)))
 (let (($x28 (= ?x27 x)))
 (let ((@x47 (hypothesis $x28)))
 (let ((@x53 (monotonicity (monotonicity (monotonicity @x47 (= ?x32 ?x25)) (= ?x33 ?x26)) (= ?x34 ?x27))))
 (let (($x36 (not $x35)))
 (let ((@x37 (asserted $x36)))
 (let ((@x57 (lemma (unit-resolution @x37 (trans* @x53 @x47 $x35) false) (not $x28))))
 (let (($x30 (or $x28 $x29)))
 (let ((@x39 (rewrite (= $x30 $x30))))
 (let ((@x58 (unit-resolution (mp (mp (mp (asserted $x30) @x39 $x30) @x39 $x30) @x39 $x30) @x57 $x29)))
 (let ((@x64 (trans* (monotonicity (monotonicity @x58 (= ?x27 ?x25)) (= ?x32 ?x26)) @x58 (= ?x32 x))))
 (let ((@x69 (trans* (monotonicity (monotonicity @x64 (= ?x33 ?x25)) (= ?x34 ?x26)) @x58 $x35)))
 (unit-resolution @x37 @x69 false))))))))))))))))))))))

F - new Z3 proof format

F - new Z3 proof format - Input

(set-option :sat.smt true)
(set-option :solver.proof.log proof-log.smt2)
(declare-fun f (Int) Int)
(declare-const x Int)
(assert (or (= (f (f (f x))) x) (= (f (f x)) x)))
(assert (not (= (f (f (f (f (f (f x)))))) x)))
(check-sat)

F - new Z3 proof format (II)

Pretty printed from Python:

assume(Or(f(f(f(x))) == x, f(f(x)) == x))
assume(Not(f(f(f(f(f(f(x)))))) == x))
infer(rup, Not(f(f(f(f(f(f(x)))))) == x))
infer(euf(Not(f(f(f(f(f(f(x)))))) == x),
          f(f(x)) == x,
          cc(f(x) == f(f(f(x)))),
          cc(f(f(f(f(x)))) == f(f(x))),
          cc(f(f(f(f(f(x))))) == f(x)),
          cc(f(f(f(f(f(f(x)))))) == f(f(f(f(x)))))),
      Or(Not(f(f(x)) == x), f(f(f(f(f(f(x)))))) == x))
infer(rup, Not(f(f(x)) == x))
infer(rup, f(f(f(x))) == x)
infer(euf(Not(f(f(f(f(f(f(x)))))) == x),
          f(f(f(x))) == x,
          cc(f(x) == f(f(f(f(x))))),
          cc(f(f(f(f(f(x))))) == f(f(x))),
          cc(f(f(f(f(f(f(x)))))) == f(f(f(x))))),
      f(f(f(f(f(f(x)))))) == x)
infer(rup, False)

F - new Z3 proof format (III)

From SMTLIB:

(declare-fun f (Int) Int)
(define-const $24 Int (f x))
(define-const $25 Int (f $24))
(define-const $26 Int (f $25))
(define-const $27 Bool (= $26 x))
(define-const $28 Bool (= $25 x))
(assume $27 $28)
(define-const $30 Int (f $26))
(define-const $31 Int (f $30))
(define-const $32 Int (f $31))
(define-const $33 Bool (= $32 x))
(assume (not $33))
(declare-fun rup () Proof)
(infer (not $33) rup)
(declare-fun euf (Bool Bool Proof Proof Proof Proof) Proof)
(declare-fun cc (Bool) Proof)
(define-const $42 Bool (= $32 $30))
(define-const $43 Proof (cc $42))
(define-const $40 Bool (= $31 $24))
(define-const $41 Proof (cc $40))
(define-const $38 Bool (= $30 $25))
(define-const $39 Proof (cc $38))
(define-const $36 Bool (= $24 $26))
(define-const $37 Proof (cc $36))
(define-const $34 Bool (not $33))
(define-const $44 Proof (euf $34 $28 $37 $39 $41 $43))
(infer (not $28) $33 $44)
(infer (not $28) rup)
(infer $27 rup)
(declare-fun euf (Bool Bool Proof Proof Proof) Proof)
(define-const $49 Bool (= $32 $26))
(define-const $50 Proof (cc $49))
(define-const $47 Bool (= $31 $25))
(define-const $48 Proof (cc $47))
(define-const $45 Bool (= $24 $30))
(define-const $46 Proof (cc $45))
(define-const $51 Proof (euf $34 $27 $46 $48 $50))
(infer $33 $51)
(infer rup)

EUF - SMT SAT

The empty theory of first-order logic.

