Satisfiability Solvers are Static Analysers

Transcription

1 Saisiabiliy Solvers are Saic Analysers Vijay D Silva, Leopold Haller, and Daniel Kroening Deparmen o Compuer Science, Oxord Universiy irsname.surname@cs.ox.ac.uk Absrac. This paper shows ha several proposiional saisiabiliy algorihms compue approximaions o ixed poins using laice-based absracions. The Boolean Consrain Propagaion algorihm (bcp) is a greaes ixed poin compuaion over a laice o parial assignmens. The original algorihm o Davis, Logemann and Loveland reines bcp by compuing a se o greaes ixed poins. The Conlic Driven Clause Learning algorihm alernaes beween overapproximae deducion wih bcp, and underapproximae abducion, wih conlic analysis. Thus, in a precise sense, saisiabiliy solvers are absrac inerpreers. Our work is he irs sep owards a uniorm ramework or he design and implemenaion o saisiabiliy algorihms, saic analysers and heir combinaion. 1 How I Learned o Sop SAT Solving and Love Absrac Inerpreaion The absrac inerpreaion approach o program analysis is o compue properies o programs using laices, ransormers and ixed poins [5]. The saisiabiliy approach is o encode programs as ormulae ha can be analysed wih heorem provers [17]. The saisiabiliy approach has gained populariy in recen years due o dramaic improvemens in he perormance o proposiional saisiabiliy solvers. The goal o much curren research is o combine echniques based on absrac inerpreaion and based on saisiabiliy. This paper shows ha proposiional saisiabiliy algorihms compue approximaions o ixed poins using laices. Thus, analyses radiionally ormulaed over laices and hose ormulaed in erms o saisiabiliy can boh be undersood in erms o absrac inerpreaion. To appreciae he signiicance o such undersanding, consider he program below, where ϕ is a ormula wih Boolean variables iniialised o arbirary values. i ( ϕ ) { asser( alse ) } I ϕ is unsaisiable, a program veriier ha uses a sa solver will conclude ha he asserion is no violaed. In conras, a saic analysis like consan propagaion (or is condiional varian [26]) canno always prove he absence o Suppored by he Toyoa Moor Corporaion, EPSRC projec EP/H017585/1 and ERC projec Suppored by a Microso Research European PhD Scholarship.

2 2 asserion violaions i a ormula is unsaisiable. This resul is surprising because we show ha all sa solvers derived rom he dpll procedure use he same laice as consan propagaion. The insigh o sa algorihms is ha we can use imprecise absrac domains o gain eiciency, and echniques like decisions and clause-learning o improve precision. Conribuion This paper demonsraes ha a broad range o proposiional saisiabiliy algorihms have naural absrac inerpreaion descripions. Our conribuions include he ollowing characerisaions. 1. Proposiional saisiabiliy as a propery o ixed poins o ransormers over he laice o ruh assignmens. 2. Boolean Consrain Propagaion (bcp) as a greaes ixed poin compuaion over he same laice as consan propagaion. 3. The Davis Punam Logemann and Loveland algorihm (dpll) as a reinemen o bcp ha uses value-based race pariioning. 4. The conlic driven clause learning algorihm (cdcl) as a combinaion o overapproximae deducion wih underapproximae abducion. In separae work, we used he ormalisaion presened here o embed he inerval absrac domain inside cdcl and veriy programs ha are beyond he scope o exising echniques [12]. This paper is organised as ollows: We give ixed poin semanics o proposiional ormulae in 2. To illusrae our approach on simple examples, we ormalise ruh ables and resoluion in 3. The dpll algorihm and cdcl are covered in 4 and 5. 2 Proposiional Saisiabiliy via Transormers This secion conains a new characerisaion o proposiional saisiabiliy using ixed poins. We irs recall background on proposiional logic and laices. Proposiional Logic. Fix a se Prop o proposiional variables. A lieral is a variable or is negaion. A clause is a disjuncion o lierals and a cube is a conjuncion o lierals. A ormula in conjuncive normal orm (cn) is a conjuncion o clauses, and a ormula in disjuncive normal orm (dn) is a disjuncion o cubes. Noe ha he negaion o a cube is a clause and vice versa. The se o ruh values is B ˆ= {, }. An assignmen σ : Prop B maps variables o ruh values. An assignmen σ is a model o ϕ, denoed σ = ϕ, i σ saisies ϕ and is a counermodel o ϕ oherwise. A ormula is saisiable i i has a model and is unsaisiable oherwise. Laices A laice (L,,, ) is a parially ordered se wih a mee and a join. Two uncions, g : Q L rom a se Q o L can be ordered poinwise, denoed g, i (x) g(x) holds or all x in Q. All uncions over L can similarly be lied poinwise o Q L. The leas and greaes ixed poins o a monoone uncion F on a complee laice will be denoed lp(f ) and gp(f ), respecively.

