We present the architecture of the oncoming version of the SMT (Satisfiability Modulo Theories) solver haRVey. haRVey checks the satisfiability of a formula written in a first-order language with interpreted symbols from various theories. Its new architecture is original, first in the sense that it is a combination of reasoners, rather than the traditional combination of decision procedures. Second, one of these reasoners is a full-featured first-order saturation-based prover. Finally, some of those reasoners in the combination may only be sporadically activated not using computer time when inactive. We believe those new features will contribute to the efficiency and expressivity of the new version of the tool

Déharbe, David

Fontaine, Pascal

Hal-Diderot

haRVey: combining reasoners

HAL Descartes

INRIA a CCSD electronic archive server

HAL Id: inria-00091662https://hal.inria.fr/inria-00091662Submitted on 6 Sep 2006HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.haRVey: combining reasonersDavid Déharbe, Pascal FontaineTo cite this version:David Déharbe, Pascal Fontaine. haRVey: combining reasoners. Automatic Verification of CriticalSystems - AVoCS 2006, Sep 2006, Nancy/France, pp.152-156. ￿inria-00091662￿AVoCS 2006haRVey: combining reasonersDavid Déharbe1UFRN - CCET - DIMApCampus Universitário - Lagoa Nova59072-970 Natal, RN, BRAZILPascal Fontaine2LORIA and University of NancyBP 239, Campus scientifique54506 Vandœuvre les Nancy, FRANCEAbstractWe present the architecture of the oncoming version of the SMT (Satisfiability Modulo Theories) solverhaRVey [5]. haRVey checks the satisfiability of a formula written in a first-order language with interpretedsymbols from various theories. Its new architecture is original, first in the sense that it is a combination ofreasoners, rather than the traditional combination of decision procedures. Second, one of these reasoners isa full-featured first-order saturation-based prover. Finally, some of those reasoners in the combination mayonly be sporadically activated not using computer time when inactive. We believe those new features willcontribute to the efficiency and expressivity of the new version of the tool.Keywords: first-order logic, combination of theories, decision procedures, automatic theorem proving1 IntroductionThe Satisfiability Modulo Theories (SMT) problem is the satisfiability problemfor first-order formulas (most often, quantifier-free) containing interpreted symbolsfrom one theory or a combination of theories (for instance, linear arithmetics, thetheories of arrays, lists, or of other programming data structures, . . . ). This problemhas attracted much interest recently, 3 because the language the solvers tackle isparticularly appropriate for verification problems, in bounded model-checking butalso in formal verification of algorithms [3].SMT solvers usually use techniques from SAT-solvers to deal with the propo-sitional structure of the formulas, thus lowering the problem to checking the sat-isfiability of sets of literals modulo a theory or a combination of theories. The1 Email: david@dimap.ufrn.br2 Email: Pascal.Fontaine@loria.fr3 A competition between SMT solvers has been organised for the first time in 2005 and is reconducted thisyear [1].Short presentation at AVoCS 2006URL: avocs06.loria.frDeharbe and FontaineSAT-solvers enumerate models of the propositional abstraction of the formulas, andthe theory reasoner refutes the set of literals corresponding to those models. 4 Forinstance, while checking a formula that contains interpreted symbols from lineararithmetics, and uninterpreted symbols, the theory reasoner may have to refute thefollowing set of literals:L = {x ≤ y, y ≤ x+ f(x), P (h(x) − h(y)), ¬P (0), f(x) = 0}.The Nelson-Oppen [6,8] framework allows to build a decision procedure for a unionof theories from the decision procedures for elementary theories: here, a decisionprocedure for linear arithmetics, and a decision procedure for uninterpreted symbols.The first step of the technique is purification: in our example, L is split in L1 and L2using new variables, such that L1 ∪L2 is equisatisfiable to L, and L1 only containslinear arithmetic symbols (and variables), whereas L2 contains only uninterpretedsymbols (and variables):L1 = {x ≤ y, y ≤ x+ v1, v1 = 0, v2 = v3 − v4, v5 = 0}L2 = {P (v2), ¬P (v5), v1 = f(x), v3 = h(x), v4 = h(y)}.Each set is then handled by its corresponding decision procedure. However this isnot sufficient to conclude to the unsatisfiability of L: L1 and L2 are satisfiable, evenif their union is not. It is also required for the decision procedures to exchange (dis-junctions of) equalities between shared variables. For instance, x = y is entailed byL1. Adding this new fact to L2 allows to deduce more equalities. All those entailedfacts will eventually lead to the unsatisfiability of one set or the other, using onlydecision procedures for the elementary languages. Combining decision proceduresis the key to obtain a rich language for SMT solvers. For the framework to becomplete, the decision procedures in the combination should be stably-infinite [8],and mutually disjoint (i.e., no interpreted symbol can be shared).The new implementation of the haRVey solver allows to combine not only disjointdecision procedures, but more generally, reasoners that may handle non-disjoint lan-guages (Section 2). In particular, one of those reasoners is a full-featured first-ordertheorem prover (that is, the E prover [7]). Although haRVey focus on expressivityrather than efficiency, it is crucial for efficiency to have some intelligent schedulingcapabilities, if some reasoners are very expensive. We describe these capabilities inSection 3.2 Combining reasonersIn a combination of decision procedures, each elementary decision procedure hasto propagate equalities between shared variables to the other decision procedures.Non-convex decision procedures 5 may also have to propagate disjunctions of equal-ities. Those disjunctions would involve case splitting at the theory reasoning level.However case splitting is a work that suits SAT-solvers better; it is thus natural tomove this splitting from the theory reasoning module to the propositional reason-ing module. As a consequence, we consider that the decision procedures interact4 Some techniques allow to avoid all models to be enumerated. This is crucial for efficiency.5 A theory is said to be non-convex when a disjunction of equalities can be derived from a conjunction ofequalities.153Deharbe and Fontainedirectly only through equality exchanges, relying on the SAT-solver to exchangedisjunction of equalities (like for instance in [2]).More generally, we assume that each reasoner in the combination may• produce entailed equalities. Those equalities are passed directly to the otherreasoners in the combination;• produce arbitrary formulas that are valid according to its own logic, but nonethe-less informative for the rest of the combination. Those lemmas are anded to theoriginal formula, at the SAT-solver level.As an example, consider the non-convex theory for linear arithmetic on integers.While deciding the satisfiability of a formula ϕ, the reasoner may have to dealwith the set {x < 5, x > 2, y = 3, z = 4}. In the classic approach, it would havebeen necessary to do a case split, and consider separately x = y and x = z. Todischarge the case split to the SAT-solver, the reasoner produces the valid lemmaψ = (x < 5∧x > 2∧y = 3∧z = 4) ⇒ (x = y∨x = z). The formula considered by theSAT-solver will then be ψ∧ϕ, which is logically equivalent to ϕ. Subsequent sets ofliterals that are generated by the SAT-solver and passed to the theory reasoners willall assign the value of one literal in the lemma to make the lemma true. Implicitly,the different cases are split by the SAT-solver, at the propositional level.Introducing lemmas at the propositional level is convenient to deal with non-convex theories, but foremost, it allows to extend the language in an easy andsound way. For instance, assume one want to decide the satisfiability of formulascontaining some set constructions, like in:{a = b, ({f(a)} ∪ E) ⊆ A, f(b) 6∈ C,A ∪B = C ∩D}.This can be simply rewritten by replacing the set operations by operations on thecharacteristic functions of the sets. It becomes:ϕ = {a = b,∀x[(x = f(a) ∨ E(x)) ⇒ A(x)],¬C(f(b)),∀x. [A(x) ∨B(x)] ≡ [C(x) ∧D(x)]}This last set of formulas contains literals, and quantified formulas. Assume now wehave an instantiation reasoner aware of the quantified formulas and symbols usedin the set. The instantiation reasoner may generate the (valid) lemmas:ψ1 = ∀x[(x = f(a) ∨ E(x)) ⇒ A(x)] ⇒ [(f(a) = f(a) ∨ E(f(a))) ⇒ A(f(a))]andψ2 = ∀x[[A(x) ∨B(x)] ≡ [C(x) ∧D(x)]]⇒ [[A(f(b)) ∨B(f(b))] ≡ [C(f(b)) ∧D(f(b))]].Like ϕ, the formula ψ1 ∧ ψ2 ∧ ϕ is unsatisfiable. But, with those lemmas from theinstantiation reasoner, the resulting formula can be showed to be unsatisfiable byusing only simple reasoning on equalities and uninterpreted symbols, all quantifiedformulas being abstracted by propositional atoms.Assuming a generic mechanism of lemma generation may also be used to improveefficiency of the prover. Indeed, techniques such as theory propagation—shown toyield significative performance improvement of SMT provers based on DPLL SAT-solvers [2]—can be viewed as instances of lemma generation.154Deharbe and FontaineAs long as all generated lemmas are valid, soundness is guaranteed. Complete-ness can be guaranteed in some cases, for instance (but not only) for the combinationof stably-infinite disjoint (convex or non-convex) theories.3 Scheduling reasonersThe Nelson-Oppen module in haRVey has been designed under the requirementthat it should be tightly integrated with a propositional SAT-solver. A SAT-solvermaintains a database of clauses representing a propositional abstraction of the for-mula to be checked for satisfiability. The SAT-solver builds propositional modelsincrementally, by repeatedly propagating unit clauses, making decisions, assigningpropositional variables, and backtracking when a conflict occurs at the propositionallevel. The interaction with the Nelson-Oppen module occurs to check the satisfi-ablity of the current assignment modulo the background theory. This interactioncan be realized on the fly while building the propositional model. In that case, weexpect that the cost of this interaction remains low, since the number of decisionsand propagations made by the SAT-solver is potentially large. However, when theSAT-solver has found a complete propositional model (i.e. that cannot be furtherextended), the Nelson-Oppen module needs to guarantee completeness.The Nelson-Oppen module should meet the following design requirements:• it should accept literals incrementally, and these literals may be retracted, fol-lowing a LIFO order. The cost of such operations should be very low;• solving may be realized in full force (when propositional models are complete),or not (when models are partial). For instance, we may want to apply a low-costsolve operation before a variable assignment at the propositional level.For the design of the module that provide these facilities, we took into accountthe fact that the individual reasoners that make up the Nelson-Oppen combinationmay also have different capabilities:• some reasoners are incremental and backtrackable, others are incremental only,and some may be neither;• the computational cost of the reasoners may differ widely. Also, there may beseveral procedures for a theory (say, arithmetics), with varying complexities, anddegrees of completeness. The reasoners are thus parameterized by the effort thatthey are expected to spend.In order to address all these constraints, we devised a scheduler for the differentreasoners. This scheduler only knows the basic characteristics of each reasoner (in-crementality, backtrackability, effort levels they can address). The scheduler is also(indirectly) aware of the current phase of the SAT-solver, since it operates differentlywhen a new literal is pushed, when the model is partial, or when the SAT-solverhas found a complete model for the propositional abstraction. The scheduler is re-sponsible also for disactivating reasoners that are not required: for instance, a veryexpensive reasoner (like the saturation prover) is only activated to check completemodels. The total number of reasoners has no impact on the cost of the combina-tion schema. Moreover, the congruence closure module [4] centralises all deduced155Deharbe and Fontaineequalities; when an expensive reasoner is activated, it gets summarized informationabout the proof state. This information, which is computed by the congruence clo-sure, already takes into account all the entailed equalities. The expensive reasoneronly has to deal with the relevant terms.4 ConclusionWe presented some aspects of the design of the oncoming version of the haRVeySMT solver. This version unifies two branches of haRVey: the haRVey-SAT branchis mainly a cooperation of a SAT-solver with congruence closure (plus an instanti-ation reasoner, and limited linear arithmetic support), whereas the main branch isbasically a cooperation of a saturation-based first-order theorem prover, an incom-plete arithmetic module, and a propositional reasoner (originally based on BDDs).At the present time, we are reaching the point of the first runs of the prototype.We hope to have a working version in a few weeks, and a full-featured tool by thisyear.Future work includes tuning the tool, by studying the effect on the performancesof different scheduling strategies. The main efforts will then be directed to the designof supplementary reasoners (e.g. based on rewriting), and to a better integrationof the different modules in the tool. For instance, we plan to investigate how touse several instances of the saturation-based first-order theorem prover, that wouldwork independently on the disjoint theories.On the theoretical side, we will investigate the completeness of the combinationof reasoners. Soundness is simply guaranteed by the fact that all produced lemmasare valid. Completeness however heavily depends on the nature of the reasoners,and their interactions (notably, the scheduling strategy, and the lemma production).References[1] Barrett, C., L. de Moura and A. Stump, SMT-COMP: Satisfiability Modulo Theories Competition, in:K. Etessami and S. Rajamani, editors, 17th International Conference on Computer Aided Verification(2005), pp. 20–23.[2] Barrett, C., R. Nieuwenhuis, A. Oliveras and C. Tinelli, Splitting on demand in satisfiability modulotheories, in: Logic for Programming, Artificial Intelligence, and Reasoning (LPAR), Lecture Notes inComputer Science (2006), to be published.[3] Barsotti, D., L. P. Nieto and A. Tiu, Verification of clock synchronization algorithms: Experimentson a combination of deductive tools, in: R. Lazic and R. Nagarajan, editors, Proceedings of the 5thInternational Workshop on Automated Verification of Critical Systems (AVoCS 2005), Electronic Notesin Theoretical Computer Science 145 (2005), pp. 63–78.[4] Fontaine, P., “Techniques for verification of concurrent systems with invariants,” Ph.D. thesis, InstitutMontefiore, Université de Liège, Belgium (2004).[5] The haRVey prover, http://harvey.loria.fr/.[6] Nelson, G. and D. C. Oppen, Simplifications by cooperating decision procedures, ACM Transactions onProgramming Languages and Systems 1 (1979), pp. 245–257.[7] Schulz, S., System Description: E 0.81, in: D. Basin and M. Rusinowitch, editors, Proc. of the 2ndIJCAR, Cork, Ireland, LNAI 3097 (2004), pp. 223–228.[8] Tinelli, C. and M. T. Harandi, A new correctness proof of the Nelson–Oppen combination procedure, in:F. Baader and K. U. Schulz, editors, Frontiers of Combining Systems (FroCoS), Applied Logic (1996),pp. 103–120.URL citeseer.nj.nec.com/tinelli96new.html156

https://hal.inria.fr/inria-00091662/document

haRVey: combining reasoners

Abstract

Similar works

Full text

Available Versions

Hal-Diderot

HAL Descartes

INRIA a CCSD electronic archive server