Davenport, James H.

England, Matthew

Kremer, Gereon

Ábrahám, E.

English

We discuss the topic of unsatisfiability proofs in SMT, particularly with reference to quantifier free non-linear real arithmetic. We outline how the methods here do not admit trivial proofs and how past formalisation attempts are not sufficient. We note that the new breed of local search based algorithms for this domain may offer an easier path forward

Coventry University Pure Portal

Proving UNSAT in SMT:The Case of Quantifier Free Non-Linear Real ArithmeticErika Ábrahám1, James H. Davenport2∗,Matthew England3†, and Gereon Kremer41 RWTH Aachen University, 52062 Aachen, Germanyabraham@cs.rwth-aachen.de2 University of Bath, Bath BA2 7AY, United KingdomJ.H.Davenport@bath.ac.uk3 Coventry University, Coventry, CV1 5FB, United KingdomMatthew.England@coventry.ac.uk4 Stanford University, Stanford, California 94305, United Statesgkremer@cs.stanford.eduAbstractWe discuss the topic of unsatisfiability proofs in SMT, particularly with reference toquantifier free non-linear real arithmetic. We outline how the methods here do not admittrivial proofs and how past formalisation attempts are not sufficient. We note that the newbreed of local search based algorithms for this domain may offer an easier path forward.1 IntroductionSince 2013, SAT Competitions have required certificates for unsatisfiability which are verifiedoffline [HJS18]. As the SAT problems tackled have grown larger, and the solvers have grownmore complicated, such proofs have become more important for building trust in these solvers.The SAT community has agreed on DRAT as a common format for presenting such proofs(although within this there are some flavours [RB19]).The SMT community has long recognized the value of proof certificates, but alas producingthem turned our to be much more difficult than for the SAT case. The current version ofthe SMT-LIB Language (v2.6) [BFT16] specifies API commands for requesting and inspectingproofs from solvers but sets no requirements on the form those proofs take. In fact on page66 it writes explicitly: “The format of the proof is solver-specific”. We assume that this is aplace holder for future work on an SMT-LIB proof format, rather than a deliberate design. Thepaper [BdF15] summarises some of the requirements, challenges and various approaches takento proofs in SMT. Key projects that have been working on this issue include LFSC [SRT+12]and veriT [BBFF20], but there has not been a general agreement in the community yet.Our long-term vision is that an SMT solver would be able to emit a “proof” that coversboth the Boolean reasoning and the theory reasoning (possibly from multiple theories) such thata theorem prover (or a combination of multiple theorem provers) could verify its correctness,where the inverted commas indicate that some programming linkage between the theoremprovers might be necessary. We would still be some way from having a fully verified one-stopchecker as in GRAT [Lam20], but would be a lot closer to it than we are now.∗Support of EPSRC (Grant EP/T015713/1) is gratefully acknowledged.†Support of EPSRC (Grant EP/T015748/1) is gratefully acknowledged.Proving UNSAT in QF NRA Ábrahám, Davenport, England and KremerIn [BdF15] the authors explain that since in SMT the propositional and theory reasoning arenot strongly mixed, an SMT proof can be an interleaving of SAT proofs and theory reasoningproofs in the shape of a Boolean resolution tree whose leaves are clauses. They identify the mainchallenge of proof production as keeping enough information to produce proofs, without hurtingefficiency too much. This may very well be true for many cases, but for the area of interestfor the authors, QF_NRA (Quantifier-Free Nonlinear Real Arithmetic), there is the additionalchallenge of providing the proofs of the theory lemmas themselves.2 Quantifier Free Non-Linear Real ArithmeticQF_NRA typically considers a logical formula Φ where the literals are statements about the signsof polynomials with rational coefficients, i.e. fi(x1, . . . , xn)σi0 with σi ∈ {=, 6=, >,≥, <,≤}.Any SMT solver which claims to tackle this logic completely relies in some way on thetheory of Cylindrical Algebraic Decomposition (CAD). This was initiated by Collins [Col75]in the 1970s with many subsequent developments since: see for example the collection [CJ98]or the introduction of the recent paper [EBD20]. The key idea is to decompose infinite spaceRn into a finite number of disjoint regions upon each of which the truth of the constraints isconstant. This may be achieved by decomposing to ensure the signs of the polynomials involvedare invariant, although optimisations can produce a coarser, and thus cheaper, decomposition.In the case of unsatisfiability an entire CAD truth invariant for the constraints may beproduced, and the solver can check that the formula is unsatisfiable for a sample of eachcell. How may this be verified? The cylindrical condition1 means that checking our cellsdecompose the space is trivial, but the fact that the constraints have invariant truth-value is adeep implication of the algorithm, not necessarily apparent from the output.Past QF NRA Formalisation AttemptsThere was a project in Coq to formalise Quantifier Elimination in Real Closed Fields. This mayalso be tackled by CAD, and of course has SMT in QF_NRA as a sub-problem. Work began on animplementation of CAD in Coq with some of the underlying infrastructure formalised [Mah07],but the project proceeded to instead formalise QE via alternative methods [CM10], [CM12]which are far less efficient2. We learn that the CAD approach was not proven correct in theend [CM12, bottom of p. 38]. Thus while it is formalised that Real QE (and thus satisfiability)is decidable, this does not offer a route to verifying current solver results.The only other related work in the literature we found is [NMD15] which essentially for-malises something like CAD but only for problems in one variable.3 Potential from Coverings Instead of Decompositions?There has been recent interaction between the SMT community and the computer algebracommunity [ÁAB+16] from which many of these methods originate. Computer algebra im-plementations are being adapted for SMT compliance [ÁAB+16], as CAD was in [KÁ20], andthere has also be success when they are used directly [FOS+18]. Most excitingly, there have1Formally, the condition is that projection of any two cells onto a lower dimensional space with respect tothe variable ordering are either equal or disjoint. Informally, this means the cells are stacked in cylinders overa decomposition in lower dimensional space.2Although CAD is doubly exponential in the number of variables, the methods verified do not even haveworst case complexity bound by a finite tower of exponentials!2Proving UNSAT in QF NRA Ábrahám, Davenport, England and Kremerbeen some entirely new algorithmic approaches developed. Perhaps most notable is the NLSATalgorithm of Jovanović and de Moura [JdM12], introduced in 2012 and since generalised into themodel constructing satisfiability calculus (mcSAT) framework [dJ13]. In mcSAT the search fora Boolean model and a theory model are mutually guided by each other away from unsatisfiableregions. Partial solution candidates for the Boolean structure and for the corresponding theoryconstraints are constructed incrementally in parallel. Boolean conflicts are generalised usingpropositional resolution as normal. At the theory level, when an assignment (sample point)is