Bradley, Manna. The Calculus of Computation, Springer, 2007

200 7 Quantified Linear Arithmetic

with free variables or some quantifier alternation? For example, consider the formula

G : y1. · · · ym. x1. · · · xn. F [x1, . . . , xn, y1, . . . , ym] .

Order the free variables free(F ′) = {j1, . . . , jn, y1, . . . , ym} so that the yi’s precede the ji’s. In the resulting triangulated system, as few constraints as possible contain yi variables. Drop all resulting constraints that contain a yi variable, and solve the remaining constraints. A variable ji that does not appear in the final set of constraints must be instantiated to all values in its range [1, δi].

7.3 Quantifier Elimination over Rationals

c

QE for the theory of rationals TQ is simpler than for TZ . Recall that TQ has the following signature:

ΣQ : {0, 1, +, −, =, ≥} ,

where

•0 and 1 are constants;

•+ is a binary function;

•− is a unary function;

•and = and ≥ are binary predicates.

To be consistent with our presentation of Cooper’s method, we switch from weak inequality ≥ to strict inequality >. Of course, they are interchangeable:

x ≥ y x > y x = y and x > y x ≥ y ¬(x = y) .

7.3.1 Ferrante and Racko ’s Method

Given a ΣQ-formula x. F [x] as input, where F is quantifier-free, the algorithm proceeds according to the following steps.

Step 1

Put F [x] in NNF. The output x. F1[x] is TQ-equivalent to x. F [x] and is such that F1 is a positive Boolean combination (only and ) of literals.

Step 2

Replace literals according to the following TQ-equivalences, applied from left to right:

The output x. F2[x] is TQ-equivalent to x. F [x] and does not contain any negations.

Step 3

Solve for x in each atom of F2[x]: for example, replace the atom

t < cx ,

where c Z \ {0} and t is a term not containing x, with

t

c < x .

Atoms in the output x. F3[x] now have the form

(A)x < a

(B)b < x

(C)x = c

where a, b, c are terms that do not contain x. x. F3[x] is TQ-equivalent to

x. F [x].

Step 4

Construct the left infinite projection F−∞ from F3[x] by replacing

(A) atoms x < a by , (B) atoms b < x by ,

and

(C) atoms x = c by .

Construct the right infinite projection F+∞ from F3[x] by replacing

(A) atoms x < a by , (B) atoms b < x by ,

and

(C) atoms x = c by .

204 7 Quantified Linear Arithmetic

Theorem 7.20 (Correct). Given ΣQ-formula x. F [x] in which F is quantifier-free, Ferrante and Racko ’s method returns a TQ-equivalent quantifier-free formula.

Exercise 7.9 asks the reader to prove the theorem.

A limited form of the block elimination optimization discussed in Section 7.2.4 can be adapted to this QE procedure: commute disjunction and existential quantification. This step reduces the size of the term set S in each subproblem.

7.4 Complexity

Fischer and Rabin proved the following lower bounds. The length n of a formula is the number of symbols.

c

Theorem 7.21 (TZ Lower Bound). There is a fixed constant c > 0 such

c

that for all su ciently large n, there is a ΣZ -formula of length n that requires at least 22cn steps to decide its validity.

Theorem 7.22 (TQ Lower Bound). There is a fixed constant c > 0 such that for all su ciently large n, there is a ΣQ-formula of length n that requires at least 2cn steps to decide its validity.

Oppen analyzed Cooper’s method to prove the following upper bound.

Ferrante and Racko proved the following upper bound.

Theorem 7.24 (TQ Upper Bound). On a ΣQ-formula of length n, Ferrante and Racko ’s method requires deterministic time 22pn for some fixed constant p > 0.

Closing the gap between the lower and upper bounds would require answering long-standing open questions in complexity theory.

7.5 Summary

Quantifier elimination is a standard technique for reasoning about theories in which satisfiability is decidable even with arbitrary quantification. This chapter presents the technique in the context of arithmetic over integers and over rationals or reals. It covers:

Exercises 205

•Quantifier elimination in general. Based on structural induction, one only

needs to consider the special case of formulae of the form x. F [x], in which F is quantifier-free but may contain free variables in addition to x; arbitrary formulae may then be treated compositionally.

•Elimination over integers, TZ . The basic theory of integers does not admit quantifier elimination; it must be augmented with divisibility predicates. This situation, in which additional predicates are required to develop a quantifier elimination procedure, is common. The main idea of the procedure is to identify intervals with periodic behavior induced by the divisibility predicates.

•Elimination over rationals, TQ. The main idea of the procedure is to partition the rationals into a finite number of points and intervals.