3 3 Le id S be he ideniy uncion. A Galois connecion beween poses (C, ) γ and (A, ), wrien C α A, is a pair o monoone uncions α : C A and γ : A C ha saisy he poinwise consrains α γ id A and id C γ α. We ideniy a ew laices o paricular ineres. The laice o ruh values (B,,, ) consiss o ruh values wih he implicaion order. Disjuncion is he join and conjuncion is he mee o ruh values. The powerse laice over a se X, wrien (P(S),,, ), consiss o all subses o S order by inclusion. Le (S, ) be a pose. A se Q S is downwards closed i or every x in Q and y in S, y x implies ha y is in Q. A downwards closed se is called a downse. The downse laice over (S, ), wrien (D(S),,, ), is he se o downses o S ordered by inclusion. Downses sricly generalise powerses because he powerse laice o S is he downse laice o S wih he ideniy relaion. 2.1 Concree Semanics o Proposiional Formulae We presen new, ixed poin characerisaions o he models and counermodels o a ormula. Saisiabiliy and validiy are properies o such ixed poins. Le Asg ˆ= Prop B be he se o assignmens. The concree domain o assignmens is (P(Asg),,, ). A ormula ϕ deines our assignmen ransormers. The name assignmen ransormers is used by analogy o sae ransormers and predicae ransormers. Le X be a se o assignmens. The model ransormer mod ϕ removes all counermodels o ϕ rom X, he counermodel ransormer cmod ϕ removes all models o ϕ rom X, he universal model ransormer umod ϕ adds all models o ϕ o X, and he universal counermodel ransormer ucmod ϕ adds all counermodels o ϕ o X. mod ϕ (X) ˆ= {σ X σ = ϕ} umod ϕ (X) ˆ= {σ Asg σ = ϕ or σ X} cmod ϕ (X) ˆ= {σ X σ = ϕ} ucmod ϕ (X) ˆ= {σ Asg σ = ϕ or σ X} Properies o a ormula can be expressed wih ransormers. The se o models o ϕ is mod ϕ (Asg), or equivalenly, umod ϕ ( ). The se o counermodels o ϕ is cmod ϕ (Asg), or equivalenly, ucmod ϕ ( ). Algebraic properies o assignmen ransormers aid in deriving ixed poin characerisaions o saisiabiliy. The De Morgan dual o a uncion on P(Asg) is he uncion. Theorem 1. The assignmen ransormers have he ollowing properies. 1. The pairs (mod ϕ, ucmod ϕ ) and (cmod ϕ, umod ϕ ) are De Morgan duals. 2. There are wo Galois connecions as below. ucmod ϕ umod ϕ P(Asg) P(Asg) P(Asg) P(Asg) mod ϕ cmod ϕ Consider he saemen assume(ϕ). The sronges poscondiion is equivalen o mod ϕ and he weakes liberal precondiion is equivalen o ucmod ϕ. Sound approximaions o hese ransormers are available in absrac domain libraries. Since our characerisaion use hese ransormers, he overhead o liing saisiabiliy algorihms o new domains is low. Theorem 2 provides several ixed poin characerisaions o saisiabiliy.

4 4 Theorem 2. The ollowing saemens are equivalen. 1. A ormula ϕ is unsaisiable. 2. The se o assignmens mod ϕ (Asg) is empy. 3. The se o assignmens umod ϕ ( ) is empy. 4. The se cmod ϕ (Asg) conains all assignmens. 5. The se ucmod ϕ ( ) conains all assignmens. 6. The greaes ixed poin gp(mod ϕ ) conains no assignmens. 7. The leas ixed poin lp(umod ϕ ) conains no assignmens. 8. The greaes ixed poin gp(cmod ϕ ) conains all assignmens. 9. The leas ixed poin lp(ucmod ϕ ) conains all assignmens. Proo. Due o space resricions, we do no prove all cases. (1 i 2 ) The ormula ϕ is unsaisiable exacly i i has no models. An assignmen σ is in mod ϕ (Asg) exacly i σ is a model o ϕ. The se mod ϕ (Asg) is empy exacly i ϕ is unsaisiable. (2 i 5 ) Recall ha ucmod ϕ (X) is he De Morgan dual o mod ϕ. I mod ϕ (Asg) is he empyse, ucmod ϕ ( ) equals mod ϕ ( ), which equals Asg. (2 i 4 ) The uncion mod ϕ is idempoen, meaning ha mod ϕ (X) is equal o mod ϕ (mod ϕ (X)) or all X. Since mod ϕ is monoone, mod ϕ (Asg) equals mod ϕ (mod ϕ (Asg)), so he greaes ixed poin o mod ϕ is mod ϕ (Asg). Thus mod ϕ (Asg) is empy exacly i gp(mod ϕ ) is empy. The argumen or he remaining equivalences is similar. Since all he ransormers are idempoen, he ixed poins in Theorem 2 may seem superluous. A sound absracion o an idempoen uncion is no necessarily idempoen, so ieraing an absrac ransormer can provide sricly beer resuls han applying i once. This inuiion is ormalised by he mehod o locally decreasing ieraions [13]. 2.2 Absrac Saisacion We use he erm absrac saisacion or he applicaion o absrac inerpreaion o design saisiabiliy algorihms. Absrac inerpreaion is ypically used o overapproximae a leas ixed poin (such as reachable saes), or o underapproximae a greaes ixed poin (such as he se o dead variables a a program locaion). In conras, we will overapproximae he greaes ixed poin gp(mod ϕ ) or underapproximae he leas ixed poin lp(ucmod ϕ ). I an overapproximaion o gp(mod ϕ ) is he empyse, ϕ is unsaisiable. I an underapproximaion o lp(ucmod ϕ ) conains all assignmens, ϕ is unsaisiable. Combining inormaion rom dieren approximaions yields beer resuls han using eiher in isolaion. Absrac Inerpreaion. Assume a Galois connecion C A. The laice C is called he concree domain and A is called he absrac domain. I C is a powerse laice, an absrac domain wih respec o he subse order saisies x γ(α(x)) α γ

