Decision Procedures for Recursive Data Structures with Ting Zhang, Henny B Sipma, Zohar Manna Stanford University tingz,sipma,zm@csstanfordedu STeP Group, June 29, 2004 IJCAR 2004 - p 1/31
Outline Outline Motivation with Motivation Recursive data structures s Recursive data structures with integer constraints Decision procedure for structures with infinite atom domain Decision procedure for structures with finite atom domain Related work Future work STeP Group, June 29, 2004 IJCAR 2004 - p 2/31
Motivation: Program Verification Outline Motivation with Recursive data structures are essential constructs in programming languages To verify programs we need to reason about these data structures Programming languages often involve multiple data domains Common mixed constraints are combinations of data structures with integer constraints on the size of those structures STeP Group, June 29, 2004 IJCAR 2004 - p 3/31
Language and Structure Axiomatization with Definition 1 A data structure is recursive if it is partially composed of smaller or simpler instances of the same structure No Junk: the data domain is the set of data objects generated exclusively by applying constructors No Confusion: each data object is uniquely generated = Term Algebras Example 1 A tree is composed of subtrees and leaves Other examples include lists, stacks, counters, and records STeP Group, June 29, 2004 IJCAR 2004 - p 4/31
" " $ # $ # Language and Structure Language and Structure Axiomatization with A recursive data structure : The data domain : A set of atoms (constants): : A finite set of constructors: associated with an arity, eg,,, consists of, each of which is : A finite set of selectors: : A finite set of testers: A special predicate &%! for each for each STeP Group, June 29, 2004 IJCAR 2004 - p 5/31
# # # # "! Axiomatization Language and Structure Axiomatization with Construction vs selection Unification closure Acyclicity properly contains, if Uniqueness, and are distinct atoms and if constructors Domain closure is built solely by constructors and and, and are distinct, if STeP Group, June 29, 2004 IJCAR 2004 - p 6/31
# # # Example: LISP lists Signature: # % Language and Structure Axiomatization Axioms: # % with # % # Formulas: (valid) (valid) STeP Group, June 29, 2004 IJCAR 2004 - p 7/31
Directed Acyclic Graph Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) Definition 2 A term can be represented by a tree is a constant or variable, then labeled by, if is in the form having the root labeled by its subtrees is a leaf vertex, then is the tree and having such that as with A directed acyclic graph (DAG) of is obtained from factoring out the common subtrees (subterms) by The DAG of a formula is the DAG representing all terms in the formula STeP Group, June 29, 2004 IJCAR 2004 - p 8/31
Example: DAG Representation Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) with STeP Group, June 29, 2004 IJCAR 2004 - p 9/31
Bidirectional Closure Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) with : a binary relation Unification Closure relation extending of : the smallest equivalence such that Congruence Closure of : the smallest equivalence relation extending such that Bidirectional Closure = + STeP Group, June 29, 2004 IJCAR 2004 - p 10/31
# # # # Type Completion Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) Definition 3 is a type completion of if from by adding tester predicates such that for any term either is present in % Example 2 A possible type completion for is obtained (for some constructor ) or is with A type completion is compatible with if the satisfiability of implies that is satisfiable and if any solution of is a solution of % STeP Group, June 29, 2004 IJCAR 2004 - p 11/31
" for Algorithm 1 Input Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) with 1 Guess a type completion and simplify selector terms accordingly We still use to denote the resulting formula 2 Construct the DAG of 3 Compute the bidirectional closure of 4 Return FAIL if ; return SUCCESS otherwise Solution = Type Completion + DAG + Bidirectional Closure STeP Group, June 29, 2004 IJCAR 2004 - p 12/31
# Example: Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) with The following graph shows the DAG for STeP Group, June 29, 2004 IJCAR 2004 - p 13/31
Example (Cont d): Initial partition Directed Acyclic Graph Bidirectional Closure Type Completion (Cont d) with Merge Merge and and since by unification closure algorithm Merge and by congruence closure algorithm The conjunction is unsatisfiable since STeP Group, June 29, 2004 IJCAR 2004 - p 14/31
Language and Structure with Language and Structure Difficulty of N-O Combination Length Constraint Main Theorem Presburger arithmetic (PA): Two-sorted language 1 2 3, : signature of recursive data structures : signature of Presburger arithmetic, the length function defined by if if : is an atom : generalized integer terms Two-sorted structures: ; ; contains infinitely many atoms contains exactly atoms STeP Group, June 29, 2004 IJCAR 2004 - p 15/31
Difficulty of N-O Combination with Language and Structure Difficulty of N-O Combination Length Constraint Main Theorem Nelson-Oppen combination methods is not directly applicable to the extended theory Example 3 Consider in is unsatisfiable in satisfiable in, while with is satisfiable in and There are hidden constraints on data structure length is STeP Group, June 29, 2004 IJCAR 2004 - p 16/31
Length Constraint with Language and Structure Difficulty of N-O Combination Length Constraint Main Theorem An arithmetic constraint is a length constraint of there is one-to-one correspondence between integer variables and terms occurring in is sound, if for any satisfying assignment satisfying assignment for is complete, if whenever assignment assignment of, is a is satisfiable, for any satisfying of there exists a satisfying of such that is induced by, if is both sound and complete, if STeP Group, June 29, 2004 IJCAR 2004 - p 17/31
Example: Length Constraint with Language and Structure Difficulty of N-O Combination Length Constraint Main Theorem Reason: the integer assignment can not be realized sound is sound but not complete is complete but not Reason: it does not satisfy the data assignment is both sound and complete, and hence is the induced constraint from STeP Group, June 29, 2004 IJCAR 2004 - p 18/31
Main Theorem with Language and Structure Difficulty of N-O Combination Length Constraint Main Theorem Main Theorem 1 Let be a mixed constraint in the form and the induced length constraint with respect to Then is satisfiable in if and only if 1 2 is satisfiable in is satisfiable in, and The decision problem for quantifier-free theories reduces to computing the induced length constraints in Presburger arithmetic STeP Group, June 29, 2004 IJCAR 2004 - p 19/31
Notations with Notations Construction of DP for (Cont d) stands for are the distinct arities of the constructors is true iff is the length of a well-formed tree children to be the sum of the lengths of its children forces the length of an states the length constraint for an -typed node with known -typed tree STeP Group, June 29, 2004 IJCAR 2004 - p 20/31
Construction of in with Notations Construction of DP for (Cont d) Algorithm 2 Input: 1 : a (type-complete) data constraint, 2 3 Initially set : the DAG of, : the bidirectional closure obtained by Algorithm 1, if, if if is an atom; " For each term is an untyped leaf vertex if if is an is an add the following to -typed vertex with children -typed leaf vertex STeP Group, June 29, 2004 IJCAR 2004 - p 21/31
Decision Procedure for with Notations Construction of DP for (Cont d) Input: 1 Guess a type completion 2 Call Algorithm 1 on Return FAIL if 3 Construct from of is unsatisfiable; continue otherwise Return SUCCESS if Return FAIL otherwise using Algorithm 2 is satisfiable STeP Group, June 29, 2004 IJCAR 2004 - p 22/31
# Example: DP for (1) with Notations Construction of DP for (Cont d) STeP Group, June 29, 2004 IJCAR 2004 - p 23/31
(2) Example (Cont d): DP for Unification and congruence closure: Induced length constraints: with Notations Construction of DP for (3) (Cont d) (4) (2), (3) and (4) imply Constraint (1) is unsatisfiable STeP Group, June 29, 2004 IJCAR 2004 - p 24/31