The optimizations of Cooper’s method, particularly solving divides constraints, make the procedure acceptably fast in practice on quantifier-free ΣZ -formulae. However, faster decision procedures exist for deciding ΣQ- satisfiability of quantifier-free ΣQ-formulae; we study one in Chapter 8.

In addition to handling quantifiers, the algorithms of this chapter treat arbitrary Boolean combinations of literals. The decision procedures of subsequent chapters require the Boolean structure to be simple: formulae are just conjunctions of literals. Treating formulae with arbitrary Boolean structure directly avoids the potential exponential increase in size associated with converting to DNF.

Bibliographic Remarks

Presburger proves that arithmetic over the natural numbers without multiplication TN is decidable [73]. Cooper presents the version of the quantifierelimination procedure for TZ that we describe [19]. Fischer and Rabin provide the lower bound on the complexity of the decision problem for TZ [33], while Oppen analyzes Cooper’s procedure to obtain an upper bound [68].

Ferrante and Racko describe the quantifier-elimination procedure that we present and the lower and upper complexity bounds on the problem [32].

Exercises

7.1 (TZ does not admit QE). Prove Lemma 7.4. Hint : Apply structural induction; the base cases involve comparisons between ay and c, for constants a and c.

c). Apply quantifier-elimination to the following Σ -formulae.

7.2 (QE for TZ Z

(a) y. 3 < x + 2y 2x + y < 3 (b) y. 3 < x + 2y 2x + y < 3

208 8 Quantifier-Free Linear Arithmetic

quantifier-free fragment of TQ. For other theories, the situation is worse: satisfiability in the full theories such as equality TE, lists Tcons, and arrays TA is undecidable. Fortunately, for verification and other applications, we typically need to decide satisfiability of quantifier-free formulae rather than of arbitrarily quantified formulae.

Recall that the quantifier-free fragment of a theory T with signature Σ consists of the axioms of T and valid Σ-formulae of the form

G : x1, . . . , xn. F [x1, . . . , xn] ,

where F is quantifier-free and free(F ) = {x1, . . . , xn}. While such formulae have quantifiers, the point is that they do not have quantifier alternations: all quantifiers are universal. Using our conventions, we would ordinarily ask whether the formula F is T -valid — whether its universal closure . F is T -valid. F is indeed quantifier-free.

T -validity of G corresponds to T -unsatisfiability of

¬G : x1, . . . , xn. ¬F [x1, . . . , xn] ,

or, using our conventions, simply T -unsatisfiability of ¬F . Hence, the quantifiers are “natural” for satisfiability checking: ¬G is T -satisfiable i there exists a T -interpretation I and an assignment to x1, . . . , xn under which ¬F evaluates to true.

Fortunately, the quantifier-free fragments of many theories are decidable, often e ciently so. In Chapters 8-10, we focus on decision procedures for the quantifier-free fragments of theories.

For ease of exposition, we consider only conjunctive quantifier-free Σ- formulae in each theory T that we examine. Conjunctive Σ-formulae are conjunctions of Σ-literals. This restriction does not limit the scope of the decision procedures. For given arbitrary quantifier-free Σ-formula F , we can convert it into DNF Σ-formula

F1 · · · Fk

in which each Fi is conjunctive. F is T -satisfiable i at least one Fi is T - satisfiable. Decide the T -satisfiability of F by considering each Fi.

Remark 8.1 ( Complexity). This restriction does, however, a ect complexity. Because satisfiability in PL is NP-complete, any decision procedure that considers arbitrary quantifier-free formulae must be at least NP-hard, as it must handle not only the theory-specific aspects of the formulae but also the combinatorial (PL) aspects. However, considering only conjunctive formulae allows us to give more insightful complexity bounds. For example, satisfiability in the conjunctive quantifier-free fragments of TQ, TE, Tcons, and their union theory is in PTIME. Thus, the “hard” part of deciding satisfiability of arbitrary quantifier-free formulae in these theories is handling the underlying PL structure. Analyzing the theory-specific aspects is comparatively easy.

8.2 Preliminary Concepts and Notation

We define basic concepts and notation of linear algebra, covering only what is required for understanding the remainder of the chapter. We refer the reader interested in learning more about linear algebra to relevant texts in Bibliographic Remarks.

Basic Concepts and Notation

A variable n-vector x is a column of n variables x1, . . . , xn. An n-vector is a column a Qn of n rationals, and its transpose aT is a row with elements listed in the same order:

An m × n-matrix A Qm×n consists of n columns of m rationals each (alternatively, m rows of n rationals each), and its transpose AT is an n ×m- matrix in which element aij is swapped with element aji:

i=1

Matrix-vector multiplication works as follows: