1 A Combination Method for Generating Interpolants by G. Yorsh and M. Masuvathi Presentation by: Emilia Katz

2 The Goal Given: –theory T – combination of T 1 and T 2 –A and B – two logical T-formulas –A ⋀ B is unsatisfiable in T –efficient interpolant-generation procedures exist for T 1 and T 2 Find: –interpolant for if both sub-procedures are polynomial, the resulting procedure will also be polynomial restrictions on T 1 and T 2 will be seen later…

3 The Idea How to find an interpolant efficiently? –Derive it from unsatisfiability proof But how? And how to get the proof? We don’t want to make further assumptions about T 1 and T 2, so –We don’t know how their interpolant-generation procedures work –We don’t know how their decision procedures work The idea: use them as black boxes –Combine d.p.-s for T 1 and T 2 into a d. p. for T. –Use the proof and the interpolant-generation procedures for T 1 and T 2 to derive an interpolant in T. Nelson-Oppen framework…

4 Example T 1 = UIF (uninterpreted functions theory) T 2 = LI (linear equalities theory) A ≝ (f(x 1 )+x 2 =x 3 )  (f(y 1 )+y 2 =y 3 )  (y 1  x 1 ) B ≝ (x 2 =g(b))  (y 2 =g(b))  (x 1  y 1 )  (x 3 < y 3 ) UIF and LI satisfy the requirements [assume it meanwhile, we’ll return to it later] A  B is unsatisfiable [we’ll see this in a couple of minutes]

5 Nelson – Oppen framework … for combining decision procedures Given: –theory T – combination of T 1 and T 2 –A and B – two conjunctions of literals in T Goal: is A ⋀ B satisfiable in T ? Assumptions: –Σ = Σ 1  Σ 2 (denote: Σ = Σ T, Σ i = Σ Ti ) –Σ 1  Σ 2 = {=} –T 1, T 2 are stably-infinite –T 1, T 2 have decision procedures for satisfiability of conjunctions of Σ i literals = every quantifier- free Σ i -formula is satisfiable in T i iff it is satisfied by a T i - interpretation with infinite domain

6 N.-O. framework application example T 1 = UIF (uninterpreted functions theory) T 2 = LI (linear equalities theory) A ≝ (f(x 1 )+x 2 =x 3 )  (f(y 1 )+y 2 =y 3 )  (y 1  x 1 ) B ≝ (x 2 =g(b))  (y 2 =g(b))  (x 1  y 1 )  (x 3 < y 3 ) 1.Purification: A LI = (a 1 +x 2 =x 3 )  (a 2 +y 2 =y 3 )  (y 1  x 1 ) A UIF = ((a 1 = f(x 1 ))  (a 2 = f(y 1 )) B LI = (x 1  y 1 )  (x 3 < y 3 ) B UIF = (x 2 =g(b))  (y 2 =g(b)) replace: f(x 1 ) by a 1, f(y 1 ) by a 2 add equalities for a 1, a 2 no replacements needed

7 Application Example – contd. 2. Equality propagation: UIF LI (1) a 1 = f(x 1 )(5) a 1 +x 2 =x 3 (2) a 2 = f(y 1 )(6) a 2 +y 2 =y 3 (3) x 2 =g(b)(7) y 1  x 1 (4) y 2 =g(b)(8) x 1  y (9) x 3 < y (10) x 1 = y 1 (11) a 1 = a 2 (12) x 2 = y 2 Unsatisfiable! Theory: LI Eq = (a 1 =a 2  x 2 =y 2 ) under the line: Eq LI under the line: Eq UIF

8 Nelson – Oppen framework A  B Purification A1 B1A1 B1 A2 B2A2 B2 in T in T 1 in T 2 Equality propagation Dec. proc. for T 1 Dec. proc. for T 2 F 1 := A 1  B 1 F 2 := A 2  B 2 Equality derivation in T 1 (Eq 1 ) Equality derivation in T 2 (Eq 2 ) F 2 := F 2  Eq 1 F 1 := F 1  Eq 2 Sat. Satisfiable! no more new equalities Unsatisfiable! (found by T i, with Eq) Unsat. adding new variables to replace objects of the “wrong” type, and equalities “defining” them

9 Theory-specific Interpolant Given: T – first order theory of signature Σ L – class of quantifier-free Σ-formulas Σ T  Σ – interpreted symbols in T A, B ∈ L such that A ⋀ B ⊦ T ⊥ Then theory-specific interpolant for is I ∈ L such that: 1.A ⊦ T I 2. I ⋀ B ⊦ T ⊥ 3. V ( I )  ( V(A)  V(B))  Σ T new requirement: quantifier-free interpolants (for completeness of SAT-checks with interpolants [in subsequent analysis stages]) less strict requirement: I can contain not only AB- common symbols not necessary for the method to work properly set of symbols that appear in the formula

10 Requirement (3) Change Motivation Example: A ≝ c 2 = car(c 1 ) ⋀ c 3 = cdr(c 1 ) ⋀  atom(c 1 ) B ≝  c 1 = cons( c 2,c 3 ) In theory of Lisp structures c i – s are lists car(c) = “head” element of the list c cdr(c) = “tail” of the list c cons(c,d) = concatenation of d after c Σ T = {car, cdr, cons, atom} A ⋀ B ⊦ T ⊥ Axiom of T: ∀ x(  atom(x) ⇒ cons(car(x),cdr(x))=x) Apply to x=A: A ⇒ ( c 1 = cons(c 2,c 3 )) contradictio n with B! Interpolant (by new def.) c 1 = cons(c 2,c 3 ) “cons” is not AB–common; “cons”, “atom”, “cdr”, “car” not alowed in I => no interpolant for !

11 Interpolants Generation Method Assumptions: T – combination of T 1, T 2 Σ = Σ 1  Σ 2 efficient interpolant-generation procedures exist for T 1 and T 2 Restrictions from Nelson-Oppen framework: –Σ 1  Σ 2 = {=} –T 1, T 2 are stably-infinite –T 1, T 2 have decision procedures for satisfiability of conjunctions of Σ i literals T 1, T 2 are equality-interpolating T 1, T 2 are convex Guarantee: Output: theory-specific interpolant for in T first-order theories Input: - conjunctions of Σ i literals; output – interpolant as L i formula to be explained (  (x i = y i )) ⇒ ∃k. (x k =y k )

12 Simple Case Constraints to be relaxed later: A, B – conjunctions of literals Constraints possible to relax T 1, T 2 are convex theories Arise from the use of the Nelson- Oppen framework Relaxed in another work of the authors…

13 Naïve approach A  B Nelson-Oppen in T “Unsatisfiable!” + Eq (propagated equalities) + P (proof of A i  B i ⊦ Ti ⊥) framework for “Satisfiable!” Given: A  B ⊦ T ⊥ A i  Eq| Ai P B i  Eq| Bi Interpolant generation procedure for T i Interpolant I for ?

14 The problem - example A ≝ (f(x 1 )+x 2 =x 3 )  (f(y 1 )+y 2 =y 3 )  (y 1  x 1 ) B ≝ (x 2 =g(b))  (y 2 =g(b))  (x 1  y 1 )  (x 3 < y 3 ) Contradiction found by LI between A’ = A LI  (a 1 =a 2 ); B’ = B LI  (x 1 =y 1 )  (x 2 =y 2 ) Interpolant found for in LI: I = (x 2 -y 2 =x 3 -y 3 ) Is I interpolant for in T? – I  B  T ⊥ –But A  I: (f(x 1 )+x 2 =x 3 )  (f(y 1 )+y 2 =y 3 )  (y 1  x 1 )  (x 2 -y 2 =x 3 -y 3 ) –A → A’ doesn’t have to hold => A  I additional information from B might appear in A’

15 Proposed solution: Partial Interpolants Definition: Projection Given Θ – conjunction of AB-pure literals Define Θ| A – conjunction of A-local literals, Θ| B – conjunction of B-local and AB-common literals Note: Θ = Θ| A  Θ| B Example: A = (a 1 =f(x 1 )  a 2 = f(y 1 )), B = (a 1 =f(x 1 )  a 3 = f(y 1 )) Θ = A  B = (a 2 = f(y 1 )  a 1 =f(x 1 )  a 3 = f(y 1 )) Θ|AΘ|A Θ|BΘ|B Attach one to each equality propagated in the unsatisfiability proof in Nelson- Oppen framework

