A Unified Framework for DPLL(T) + Certificates

Abstract

Satisfiability Modulo Theories (SMT) techniques are widely used nowadays. SMT solvers are typically used as verification backends. When an SMT solver is invoked, it is quite important to ensure the correctness of its results. To address this problem, we propose a unified certificate framework based on DPLL(T), including a uniform certificate format, a unified certificate generation procedure, and a unified certificate checking procedure. The certificate format is shown to be simple, clean, and extensible to different background theories. The certificate generation procedure is well adapted to most DPLL(T)-based SMT solvers. The soundness and completeness for DPLL(T) + certificates were established. The certificate checking procedure is straightforward and efficient. Experimental results show that the overhead for certificates generation is only 10%, which outperforms other methods, and the certificate checking procedure is quite time saving.

1. Introduction

1.1. Background and Motivation

Satisfiability Modulo Theories (SMT) techniques are getting increasingly popular in many verification applications. An SMT solver takes as input an arbitrary formula given in a specific fragment of first order logic with interpreted symbols. It returns a judgment telling whether the formula is satisfiable. By satisfiable, it means that there exists at least one interpretation under which the formula evaluates to true.

SMT solvers are typically used as verification backends. During a verification process, SMT solver may be invoked many times. Each time the SMT solver is given a complex logical formula and is expected to give a correct judgment. However, SMT solvers employ many sophisticated data structures and tricky algorithms, which make their implementations prone to error. For instance, there are some solvers disqualified in SMT-COMP due to their incorrect judgments [1]. We therefore strongly believe that SMT solvers should be supported with a formal assessment of their correctness.

Ensuring the correctness of an SMT solver is never easy. Generally, there are two approaches: to verify the SMT solver or to certify their judgments. For the former approach, it proves directly that the solver is correct. So, its judgements are naturally correct. Though rigor in logic, this method is not generally practical because verifying an SMT solver requires great workload. Not only the algorithm but also the implementation should be verified in a formal way. To the best of our knowledge, no state-of-the-art SMT solver has been completely verified. More importantly, this approach is solver dependent. Even if a solver is completely verified, the whole verification has to be done again when the solver is modified.

The rationale of the latter approach is as follows: instead of proving the correctness of the solver, we prove its judgment. For this purpose, the solver is required to return a piece of evidence to support its judgment. This evidence is called certificate in this paper. Then, the correctness for the judgment is ensured by the certificate. If so, a rigorous and detailed proof can be constructed by referring to the certificate. Obviously, checking a certificate is much easier than verifying a solver. If the certificates are presented in a proper format, its checking algorithm could have low complexity. For instance, linear time is required to check certain certificates for unsatisfiable SAT problems. The certificate approach is solver independent. We need not to look into the solvers; the only requirement for solvers is to generate certificates. If the certificate format is unified, the certificate checking can be a uniform procedure. This benefit is vital since we need not to develop a certificate checker for each SMT solver.

There are some SMT solvers that support certificate generation, such as CVC3 [2] and Z3 [3]. However, their certificate formats are quite different. As a result, the generation and checking procedures are tool specific. Although SMT solvers differ in the algorithms, we believe that their formats of certificates could be unified. The basic idea comes from SAT. In an SAT community, people consider to generate certificates along with the DPLL framework, and the certificates (for unsatisfiability instances) are unified as chains of linear regular resolutions which can lead from the initial clauses to an empty clause [4, 5]. With this uniform format, the generation and checking procedures for certificates can also be unified.

This paper considers the DPLL(T) framework, which is extended from DPLL and has been widely used in state-of-the-art SMT solvers. A uniform format of SMT certificate is defined in this paper. The road map of our approach is shown in Figure 1. Note that the size of certificate can be exponential or even larger with respect to the input problem [6]. To reduce storage space, the certificate format is defined carefully in a concise way. Upon this format, a unified procedure for certificates generation is proposed. This procedure can be easily integrated into DPLL(T)-based SMT solvers. Moreover, a certificate checking procedure is also proposed in this paper. The checking procedure is easy, fast, and memory saving. To make it extensible, theory lemmas are checked by individual lemma checkers. Experimental results show that the average overhead for the certificates generation is about 10%.

Figure 1 

The road map of our approach.

1.2. Related Work

Propositional satisfiability problem (SAT) is a well-known decision problem. It was proven to be NP-complete by Cook [7] in 1971. All known algorithms for SAT have exponential complexity. State-of-the-art SAT solvers are based on DPLL [8] algorithm. The basic idea is to explore all valuations by depth-first search in a branch and bound manner. To reduce unnecessary search efforts, an optimization called clause learning is used, which learns a clause whenever it recovers from a conflict. This optimization significantly increases the performance and makes SAT algorithms practical. During the clause learning process, each learned clause is a resolvent of linear regular resolution from existing clauses [4].

SMT is an extension of SAT. As the name implies, the input formula may contain theory-specific predicates and functions. For instance, while only boolean variables are allowed in SAT, 𝑥≥𝑦∧𝑦≥𝑓(𝑎)+𝑥∨𝑥<0 is a well-formed SMT formula. The background theory T of SMT is usually a composed theory from several individual theories. In this paper, we focus on quantifier-free SMT problems, for which the popular algorithm is DPLL(T) [9]. The DPLL(T) algorithm is extended from DPLL. Since the DPLL(T) algorithm is described as a transition system, solving an SMT problem is actually seeking a path to the success or fail state while respecting the guard conditions on transitions. Although there are other heuristics and optimizations, currently it is almost standard to develop SMT solvers based on DPLL(T).

Certificates are, informally, a set of evidence that can be used to construct a rigorous proof for the judgment. For satisfiable cases, the certificate could be a model. What is more interesting is the certificates for unsatisfiable cases. Deduction steps from the input problem to a conflict should be reproducible by referring to the certificate. In this paper, when saying certificates, we refer to those for unsatisfiable cases.

