    # Efficient Interpolation for the Theory of Arrays

Existing techniques for Craig interpolation for the quantifier-free fragment of the theory of arrays are inefficient for computing sequence and tree interpolants: the solver needs to run for every partitioning (A, B) of the interpolation problem to avoid creating AB-mixed terms. We present a new approach using Proof Tree Preserving Interpolation and an array solver based on Weak Equivalence on Arrays. We give an interpolation algorithm for the lemmas produced by the array solver. The computed interpolants have worst-case exponential size for extensionality lemmas and worst-case quadratic size otherwise. We show that these bounds are strict in the sense that there are lemmas with no smaller interpolants. We implemented the algorithm and show that the produced interpolants are useful to prove memory safety for C programs.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Several model-checkers [1, 2, 8, 14, 16, 17, 20, 24, 25] use interpolants to find candidate invariants to prove the correctness of software. They require efficient tools to check satisfiability of a formula in a decidable theory and to compute interpolants (usually sequence or tree interpolants) for unsatisfiable formulas. Moreover, they often need to combine several theories, e.g., integer or bitvector theory for reasoning about numeric variables and array theory for reasoning about pointers. In this paper we present an interpolation procedure for the quantifier-free fragment of the theory of arrays that allows for the combination with other theories and that reuses an existing unsatisfiability proof to compute interpolants efficiently.

Our method is based on the array solver presented in , which fits well into existing Nelson-Oppen frameworks. The solver generates lemmas, valid in the theory of arrays, that explain equalities between terms shared between different theories. The terms do not necessarily belong to the same formula in the interpolation problem and the solver does not need to know the partitioning. Instead, we use the technique of Proof Tree Preserving Interpolation , which produces interpolants from existing proofs that can contain propagated equalities between symbols from different parts of the interpolation problem.

The contribution of this paper is an algorithm to interpolate the lemmas produced by the solver of the theory of arrays without introducing quantifiers. The solver only generates two types of lemmas, namely a variant of the read-over-write axiom and a variant of the extensionality axiom. However, the lemmas contain array store chains of arbitrary length which need to be handled by the interpolation procedure. The interpolants our algorithm produces summarize array store chains, e. g., they state that two shared arrays at the end of a sub-chain differ at most at indices, each satisfying a subformula. Bruttomesso et al.  showed that adding a diff function to the theory of arrays makes the quantifier-free fragment closed under interpolation, i.e. it ensures the existence of quantifier-free interpolants for quantifier-free problems. We use the diff function to obtain the indices for store chains and give a more efficient algorithm that exploits the special shape of the lemmas provided by the solver.

Nevertheless, the lemma interpolants produced by our algorithm may be exponential in size (with respect to the size of the input lemma). We show that this is unavoidable as there are lemmas that have no small interpolants.

#### Related Work.

The idea of computing interpolants from resolution proofs goes back to Krajíček and Pudlák [21, 26]. McMillan  extended their work to SMT with a single theory. The theory of arrays can be added by including quantified axioms and can be interpolated using, e.g., the method by Christ and Hoenicke  for quantifier instantiation, or the method of Bonacina and Johansson  for superposition calculus. Brillout et al  apply a similar algorithm to compute interpolants from sequent calculus proofs. In contrast to our approach, using such a procedure generates quantified interpolants.

Equality interpolating theories [29, 7] allow for the generation of quantifier-free interpolants in the combination of quantifier-free theories. A theory is equality interpolating if it can express an interpolating term for each equality using only the symbols occurring in both parts of the interpolation problem. The algorithm of Yorsh and Musuvathi  only supports convex theories and is not applicable to the theory of arrays. Bruttomesso et al.  extended the framework to non-convex theories. They also present a complete interpolation procedure for the quantifier-free theory of arrays that works for theory combination in . However, their solver depends on the partitioning of the interpolation problem. This can lead to exponential blow-up of the solving procedure. Our interpolation procedure works on a proof produced by a more efficient array solver that is independent of the partitioning of the interpolation problem.