16 Partial Interpolant – defn. Definition: Theory-specific partial interpolant A’,B’ - conjunctions of pure literals in Σ i, e – AB-pure atomic formula generated by decision procedure for the theory T i : A’  B’  Ti e Then: Theory-specific partial interpolant for e w.r.t., φ i A’,B’ (e), is the interpolant generated for by T i ’s procedure thus, A’  B’  e  Ti ⊥ in our case, V(A’)  V(A), V(B’)  V(B) => interpolant for e contains only AB-common symbols

17 LI-Partial Interpolant Example First equality propagated: e=(x 1 =y 1 ); A’ = A LI, B’ = B LI (7)  A LI, (8)  B LI e| A’ = true, e| B’ = (x 1 =y 1 ) Interpolant for : φ LI A’,B’ (x 1 =y 1 )= y 1  x 1 UIF LI (1) a 1 = f(x 1 )(5) a 1 +x 2 =x 3 (2) a 2 = f(y 1 )(6) a 2 +y 2 =y 3 (3) x 2 =g(b)(7) y 1  x 1 (4) y 2 =g(b)(8) x 1  y (9) x 3 < y (10) x 1 = y 1 x 1, y 1 are AB-common

18 Partial Interpolant – contd. Definition: Partial interpolant e – AB-pure equality derived from A  B in Nelson-Oppen framework by a theory T i : A i  B i  Eq  Ti e A i, B i – conjunctions of pure literals Eq – a set of AB-pure equalities Partial interpolant for e w.r.t., φ A,B (e), is defined inductively: Base: –e  A i ⇒ φ A,B (e) = ⊥, –e  B i ⇒ φ A,B (e) = ⊤ Inductive step: Let A’ ≝ A i  Eq| A, B’ ≝ B i  Eq| B φ A,B (e) = (φ i A’,B’ (e)  ⋁ a  A’ φ A,B (a))  ⋀ b  B’ φ A,B (b) reason for restriction to equality-interpolating theories derived from A  B by Nelson-Oppen procedure… a, b - equalities

19 Partial interpolant - example Find partial interpolant for, φ A,B ( ⊥ ), from the running example: Follow the proof step-by-step Step1: deriving (x 1 =y 1 ) – T i = LI –Eq = ⊤, thus: –A’ = A LI = (a 1 +x 2 =x 3 )  (a 2 +y 2 =y 3 )  (y 1  x 1 ) –B’ = B LI = (x 1  y 1 )  (x 3 < y 3 ) – φ A,B (x 1 =y 1 ) = φ LI A’,B’ (x 1 =y 1 ) = y 1  x 1

20 Partial interpolant example – contd. Step2: deriving (a 1 =a 2 ) – T i = UIF –Eq = (x 1 =y 1 ) –Eq| A = ⊤, Eq| B = (x 1 =y 1 ), thus: –A’ = A UIF = ((a 1 = f(x 1 ))  (a 2 = f(y 1 )) –B’ = B UIF  (x 1 =y 1 ) = (x 2 =g(b))  (y 2 =g(b))  (x 1 =y 1 ) –φ A,B (a 1 =a 2 ) = ( φ UIF A’,B’ (a 1 =a 2 )  ⊥)  ⋀ b  B’ φ A,B (b) –φ UIF A’,B’ (a 1 =a 2 )=  (x 1 =y 1 ) –φ A,B (a 1 =a 2 ) =  (x 1 =y 1 )  (y 1  x 1 ) = (y 1 < x 1 ) A’=A UIF => we have results only from the base case = φ A,B (x 1 =y 1 ) = (y1  x1) interpolant-generation proc. of UIF the rest is True from the base case propagated eq. used to derive a 1 =a 2

21 Partial interpolant example – contd. Step3: deriving (x 2 =y 2 ) – T i = UIF –Eq = ⊤, thus: –A’ = A UIF = ((a 1 = f(x 1 ))  (a 2 = f(y 1 )) –B’ = B UIF = (x 2 =g(b))  (y 2 =g(b)) –φ A,B (x 2 =y 2 ) = φ UIF A’,B’ (x 2 =y 2 ) = = interpolant, derived by UIF’s procedure for = =interpolant for no propagated eq. needed to derive x 2 =y 2 = ⊤ =  (x2=y2) => Internal contradiction => φ A,B (x2=y2) = ⊤

22 Partial interpolant example – contd. Step4: deriving ⊥ – T i = LI –Eq = (x 2 =y 2 )  ( a 1 =a 2 ) –Eq| A = (x 2 =y 2 )  ( a 1 =a 2 ), Eq| B = ⊤, thus: –A’ = A LI  (x 2 =y 2 )  ( a 1 =a 2 ) = ((a 1 = f(x 1 ))  (a 2 = f(y 1 ))  (x 2 =y 2 )  ( a 1 =a 2 ) –B’ = B LI = (x 2 =g(b))  (y 2 =g(b)) –φ A,B ( ⊥ ) = ( φ LI A’,B’ ( ⊥ )  ( φ A,B (x 2 =y 2 )  φ A,B (a 1 =a 2 )) )  ⊤ => φ A,B ( ⊥ ) = ( (x 2 -y 2 =x 3 -y 3 ) )  (y 1 < x 1 ) = (y 1 <x 1 ) interpolant-generation proc. of UIF ⋀ b  B’ φ A,B (b) = ⊤ from the base case propagated eq.-s used to derive ⊥ = ⊤ = (x2-y2=x3-y3)

23 Correctness Lemma 1: The partial interpolant, φ A,B (e), is an interpolant for in the combined theory T. φ A,B ( ⊥ ) is an interpolant for

24 Equality-interpolating theories Restriction on T 1, T 2 : they should be equality- interpolating Definition: Theory T is equality-interpolating if whenever –A, B  T –A  B  T (a=b) –a  V(A)-V(B), b  V(B)-V(A) => Exists a term t s.t. –A  B  T (a=t)  (b=t) – V(t)  V(A)  V(B) t is called equality-interpolating term for (a=b) with respect to thus propagation of AB-pure equalities only in the Nelson- Oppen framework is enough indeed

25 Equality-interpolating theories (contd.) LI, UIF, Lisp are equality-interpolating theories Not all the theories are equality-interpolating. Example: –theory with two relation symbols, P and Q –axiom:  abc P(a,c)  Q(c,b) ⇒ (a=b) –let A ≝ P(a,c), B ≝ Q(c,b) –A  B  (a=b) –But: no equality-interpolating term for (a=b) !

26 Relaxing constraints Constraints to be relaxed: –A, B – conjunctions of literals The idea: use –Extended Pudlák’s algorithm => propositional interpolants for a pair of clause sets –Lazy Proof-Explication framework (using SAT-slover) => checking satisfiability of arbitrary quantifier-free FOL formulas i.e., CNF formulas

27 Pudlák’s algorithm Input: –A, B – pair of clause sets –A ⋀ B ⊦ T ⊥ – T – proof of unsatisfiability for A ⋀ B For each clause c in T, define p(c): 1.(a) c  A ⇒ p(c) := ⊥ (b) c  B ⇒ p(c) := ⊤ otherwise,  x,c 1,c 2.(c = resolve x (c 1,c 2 )) (a) x  A and x  B ⇒ p(c) := p(c 1 )  p(c 2 ) (b) x  B and x  A ⇒ p(c) := p(c 1 )  p(c 2 ) (c) x - AB-common ⇒ p(c) := (x  p(c 1 ))  (  x  p(c 2 )) p(⊥) is the interpolant for partial interpolant for c c is a result of resolution; x - pivot x – A-local x – B-local variant of the seen before

28 Pudlák’s algorithm correctness Invariant: For each clause c  T, p(c) is an interpolant for g A (c) =A  (  c)| A, g B (c)=B  (  c)| B Thus: (c = ⊥) ⇒ g A ( ⊥ ) = A, g B ( ⊥ ) = B ⇒ [invariant] p(⊥) is the interpolant for

29 Lazy Proof-Explication framework Our input – quantifier-free FOL formulas Nelson-Oppen framework works on conjunctions of literals How to bridge the gap? Use SAT-solver!