Many of the state-of-the-art SAT solvers can generate certificates, but their logical formats are very distinct from each other. For example, the certificate generated by zChaff [10] and MiniSat [11] are quite different. PicoSAT [12] generates concise and well-defined certificates. A tool called TraceCheck can do certificate checking [12]. In PicoSAT's certificates, there are initial clauses and resolvents. Resolvents are obtained from linear regular resolution. If all the clauses form a directional acyclic graph and the empty clause is derived, then it implies that the initial clause set is unsatisfiable. As shown in [4, 5], clause learning in DPLL corresponds to a linear regular resolution. So, this certificate format is also adoptable by other DPLL-based solvers.

For general SMT problems, quantifiers may be used. Furthermore, theory-specific inference rules should be considered when deciding their satisfiability. Various logical frameworks are developed to provide flexible languages to write their proof, such reference could be found in [13–16]. If we focus on quantifier-free problems, the proof format and proof checking could be simplified. In practice, solvers such as CVC3 and Z3 can generate certificates, but their formats are also quite different because they use different proof rules. Proof rules are a set of inference rules with respect to the background theory T. To be better suited for certificate generation and checking, the certificate format should not depend heavily on theory-specific proof rules.

The overhead for generating certificates should be as small as possible. An approach with 30% overhead is presented in [17], which uses the Edinburgh Logical Framework with Side Condition (LFSC). In our approach, we focus on quantifier-free problems so that the overhead is further reduced. Certificate generation is related to unsatisfiable core computation. In [18], a simple and flexible way of computing small unsatisfiable core in SMT was proposed. They compute by the propositional abstraction of SMT problem and invoke an existing unsatisfiable core extractor for SAT. Although the idea might be similar, unsatisfiable core computation concerns which clauses lead to unsatisfiability, whereas certificate generation concerns how. It is convenient to generate unsatisfiable core from certificates, but not vice versa.

To check certificates, people can either check the certificate directly, just as in the SAT case, or translate them into inputs for some theorem provers such as HOL Light [19] or Isabelle/HOL [20]. There is also research in checking certificates using simple term rewriting [21]. A known fact is that if certificates are checked by translating them to proof items for theorem provers, it could take much longer time than certificate finding [20].

1.3. Contribution

In this paper, we present a certificate framework for quantifier-free formulas. Compared to other works, our approach has the following advantages. (i)The certificate format is simple, clean, and extensible to different underlying theories. (ii)The certificate generation procedure is well adapted to most DPLL(T)-based SMT solvers. We also implement it in our solver. (iii)On average, the certificate generation induces about 10% overhead which is much less than other approaches. (iv)The certificate checking procedure is simplified. It has better performance.

The rest of this paper is organized as follows. In Section 2, we recall the original DPLL(T) algorithm. The certificate format is defined in Section 3. The framework of DPLL(T) + certificate is described in Section 4, where the formal rules are defined in Section 4.1, necessary implementation issues are discussed in Section 4.2, the properties are discussed in Section 4.3, and a couple of examples are shown in Section 4.4. Section 5 discusses the certificate checking matters. Experiments’ results are shown in Section 6. Finally, Section 7 concludes the paper.

2. The DPLL(T) Algorithm

The DPLL(T) algorithm was proposed in [9]. The input is a quantifier-free first order formula in conjunctive normal form (CNF) from the background theory T. DPLL(T) was given as a transition system. Most features and optimizations of SMT algorithms can be formalized in that way.

In first order logic, any CNF formula can be viewed as a set of clauses. Each clause is disjunction of literals, and each literal is a positive or negative form of an atom. A formula is satisfiable if there exists an interpretation under which the formula evaluates to true.

In DPLL(T), formula satisfiability is considered in some background theory T (all interpreted symbols should be from T). We use “⊨_T” to denote theory entailment in T. Given sets of formulas Σ and Γ, if any interpretation that satisfies all formulas in Σ also satisfies all formulas Γ, we write Σ⊨_TΓ. Similarly, “⊨” denotes propositional entailment which consider each atomic formula syntactically as a propositional literal.

Each state is a 2-tuple “𝑀‖𝐹” where 𝑀 is a stack of the currently asserted literals and 𝐹 the set of clauses to be satisfied. The transition relations are given by the following rules.

(i) Decide:

Precondition(1)𝑙 or ¬𝑙 occurs in a clause of 𝐹;(2)𝑙 is undefined in 𝑀, 𝑀‖𝐹↦𝑀𝑙^𝖽‖𝐹. (1)

(ii) UnitPropagate:

Precondition(1)𝑀⊨¬𝐶;(2)𝑙 is undefined in 𝑀, 𝑀‖𝐹,𝐶∨𝑙↦𝑀𝑙‖𝐹,𝐶∨𝑙. (2)

(iii) TheoryPropagate:

Precondition(1)𝑀⊨_T𝑙;(2)𝑙 or ¬𝑙 occurs in 𝐹;(3)𝑙 is undefined in 𝑀, 𝑀‖𝐹↦𝑀𝑙‖𝐹. (3)

(iv) T-Backjump:

Precondition(1) 𝑀𝑙^𝖽𝑁⊨¬𝐶; (2)there is some clause 𝐶^′∨𝑙^′ such that:(a)𝐹,𝐶⊨_T𝐶^′∨𝑙^′ and 𝑀⊨¬𝐶^′;(b) 𝑙^′ is undefined in 𝑀;(c) 𝑙^′ or ¬𝑙^′ occurs in 𝐹 or in 𝑀𝑙^𝖽𝑁, 𝑀𝑙^𝖽𝑁‖𝐹,𝐶↦𝑀𝑙^′‖𝐹,𝐶. (4)

(v) T-Learn:

Precondition(1)each atom of 𝐶 occurs in 𝐹 or in 𝑀; (2)𝐹⊨_T𝐶, 𝑀‖𝐹↦𝑀‖𝐹,𝐶. (5)

(vi) T-Forget:

Precondition 𝐹⊨_T𝐶, 𝑀‖𝐹,𝐶↦𝑀‖𝐹. (6)

(vii) Restart:

Precondition T𝑀‖𝐹↦∅‖𝐹. (7)

(viii) Fail:

Precondition(1)𝑀⊨¬𝐶; (2)𝑀 contains no decision literals, 𝑀‖𝐹,𝐶↦⟨Fail⟩. (8)

In DPLL(T) algorithm, there is an assumption that there exists a T-solver that can check the consistency of conjunctions of literals given in T. This algorithm will terminate under weak assumption and is proven sound and complete [9].