Totla and Wies  present an interpolation method for arrays based on complete instantiations. It combines the idea of  with local theory extension . Given an interpolation problem and , they define two sets, each using only symbols from resp. , that contain the instantiations of the array axioms needed to prove unsatisfiability. Then an existing solver and interpolation procedure for uninterpreted functions can be used to compute the interpolant. The procedure causes a quadratic blow-up on the input formulas. We also found that their procedure fails for some extensionality lemmas, when we used it to create candidate interpolants. We give an example for this in Sect. 6.

The last two techniques require to know the partitioning at solving time. Thus, when computing sequence  or tree interpolants , they would require either an adapted interpolation procedure or the solver has to run multiple times. In contrast, our method can easily be extended to tree interpolation .

## 2 Basic Definitions

We assume standard first-order logic. A theory is given by a signature and a set of axioms. The theory of arrays is parameterized by an index theory and an element theory. Its signature contains the select (or read) function and the store (or write) function . In the following, denote array terms, index terms and element terms. For array , index and element , returns the element stored in at , and returns a copy of where the element at index is replaced by the element , leaving unchanged. The functions are defined by the following axioms proposed by McCarthy .

 ∀a i v. a⟨i⊲v⟩[i] =v (idx) ∀a i j v. i≠j→a⟨i⊲v⟩[j] =a[j] (read-over-write)

We consider the variant of the extensional theory of arrays proposed by Bruttomesso et al.  where the signature is extended by the function . For distinct arrays and , it returns an index where and differ, and an arbitrary index otherwise. The extensionality axiom then becomes

 ∀a b. a[diff(a,b)]=b[diff(a,b)]→a=b. (ext-diff)

The authors of  have shown that the quantifier-free fragment of the theory of arrays with , , is closed under interpolation. To express the interpolants conveniently, we use the notation from  for rewriting arrays. For , we define for two arrays and inductively as

 a0⇝b:=aam+1⇝b:=a⟨diff(a,b)⊲b[diff(a,b)]⟩m⇝b.

Thus, changes the values in at indices to the values stored in . The equality holds if and only if and differ at up to indices. The indices where they differ are the diff terms occurring in .

An interpolation problem is a pair of formulas where is unsatisfiable. A Craig interpolant for is a formula such that (i) implies in the theory , (ii) and are -unsatisfiable and (iii) all non-theory symbols occurring in are shared between and . Given an interpolation problem , the symbols shared between and are called shared, symbols only occurring in are called -local and symbols only occurring in , -local. A literal, e.g. , that contains -local and -local symbols is called mixed.

## 3 Preliminaries

Our interpolation procedure operates on theory lemmas instantiated from particular variants of the read-over-write and extensionality axioms, and is designed to be used within the proof tree preserving interpolation framework. In the following, we give a short overview of this method and revisit the definitions and results about weakly equivalent arrays.

### 3.1 Proof Tree Preserving Interpolation

The proof tree preserving interpolation scheme presented by Christ et al.  allows to compute interpolants for an unsatisfiable formula using a resolution proof that is unaware of the interpolation problem.

For a partitioning of the interpolation problem, two projections and project a literal to its -part resp. -part. For a literal occurring in , we define . If is -local, . For in , the projections are defined analogously. These projections are canonically extended to conjunctions of literals. A partial interpolant of a clause occurring in the proof tree is defined as the interpolant of and . Partial interpolants can be computed inductively over the proof tree and the partial interpolant of the root is the interpolant of and . For a theory lemma , a partial interpolant is computed for the interpolation problem .

The core idea of proof tree preserving interpolation is a scheme to handle mixed equalities. For each where is -local and is -local, a fresh variable is introduced. This allows to define the projections as follows.

 (a=b)⇂A≡(a=xab)(a=b)⇂B≡(xab=b)

Thus, is equivalent to and is a new shared variable that may occur in partial interpolants. For disequalities we introduce an uninterpreted predicate EQ and define the projections for as

 (a≠b)⇂A≡EQ(xab,a)(a≠b)⇂B≡¬EQ(xab,b).

For an interpolation problem where contains , we require as additional symbol condition that only occurs as first parameter of an predicate which occurs positively in the interpolant, i.e., the interpolant has the form 111One can show that such an interpolant exists for every equality interpolating theory in the sense of Definition 4.1 in . The terms are the terms v in that definition.. For a resolution step on the mixed pivot literal , the following rule combines the partial interpolants of the input clauses to a partial interpolant of the resolvent.