5 5 and is called an overapproximaion. An absrac domain wih respec o he superse order saisies x γ(α(x)) and is called an underapproximaion. Funcions on a concree domain are called concree ransormers and hose on absrac domains are absrac ransormers. The absrac ransormer G soundly approximaes F i F γ γ G holds. The bes absrac ransormer α F γ represens he maximum precision ha can be derived rom an absracion. Absrac Inerpreaion o Saisiabiliy This secion presens new, ixed poin approximaions o saisiabiliy. Le (O,,, ) be an overapproximaion o he domain o assignmens and (U,,, ) be underapproximaion. The approximaion is ormalised by he Galois connecions below. The orders and boh reine he subse order on assignmens. Tha is, a b implies γ(a) γ(b), and x y implies γ(x) γ(y). γ (P(Asg), ) O γ (O, ) (P(Asg), ) U (U, ) α U α O Absrac ransormers can be deined or over- or underapproximaing absracions. We use an overapproximaion o he model ransormer and underapproximaions o he counermodel and universal counermodel ransormers. An absrac model ransormer amod O ϕ : O O, an absrac counermodel ransormer acmod U ϕ : U U, and an absrac universal counermodel ransormer aucmod U ϕ : U U are monoone uncions saisying he consrains below. mod ϕ γ O γ O amod O ϕ ucmod ϕ γ U γ U aucmod U ϕ cmod ϕ γ U γ U acmod U ϕ Theorem 3 provides sound and possibly incomplee characerisaions o unsaisiabiliy. In conras o concree ixed poins, he characerisaions below are no equivalen because he domains and ransormers may have dieren precision. Theorem 3. A proposiional ormula ϕ is unsaisiable i a leas one o he condiions below hold. 1. The se γ O (gp(amod O ϕ )) is empy. 2. The se γ U (lp(aucmod U ϕ )) conains all assignmens. 3. The se γ O (x) γ U (y) is empy in (x, y) = γ OU (gp(amc OU ϕ )). Theorem 3 ollows rom he soundness o absrac inerpreaion. The res o he paper shows ha saisiabiliy algorihms compue hese absrac ixed poins. 3 Sound and Complee Absracions In his secion, we ormalise he consrucion o ruh ables and resoluion proos in he absrac saisacion ramework. Truh able consrucion is absrac ransormer applicaion and he resoluion rule is a sound absrac ransormer. Repeaed applicaion o he resoluion rule is absrac ransormer ieraion.

6 6 Truh Tables A ruh able is an enumeraion ha represens wheher each ruh assignmen saisies a ormula. In absrac saisacion, ruh ables are a represenaion o he domain o assignmens and ruh able consrucion is applicaion o he bes absrac ransormer or a ormula. Binary Decision Diagrams are semanically equivalen bu have a more eicien represenaion. Example 1. This example illusraes he order on ruh ables. Consider he ormula ϕ = p q. The se o assignmens {p, q} B is shown in gray below. The ruh ables or he ormulae p and q are shown below. p q p q = p q I he implicaion order on B is lied o ruh ables, he ruh able or p q is he poinwise mee o he ruh ables or p and q. A ruh able is a uncion in Table ˆ= Asg B. The domain o ruh ables (Table,,, ) is ordered by poinwise liing o he implicaion order on ruh values. Speciically, T 1 T 2 i T 1 (σ) T 2 (σ) or every assignmen σ. A se o assignmens X absracs o he ruh able T ha maps assignmens in X o and all oher assignmens o. The uncions α and γ below orm a Galois connecion, are bijecions and saisy ha γ α and α γ are ideniy uncions. Tha is, he Galois connecion is a Galois isomorphism, meaning ha ruh ables do no absrac inormaion. α(x) ˆ= {σ σ X} {σ σ / X} γ(t ) ˆ= {σ T (σ) = } Consider he bes absrac ransormer or mod ϕ, denoed amod ϕ. Observe ha amod ϕ ( ) represens he ruh able or ϕ. Thus, ruh able consrucion can be viewed as ransormer applicaion. The compleeness o ruh-able consrucion is expressed as mod ϕ γ = γ amod ϕ. Resoluion The resoluion principle saes ha an assignmen saisying he clauses C p and p D also saisies C D [21]. The variable p is he pivo and C D is he resolven. Resoluion is sound bu is no complee or deriving arbirary implicaions. For example, he ormula p q implies p q, bu his implicaion canno be derived by resoluion. Resoluion is reuaion complee: a ormula is unsaisiable exacly i he empy clause can be derived by resoluion. In absrac saisacion, cn ormulae, wih he superse order, are an absrac domain, and resoluion deines an absrac ransormer. The absrac ransormer is a sound bu incomplee absracion. Le Li be he se o lierals over he proposiional variables Prop, and Clause ˆ= P(Li) be he se o clauses. The cn domain CNF ˆ= P(Clause) conains ses o clauses wih he superse order (CNF,,, ). The superse order underapproximaes implicaion because ϕ ψ enails ϕ ψ bu he