30 Lazy Proof-Explication framework φ=A  B Nelson-Oppen atomic formulas replaced by boolean variables “Unsatisfiable!” + C (conflict clauses set) framework for “Satisfiable!” result: φ’ propositional abstraction satisfiability check Unsat. satisfying ass. s for φ’ φ’:= φ’  s; C:= C  {s} Unsat. Sat. s = conjunction of literals; satisfies φ propositionally s = new conflict clause SAT- solver L.P.E.

31 Obtaining the interpolant We would like to : –give Pudlák’s algorithm the proof obtained from L.P.E. framework –obtain interpolant Problem: the base case! (a) c  A ⇒ p(c) := ⊥ (b) c  B ⇒ p(c) := ⊤ Now possible: c  A and c  B –Conflict clauses appear in the proof, and a conflict clause may involve local literals from both A and B

32 L.P.E. framework - observations For each conflict clause c  C,  c is a conjunction of literals  c is unsatisfiable (proven by N.-O.)  c contains only literals from A and B => every literal in  c is AB-pure Thus we can apply previously described method (“simple case”) to find an interpolant between (  c)| A and (  c)| B

33 Partial Interpolant for Clauses Definition: Partial interpolant for clauses A  B  T ⊥ C – corresponding set of conflict clauses A  B  C – propositionally unsatisfiable c  C Partial interpolant for c, φ A,B (c), is defined inductively: Base: –c  A ⇒ φ A,B (c) = ⊥, –c  B ⇒ φ A,B (c) = ⊤ Inductive step: φ A,B (c) = interpolant for in T can be calculated by the “simple case” method

34 Extended Pudlák’s algorithm Input: – where A, B, C – clause sets –A ⋀ B ⊦ T ⊥ – T – proof of unsatisfiability for A ⋀ B For each clause c in T, define p(c): 1.c is not a resolution result ⇒ p(c):= φ A,B (c) 2.otherwise,  x,c 1,c 2.(c = resolve x (c 1,c 2 )) (a) x  A and x  B ⇒ p(c) := p(c 1 )  p(c 2 ) (b) x  B and x  A ⇒ p(c) := p(c 1 )  p(c 2 ) (c) x - AB-common ⇒ p(c) := (x  p(c 1 ))  (  x  p(c 2 )) p(⊥) is the interpolant for C – set of conflict clauses No change needed here…

35 Extended algorithm correctness Enough to show the invariant is maintained, i.e.,  c  T, p(c) is an interpolant for g A (c) =A  (  c)| A, g B (c)=B  (  c)| B Observation: in the base case, –c  A ⇒ φ A,B (c) = ⊥ ⇒ p(c) := ⊥ (as in the original algorithm) ⇒ old proof works –c  B ⇒ φ A,B (c) = ⊤ ⇒ p(c) := ⊤ (as in the original algorithm) ⇒ old proof works –new case: c  A and c  B ⇒ need new proof

36 Extended algorithm correctness(2) Base case: –left to prove for the case c  A and c  B –then φ A,B (c) is interpolant for (by definition) ⇒ ((  c)| A  φ A,B (c)) ⇒ ((A  (  c)| A )  φ A,B (c)) ⇒ (φ A,B (c)  (  c)| B  ⊥) ⇒ ((B  (  c)| B )  φ A,B (c)  ⊥ ) –thus p(c)=φ A,B (c) is indeed an interpolant for in T Induction step: –the proof relied only on the fact that the invariant holds in the base case => the old proof stays correct

37 Conclusions Presented: efficient and modular method for interpolant-generation Generic, and not theory-specific method Easy to incrementally extend interpolation- generation to additional theories Uses Nelson-Oppen framework in a modular way, and in case of its improvement can easily connect to the new version

38 Thank you!