# Complication for Suppose that the atom domain contains only one atom Then % with (5) is unsatisfiable while by the previous procedure Complication for Counting Constraints Equality Completion Construction of DP for is obviously satisfiable together with (6) Need to count how many distinct trees at certain length STeP Group, June 29, 2004 IJCAR 2004 - p 25/31
Counting Constraints with Complication for Definition 4 A counting constraint is a predicate that is true if and only if there are at least different the language with exactly Example 4 For, number such that the -terms of length distinct atoms where -th Catalan number in is the least Counting Constraints Equality Completion Construction of DP for is greater than is expressible by a quantifier-free Presburger formula that can be computed in time STeP Group, June 29, 2004 IJCAR 2004 - p 26/31
" Equality Completion with Definition 5 (Equality Completion) Let be a set of -terms An equality completion of is a formula consisting of the following literals: for any exactly one of, exactly one of and Example 5 An equality completion of and are in, and is Complication for Counting Constraints Equality Completion Construction of DP for! The notion of equality completion naturally generalizes to a conjunction of literals, eg, the above is an equality completion of (7) STeP Group, June 29, 2004 IJCAR 2004 - p 27/31
Construction of in with Let denote that length but are pairwise unequal Algorithm 3 Input: (type and equality complete), and have the same Complication for 1 Call Algorithm 2 to obtain 2 For each occurring in, add Counting Constraints Equality Completion Construction of DP for Example 6 Formula (5) implies which gives the counting constraint A contradiction STeP Group, June 29, 2004 IJCAR 2004 - p 28/31
Decision Procedure for with Complication for Counting Constraints Equality Completion Construction of Input : 1 Guess a type and equality completion 2 Call Algorithm 1 on Return FAIL if 3 Construct from of is unsatisfiable; continue otherwise Return SUCCESS if Return FAIL otherwise using Algorithm 3 is satisfiable DP for STeP Group, June 29, 2004 IJCAR 2004 - p 29/31
on Arithmetic Integration with Combining integer with sets and multisets [Zar02b, Zar02a] Combining integer with lists [Zar01] Quantifier-free theory of term algebras with Knuth-Bendix order [KV00, KV01] First-order theory of term algebras with Knuth-Bendix order [ZSM04a] First-order theory of term algebras with integer constraints [ZSM04b] STeP Group, June 29, 2004 IJCAR 2004 - p 30/31
on Arithmetic Integration Recursive data structures with subterm relation Eg, with Queues (flat lists without concatenation) Eg, Word concatenation Eg, STeP Group, June 29, 2004 IJCAR 2004 - p 31/31
[KV00] Konstantin Korovin and Andrei Voronkov A decision procedure for the existential theory of term algebras with the Knuth-Bendix ordering In Proc 15th IEEE Symp Logic in Comp Sci, pages 291 302, 2000 [KV01] Konstantin Korovin and Andrei Voronkov Knuth- Bendix constraint solving is NP-complete In Proceedings of 28th International Colloquium on Automata, Languages and Programming (ICALP), volume 2076 of Lecture Notes in Computer Science, pages 979 992 Springer-Verlag, 2001 [Zar01] Calogero G Zarba Combining lists with integers In Rajeev Goré, Alexander Leitsch, and Tobias Nipkow, editors, International Joint Conference on Automated Reasoning (Short Papers), Technical Report DII 11/01, pages 170 179 University of Siena, Italy, 2001 [Zar02a] Calogero G Zarba Combining multisets with integers In Andrei Voronkov, editor, Proc of the Intl Conference on Automated Deduction, volume 2392 of Lecture Notes in Artificial Intelligence, pages 363 376 Springer, 2002 [Zar02b] Calogero G Zarba Combining sets with integers In Alessandro Armando, editor, Frontiers of Combining 31-1
Systems, volume 2309 of Lecture Notes in Artificial Intelligence, pages 103 116 Springer, 2002 [ZSM04a] Ting Zhang, Henny Sipma, and Zohar Manna The decidability of the first-order theory of term algebras with Knuth-Bendix order, 2004 Submitted [ZSM04b] Ting Zhang, Henny Sipma, and Zohar Manna Term algebras with length function and bounded quantifier alternation, 2004 To appear in the Proceedings of the International Conference on Theorem Proving in Higher Order Logics 31-2