3. The Certificate Format

If a formula is satisfiable, the certificate is simply an interpretation under which the formula evaluates to true. On the other hand, if it is unsatisfiable, the certificate could be much more complicated. It should be proven that “all attempts to find a model failed.” More precisely, each branch of the search tree must be tried. Technically speaking, this closed search tree can be presented as a refutation procedure which contains sequences of resolution procedures that produce the empty clause [12]. It is imaginable that if the search tree is quite large so is the set of refutation clauses.

Remember that in first order logic (FOL), constants are considered as nullary functions. Then, a term is either a variable or a function with arguments which are also terms. For example, 𝑥, 𝑓(𝑥,𝑦) and 𝜙(𝑠,𝜓(𝑡)) are valid terms. An atom (or atomic formula) is a predicate with arguments being terms. Note that nullary predicates are actually propositional variables.

Definition 1 (T-atom, T-literal). Given a background theory T, a T-atom is an atom whose functions and predicates are in the signature of T. A T-literal is the positive or negative form of a T-atom.

For example, given T the theory of Equality with Uninterpreted Functions, if 𝑝 is a propositional variable, then 𝑝, 𝑥=𝑓(𝑦) are T-atoms and 𝑝, ¬𝑝, 𝑥=𝑓(𝑦) and 𝑥≠𝑓(𝑦) are T-literals.

A proof rule is an inference rule which has several T-literals as premises and one T-literal as the conclusion. For proof rules whose conclusion is conjunction of 𝑛   T-literals, we can split it to 𝑛 proof rules and one for each.) For example, 𝑥=𝑦 implies that 𝑓(𝑥)=𝑓(𝑦) is a proof rule (the monotonicity of equality). This rule holds for all T-terms 𝑥,𝑦 and all function 𝑓. Each proof rule can be instantiated to a theory lemma. For instance, if 𝑠,𝑡 are two specific T-terms and 𝑔 is a specific function, then (𝑠=𝑡)→(𝑔(𝑠)=𝑔(𝑡)) is a theory lemma.

Definition 2 (clause item). A clause item is one of the following three forms.(i)Init  𝑙₁∨⋯∨𝑙_𝑛: an initial clause 𝑙₁∨⋯∨𝑙_𝑛, where all 𝑙_𝑖 are T-literals. (ii)Res  {𝐶₁,…,𝐶_𝑛}: a clause obtained from a linear resolution of 𝐶₁,…,𝐶_𝑛, where all 𝐶_𝑖 are clauses items. (iii)Lemma  𝑙₁∧⋯∧𝑙_𝑛→𝑙^′: a theory lemma where all 𝑙_𝑖 and 𝑙^′ are T-literals. The defined clause is ¬𝑙₁∨⋯∨¬𝑙_𝑛∨𝑙^′.

A resolution chain 𝐶₁,𝐶₂,…,𝐶_𝑛 is called a linear regular resolution chain if there exists a sequence of clauses 𝐷₁,𝐷₂,…,𝐷_𝑛−1 such that: (1) 𝐷₁ is the resolvent of 𝐶₁ and 𝐶₂; (2) for 2≤𝑖<𝑛, 𝐷_𝑖 is the resolvent of 𝐷_𝑖−1 and 𝐶_𝑖+1; (3) all resolutions are applied on different T-atoms.

A clause item gives the syntax form for a clause. For each clause item 𝐶, if it is well defined; the concrete form of 𝐶 (given as disjunction of T-literals) can be calculated. It is called a concrete clause, denoted by ⟦𝐶⟧. We do not distinguish 𝐶 and ⟦𝐶⟧ when no ambiguity is caused.

Definition 3 (certificate item). A certificate item is either of the following: (i)Define ClauseItem,(ii)Forget ClauseItem.

Definition 4 (certificate). A certificate 𝑃 with respect to an SMT instance is a sequence of certificate items. The size of 𝑃, denoted by |𝑃|, is the number of certificate items contained in 𝑃. 𝑃[𝑖] is the 𝑖th element in 𝑃, for 𝑖=1,2,…,|𝑃|.

Definition 5 (context). Given a certificate 𝑃 and a number 0≤𝑖≤|𝑃|, the context with respect to 𝑖, denoted by ⌊𝑃⌋, is a set of clause items such that: ⌊𝑃⌋_𝑖=⌊𝑃⌋∅if𝑖=0_𝑖−1∪{𝐶}[]⌊𝑃⌋if𝑖>0and𝑃𝑖−1is𝖣𝖾𝖿𝗂𝗇𝖾𝐶_𝑖−1⧵{𝐶}if𝑖>0and𝑃[𝑖−1]is𝖥𝗈𝗋𝗀𝖾𝗍𝐶. (9)

Specially, denote ⌊𝑃⌋_|𝑃| by ⌊𝑃⌋.

Example 6. Assume that 𝑙₁∶𝑥=𝑦, 𝑙₂∶𝑓(𝑥)=𝑓(𝑦) and 𝐶₁∶¬𝑙₁∨¬𝑙₂, 𝐶₂∶𝑙₁. A certificate for the unsatisfiability of the clause set {𝐶₁,𝐶₂} is presented in Table 1. In this example, {𝐶₁,𝐶₂} is intuitively unsatisfiable. Note that 𝐶₂ entails 𝑙₁ which implies 𝑙₂ in T_EUF, while 𝐶₁,𝐶₂⊨¬𝑙₂.

Table 1 

A certificate example.

Definition 7 (well-formed certificate). A certificate 𝑃 is well formed if for all 1≤𝑖≤|𝑃|: (i)if 𝑃[𝑖] is a Define item then one of the following conditions hold: (a)it is of Init type; (b)it is of Res  {𝐶₁,…,𝐶_𝑛} type where 𝐶_𝑘∈⌊𝑃⌋_𝑖−1 for all 1≤𝑘≤𝑛, and there should be a linear regular resolution from {⟦𝐶₁⟧,⟦𝐶₂⟧,…,⟦𝐶_𝑛⟧} to 𝑃[𝑖]; (c) it is of Lemma type and the concrete clause is valid in theory T, that is, ⊨_T⟦𝑃[𝑖]⟧;(ii)otherwise 𝑃[𝑖] is a Forget item and the referred clause must be defined in ⌊𝑃⌋_𝑖−1.