7 7 converse is no rue. The uncions below are relaed by he Galois connecion (P(Asg), ) (CNF, ). α γ α(x) ˆ= {C X mod C (Asg)} γ(ϕ) ˆ= mod ϕ (Asg) We ormalise resoluion wih a ransormer. The resolvens derived rom ϕ wih pivo x are denoed res(x, ϕ). The resoluion ransormer Res ϕ : CNF CNF adds all possible resolvens o a se o clauses. res(x, ϕ) ˆ= {C D x C and x D are in ϕ} Res ϕ (ψ) ˆ= ϕ ψ res(x, ϕ) x Prop We express properies o resoluion nex. Logical soundness saing ha every clause derived by resoluion is implied by ϕ becomes he condiion α mod ϕ Res ϕ α. Res ϕ is no idempoen, so muliple applicaions o resoluion yield more resolvens han a single applicaion. The se o clauses derived by resoluion is he ixed poin gp(res ϕ ). Resoluion is no complee or arbirary implicaions, so in general, α(gp(mod ϕ )) is a sric superse o gp(res ϕ ). The reuaion compleeness o resoluion becomes he condiion ha γ(gp(res ϕ )) is he empy se exacly i gp(res ϕ ) conains he empy clause. 4 Fixed Poin Reinemen In his secion, we ormalise he classic dpll procedure. We irs characerise Boolean Consrain Propagaion as absrac ixed poin ieraion. 4.1 Boolean Consrain Propagaion The workhorse o all solvers based on dpll is he Boolean Consrain Propagaion (bcp) rouine. bcp repeaedly applies a ransormaion called he uni rule o a daa srucure called a parial assignmen. In absrac saisacion, parial assignmens are an absrac domain, he uni rule is he bes absrac ransormer or a clause, and bcp compues a greaes ixed poin. Example 2. We illusrae bcp wih he ormula below. ϕ ˆ= p ( p q) (q r s) (q r s) Iniially, nohing is known abou he ormula, encoded by he empy se. Then, bcp concludes ha p mus be rue in every saisying assignmen. Since p mus be rue, bcp concludes ha q mus be alse o saisy he clause p q. π 0 ˆ= π 1 ˆ= p: π 2 ˆ= p:, q: All he remaining clauses have more han one lieral unassigned, so bcp erminaes. bcp is a sound bu incomplee deducion procedure. bcp need no begin

8 8 Vars B P Q P Q P Q P Q P P Q Q Q P Q P P Q P Q P Q P Q p: q: q: p: p:, q: p:, q: p:, q: p:, q: Fig. 1. Domains or assignmens over p and q. The concree domain P(Asg) is on he le. The se P conains assignmens ha map p o rue. Parial assignmens are on he righ. The shaded elemens o P(Asg) canno be represened as parial assignmens. wih π 0 as above. We can begin by assuming p is rue, q is alse, and r is alse, wrien π ˆ= p:, q:, r:. Given π, bcp concludes, rom (q r s), ha s mus be alse and rom (q r s) ha s mus be rue. This siuaion, denoed, is a conlic. No assignmen exending π saisies ϕ. We show ha parial assignmens are an absrac domain. A parial assignmen is a parial uncion in Prop B. Consider he se {,, } wih he inormaion order and. We model a parial assignmen as a oal uncion π : Prop {,, }, where or each variable p, π(x) is i π is undeined on p. The domain o parial assignmens (PAsg, ) conains a se PAsg ˆ= (Prop {,, }) { }, o parial assignmens exended wih a leas elemen, called a conlic. The order beween non- elemens is he poinwise liing o he inormaion order. A parial assignmen in which p is and oher variables map o is wrien p:. Figure 1 depics parial assignmens over wo variables. A varian o he parial assignmens domain is used or consan propagaion [16] and is equivalen o he Caresian absracion [4]. In absrac inerpreaion parlance, parial assignmens as presened here are a reducion o he Caresian absracion domain in which he empy se has a unique represenaion. The absracion and concreisaion uncions α PAsg : P(Asg) PAsg and γ PAsg : PAsg P(Asg) below are sandard and are known o orm a Galois connecion. α PAsg ( ) ˆ= α PAsg (S) ˆ= γ PAsg ( ) ˆ= { x } {σ(x) σ S} x Prop, or S γ PAsg (π) ˆ= {σ Asg or all x in Prop, σ(x) π(x)} We ormalise he uni rule. The uni rule saes ha i all bu one lierals in a clause are alse under a parial assignmen, he remaining lieral mus be rue. I is deined by a uncion uni : Clause PAsg PAsg. The image o a clause θ

9 9 under a parial assignmen π is alse i π and makes all lierals in θ alse. π {p } uni(θ, π) ˆ= π {p } π i π(θ) is i θ is ψ p and π(ψ) = i θ is ψ p and π(ψ) = oherwise Example 3. We illusrae he uni rule wih ϕ ˆ= p (p q). Assume we have bes absrac ransormers or lierals. The absrac ransormer or ϕ is derived by replacing conjuncion and disjuncion by poinwise mee and join. amod ϕ ˆ= amod p (amod p amod q ) We compue a greaes ixed poin in he parial assignmens domain. π 0 ˆ= p:, q: π 1 ˆ= p:, q: π 2 ˆ= p:, q: π 3 ˆ= p:, q: Applying he uni rule generaes he same sequence. Lemma 1. For a ixed clause θ, he uni rule is equivalen o he bes absrac ransormer: uni(θ, π) = α PAsg mod θ γ PAsg (π). Proo. Consider a parial assignmen π and he bes absrac ransormer amod θ ˆ= α PAsg mod θ γ PAsg. We disinguish he cases in he deiniion o uni. (π(θ) is ) I π makes every lieral in θ alse, uni(θ, π) =. No assignmen in γ PAsg (π) will θ, so mod θ (γ PAsg (π)) is he empy se and by deiniion o α PAsg, rom amod θ (π) =. (θ = ψ p and π(ψ) = ) Here, uni(θ, π) = π {p }. Since p is unassigned, π(p) =, and γ(π) conains assignmens in which every p is rue and alse and all in ϕ are alse. The se mod θ (γ π (π)) only includes assignmens ha saisy p because no oher lieral is saisied. All oher variables are unaeced. Thus, α PAsg (mod θ (γ π (π))) equals π {p }. (π undeined or muliple variables in θ) The uni rule leaves π unchanged. A leas wo lierals in θ are undeined in π, so mod θ (γ PAsg (π)) conains an assignmen ha makes one rue and he oher alse and vice-versa. Consequenly, he variables or boh lierals map o in α PAsg (mod θ (γ PAsg (π))) and π is unchanged, as required. bcp maps a ormula ϕ and a parial assignmen π represening an assumpion o he resul o applying he uni rule repeaedly wih all clauses ill no changes are observed. Formally, bcp is a uncion bcp : CNF PAsg PAsg. Le ϕ be a ormula, θ represen a clause, and amod θ be he bes absrac ransormer or mod θ. We model he eec o concree deducion rom a parial assignmen wih he concree ransormer mod ϕ,. mod ϕ : PAsg P(Asg) P(Asg) mod ϕ, (x) ˆ= mod ϕ (x γ( ))

10 10 The absrac deducion ransormer below overapproximaes mod ϕ,. ded ϕ : PAsg PAsg PAsg ded ϕ, (π) ˆ= {amod θ (π ) θ is in ϕ} The soundness consrain mod ϕ, γ PAsg γ PAsg ded ϕ, implies ha all conclusions derived by ded ϕ, are saisied by all models o ϕ in. Example 4 shows ha he deducion ransormer is no complee. Example 4. The ormula ϕ ˆ= ( p q) (p q) ( p q) (p q) is unsaisiable. The bes absrac ransormer saisies α PAsg (mod ϕ, (γ PAsg ( ))) = whereas he deducion ransormer saisies α PAsg (mod ϕ, (γ PAsg ( ))) =. Thus, he absrac deducion ransormer is incomplee. Theorem 4. The resul o Boolean Consrain Propagaion bcp(ϕ, ) is equivalen o he greaes ixed poin gp(ded ϕ, ). In absrac inerpreaion erms, bcp is boom-up absrac inerpreaion o Boolean expressions wih locally decreasing ieraions [13, 4]. 4.2 The Classic DPLL Algorihm We say classic dpll, or dpll, or he algorihm o Davis, Logemann, and Loveland [10]. The dpll algorihm simpliies he algorihm o Davis and Punam [11] by eliminaing he resoluion and pure lieral rules. I bcp is viewed as a saic analysis, dpll can be undersood as running bcp on he sequence o programs below. In absrac saisacion erms, dpll dynamically resrics he range o values a variable can ake o improve precision. I is a procedure o dynamically discover value-based race pariions [20]. P 0 ˆ= i(ϕ) asser() P 1 ˆ= i(p) P 0 else P 0 P 2 ˆ= i(q) P 1 else P 1 Example 5. Revisi he ormula ϕ ˆ= ( p q) (p q) ( p q) (p q) which could no be reued by bcp. Since gp(ded ϕ, ) is, dpll concludes ha precision was los and compues wo ixed poins gp(ded ϕ, p: ) and gp(ded ϕ, p: ). Boh ixed poins are, so dpll concludes ha ϕ is unsaisiable. dpll operaes in wo phases, using wo absrac domains. One phase consiss o deducion under assumpions and uses bcp. The oher phase reines assumpions and is ormalised nex. dpll only considers assumpions ha can be represened by parial assignmens, bu such a resricion is no necessary. Example 6. Figure 2 illusraes pariions o wo variable assignmens. An elemen /, represens a pariion in which one block conains he assignmen {p, q } and he oher block conains all oher assignmens. dpll can be run using he assignmens in each pariion as assumpions. The pariion laice is large, wih he size given by he Bell number.

11 11 Asg /, /, /, /, /, /, /, /,, / /,, / /,, /, /, /,,, /,, /,, /, /, /, Fig. 2. The concree domain or case-based reasoning is he laice o pariions over assignmens. The absrac domain only conains pariions ha can be expressed as parial assignmens. An absrac laice o pariions reduces he cases ha mus be considered. Figure 2 depics pariions ha can be expressed as parial assignmens. The pariion consising o he wo ses represened by p q and p q canno be expressed wih parial assignmens bu he pariion consising o p and p can. An absrac pariion is a se χ A o elemens rom an absrac domain saisying ha {γ(a) a χ} is a pariion. Given wo absrac pariions, χ 1 reines χ 2, denoed χ 1 χ 2, i or every a 2 in χ 2, here is an a 1 in χ 1 such ha a 1 a 2. An absrac pariion represens cases used in deducion. Le (Cases(PAsg), ) be he se o absrac pariions over parial assignmens ordered by reinemen. Le χ be an absrac pariion. The case deducion ransormer models he eec o using each block o a pariion as an assumpion. acase ϕ : χ PAsg acase ϕ ˆ= { gp(ded ϕ, ) χ} In he reinemen sep, a variable ha is currenly undeined is used o reine a block o he pariion. We model selecion o an unassigned variable wih a uncion pick : PAsg Prop ha maps a parial assignmen π o a variable p or which π(p) =. The case spli uncion spli : PAsg P(PAsg) ormalises reinemen o a pariion based on deducion. spli(π) ˆ= {π p:, π p: p = pick(gp(ded ϕ,π ))} dpll runs unil he ormula is shown o be unsaisiable or a saisying assignmen is ound. Saisying assignmens are ormalised using covering. An elemen a in a laice covers i here is no disinc a saisying a a. Elemens o PAsg covering are assignmens. I deducion under every block o a pariion yields, he ormula is unsaisiable. Algorihm 1 presens an absrac inerpreaion perspecive o dpll. Since every uncion acase ϕ represens a race pariion [20], dpll can be undersood as a procedure o dynamically discover a race pariion.