determined not to satisfy all constraints then this is generalised from the point to a regioncontaining the point on which the same constraints fail for the same reason.In NLSAT, which only considers QF_NRA, the samples are generalised to CAD cells3 beingexcluded by adding a new clause with the negation of the algebraic description of the cell. InUNSAT cases these additional clauses become mutually exclusive, in effect the cells generatedcover all possible space in Rn. However, as these are not arranged cylindrically, this may notbe trivial to check from the output. We note also the more efficient algorithm to compute thesesingle CAD cells in [BK15], and the new type of decomposition they inspired in [Bro15].Another new approach was presented recently in [ÁDMK21]: conflict driven cylindrical al-gebraic covering (CDCAC). Like NLSAT this produces a covering of Rn to show unsatisfiability.Essentially, a depth first search is performed according to the theory variables. Conflicts overparticular assignments are generalised to cells until a covering of a dimension is obtained, andthen this covering is generalised to a cell in the dimension below. In this procedure the coveringitself is explicit and easy to verify. Further, CDCAD computes the covering relative to a setof constraints to check their consistency independent of the Boolean search, meaning it can bemore easily integrated into an CDCL(T)-style SMT solver and combined with its other theorysolving modules than NLSAT, which is a solving framework on its own.Both NLSAT and CDCAC rely on CAD theory to conclude that the generalisations ofconflicts from models to cells are valid, and so the verification of such theory is still a barrierto verifiable proofs. But unlike CAD itself, the conflicts that are being generalized are local forboth NLSAT and CDCAC. This may allow a simpler path for verification of individual casesbased on the particular relationships of the polynomials involved. It was observed in [ÁDE+20]that a trace of the computation from CDCAC appears far closer to a human derived proof thanany of the other algorithms discussed here. Whether this means it will be more susceptible tomachine verification remains to be seen.4 Other approaches for QF NRAWe wrote earlier that all solvers tackling QF_NRA in a complete manner rely on CAD basedapproaches, as these are the only complete methods that have been implemented. However,we should note that most solvers also employ a variety of incomplete methods for QF_NRAwhich tend to be far more efficient than CAD based ones and so are attempted first, and mayalso be used to solve sub-problems or simplify the input to CAD. These include incrementallinearisation [CGI+18], interval constraint propagation [TVO17], virtual substitution [Wei97],subtropical satisfiability [FOSV17] and Gröbner bases [HEDP16].So, although we think there is potential for verifying output of a cylindrical covering basedalgorithm, we caution that to obtain fully verified proofs for QF_NRA problems we must takeon a greater body of work: to generate proofs for all these methods and furthermore integratethem into or combine them with the CAD proofs.3But not necessarily one that would be produced within any entire CAD for the problem.3Proving UNSAT in QF NRA Ábrahám, Davenport, England and KremerReferences[ÁAB+16] E. Ábrahám, J. Abbott, B. Becker, A.M. Bigatti, M. Brain, B. Buchberger, A. Cimatti,J.H. Davenport, M. England, P. Fontaine, S. Forrest, A. Griggio, D. Kroening, W.M.Seiler, and T. Sturm. SC2: Satisfiability checking meets symbolic computation. InM. Kohlhase, M. Johansson, B. Miller, L. de Moura, and F. Tompa, editors, Intelli-gent Computer Mathematics: Proceedings CICM 2016, volume 9791 of Lecture Notes inComputer Science, pages 28–43. Springer International Publishing, 2016. URL: https://doi.org/10.1007/978-3-319-42547-4_3.