4. Certificate Generation with DPLL(T)

The certificate generation algorithm is described in this section. We first describe the abstract rule and implementation issues, then prove some important properties, and finally give a couple of examples.

4.1. The CDPLL(T) Algorithm

We describe here a certificate generation procedure that can be well adapted to the DPLL(T) algorithm. The extension of DPLL(T) with certificate generation is called CDPLL(T).

Definition 8 (certificate refinement). The certificate obtained by appending a certificate item 𝐶 to the end of the certificate 𝑃 is denoted by 𝑃⊲𝐶.

We use a transition system to model the CDPLL(T) algorithm. Each state is represented as a 3-tuple “𝑀‖𝐹⊕𝑃,” where 𝑀 is the literal stack, 𝐹 the clause set to be satisfied, and 𝑃 the current certificate. The transition rules in CDPLL(T) are follows.

(i) Decide:

Precondition(1)𝑙 or ¬𝑙 occurs in a clause of 𝐹; (2)𝑙 is undefined in 𝑀, 𝑀‖𝐹⊕𝑃↦𝑀𝑙^𝖽‖𝐹⊕𝑃. (10)

(ii) UnitPropagate:

Precondition(1)𝑀⊨¬𝐶; (2)𝑙 is undefined in 𝑀, 𝑀‖𝐹,𝐶∨𝑙⊕𝑃↦𝑀𝑙‖𝐹,𝐶∨𝑙⊕𝑃. (11)

(iii) TheoryPropagate:

Precondition (1)𝑀⊨_T𝑙; (2)𝑙 or ¬𝑙 occurs in 𝐹; (3)𝑙 is undefined in 𝑀, 𝑀‖𝐹⊕𝑃↦𝑀𝑙‖𝐹⊕𝑃. (12)

(iv) T-Backjump:

Precondition (1)𝑀𝑙^𝖽𝑁⊨¬𝐶; (2)there exists a clause 𝐶^′∨𝑙^′ such that: (a) 𝐹,𝐶⊨_T𝐶^′∨𝑙^′ and 𝑀⊨¬𝐶^′, (b) 𝑙^′ is undefined in 𝑀, and (c) 𝑙^′ or ¬𝑙^′ occurs in 𝐹 or in 𝑀𝑙^𝖽𝑁;(3)𝑅={𝐶₁,𝐶₂,…,𝐶_𝑛} is a set of clause items such that: 𝐶_𝑖∈⌊𝑃⌋ for all 𝑖, and there exists a linear regular resolution from {⟦𝐶₁⟧,⟦𝐶₂⟧,…,⟦𝐶_𝑛⟧} to 𝐶^′∨𝑙^′, 𝑀𝑙^𝖽𝑁‖𝐹,𝐶⊕𝑃↦𝑀𝑙^′‖𝐹,𝐶⊕(𝑃⊲𝖱𝖾𝗌(𝑅)). (13)

(v) T-Learn(I): this rule models the clause learning procedure.

Precondition(1)Each atom of 𝐶 occurs in 𝐹 or in 𝑀; (2)𝐹⊨𝐶;(3)𝑅={𝐶₁,𝐶₂,…,𝐶_𝑛} is a set of clause items such that: 𝐶_𝑖∈⌊𝑃⌋ for all 𝑖, and there exists a linear regular resolution from {⟦𝐶₁⟧,⟦𝐶₂⟧,…,⟦𝐶_𝑛⟧} to 𝐶, 𝑀‖𝐹⊕𝑃↦𝑀‖𝐹,𝐶⊕(𝑃⊲𝖱𝖾𝗌(𝑅)). (14)

(vi) T-Learn(II): this rule models the learning of theory lemma.

Precondition (1)Each atom of 𝐶 occurs in 𝐹 or in 𝑀; (2)⊨_T𝐶, 𝑀‖𝐹⊕𝑃↦𝑀‖𝐹,𝐶⊕(𝑃⊲𝖫𝖾𝗆𝗆𝖺(𝐶)). (15)

(vii) T-Forget:

Precondition 𝐹⊨_T𝐶, 𝑀‖𝐹,𝐶⊕𝑃↦𝑀‖𝐹⊕(𝑃⊲𝖥𝗈𝗋𝗀𝖾𝗍(𝐶)). (16)

(viii) Restart:

Precondition T𝑀‖𝐹⊕𝑃↦∅‖𝐹⊕𝑃. (17)

(ix) Fail:

Precondition (1)𝑀⊨¬𝐶; (2)𝑀 contains no decision literals;(3)𝑅={𝐶₁,𝐶₂,…,𝐶_𝑛} is a set of clause items such that: 𝐶_𝑖∈⌊𝑃⌋ for all 𝑖, and there exists a linear regular resolution from {⟦𝐶₁⟧,⟦𝐶₂⟧,…,⟦𝐶_𝑛⟧} to □, 𝑀‖𝐹,𝐶⊕𝑃↦⟨Fail⟩⊕(𝑃⊲𝖱𝖾𝗌(𝑅)). (18)

The initial state is 𝑀‖𝐹⊕𝑃₀ where 𝑃₀ is the certificate that defines all initial clauses. When a final state ⟨Fail⟩⊕𝑃 is reached, 𝑃 is the obtained certificate for the unsatisfiability judgment.

The major differences between CDPLL(T) and DPLL(T) are as follows. (1) Certificate generation is added. Notice the modifications to rules T-Backjump, T-Learn, T-Forget, and T-Fail. (2) In order to generate well-formed certificates, the original T-Learn rule is split into 2 cases, one for the learning of resolvents (corresponds to clause learning) and the other for the learning of theory lemmas (corresponds to deductions in T). The first three rules are unchanged except the certificate part.

4.2. Implementation of CDPLL(T)

In a real implementation of CDPLL(T), additional information need to be collected to construct the certificate items. In this section, we discuss these details.

Lemma 9. For any reachable state 𝑀‖𝐹⊕𝑃 in CDPLL(T) and any clause 𝐶∈𝐹, there exists a clause item 𝐷∈⌊𝑃⌋ such that ⟦𝐷⟧=𝐶.

Proof. We prove that by induction. Initially, this property holds because all clauses in 𝐹₀ are initial clauses and 𝑃₀ consists of all initial clause items (by definition). At each valid transition step, the clause set 𝐹 and the certificate 𝑃 may be modified. However, each rule ensures that whenever a clause 𝐶 is added to 𝐹, there is always a clause item 𝐷 such that ⟦𝐷⟧=𝐶 added to 𝑃, for example, in the rule T-Learn(I). Furthermore, whenever a clause item is removed from 𝑃, the corresponding clause is removed in 𝐹, for example, in the rule T-Forget. Thus, the property holds on all valid trace of CDPLL(T).

4.2.1. Record Reasons

For any literal 𝑙 in 𝑀, it is either added by the Decide rule or forced by a clause or theory lemma. For the latter case, we need to record a clause item which is a deduction of the lemma and from which the literal 𝑙 can be enforced. We call this item the reason for literal 𝑙 being in 𝑀.

Only rules UnitPropagate, TheoryPropagate, and T-Backjump can enforce new literal to 𝑀. We discuss in the following the reasons recorded by these three rules. (i)UnitPropagate: the reason is a certificate item 𝐷 such that ⟦𝐷⟧=𝐶∨𝑙∈𝐹. By Lemma 9, such item always exists. (ii)TheoryPropagate: assume that 𝑀=𝑙₁∧𝑙₂∧⋯∧𝑙_𝑚 and 𝑀⊨_T𝑙; then, the reason is a certificate item 𝐷 such that ⟦𝐷⟧=¬𝑙₁∨¬𝑙₂∨¬⋯∨¬𝑙_𝑚∨𝑙. (iii)T-Backjump: the reason for 𝑙^′ is a certificate item 𝐷 such that ⟦𝐷⟧=𝐶^′∨𝑙^′. We will show in the following that such certificate item always exists when T-Backjump is applicable. For convenience, a subscript is used to denote the reason, for example, 𝑙_(𝐷) denotes the literal 𝑙 asserted by the reason ⟦𝐷⟧.

4.2.2. Learn Clauses

In rules T-Backjump and Fail, once there is a conflict, a backjump clause needs be learned. Furthermore, if there are some branches that have not been explored, T-Backjump is applied; otherwise, Fail is applied. Each clause learning procedure introduces some new certificate items.

We use implication graph to analyze the clause learning process. Remember that in DPLL all literals are propositional atoms, the implication graph is simply a direct acyclic graph (DAG) where each edge corresponds to a deduction step. In CDPLL(T), the implication graph has two kinds of deductions: propositional deduction (which is similar to DPLL) and theory deduction. Each deduction step in the implication graph is labelled with a reason 𝐶. This graph can be viewed as a generalized implication graph. Without causing ambiguity, we still call it an implication graph.

In the implication graph of DPLL, each cut containing the conflict literals corresponds to a learned clause (by resolving all the associated clauses of edges in this cut) [4]. No matter which criteria (e.g., 1-UIP) is used, the rule for clause learning is applicable. For CDPLL(T), when considering the generalized implication graphs, the clause learning rule is also applicable.

There are two situations where T-Backjump can be applied. Given a state 𝑀‖𝐹⊕𝑃, the first situation is that there exists a clause 𝐶∈𝐹 which is falsified by 𝑀, that is, ⊭𝑀,𝐶. Then, 𝐶 is called the conflict clause. As in the rule, some backjump clause 𝐶^′∨𝑙^′ should be learned by analyzing the conflict. Usually, 𝐶^′∨𝑙^′ is a resolvent of a linear resolution. A certificate item with resolution type will be learned.

The other situation is that 𝑀 itself becomes T-inconsistent. Then, a subset {𝑙₁,𝑙₂,…,𝑙_𝑚} of 𝑀 is unsatisfiable, that is, ⊨_T¬𝑙₁∨¬𝑙₂∨⋯∨¬𝑙_𝑚. This is also a conflict clause. It may not belong to 𝐹, but it can definitely be learned from 𝐹 along with some theory lemmas. The fact that 𝑙₁,…,𝑙_𝑚 leads to conflict is represented in the generalized implication graph. Furthermore, the clause 𝐶^′∨𝑙^′ that is required by the rule T-Backjump can also be learned by generalized conflict clause analysis.

In both situations, the backjump clauses are learned by clause learning. The certificate for unsatisfiability is actually a well-organized collection of these clause items. If Fail is applicable, no literal in 𝑀 is decision variable; then, the learnt clause is the empty clause which shows 𝐹⊨_T□.

Example 10. A generalized implication graph is shown in Figure 2, where the literals are as follows: 𝑙₀∶𝑥=𝑦, 𝑙₁∶𝑓(𝑥)=𝑓(𝑦), and 𝑝 is a propositional literal. Clauses are as follows: 𝐶₀∶¬𝑙₀∨¬𝑙₁∨𝑓(𝑥)𝑦,𝐶∶=¬𝑥=𝑦=𝑓₁∶𝑙₀𝐶∨𝑝∶=𝑥=𝑦∨𝑝,₂∶𝑙₀∨¬𝑝∶=𝑥=𝑦∨¬𝑝. (19)

Figure 2 

Example of a generalized implication graph.

Assume the current assignment 𝑀=𝑝,𝑙₀,¬𝑙₁. Then, there is a conflict between ¬𝑙₁ and 𝑙₁. In all, there are 3 deductions in the implication graph: 𝑝→𝑙₀ forced by 𝐶₂, 𝑙₀→¬𝑙₁ by 𝐶₀ and 𝑙₀→𝑙₁ by the theory lemma 𝐶₃. Among those reasons, solid lines correspond to existing clauses in 𝐹, while dashed lines correspond to theory lemmas. 𝐶₃ is actually a theory lemma 𝑙₀→𝑙₁(𝑥=𝑦→𝑓(𝑥)=𝑓(𝑦)).