 \inferruleC1∨a=b:I1[EQ(xab,s1)]…[EQ(xab,sn)]C2∨a≠b:I2(xab)C1∨C2:I1[I2(s1)]…[I2(sn)]

### 3.2 Weakly Equivalent Arrays

Proof tree preserving interpolation can handle mixed literals, but it cannot deal with mixed terms which can be produced when instantiating (read-over-write) on an -local store term and a -local index. The lemmas produced in the decision procedure for the theory of arrays presented by Christ and Hoenicke  avoid such mixed terms by exploiting weak equivalences between arrays.

For a formula , let be the set of terms that contains the array terms in and in addition the select terms and their indices and for each store term in the terms , , and . Let be the equivalence relation on representing equality. The weak equivalence graph is defined by its vertices, the array-valued terms in , and its undirected edges of the form (i) if and (ii) if has the form or vice versa. If two arrays and are connected in by a path , they are called weakly equivalent. This is denoted by . Weakly equivalent arrays can differ only at finitely many positions given by . Two arrays and are called weakly equivalent on , denoted by , if they are connected by a path such that holds for each . Two arrays and are called weakly congruent on , , if they are weakly equivalent on , or if there exist with and and , . If and are weakly congruent on , they must store the same value at . For example, if and , arrays and are weakly equivalent on while and are only weakly congruent on .

We use to denote the conjunction of the literals (resp. ), , such that (resp. ) is necessary to show the corresponding property. Instances of array lemmas are generated according to the following rules:

 \inferrulea≈ibi∼ja[i],b[j]∈VCond(a≈ib)∧i=j→a[i]=b[j] (roweq)
 \inferruleaP⇔b∀i∈Stores(P). a∼iba,b∈VCond(aP⇔b)∧⋀i∈Stores(P)Cond(a∼ib)→a=b (weq-ext)

The first rule, based on (read-over-write), propagates equalities between select terms and the second, based on extensionality, propagates equalities on array terms. These rules are complete for the quantifier-free theory of arrays . In the following, we describe how to derive partial interpolants for these lemmas.

## 4 Interpolants for Read-Over-Weakeq Lemmas

A lemma generated by (roweq) explains the conflict (negation of the lemma)

 Cond(a≈ib)∧i=j∧a[i]≠b[j].

The weak equivalence ensures that and are equal at which contradicts (see Fig. 1).

The general idea for computing an interpolant for this conflict, similar to , is to summarize maximal paths induced by literals of the same part ( or ), relying on the fact that the terms at the ends of these paths are shared. If a shared term is equal to the index , we can express that the shared arrays at the path ends coincide or must differ at the index. There is a shared term for if or are shared or if is mixed. If there is no shared term for , the interpolant can be expressed using diff chains to capture the index. We identify four basic cases: (i) there is a shared term for and is in or mixed, (ii) there is a shared term for and is -local, (iii) both and are -local, and (iv) both and are -local.

### 4.1 Shared Term for i=j and a[i]=b[j] is in B or mixed

If there exists a shared term for the index equality , the interpolant can contain terms for shared array terms occurring on the weak path between and . The basic idea is to summarize the weak -paths by applying rule (roweq) on their end terms.

###### Example 1

 ∧a=s1∧s1⟨k1⊲v1⟩=s2∧s2⟨k2⊲v2⟩=s3∧s3=b ∧i≠k1∧i≠k2∧i=j∧a[i]≠b[j]

where , , , are -local, , , , are -local, and , , are shared. Projecting the mixed literals on and as described in Sect. 3.1 yields the interpolation problem

 A :a=s1∧s2⟨k2⊲v2⟩=s3∧EQ(xik1,i)∧i≠k2∧i=xij∧EQ(xa[i]b[j],a[i]) B :s1⟨k1⊲v1⟩=s2∧s3=b∧¬EQ(xik1,k1)∧xij=j∧¬EQ(xa[i]b[j],b[j]).

An interpolant is .