[ÁDE+20] E. Ábrahám, J.H. Davenport, M. England, G. Kremer, and Z. Tonks. New opportunitiesfor the formal proof of computational real geometry? In P. Fontaine, K. Korovin, I.S.Kotsireas, P. Rümmer, and S. Tourret, editors, Proceedings of the 5th Workshop on Satis-fiability Checking and Symbolic Computation (SC2 2020), CEUR-WS 2752, pages 178–188,2020. URL: http://ceur-ws.org/Vol-2752/.[ÁDMK21] E. Ábrahám, J.H. Davenport, M.England, and G. Kremer. Deciding the consistency of non-linear real arithmetic constraints with a conflict driven search using cylindrical algebraiccoverings. Journal of Logical and Algebraic Methods in Programming, 119, 2021. URL:https://doi.org/10.1016/j.jlamp.2020.100633.[BBFF20] Haniel Barbosa, Jasmin Christian Blanchette, Mathias Fleury, and Pascal Fontaine. Scal-able fine-grained proofs for formula processing. Journal of Automated Reasoning, 64(3):485–510, 2020. URL: https://doi.org/10.1007/s10817-018-09502-y.[BdF15] C. Barrett, L. de Moura, and P. Fontaine. Proofs in satisfiability modulo theories. InD. Delahaye and B. Woltzenlogel Paleo, editors, All about Proofs, Proofs for All, volume 55of Mathematical Logic and Foundations, pages 23–44. College Publications, London, UK,2015. URL: http://www.cs.stanford.edu/~barrett/pubs/BdMF15.pdf.[BFT16] C. Barrett, P. Fontaine, and C. Tinelli. The Satisfiability Modulo Theories Library (SMT-LIB). Online Resource, 2016. URL: http://www.SMT-LIB.org.[BK15] C.W. Brown and M. Kosta. Constructing a single cell in cylindrical algebraic decompo-sition. Journal of Symbolic Computation, 70:14 – 48, 2015. URL: https://doi.org/10.1016/j.jsc.2014.09.024.[Bro15] C.W. Brown. Open non-uniform cylindrical algebraic decompositions. In Proceedings ofthe 2015 International Symposium on Symbolic and Algebraic Computation, ISSAC ’15,pages 85–92. ACM, 2015. URL: https://doi.org/10.1145/2755996.2756654.[CGI+18] A. Cimatti, A. Griggio, A. Irfan, M. Roveri, and R. Sebastiani. Incremental linearizationfor satisfiability and verification modulo nonlinear arithmetic and transcendental functions.ACM Transactions on Computational Logic, 19(3):19:1–19:52, 2018. URL: http://doi.acm.org/10.1145/3230639, doi:10.1145/3230639.[CJ98] B. Caviness and J. Johnson. Quantifier Elimination and Cylindrical Algebraic Decom-position. Texts & Monographs in Symbolic Computation. Springer-Verlag, 1998. URL:https://doi.org/10.1007/978-3-7091-9459-1.[CM10] C. Cohen and A. Mahboubi. A formal quantifier elimination for algebraically closed fields.In S. Autexier, J. Calmet, D. Delahaye, P. Ion, L. Rideau, R. Rioboo, and A.P. Sexton,editors, Intelligent Computer Mathematics, volume 6167 of Lecture Notes in ComputerScience, pages 189–203. Springer Berlin Heidelberg, 2010. URL: https://doi.org/10.1007/978-3-642-14128-7_17.[CM12] C. Cohen and A. Mahboubi. Formal proofs in real algebraic geometry: from ordered fieldsto quantifier elimination. Logical Methods in Computer Science, 8(1):1–40, 2012. URL:https://doi.org/10.2168/LMCS-8(1:2)2012.[Col75] G.E. Collins. Quantifier elimination for real closed fields by cylindrical algebraic decom-position. In Proceedings of the 2nd GI Conference on Automata Theory and Formal Lan-guages, pages 134–183. Springer-Verlag (reprinted in the collection [CJ98]), 1975. URL:4Proving UNSAT in QF NRA Ábrahám, Davenport, England and Kremerhttps://doi.org/10.1007/3-540-07407-4_17.[dJ13] L. de Moura and D. Jovanović. A model-constructing satisfiability calculus. In R. Gia-cobazzi, J. Berdine, and I. Mastroeni, editors, Verification, Model Checking, and AbstractInterpretation (Proc. VMCAI 2013), pages 1–12. Springer Berlin Heidelberg, 2013. URL:https://doi.org/10.1007/978-3-642-35873-9_1.