EUF - Decision Procedure

EUF - Data-structures

• E-Node:
• Union-find: - set until .
• etable:

EUF - algorithm merge

merge()

Roots:        n1 := find(n1), r2 := find(n2)
              assume (r1 != r2)
Erase:        for each p in r1.P such that p.cg == p:
                 erase from table        
Update root:  r1.find := r2
Justify:      ....
Insert:       for each p in r1.P:
                 p.cg = insert p in etable
                 if p.cg == p:
                   append p to r2.P
                 else 
                   add (p.cg == p) to "to_merge" 

EUF - algorithm - unmerge

unmerge():

Erase:        for each p in r2.P added from r1.P:
                 erase p from table 
Unjustify:    ....
Revert root:  r1.find := r1
Insert:       for each p in r1.P:
                 insert p if n was cc root before merge

condition for being cc root before merge:
  p.cg == p or !congruent(p, p.cg)

congruent(p,q) := roots of p.ts = roots of q.ts

EUF - justifications (I)

A justification is a reason for merging two nodes. There are two possible reasons for merging nodes:

1. A literal is asserted. The justification is the literal .
2. Nodes are merged due to congruence closure.

NB: is justified recursively by justifying .

EUF - justifications (II)

Invariant: Every non-root node points to a linked list of justifications leading to the root

NB The linked list does not follow direction of union-find.

EUF - justifications (III)

EUF - justifications are not unique

• Missed justifications:

  • If then merge is a no-op.

• egg (Flatt et al., 2022) keeps track of potential extra paths to find short proofs.

• for SMT: data-structure overhead vs. amortized effect of backtracking?

EUF - from justifications to proofs

• Suppose follows from
  • merge(), merge(),, merge().
  • Proof of :

EUF - from justifications to proofs (II)

EUF - coarse- or fine-grained proofs

• Fine-grained proofs - pro/cons:

  • Proof checker is simple. Just needs to check proof rules.
  • Requires building proof terms.
  • produces proofs of size . Can be tuned to .

• A coarse-grained proof object (N. Shankar chat @ FLoC):

  • Just list set of input literals and congruences used.
  • Sort starting from leaves in (z3 sorts on a global timestamp).
  • Proof checker: union-find + processing into union-find.

EUF - Example

(set-option :sat.euf true)
(set-option :sat.smt.proof eufproof.smt2)
(declare-fun f (Int) Int)
(declare-const x Int)
(assert (or (= (f (f (f x))) x) (= (f (f x)) x)))
(assert (not (= (f (f (f (f (f (f x)))))) x)))
(check-sat)

EUF - Example (II)

assume(Or(f(f(f(x))) == x, f(f(x)) == x))
assume(Not(f(f(f(f(f(f(x)))))) == x))
infer(rup, Not(f(f(f(f(f(f(x)))))) == x))
infer(euf(Not(f(f(f(f(f(f(x)))))) == x),
          f(f(x)) == x,
          cc(f(x) == f(f(f(x)))),
          cc(f(f(f(f(x)))) == f(f(x))),
          cc(f(f(f(f(f(x))))) == f(x)),
          cc(f(f(f(f(f(f(x)))))) == f(f(f(f(x)))))),
      Or(Not(f(f(x)) == x), f(f(f(f(f(f(x)))))) == x))
infer(rup, Not(f(f(x)) == x))
infer(rup, f(f(f(x))) == x)
infer(euf(Not(f(f(f(f(f(f(x)))))) == x),
          f(f(f(x))) == x,
          cc(f(x) == f(f(f(f(x))))),
          cc(f(f(f(f(f(x))))) == f(f(x))),
          cc(f(f(f(f(f(f(x)))))) == f(f(f(x))))),
      f(f(f(f(f(f(x)))))) == x)
infer(rup, False)

A - Arithmetic

A - Farkas and Dual Simplex

SMT solving based on Dual Simplex maintain a tableau of the form:

where are basic and are non-basic variables.

A - Compiling into tableau

  x, y = Reals('x y')
  solve([x >= 0, Or(x + y <= 2, x + 2*y >= 6), 
                 Or(x + y >= 2, x + 2*y > 4)])

Introduce slacks to define terms

Formula using slacks:

Only bounds (e.g., ) are asserted during search.

