On Solving Presburger and Linear Arithmetic with SAT

1. On Solving Presburger and Linear Arithmetic with SAT Ofer Strichman Carnegie Mellon University

2. Disjunctive linear arithmetic • A Boolean combination of predicates of the form • are constants

3. Some Known Techniques • Linear Arithmetic (conjunctions only) • Interior point method (Khachian 1979, Karmarkar 1984) (P) • Simplex (Dantzig 1949) • Fourier-Motzkin elimination • Loop residue (Shostak 1984) • … Almost all theorem provers use Fourier-Motzkin (PVS, ICS, SVC, IMPS, …)

4. Eliminatex1 Eliminatex2 Eliminatex3 Fourier-Motzkin elimination - example Elimination order: x1, x2, x3 (1) x1 – x2 < 0 (2) x1 – x3 < 0 (3) -x1 + 2x3 + x2 < 0 (4) -x3 < -1 (5) 2x3 < 0(from 1 and 3) (6) x2 + x3 < 0 (from 2 and 3) (7) 0 < -1 (from 4 and 5) Contradiction (the system is unsatisfiable)!

5. A system of conjoined linear inequalities Fourier-Motzkin elimination (1/2) m constraints n variables

6. Fourier-Motzkin elimination (2/2) • Eliminating xn: • For all i s.t. ai,n> 0 • For all i s.t. ai,n< 0 • For all I s.t. ai,n= 0 m1 m2 Each elimination adds (m1* m2 – m1 – m2) constraints

7. Complexity of Fourier-Motzkin • Worst-case complexity: • So why is it so popular in verification? • The bottleneck: case splitting. • Q: Is there an alternative to case-splitting ?

8. (Boolean) (Arith.) (Boolean) A Combined SAT/FM method  : x1 - x2 < 0  x1 - x3 < 0  (-x1 + 2x3 + x2 < 0  -x3 < -1) • Encode: ’: e1  e2  ( e3  e4 ) • Repeat: • SAT solve ’. • If UNSAT – exit.  is unsatisfiable. • Else – Check consistency of assignment. • If SAT – exit.  is satisfiable. • Else – Backtrack, and apply learning to ’. Implemented in CVC, MathSAT,ICSAT, VeriFun

9. x1 – x3 < 0 x2 -x3 0 x2-x1 <0 1 0 A combined BDD/FM method • Difference Decision Diagrams (Møller et al., 1999): • Can be easily adapted to disjunctive linear arithmetic ‘Path – reduce’ 1 • Each path is checked for consistency with a theory specific procedure • Worst case – an exponential no. of such paths

10. Boolean Fourier-Motzkin (BFM) (1/2) • Normalize formula: • Transform to NNF • Eliminate negations by reversing inequality signs (x1–x2  0)  x1–x3< 0  (-x1 + 2x3 + x2  0  1  x3 ) x1–x2< 0  x1–x3< 0  (-x1 + 2x3 + x2 < 0  -x3< -1)

11. e1 e3 e5 x1 – x2< 0 -x1 + 2x3 + x2< 0 2x3 <0 e1 e3  e5 Boolean Fourier-Motzkin (BFM) (2/2)  : x1 - x2< 0  x1 - x3< 0  (-x1 + 2x3 + x2 < 0  -x3< -1) ’: e1  e2  ( e3  e4 ) 2.Encode: 3. Perform FM on the conjunction of all predicates: Add new constraints to ’

12. e1e3e5 e5 2x3 < 0 e6x2 + x3 < 0 e2e3e6 False 0 < -1 e4e5False BFM: example e1x1 – x2 < 0 e2x1 – x3 < 0 e3 -x1 + 2x3 + x2 < 0 e4 -x3 < -1 e1  e2  (e3  e4) ’ is satisfiable

13. Case splitting x1 < x2 – 3  x2 < x3 –1 x1 < x2 – 3  x3 < x1 +1 No constraints No constraints x1 < x2 – 3  x2 < x3 – 1  x3 < x1 + 1 ... constraints Problem: redundant constraints : (x1 < x2 – 3  (x2 < x3 –1 x3 < x1 +1))

14. Solution: Conjunctions Matrices (1/2) • Let dbe the DNF representation of  • We only need to consider pairs of constraints that are in one of the clauses of d • Deriving dis exponential. But – • Knowing whether a given set of constraints share a clause in dis polynomial, using Conjunctions Matrices

15. l0 l1 l2 l3  :l0 (l1(l2  l3)) 1 1 1 l0 l1 l2 l3 0 0  M: 1 l0   l1 Conjunctions Matrix l2 l3 Conjunctions Matrices (2/2) • Consider a pair of literals (l0,l1)only ifM[l0, l1] = 1

16. e1 e2 e3 e4 e1 e2 e3 e4 1 1 1 1 1 0 e1e3e5 e5 2x3 < 0 e6 x2 + x3 < 0 e1 e2 e3 e4 e5 e6 e2e3e6 e1 e2 e3 e4 e5 e6 1 1 1 1 1 1 1 1 1 0 1 1 0 0 1 BFM: example e1x1 – x2 < 0 e2x1 – x3 < 0 e3 -x1 + 2x3 + x2 < 0 e4 -x3 < -1 e1  e2  (e3  e4) Saved a constraint from e4 ande5

17. Comparing Complexity (1/2) • Total no. of constraints are denoted by: • bfm – with BFM. • split – with Case-Splitting. • comb –with combined SAT/FM. • Claim 2: bfm  split • Because of the conjunctions matrices • Claim 3: Typically, bfm << split • Same pair of constraints can appear in many DNF clauses

18. Comparing Complexity (2/2) • Claim 4: The practical ratio between bfm and comb varies • Theoretically, comb can generate more constraints than split • Even with learning, it may generate the same constraint many times. • But… due to the pruning power of SAT, comb will traverse only a small subset of the possible combinations.

19. Overallcomplexity: Reduction SAT Complexity of solving the SAT instance Claim 5: Complexity of solving the resulting SAT  ( m = # of predicates in ) All the clauses that we add, are Horn clauses.

20. Experimental results –Real examples (1/2) Some real examples The reason for the inconsistency (?): ICS has a more efficient implementation of Fourier-Motzkin compared to the other tools (e.g. heuristics for choosing elimination order).

21. Both ICS and CVC could only solve the 10x10 instance Experimental results – Random instances (2/2) Reduction time of ‘2-CNF style’ random instances. • Solving the instances with Chaff – a few seconds each.

22. A projection chain n-1 n-1 n . . . . n n-1 1 x1 . . . xn-1 x1 . . . . . . . xn x1 ²Fn ,²Fn-1 ,… ,²F1

23. The Omega Test for Presburger formulas • Input: xn. Cn • Output: C’n-1 Sn-1 An adaptation of the Fourier-Motzkin method to Integer variables In each elimination step:

24. inequality #1 inequality #2 inequality #3  inequality #4 e1 e2 e3 e4 e1 e2 e3 e4 Add new constraints to ’ Boolean Omega Test • Normalize (eliminate all negations) • Encode each predicate with a Boolean variable • Solve the conjoined list of constraints with the Omega-test:

25. The End