#### Algorithm.

The first step is to subdivide the weak path into - and -paths. An equality edge is assigned to either an - or -path depending on whether the corresponding equality is in or . A mixed equality is split into the -local equality and the -local equality . Store edges are assigned depending on which part contains the store term. If an equality or store term is shared between both parts, the algorithm can assign it to or arbitrarily. The whole path from to is then an alternation of - and -paths, which meet at shared boundary terms.

Let be the shared term for , i.e.  stands for if is shared, for if is not shared but is, and for the auxiliary variable if is mixed.

(i) An inner -path of starts and ends with a shared term. The summary is . For a store edge on with index , add the disjunct if the corresponding disequality is -local, and the disjunct if the disequality is mixed. The interpolant of the subpath is

(ii) If is mixed and is -local, the first -path on starts with or is shared, i.e. (where can be ). For the path , build the term and add as in case (i).

 Iπ≡EQ(xa[i]b[j],s1[x])∨FAπ(x)

(iii) Similarly in the case where is mixed and is -local, the last -path on ends with or is shared, . In this case the disjunct needs to be added if is -local and , are both shared.

 Iπ≡EQ(xa[i]b[j],sn[x])∨FAπ(x)[∨i≠j]

(iv) For every -path , add the conjunct for each -local index disequality , and the conjunct for each mixed index disequality on . We define

 FBπ(x)≡⋀k∈Stores(π)i≠k A-localx≠k∧⋀k∈Stores(π)i≠k mixedEQ(xik,x).

The lemma interpolant is the conjunction of the above path interpolants. If are shared, is in , and is -local, add the conjunct .

###### Lemma 1

If is a shared term for and is in or mixed, a partial interpolant of the lemma is

 I≡⋀π∈A-pathsIπ∧⋀π∈B-pathsFBπ(x)[∧i=j].
###### Proof

The interpolant only contains the shared boundary arrays, the shared term for , auxiliary variables for mixed disequalities under an EQ predicate, and shared store indices where the store term is in a different part than the corresponding index disequality.

implies : For a -path , we show that follows from the -part. If is -local, there are no -local or mixed index disequalities and holds trivially. Otherwise follows from , since either is shared and is , is -local and is , or is the -projection of the mixed equality . Then follows by replacing by in -local disequalities and -projections of mixed disequalities on . For an -path , if does not hold, we get by applying rule (roweq). Note that follows from if is -local, and from and in the mixed case. For the outer -path in case (ii), is combined with the -projection of the mixed disequality using , which yields the term. Analogously we get the term for (iii), but to derive in the case where both and are shared but is -local, we need to exclude .

is unsat: Again if is in then follows from by the choice of . For a -path , we can conclude by applying rule (roweq) and using the index disequalities in and . For an -path , (or, in cases (ii) and (iii), ) follows from using the -local index disequalities and to show that cannot hold. Transitivity and the -projection of lead to a contradiction. If is -local, is the shared term, and is in , the conjunct in is needed here. ∎

### 4.2 Shared Term for i=j and a[i]=b[j] is A-local

If there exists a shared index for and is -local, we build disequalities for the -paths instead of equalities for the -paths. This corresponds to obtaining the interpolant of the inverse problem by Sect. 4.1 and negating the resulting formula. Only the terms are not negated because of the asymmetry of the projection of mixed disequalities.

###### Lemma 2

Using the definitions of and from the previous section, if is a shared term for and is -local, then a partial interpolant of the lemma is

 I≡⋁(π:s1≈is2)∈B-paths(s1[x]≠s2[x]∧FBπ(x))∨⋁π∈A-% pathsFAπ(x)[∨i≠j].

### 4.3 Both i and j are B-local

When both and are -local (or both -local), we may not find a shared term for the index where and should be equal. Instead we use the function to express all indices where and differ. For instance, if for arrays with , then or hold.

###### Example 2

Consider the following conflict:

 a=s1∧s1⟨k⊲v⟩=s2∧s2=b∧i≠k∧i=j∧a[i]≠b[j]

where , , , are -local, , are -local, and , are shared. Splitting the mixed disequality as described in Sect. 3.1 yields the interpolation problem

 A :s1⟨k⊲v⟩=s2∧EQ(xik,k) B :a=s1∧s2=b∧¬EQ(xik,i)∧i=j∧a[i]≠b[j].