In the clause learning procedure, we start from the conflict (¬(𝑙₁∧¬𝑙₁)=¬𝑙₁∨𝑙₁) and trace back (apply a sequence of resolutions). If the 1st UIP schema [4] is used, it is possible to learn ¬𝑝 or ¬𝑙₀ (corresponds to cut₁ and cut₂, resp.). The resolution steps for learning ¬𝑝 are shown in Figure 3. Actually, ¬𝑝 is the resolvent of {𝐶₃,𝐶₀,𝐶₂} which are exactly the reasons labeled on the edges from the conflict to the cut. Among those, 𝐶₀,𝐶₂ are normal clauses, and 𝐶₃ is a theory lemma.

Figure 3 

Resolution steps for learning ¬𝑝.

Based on the above discussions, the related rules can be interpreted more precisely as follows.

(i) TheoryPropagate: 𝑀‖𝐹⊕𝑃↦𝑀𝑙_(𝐶)‖𝐹⊕𝑃. (20) The precondition requires that 𝑀⊨_T𝑙. Let 𝑀^′ be a subset of 𝑀 which entails 𝑙 (possibly 𝑀^′=𝑀). Let 𝐶=¬𝑀^′∨𝑙, then ⊨_T𝐶. Furthermore, 𝑀,𝐶⊨_T𝑙, which means 𝐶 is a unit clause under the assignment 𝑀. Thus, 𝐶 is the reason of 𝑙.

(ii) UnitPropagate: 𝑀‖𝐹,𝐶∨𝑙⊕𝑃↦𝑀𝑙_{(𝐶∨𝑙)}‖𝐹,𝐶∨𝑙⊕𝑃. (21) The precondition requires that 𝑀⊨¬𝐶; thus, 𝐶∨𝑙 is a unit clause under 𝑀. So, the reason of 𝑙 is 𝐶∨𝑙.

(iii) T-Backjump: 𝑀𝑙^𝖽𝑁‖𝐹,𝐶⊕𝑃↦𝑀𝑙^′_{(𝐶′∨𝑙′)}‖𝐹,𝐶⊕(𝑃⊲𝖱𝖾𝗌(𝑅)). (22) The precondition requires that there exits some clause 𝐶^′∨𝑙^′ such that 𝐹,𝐶⊨_T𝐶^′∨𝑙^′ and 𝑀⊨¬𝐶^′. The clause 𝐶^′∨𝑙^′ is then used as the reason for 𝑙^′. As the clause learning is always applicable [9], this clause always exists. If the assignment 𝑀𝑙^𝖽𝑁 is T-consistent, then there must be some conflict clause 𝐶∈𝐹. As explained above, the clause learning will then be applied, and the learned clause will be 𝐶^′∨𝑙^′. On the other hand, when 𝑀𝑙^𝖽𝑁 is T-inconsistent, clause learning is also applicable in the generalized implication graph and generates a candidate 𝐶^′∨𝑙^′. In both cases, 𝐶^′∨𝑙^′ can be learned by applying linear regular resolutions on a clause set 𝑅 [4]. Moreover, such 𝑅 is the union of a subset of reasons in 𝑀𝑙^𝖽𝑁 and a group of theory lemmas.

(iv) Fail: 𝑀‖𝐹,𝐶⊕𝑃↦⟨Fail⟩⊕(𝑃⊲𝖱𝖾𝗌(𝑅)). (23) The Fail rule is similar to T-Backjump except that the learned clause is the empty clause.

4.3. Properties of CDPLL(T)

The soundness and completeness of CDPLL(T) are proven in this subsection.

Lemma 11. A well-formed certificate modified by T-Backjump, T-Learn(I), T-Learn(II), Fail, or T-Forget is still well formed.

Proof. Each of the 4 rules appends a new item to the certificate. Assume that the certificate 𝑃 is modified to 𝑃^′=𝑃⊲𝐼 where 𝐼 is the appended certificate item. The well-formed property of 𝑃^′ is checked by case studying the rules applied.(i)For T-Backjump: a certificate item of resolution type is appended. According to the precondition, the certificate items referred by 𝐼 are already defined in ⌊𝑃⌋. So, 𝑃^′ is still well formed. (ii)For T-Learn(I): similar to the previous case. The dependency of appended certificate item is satisfied. (iii)For T-Learn(II): a theory lemma item 𝐶 is appended. It is required that ⊨_T𝐶. Thus, 𝑃^′ is still well formed. (iv)For Fail: similar to the T-Backjump case. (v)For T-Forget: the rule requires that the forgotten clause is in the clause set. By Lemma 9, we know that there is a certificate item in 𝑃 which defines 𝐶. Thus, the well formedness is ensured.

With the help of this lemma, it can be proven that CDPLL(T) procedure always generates well-formed certificates.

Lemma 12. Given any reachable state 𝑀‖𝐹⊕𝑃 in any CDPLL(T) procedure, 𝑃 is a well-formed certificate.

Proof. First of all, the initial certificate 𝑃₀ is well formed because it only contains initial items. Secondly, the certificate is only modified in T-Backjump, T-Learn(I), T-Learn(II), Fail, and T-Forget. By Lemma 11, these rules will preserve well formedness. So, following any path of CDPLL(T) will always generate a well-formed certificate. That completes the proof.

Theorem 13 (soundness). Given a clause set 𝐹₀, for any certificate 𝑃, if 𝑀_𝑥‖𝐹_𝑥⊕𝑃_𝑥 is reachable in a CDPLL(T) procedure, then 𝑀_𝑥‖𝐹_𝑥 is also reachable in a DPLL(T) procedure. Specially, if 〈Fail〉  ⊕𝑃 is reachable in CDPLL(T), then 〈Fail〉 is also reachable in DPLL(T).

Proof. For each transition step in CDPLL(T): 𝑀‖𝐹⊕𝑃⟶_CDPLL(T)𝑀^′‖𝐹^′⊕𝑃^′, (24) it holds that 𝑀‖𝐹⟶_DPLL(T)𝑀^′‖𝐹^′. (25) So, given a CDPLL(T) trace, a trace in DPLL(T) can be obtained by removing the certificate part. If 𝑀_𝑥‖𝐹_𝑥⊕𝑃_𝑥 is reachable in CDPLL(T) so is 𝑀_𝑥‖𝐹_𝑥 in DPLL(T).