12 12 Absrac-DPLL(ϕ, χ) Compue acase ϕ i acase ϕ( ) = or all in χ hen reurn UNSAT i acase ϕ( ) covers or some in χ hen reurn SAT else χ (χ \ { }) spli( ) Absrac-DPLL(ϕ, χ) Algorihm 1: dpll as ixed poin compuaion wih dynamic reinemen 5 Conlic Driven Clause Learning This secion ormalises he Conlic Driven Clause Learning (cdcl) algorihm. Though cdcl hisorically derives rom dpll, dpll can naurally be viewed as a recursive search procedure, while he search paern o cdcl is more inricae. dpll uses case based reasoning o reine an analysis. cdcl uses clause learning o reine he ransormers used o compue a ixed poin. In erms o programs, every ieraion o cdcl generaes and analyses a program o he orm below. P 0 ˆ= i(ϕ) asser() P 1 ˆ= i(θ 1 ) P 0 P 2 ˆ= i(θ 2 ) P 1 Example 7. This example illusraes a run o cdcl on a ormula ϕ. ϕ ˆ= { { u, v, w}, { w, x}, { w, y}, {x, y, z}, {x, z}, {x, y}, { y, x} } cdcl iniially proceeds like dpll and alernaes bcp and decisions. The seps in bcp are recorded by an implicaion graph shown below. A direced edge rom u o w and rom v o w indicaes ha bcp deduced ha w is rue i u is rue and v is alse. A cu in he graph represens a conjuncion o lierals. A cu ha separaes u and v rom represens a suicien condiion or a conlic. The disjuncion o ormulae represened by a se o cus is also suicien or a conlic. u v cu w cu x y w x y z Implicaion graph y x w xy... uvwxyz Choices The irs sep o conlic analysis is o heurisically choose a cu. A single cu is used raher han a se o save space. Suppose he solver chooses he cu x y. The second sep is o generalise he cu. Observe ha i x holds, he uni rule and he clause {x, y} imply y. Similarly, he solver can use y and { x, y} o deduce x. The conlic can be generalised o eiher or x or y. I x is suicien or a conlic, is negaion x mus be saisied by all models o ϕ. The solver learns he clause {x} and coninues wih model search. We view cdcl as operaing in wo phases. In he model search phase, cdcl uses bcp o draw conclusions abou all models o ϕ. Since ϕ ψ i all models

13 13 Model Search gp(amod ϕ ) Clause Conlic Analysis lp(aucmod ϕ ) SAT UNSAT Dual widen Conlic Dual narrow Fig. 3. Absrac Inerpreaion view o CDCL o ϕ saisy ψ, we say ha bcp overapproximaes deducion. The incompleeness o bcp ranslaes ino imprecision in an absrac ransormer. cdcl uses decisions o gain precision. Tha is, cdcl makes assumpions (ha we wrie as a ormula ) unil i inds a saisying assignmen, or unil ϕ. Unlike in dpll, only one assumpion is made, so he use o assumpions is unsound. Aer a conlic is ound, cdcl eners he conlic analysis phase. The goal o conlic analysis is o derive a ormula θ such ha ϕ θ implies. Given ormulae ϕ and ψ, he ask o deriving θ such ha ϕ θ ψ is called abducion. Conlic analysis only derives hose θ ha can be expressed as a cube, so his sep underapproximaes abducion. The absrac inerpreaion view o cdcl is illusraed in Figure 3 and ormalised nex. Model Search and Exrapolaion As beore, bcp is a greaes ixed poin compuaion wih he absrac ransormer amod ϕ. Decisions are used o increase precision by ieraing below he greaes ixed poin gp(ded ϕ, ). Recall ha widening operaors are used o ascend up a laice in a leas ixed poin compuaion. Decisions underapproximae he greaes ixed poin compued by bcp and are dual widening operaors [8]. Widening is ypically used o enorce convergence. The goal o decisions is no convergence, so we use he erm exrapolaion, suggesed in [8] or a weakening o widening wihou a convergence requiremen. A downwards exrapolaion on a laice is a uncion : L L saisying (a) a or all a. Such a uncion is usually called reducive or decreasing, bu we preer exrapolaion o emphasise he connecion o widening. We model decisions wih he downwards exrapolaion uncion below. ex : PAsg PAsg ex (π) ˆ= π p:b where p = pick(π) and b B The model search phase o cdcl compues π = gp(ded ϕ, ). I π is, he ormula is unsaisiable. I π covers, he ormula is saisiable. In oher cases, exrapolaion is used o derive a parial assignmen = ex (π). This parial assignmen represens he new assumpions ha will be used. Model search

14 14 coninues by compuing gp(ded ϕ, ). Exrapolaion is ypically used o accelerae convergence o a ixed poin compuaion by losing precision while preserving soundness. The applicaion o exrapolaion o gain precision a he cos o soundness in cdcl is unusual. Conlic Analysis and Inerpolaion I model search wih exrapolaion discovers an elemen such ha gp(ded ϕ, ) is, cdcl eners he conlic analysis phase. The goal o conlic analysis is o generalise he reason or he conlic. In erms o concree ransormers, we have ha mod ϕ (γ( )) is empy and wish o compue he se o counermodels ucmod ϕ (γ( )). This se is underapproximaed using an underapproximae domain and ransormer. Example 8. This example illusraes he domain and ransormers used or conlic analysis. Revisi he implicaion graph in Example 7. Every cu in he graph ha separaes he verices u and v rom is a reason or a conlic. Such cus can be compued by raversing he graph saring rom. C 0 = {{ }} C 1 = {{ }, { x, z}} C 2 = {{ }, { x, z}, { x, y}} Noe ha a graph cu is a se o verices, so he se o graph cus is a se o ses o verices. Unlike breadh-irs reachabiliy, which only mainains a se o verices, he ieraion above mainains a se o ses o verices. We ormalise he domain and ransormer or conlic analysis. A cu in he implicaion graph represens a conjuncion o lierals, so every cu c can be represened by a parial assignmen π c. A se o cus is a se o parial assignmens. I c is a se o verices represening a cu, every se o verices d ha conains c also represens a cu. I c is conained in d, he corresponding parial assignmens saisy π d π c. The domain or conlic analysis is downwards closed ses (downses) o parial assignmens. Le (D(PAsg), ) be he amily o downses o parial assignmens. We make he sandard assumpion ha downses are represened by heir maximal elemens. The laice o downses is an underapproximaing absrac domain wih he ollowing absracion and concreisaion uncions [7]. α D (X) = {π γ PAsg (π) X} γ D (Y ) = {γ PAsg (π) π Y } Since every se o assignmens is also a se o parial assignmens, his absrac domain can represen all ses o assignmens. We also noe ha he downse laice is called he disjuncive compleion o an absrac domain. We model concree abducion wih he ransormer below. ucmod ϕ : PAsg P(Asg) P(Asg) ucmod ϕ, (x) ˆ= ucmod ϕ (x γ PAsg ( )) An absrac abducion ransormer abd ϕ : PAsg D(PAsg) D(PAsg) underapproximaes concree abducion and maps a parial assignmen and se Q o a se o parial assignmens derived rom Q.

15 15 We describe an insance o abducion which ormalises clause minimisaion [23]. In general, oher echniques such as cuing a conlic graph [22] may also be used. minimise ϕ, (P ) ˆ= {π PAsg θ Form. amod θ (π) π, π P { }} The conlic minimisaion ransormer minimise ϕ, inds all parial assignmens rom which a known conlic can be deduced wih he uni rule. Applying abducion may produce a se o parial assignmens. Conlic analysis is expensive, so solvers heurisically choose a single parial assignmen and reurn o model search. In a dual manner o deducion, underapproximaing he se o reasons or a conlic can be viewed as a leas ixed poin compuaion. Recall ha narrowing operaors are used o overapproximae he limi o a decreasing ieraion sequence [8]. A dual narrowing operaor can be used o underapproximae he limi o an increasing ieraion sequence. Choosing a reason or a conlic can be viewed as dual narrowing. For similar reasons o our use o exrapolaion, he erm inerpolaion is more appropriae because convergence is no an issue. The use o he erm inerpolaion should no be conused wih Craig inerpolans. An upwards inerpolaion on a laice is a uncion : L L L saisying ha a b a (a, b) b or all a, b. We model heurisic choice among candidaes as he upwards inerpolaion uncion below. in : D(PAsg) D(PAsg) D(PAsg) For P Q, in (P, Q) ˆ= {choose(p, Q) p is maximal in P } The saemen choose(p, Q) above is deined when p is an elemen o Q and reurns a maximal elemen q o Q wih p q. Example 9. In Example 8, he iniial conlic is p = u :, v :, w :, x :, y :, z :. The wo graph cus produce he se o candidaes Q = { w :, x :, y : }. The second elemen o he se is chosen. This corresponds o he applicaion o upwards inerpolaion in ({p}, Q) = { x :, y : }. 6 Relaed Work and Discussion Sandard saic analysis is, o necessiy, incomplee and compues approximaions. A surprising insigh o our work is ha saisiabiliy procedures operae over imprecise absracions bu obain sound and complee resuls. The main reason is ha sa solvers use echniques o reine he precision o an analysis. The veriicaion lieraure conains numerous examples o domain reinemen, originaing in [6]. A very popular reinemen echnique a presen is Counerexample Guided Absracion Reinemen (cegar) [3]. We believe he reinemen in sa solvers is very dieren rom cegar. Each ieraion o he cegar loop requires consrucing a new absracion and new ransormers. In sark conras, sa solvers never change he domain. This immuabiliy is crucial or eiciency

16 16 as absrac domain implemenaions can be highly opimised. In ac, sa algorihms can be undersood as a porolio o echniques or reinemen wihou domain manipulaion. The reinemen in bcp is o compue a ixed poin insead o applying a ransormer. bcp uses locally decreasing ieraions [13] o reine condiional consan propagaion [26], which in urn reines consan propagaion [16]. The reinemen in dpll is o compue a se o ixed poins insead o a single ixed poin. A run o dpll can be undersood as a search or a suicienly precise se o ixed poins or as a search or a race pariion [15, 20]. cdcl uses wo ypes o reinemens. Decisions reine he saring elemen or ixed poin ieraion o eliminae precision loss. Conlic analysis reines he inpu consrains. We are no aware o exising program analysis echniques ha generalise cdcl in a sric mahemaical sense bu here are several analizing similariies ha deserve closer sudy. Transormer reinemen in predicae absracion [1] achieves a similar eec o clause learning. Counerexample dags in [14] play a similar role o implicaion graphs, while he combinaion o esing wih weakes precondiions in Yogi [2] and wih inerpolans in lazy annoaion [18] resembles he inerplay beween decisions and conlic analysis. The breadh and diversiy o he saisiabiliy lieraure made i ineasible o cover all bu a ew proposiional saisiabiliy procedures in his paper. Sålmarck s mehod is no covered in his paper bu can naurally be undersood as an exension o bcp ha combines case-based reinemen wih joins. Thakur and Reps [24, 25] have recenly applied absrac inerpreaion o generalise Sålmarck s mehod and shown ha his generalisaion has applicaions beyond sa solving. We conjecure ha algorihms or solving saisiabiliy in a heory (sm) have absrac inerpreaion characerisaions and may independenly exis in he saic analysis lieraure. The analysis o a ormula based on is proposiional srucure in DPLL(T) [19] is remarkably similar o he program analysis using conrol low pahs. The Nelson-Oppen combinaion procedure was recenly shown o be an insance o he ieraive reduced produc [9]. We believe ha hese are bu a ew direcions ha mus be explored en roue o an exciing uniicaion o he heory and pracice o decision procedures and saic analysers. Acknowledgemens We are deeply indebed o he French saic analysis communiy, and Parick and Radhia Couso in paricular, or heir encouragemen and suppor. Reerences 1. T. Ball, R. Majumdar, T. D. Millsein, and S. K. Rajamani. Auomaic predicae absracion o C programs. In PLDI, pages ACM Press, N. E. Beckman, A. V. Nori, S. K. Rajamani, and R. J. Simmons. Proos rom ess. In Proc. o Soware Tesing and Analysis, pages ACM Press, E. Clarke, O. Grumberg, S. Jha, Y. Lu, and H. Veih. Counerexample-guided absracion reinemen or symbolic model checking. JACM, 50: , 2003.

17 4. P. Couso. Absrac inerpreaion. MIT course , Feb. May P. Couso and R. Couso. Absrac inerpreaion: a uniied laice model or saic analysis o programs by consrucion or approximaion o ixpoins. In POPL, pages ACM Press, P. Couso and R. Couso. Sysemaic design o program analysis rameworks. In POPL, pages ACM Press, P. Couso and R. Couso. Absrac inerpreaion and applicaion o logic programs. Journal o Logic Programming, 13(2 3): , P. Couso and R. Couso. Absrac inerpreaion rameworks. Journal o Logic and Compuaion, 2(4): , Aug P. Couso, R. Couso, and L. Mauborgne. The reduced produc o absrac domains and he combinaion o decision procedures. In FoSSaCS, pages , M. Davis, G. Logemann, and D. Loveland. A machine program or heoremproving. CACM, 5: , July M. Davis and H. Punam. A compuing procedure or quaniicaion heory. JACM, 7: , July V. D Silva, L. Haller, D. Kroening, and M. Tauschnig. Numeric bounds analysis wih conlic-driven learning. In TACAS, pages Springer, P. Granger. Improving he resuls o saic analyses programs by local decreasing ieraion. pages 68 79, B. S. Gulavani, S. Chakrabory, A. V. Nori, and S. K. Rajamani. Auomaically reining absrac inerpreaions. In TACAS, volume 4963 o LNCS, pages Springer, L. H. Holley and B. K. Rosen. Qualiied daa low problems. In POPL, pages 68 82, New York, NY, USA, ACM Press. 16. G. A. Kildall. A uniied approach o global program opimizaion. In POPL, pages , New York, NY, USA, ACM. 17. J. C. King. A Program Veriier. PhD hesis, K. L. McMillan. Lazy annoaion or program esing and veriicaion. In CAV, pages , R. Nieuwenhuis, A. Oliveras, and C. Tinelli. Solving SAT and SAT modulo heories: From an absrac Davis Punam Logemann Loveland procedure o DPLL(T). JACM, 53: , X. Rival and L. Mauborgne. The race pariioning absrac domain. TOPLAS, 29(5):26, J. A. Robinson. A machine-oriened logic based on he resoluion principle. JACM, 12(1):23 41, Jan J. a. P. M. Silva and K. A. Sakallah. GRASP a new search algorihm or saisiabiliy. In ICCAD, pages , N. Sörensson and A. Biere. Minimizing learned clauses. In SAT, pages , A. Thakur and T. Reps. A Generalizaion o Sålmarck s Mehod. In SAS. Springer, A. Thakur and T. Reps. A mehod or symbolic compuaion o absrac operaions. In CAV. Springer, M. N. Wegman and F. K. Zadeck. Consan propagaion wih condiional branches. TOPLAS, 13: , April