[EBD20] M. England, R. Bradford, and J.H. Davenport. Cylindrical algebraic decomposition withequational constraints. Journal of Symbolic Computation, 100:38–71, 2020. URL: https://doi.org/10.1016/j.jsc.2019.07.019.[FOS+18] P. Fontaine, M. Ogawa, T. Sturm, V. Khanh To, and X. Tung Vu. Wrapping computeralgebra is surprisingly successful for non-linear SMT. In A.M. Bigatti and M. Brain,editors, Proc. 3rd Workshop on Satisfiability Checking and Symbolic Computation (SC22018), CEUR-WS 2189, pages 110–117, 2018. URL: http://ceur-ws.org/Vol-2189/.[FOSV17] P. Fontaine, M. Ogawa, T. Sturm, and X.T. Vu. Subtropical satisfiability. In C. Dixonand M. Finger, editors, Frontiers of Combining Systems (FroCoS 2017), volume 10483of Lecture Notes in Computer Science, pages 189–206. Springer International Publishing,2017. URL: https://doi.org/10.1007/978-3-319-66167-4_11.[HEDP16] Z. Huang, M. England, J.H. Davenport, and L. Paulson. Using machine learning to decidewhen to precondition cylindrical algebraic decomposition with Groebner bases. In 18thIntl. Symp. on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC ’16),pages 45–52. IEEE, 2016. URL: https://doi.org/10.1109/SYNASC.2016.020.[HJS18] M.J. Heule, M. Järvisalo, and M. Suda. Proceedings of SAT competition 2018: Solver andbenchmark descriptions. In Technical Report B-2018-1, University of Helsinki Departmentof Computer Science, 2018. URL: https://helda.helsinki.fi/handle/10138/237063.[JdM12] D. Jovanovic and L. de Moura. Solving non-linear arithmetic. In B. Gramlich, D. Miller, andU. Sattler, editors, Automated Reasoning: 6th International Joint Conference (IJCAR),volume 7364 of Lecture Notes in Computer Science, pages 339–354. Springer, 2012. URL:https://doi.org/10.1007/978-3-642-31365-3_27.[KÁ20] G. Kremer and E. Ábrahám. Fully incremental CAD. Journal of Symbolic Computation,100:11–37, 2020. URL: https://doi.org/10.1016/j.jsc.2019.07.018.[Lam20] P. Lammich. Efficient verified (un)SAT certificate checking. Journal of Automated Rea-soning, 64:513–532, 2020. URL: https://doi.org/10.1007/s10817-019-09525-z.[Mah07] A. Mahboubi. Implementing the cylindrical algebraic decomposition within the Coq system.Mathematical Structures in Computer Science, 17(1):99–127, 2007. URL: https://doi.org/10.1017/S096012950600586X.[NMD15] A. Narkawicz, C. Munoz, and A. Dutle. Formally-verified decision procedures for univariatepolynomial computation based on Sturm’s and Tarski’s theorems. Journal of AutomatedReasoning, 54(4):285–326, 2015. URL: https://doi.org/10.1007/s10817-015-9320-x.[RB19] A. Rebola-Pardo and A. Biere. Two flavours of DRAT. In Proceedings of Pragmatics ofSAT 2015 and 2018, volume 59 of EPiC Series in Computing, pages 91–110, 2019. URL:https://doi.org/10.29007/lt8r.[SRT+12] A. Stump, A. Reynolds, C. Tinelli, A. Laugesen, H. Eades, C. Oliver, and R. Zhang. LFSCfor SMT proofs: Work in progress. In Proof Exchange for Theorem Proving—SecondInternational Workshop, PxTP 2012, CEUR-WS 878, pages 21–27, 2012. URL: http://ceur-ws.org/Vol-878/paper1.pdf.[TVO17] V.X. Tung, , T. Van Khanh, and M. Ogawa. raSAT: An SMT solver for polynomialconstraints. Formal Methods in System Design, 51(3):462–499, 2017. URL: https://doi.org/10.1007/s10703-017-0284-9.[Wei97] V. Weispfenning. Quantifier elimination for real algebra — the quadratic case and beyond.Applicable Algebra in Engineering, Communication and Computing, 8(2):85–101, 1997.URL: https://doi.org/10.1007/s002000050055.5

Proving UNSAT in SMT: The Case of Quantifier Free Non-Linear Real Arithmetic

https://pure.coventry.ac.uk/ws/files/44166050/ADEK21b.pdf

Proving UNSAT in SMT: The Case of Quantifier Free Non-Linear Real Arithmetic

Abstract

Similar works

Full text

Available Versions

Coventry University Pure Portal