Theorem 14 (completeness). Given a clause set 𝐹₀, if the state 𝑀_𝑥‖𝐹_𝑥 is reachable in a DPLL(T) procedure, then there must be a certificate 𝑃_𝑥 such that 𝑀_𝑥‖𝐹_𝑥⊕𝑃_𝑥 is reachable in a DPLL(T) procedure. Furthermore, if 〈Fail〉 is reachable in a DPLL(T) procedure, then 〈Fail〉  ⊕𝑃_𝑥 is reachable in a CDPLL(T) and □∈⌊𝑃_𝑥⌋.

Proof. For rules Decide, TheoryPropagate, UnitPropagate, T-Learn(II), T-Forget, and Restart, the preconditions are equal to those in CDPLL(T). So, if there is a transition in DPLL(T) labelled with one of these rules, there could also be the same transition in CDPLL(T).
For other rules, T-Backjump, T-Learn(I), and Fail, we need to prove that: if 𝑀_𝑥‖𝐹_𝑥 is reachable, then there is some certificate 𝑃_𝑥 such that 𝑀_𝑥‖𝐹_𝑥⊕𝑃_𝑥 is reachable. We prove that by induction. Initially, this condition holds because the initial state 𝑀₀‖𝐹₀ corresponds to 𝑀₀‖𝐹₀⊕𝑃₀. Inductively, if 𝑀‖𝐹⟶_DPLL(T)𝑀^′‖𝐹^′ (26) is a possible transition in DPLL(T), and there is some 𝑃 such that 𝑀‖𝐹⊕𝑃 is reachable in CDPLL(T). (i)If it is labelled with T-Learn(I), because the learned clause is from clause learning, and clause learning corresponds to linear regular resolution. It is always possible that necessary theory lemmas in the implication graph are learned at first by Learn(II) and get to a state 𝑀‖𝐹⊕𝑃^′′, on which the preconditions of Learn(I) are satisfied. Then, 𝑀^′‖𝐹^′⊕𝑃^′ is reached. (ii)If it is labelled with T-Backjump or Fail, the situation is similar.

Our approach can be well adapted to any DPLL(T)-based SMT solver. It is sound and complete regardless of the theory learning scheme used or the order of the decision procedure. It works well as long as clause learning is based on the generalized implication graph.

4.4. Examples

A couple of examples are discussed in this subsection. The first example is given as a CNF formula on propositional variables. In this case, the SMT problem reduces to an SAT problem. No theory deduction is involved in this example; so, we can get a general idea of the structure of certificates.

Example  1. Consider the following clause set: 𝐶₁=¬𝑙₁∨¬𝑙₂∨¬𝑙₃,𝐶₂=¬𝑙₁∨¬𝑙₂∨𝑙₃,𝐶₃=¬𝑙₁∨𝑙₂,𝐶₄=𝑙₁∨¬𝑙₂,𝐶₅=𝑙₁∨𝑙₂. (27)

Let 𝐹₀={𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅}; assume that 𝑃₀ defines everything in 𝐹₀ as initial clause; then, a possible CDPLL(T) procedure is shown in Table 2, where “∼” means this field is the same as that in the previous row.

Table 2 

The CDPLL(T) procedure for Example  1.

In step 4, 𝐶₂=¬𝑙₁∨¬𝑙₂∨𝑙₃ is falsified. By analysing the implication graph, a clause is learned from 𝐶₁,𝐶₂,𝐶₃. Among the referred clauses, 𝐶₂ is a falsified clause, and 𝐶₁,𝐶₃ are in the reasons. In step 7, 𝐶₄ is falsified, but there is no decision variable. By analysing the implication graph, we can find a resolution from 𝐶₄,𝐶₅,𝐶₆ to the empty clause. Among the referred clauses, 𝐶₄ is a falsified clause, and 𝐶₅,𝐶₆ are in the reasons.

Example  2. Consider the background theory T_EUF and a clause set 𝐹 containing the following: 𝐶₁(𝑎)(𝑏),𝐶𝑎=𝑏∨𝑔≠𝑔₂ℎ(𝑎)(𝑐)𝐶≠ℎ∨𝑝,₃𝑔(𝑎)(𝑏)𝐶=𝑔∨¬𝑝,₄ℎ(𝑎)(𝑐)𝐶=ℎ∨𝑎=𝑐,₅𝑓(𝑎)(𝑏),𝐶≠𝑓₆𝑏=𝑐. (28) Its boolean structure is 𝐶₁=𝑙₁∨¬𝑙₅,𝐶₂=¬𝑙₆𝐶∨𝑝,₃=𝑙₅𝐶∨¬𝑝,₄=𝑙₆∨𝑙₂,𝐶₅=¬𝑙₄,𝐶₆=𝑙₃, (29) where 𝑙₁𝑙:𝑎=𝑏,₂𝑙:𝑎=𝑐,₃𝑙:𝑏=𝑐,₄(𝑎)(𝑏),𝑙:𝑓=𝑓₅(𝑎)(𝑏),𝑙:𝑔=𝑔₆:ℎ(𝑎)=ℎ(𝑐). (30)

A possible CDPLL(T) procedure is shown in Table 3, where the referred certificates are as follows: 𝑃₁=𝑃₀⊲𝖫𝖾𝗆𝗆𝖺¬𝑙₁∨𝑙₄=𝐶₇,𝑃₂=𝑃₀⊲𝖫𝖾𝗆𝗆𝖺¬𝑙₁∨𝑙₄=𝐶₇𝖫𝖾𝗆𝗆𝖺𝑙₂∧𝑙₃⟶𝑙₁=𝐶₈,𝑃₃=𝑃₀⊲𝖫𝖾𝗆𝗆𝖺¬𝑙₁∨𝑙₄=𝐶₇𝖫𝖾𝗆𝗆𝖺𝑙₂∧𝑙₃⟶𝑙₁=𝐶₈𝖱𝖾𝗌𝐶₈,𝐶₇,𝐶₄,𝐶₆,𝐶₂,𝐶₃,𝐶₁.=□ (31)

Table 3 

A possible CDPLL(T) procedure.