A - Infeasible Tableau

A tableau is infeasible if there is a row such that

(We omit the symmetric case for upper bounds, )

The explanation for infeasibility are the literals or , respectively or .

Slack variables are unfolded into their definitions.

The justification are the coefficients

A - Inferences

• Dual simplex infeasibility

• Bounds propagation

• Equality propagation

• Properties of div, mod, rem, to_int

• Cuts

• GCD tests

• Non-linear arithmetic

  • NLSat
  • Incremental Linearization
  • Gröbner basis computation
  • Interval reasoning

A - Towards Generic Inferences

   (farkas c1 (<=? g1 g1') c2 (<=? g2 g2') ... cn (<=? gn gn'))
   (bound c1 (<=? g1 g1') c2 (<=? g2 g2') ... cn (<=? gn gn') (not (<= e1 e2)))
   (implied-eq c0 c1 (<=? g1 g1') c2 (<=? g2 g2') ... cn (<=? gn gn') (not (= e1 e2)))

where <=? is <=, <, > >=, =, and their negations; and are integer constants.

• All inferences
  • Apply Gauss-Jordan elimination to equalities
  • Substitute result into remaining inequalities

A - Towards Generic Inferences - bounds

   (bound c1 (<=? g1 g1') (<=? g2 g2') ... (<=? gn gn') (not (<= e1 e2)))

• Apply Cut to the first bounds.
• Remaining inequalities are and
• Check .

A - Towards Generic Inferences - implied equalities

   (implied-eq c0 c1 (<=? g1 g1') c2 (<=? g2 g2') ... cn (<=? gn gn') (not (= e1 e2)))

Check:

• Linear combination of first c0 inequalities implies one side of equality.
• Linear combination of remaining inequalities implies the other side.

Quantifiers and other theories

T - Skolem functions

Use Skolem functions, not fresh constants (Katz et al., 2016), when instantiating existentials

    (=> (forall ((x I)) (= (A i) (B i))) (= A B))

is instantiated as

   A = B or select(A, diff(A,B)) != select(B, diff(A, B))

Use Skolem functions to replace extended operators

(assert (contains a b))

Is rewritten into

(assert (= a (str.++ (contains.left a b) b (contains.right a b))))

T - Hilbert Choice

   (choose ((x T)) (p x))

Used in proof generating systems (veriT, SMTInterpol).

T - Quantifiers

• Mainstream SMT solvers are (still) Instantiation Based

Standardization?

• SMTLIB Google Group (Hoenicke, Reynolds, others active)

• Some diversity in formats generated by provers and not clear the format from provers should/can be aligned.

S - Farkas with SMTInterpol

S - Farkas with Z3

   (farkas c1 (<=? g1 g1') c2 (<=? g2 g2') ... cn (<=? gn gn'))

where <=? is <=, <, > >=, =, and their negations; and are integer constants.

Define normalization function:

   ci * (>= gi gi')       ->  -ci * (<= gi gi')
   ci * (< gi gi')        ->   ci * (<= (+ 1 gi) gi')        if gi is Int
   ci * (> gi gi')        ->  -ci * (< gi gi')
   ci * (not (<= gi gi')) ->  -ci * (< gi gi')
   ci * (<= gi gi')       ->  -ci * (<= gi' gi)              if ci < 0
   etc

Let be indices of inequalities, equalities, and reduce using the equalities . Then is non-negative if contains a strict inequality, or negative if it only contains weak inequalities.

S - some impressions

• Tradeoff between generic rules and simpler rules.

  • Shifts work between proof logger and proof checker

• Unclear if added complexity of checking generic rules provides return on investment.

• A proof checker could map to nucleus of SMTInterpol format before validating premises.

  • Each normalization step maps to a justification

Several Directions

• Model transformers, dual to proofs

  • undo effect of model transformers for incrementality

• Pre and in-processing proofs

  • proofs for global inferences

• Sustainable proofs

  • proof/life balance

Several Directions (II)

• Beyond the power of regular resolution

  • for EUF
  • for EPR

• Proofs for

  • word-level bit-vectors
  • CP domains within CDCL(T) solvers
  • PB/Cardinality proofs for CDCL(T)
    • Specifically extract PB justification as coarse/fine-grained proofs