An interpolant should reflect the information that and can differ at most at one index satisfying the term. Using , we can express the interpolant

 I≡(s1=s2∨EQ(xik,diff(s1,s2)))∧s11⇝s2=s2.

To generalize this idea, we define inductively over for the arrays and , and a formula with one free parameter:

 weq(a,b,0,F(⋅)) ≡a=b weq(a,b,m+1,F(⋅)) ≡(a=b∨F(diff(a,b)))∧weq(a1⇝b,b,m,F(⋅)).

The formula states that arrays and differ at most at indices and that each index where they differ satisfies the formula .

#### Algorithm.

For an -path , we count the number of stores . Each index where and differ must satisfy as defined in Sect. 4.1. There is nothing to do for -paths.

###### Lemma 3

A partial interpolant of the lemma with -local and is

 I≡⋀(π:s1≈is2)∈A-pathsweq(s1,s2,|π|,FAπ(⋅)).
###### Proof

The symbol condition holds by the same argument as in Lemma 1.

implies : Let be an -path on . The path shows that and can differ at most at indices, hence follows from . If holds for , then for some . If is -local, then holds trivially, if is mixed, then is part of . Hence, holds for all . This shows .

is unsat: For every -path on , we get with (roweq). For every -path , implies that and differ at finitely many indices which all satisfy . The disequalities and -projections in imply that does not satisfy , and therefore . Then holds by transitivity, in contradiction to and in . ∎

### 4.4 Both i and j are A-local

The interpolant is dual to the previous case and we define the dual of weq for arrays , a number and a formula :

 nweq(a,b,0,F(⋅)) ≡a≠b nweq(a,b,m+1,F(⋅)) ≡(a≠b∧F(diff(a,b)))∨nweq(a1⇝b,b,m,F(⋅)).

The formula expresses that either one of the first indices found by stepwise rewriting to satisfies the formula , or and differ at more than indices. Like in Sect. 4.2, the lemma interpolant is dual to the one computed in Sect. 4.3.

###### Lemma 4

A partial interpolant of the lemma with -local and is .

###### Theorem 4.1

For all instantiations of the rule (roweq), quantifier-free interpolants can be computed as described in Sects. 4.14.4.

## 5 Interpolants for Weakeq-Ext Lemmas

A conflict corresponding to a lemma of type (weq-ext) is of the form

 Cond(aP⇔b)∧⋀i∈Stores(P)Cond(a∼ib)∧a≠b.

The main path shows that and differ at most at the indices in , and (called -path as of now) shows that and do not differ at index .

To compute an interpolant, we summarize the main path by weq (or nweq) terms to capture the indices where and can differ, and include summaries for the -paths that are similar to the interpolants in Sect. 4. The -paths can contain a select edge where , , and . In the -local case 4.3, -local select edges make no difference for the construction, as the weq formulas are built over -paths, and analogously for the -local case 4.4. However, if there are -local select terms in the -local case or vice versa, then is shared or the index equality is mixed and we can use or the auxiliary variable and proceed as in the cases where there is a shared term.

We have to adapt the interpolation procedures in Sects. 4.1 and 4.2 by adding the index equalities that pertain to a select edge, analogously to the index disequality for a store edge. More specifically, we add to a disjunct for each -local on an -path, and for each mixed . Here, is the shared term for the -path index . For -paths we add to a conjunct for each -local and for each mixed . Moreover, if there is a mixed select equality on the -path, the auxiliary variable is used in the summary for the subpath instead of , i.e., we get a term of the form in 4.1, and analogously for 4.2.

###### Lemma 5

Instead of a weak equivalence , let the lemmas in Sect. 4 contain a weak congruence . Then the modified methods described above give correct partial interpolants.

###### Proof

If the weak congruence does not contain a select edge, the methods in Sect. 5 can be used unchanged. We assume now that the weak congruence path consists of two weak equivalence paths and and the select edge with , , and .

Let be the interpolant constructed as described above. We give a proof for the modified methods based on 4.1 and 4.3 where is in or mixed; the other cases follow dually.

implies (Case 4.3): The select edge