In step 4, 𝑀 becomes T-inconsistent. The generalized implication graph is shown in Figure 4. A theory lemma 𝐶₇=¬𝑙₁∨𝑙₄ is learned (instantiated the monotonicity property of the equality) firstly, then the backjump rule is applicable. In steps 11 and 12, 𝑀 becomes T-inconsistent again. A theory lemma 𝐶₈=𝑙₂∧𝑙₃→𝑙₁ is then learned (transitivity of equality), and then clause learning is performed which learns the empty clause. The implication graph is shown in Figure 5.

Figure 4 

The implication graph in step 4.

Figure 5 

The implication graph in steps 11 and 12.

5. The Certificate Checking

Lemma 15. For any initial clause set 𝐹₀, given a well-formed certificate 𝑃 and 0≤𝑖≤|𝑃|, if 𝑃[𝑖] is a certificate item that defines a clause, then 𝐹₀⊨_T⟦𝑃[𝑖]⟧.

Proof. We prove that by induction. The base case is easy to prove because for any initial item 𝑃[𝑖] that defines a clause, 𝑃[𝑖]∈𝐹₀. Therefore, it is trivial that 𝐹₀⊨⟦𝑃[𝑖]⟧. Thus, 𝐹₀⊨_T⟦𝑃[𝑖]⟧. (i)For resolution certificate items, assume that 𝑃[𝑖]=Res{𝐶₁,𝐶₂,…,𝐶_𝑛}. By definition, all 𝐶_𝑖 are all defined in ⌊𝑃⌋_𝑖−1. Then by the inductive hypothesis, we know 𝐹₀⊨_T⟦𝐶_𝑖⟧. By the property of resolution, it is true that 𝐹₀⊨_T⟦𝑃[𝑖]⟧. (ii)For theory lemma, it is true that ⊨_T⟦𝑃[𝑖]⟧. So, 𝐹₀⊨_T⟦𝑃[𝑖]⟧.

Theorem 16. Given a clause set 𝐹₀, if a certificate 𝑃 for 𝐹₀ is well formed and □∈⌊𝑃⌋, then 𝐹₀ is unsatisfiable.

Proof. By Lemma 15, we know that 𝐹₀⊨_T□ in this case.

By Theorem 16, certificate checking is actually checking whether the certificate is well formed and contains the empty clause. Checking the well formedness of a certificate can directly follow Definition 7. Only one traverse from the first item to the last one is needed. Moreover, the following properties make the checking process even easier.(i)Only checking for theory lemma is performed in theory T. Once a theory lemma is proved valid, it can be treated as a propositional clause. (ii)For each individual proof rule, we have a dedicated checker to check if the theory lemma is an instance of the rule. In this way, the certificate checker is extensible. Given a new proof rule, we need only to add the corresponding lemma checker. Notice that each proof rule defines an atomic deduction step; the checking effort is much less than solving a constraint in the theory T. For instance, only pattern matching is needed to check if a theory lemma is an instance of the monotonicity property of equality.

6. Experiments

Two criteria are adopted to assess our certificate approach: the overhead for generating certificates, and the cost for certificate checking. We implemented an SMT solver aCiNO based on the CDPLL(T) algorithm. It uses the Nelson-Oppen framework to solve combined theory. Currently, T_EUF and T_LRA are considered. The experiments are carried out on a machine with a E7200 dual core CPU (2.53 GHz per core) and 2.0 GB RAM.

All test cases are taken from SMT-LIB [22]. Our approach is tested on 19 unsatisfiable instances from different folders (in order to test it on different kinds of problem instances). Experiment results are shown in Table 4.

Table 4 

Experiment results.

In Table 4, the first column-group describes the scale of the input problem. The input is transformed to its equivalent conjunctive normal form, and the number of literals and clauses are counted. In the CDPLL(T) procedure, once a closed branch is encountered, a new clause will be learned. The number of learned clauses is listed in the second column-group. This number is equal to that in DPLL(T) since certificate generation will not affect the search procedure of the SMT problem. As in the DPLL(T) algorithm, the number of clause learning can be quite large (e.g., the 17th case). The time used in CDPLL(T) is also presented. The third column-group summarises the generated certificates. It is obvious that the number of theory lemma items is usually very large. The column of “Forget” is the number of forget items that forgets an initial or resolution certificate item. All theory lemmas are eventually forgotten, these items are not counted here. For SMT problem, this is not surprising since the major work of SMT solvers is in reasoning in the background theory. The resources and time required to check the certificates are listed in the Checking column-group. All certificates are checked to be well formed. The “Mem” column is not the size of memory consumed but the maximal number of clause items that are stored in the memory during checking. Also, the time for certificate checking is listed besides.

Regarding the certificate checking, the number of initial clauses and memory consumption is compared in Figure 6. It is rather interesting that although the certificate itself could be exponentially large with respect to the input problem, the memory consumption will not grow in the same way. The reason is that we have explicitly forgotten many items. In particular, many theory lemma are referred locally. They are only available in a short period of time, after which they are forgotten. With the technique of forgetting items, the certificate checking becomes more efficient. This is also supported by data from the “Time” column in Table 4.

Figure 6 

Comparison between the number of initial clauses and memory usage.

Towards the overhead of our approach, the experiment is shown in Table 5. Tested cases are also from SMT-LIB. In order to suppress the inaccurate measurement of time, we intentionally selected time consuming cases (e.g., longer than 0.01 sec). The maximal overhead is about 27.33%, and the average overhead is about 10.5%. It is much smaller compared to other approaches [17, 21].

Table 5 

Overhead of our approach.

7. Conclusion

In this paper, a unified certificate framework for quantifier-free SMT instances was presented. The certificate format is simple, clean, and extensible to other background theories. The certificate generation procedure can be easily integrated to any DPLL(T)-based SMT solver. Soundness and completeness of the extension of DPLL(T) with the certificate generation procedure were established. Experimental results show that our certificate framework outperforms others in both certificate generation and certificate checking.

Acknowledgments

This work was supported by the Chinese National 973 Plan under Grant no. 2010CB328003; the NSF of China under Grants nos. 61272001, 60903030, and 91218302; the Chinese National Key Technology R&D Program under Grant no. SQ2012BAJY4052; the Tsinghua University Initiative Scientific Research Program.