A Generalization of Shostaks Metho d for Combining Decision Pro cedures Clark W Barrett David L Dill and Aaron Stump Stanford University Stanford CA USA httpverifystanfordedu c SpringerVerlag Abstract Consider the problem of determining whether a quantier free formula is satisable in some rstorder theory T Shostaks al gorithm decides this problem for a certain class of theories with b oth interpreted and uninterpreted function symbols We present two new algorithms based on Shostaks metho d The rst is a simple subset of Shostaks algorithm for the same class of theories but without uninter preted function symbols This simplied algorithm is easy to understand and prove correct providing insight into how and why Shostaks algo rithm works The simplied algorithm is then used as the foundation for a generalization of Shostaks metho d based on a variation of the Nelson Opp en metho d for combining theories Introduction In Shostak introduced a clever and subtle algorithm which decides the satisability of quantierfree formulas in a combined theory which includes a rstorder theory or combination of rstorder theories with certain prop erties and the theory of equality with uninterpreted function symbols But despite the fact that Shostaks metho d is less general than its predecessor the Nelson Opp en metho d it has generated considerable interest and is the basis for decision pro cedures found in several to ols including PVS STeP and SVC There are several go o d reasons for this First of all it is easier to implement the NelsonOpp en metho d provides a framework for combining decision pro ce dures but gives no help on how to construct the individual decision pro cedures But as we show in the next section at the core of Shostaks pro cedure is a simple metho d for generating decision pro cedures for a large class of theories A second reason for the success of Shostaks metho d is that despite requiring more restrictive conditions in order to accommo date a theory a wide variety of useful theories have b een shown to satisfy these conditions Finally empirical studies have shown that Shostaks metho d is an order of magnitude more ecient than the NelsonOpp en metho d Unfortunately the original pap er is dicult to follow due in part to the fact that it contains several errors and despite an ongoing eort to understand and clarify the metho d it remains dicult to understand In this pap er we take a new approach to explaining Shostaks algorithm We rst present a subset of the original algorithm in particular the subset which decides formulas without uninterpreted function symbols This algorithm is surprisingly simple and straightforward and gives considerable insight into how Shostaks algorithm works This algorithm then forms the basis for a more general algorithm that lies at an abstraction level somewhere b etween the general NelsonOpp en framework and the highlysp ecialized Shostak pro cedure The purp ose is to describ e an algorithm which is abstract enough that it can b e understo o d and proved correct but sp ecic enough that it is not hard to see how to sp ecialize it further to recover Shostaks original algorithm The correctness pro of of this algorithm relies on a new variation of the NelsonOpp en pro cedure and new theorem which relates convexity a requirement for Shostak and stableinniteness a requirement for NelsonOpp en It is our hop e that this exercise will not only shed light on how Shostaks metho d can b e seen as an ecient renement of the NelsonOpp en metho d but also provide a generalization which can b e used to achieve other ecient renements Indeed one such p ossible renement is describ ed in the rst authors dissertation In Section b elow some preliminary denitions and notation are given The simple algorithm without uninterpreted function symbols is presented in Section Section reviews the NelsonOpp en metho d in preparation for the generalized algorithm which is presented in Section Finally Section compares our approach to other work on Shostaks algorithm and describ es the renements necessary to recover Shostaks original algorithm Preliminary Concepts Some Notions from Logic A theory is a set of closed formulas For the purp oses of this pap er all theories are assumed to b e rstorder and to include the axioms of equality The sig nature of a theory is the set of function predicate other than equality and constant symbols app earing in those sentences A literal is an atomic formula or its negation To avoid confusion with the logical equality symbol we use the symbol to indicate that two logical expressions are syntactically identical For a given mo del M a variable assignment is a function which assigns to each variable an element of the domain of M We write M j if is true in the mo del M with variable assignment If is a set of formulas then M j indicates that M j for each In general whenever sets of formulas are used as logical formulas the intended meaning is the conjunction of the formulas in the set A formula is satisable if there exists some mo del M and variable assignment such that M j If is a set of formulas and is a formula then j means that whenever a mo del and variable assignment satisfy they also satisfy A set S of literals is convex in a theory T if T S do es not entail any disjunction of equalities b etween variables without entailing one of the equalities itself A theory T is convex if every set of literals in the language of the theory is convex in T Equations in Solved Form Denition A set S of equations is said to be in solved form i the lefthand side of each equation in S is a variable which appears only once in S We refer to the variables which appear only on the lefthand sides as solitary variables A set S of equations in solved form denes an idemp otent substitution the one which replaces each solitary variable with its corresp onding righthand side If S is an expression or set of expressions we denote the result of applying this substitution to S by S S Another interesting prop erty of equations in solved form is that the question of whether such a set S entails some formula in a theory T can b e answered simply by determining the validity of S in T Prop osition If T is a theory with signature and S is a set of equations in solved form then T S j i T j S Proof Clearly T S j i T S j S Thus we need only show that T S j S i T j S The if direction is trivial To show the other direction assume that T S j S Any mo del of T can b e made to satisfy T S by assigning any value to the nonsolitary variables of S and then choosing the value of each solitary variable to match the value of its corresp onding right hand side Since none of the solitary variables o ccur anywhere else in S this assignment is welldened and satises S By assumption then this mo del and assignment also satisfy S but none of the solitary variables app ear in S so the initial arbitrary assignment to nonsolitary variables must b e sucient to satisfy S Thus it must b e the case that every mo del of T satises S with every variable assignment ut Corollary If T is a satisable theory with signature and S is a set of equations in solved form then T S is satisable Algorithm S In this section we present an algorithm based on a subset of Shostaks algorithm for deciding satisability of quantierfree formulas in a theory T which meets certain conditions We call such a theory a Shostak theory Denition A satisable theory T with signature is a Shostak theory if the fol lowing conditions hold does not contain any predicate symbols T is convex There exists a canonizer canon a computable function from terms to terms with the property that T j a b i canona canonb There exists a solver solve a computable function from equations to sets of formulas dened as fol lows a If T j a b then solve a b ffalse g b Otherwise solve a b returns a set S of equations in solved form such that T j a b x S where x is the set of variables which appear in S but not in a or b Each of these variables must be fresh These requirements are slightly dierent from those given by Shostak and others These dierences are discussed in Section b elow In the rest of this section T is assumed to b e a Shostak theory with signature canonizer canon and solver solve As we will show the solver can b e used to convert an arbitrary set of equations into a set of equations in solved form The canonizer is used to determine whether a sp ecic equality is entailed by a set of equations in solved form as shown by the following prop osition Prop osition If S is a set of equations in solved form then T S j a b i canonS a canonS b Proof By Prop osition T S j a b i T j S a S b But T j S a S b i canonS a canonS b by the denition of canon ut S canon solve S WHILE DO BEGIN Remove some equality a b from a S a b S b S solve a b IF S ffalse g THEN RETURN FALSE S S S S END IF canon S a canon S b for some a b THEN RETURN FALSE RETURN TRUE Fig Algorithm S based on a simple subset of Shostaks algorithm Algorithm S shown in Fig makes use of the prop erties of a Shostak theory to check the joint satisability of an arbitrary set of equalities and an arbitrary set of disequalities in a Shostak theory with canonizer canon and solver solve Since the satisability of any quantierfree formula can b e determined by rst converting it to disjunctive normal form it suces to have a satisability pro cedure for a conjunction of literals Since contains no