Let's look at the following problem: f(a, b, c, x, y, z) is a Boolean function where a, b, c, x, y and z are Boolean values, and the output of f is a boolean value. The definition of f consists of a number of and/or/nor operators. I want to find a set of three Boolean values x0, y0, and z0, such that:
f(0, 0, 0, x0, y0, z0) = 0 AND
f(0, 0, 1, x0, y0, z0) = 1 AND
f(0, 1, 0, x0, y0, z0) = 1 AND
f(0, 1, 1, x0, y0, z0) = 0 AND
...
f(1, 1, 1, x0, y0, z0) = 1 # A total of 8 constrains. Each of them is from an entry in the truth table.
A naive approach is to define 3 Boolean variables x, y, z, and repeatedly define the function f 8 times. However f consists of complex boolean expressions. Defining it 8 times can blow up the model. Moreover, in fact, I have 7 variables: a, b, c, d, e, f, g. The truth table has 128 entries.
Is there a way to define something like a "placeholder" variables a, b, c which are not part of the solution? I can then define f on a, b, c, x, y, z only once, and later somehow "assign" a, b, c to Boolean constants.
I'm a newbie on SMT solvers, the placeholder idea might be totally irrelevant. Other solutions are appreciated as well.
It's hard to decipher exactly what you are trying to do. But it seems to me that your concern is about how to code this easily, as opposed to anything else. If so, I'd recommend programming in a language that provides a higher-level API than SMTLib. You can use many of the interfaces z3 supports: C, C++, Java, etc., to simplify the programming task.
For instance, here's how one can use the Python interface to code an instance of your problem:
from z3 import *
def fOriginal(a, b, c, x, y, z):
return Or([a, b^c, x, y, z])
x0, y0, z0 = Bools("x0 y0 z0")
def f(a, b, c):
return fOriginal(a == 1, b == 1, c == 1, x0, y0, z0)
s = Solver()
s.add(f(0, 0, 0) == False)
s.add(f(0, 0, 1) == True)
s.add(f(0, 1, 0) == True)
s.add(f(0, 1, 1) == False)
s.add(f(1, 1, 1) == True)
print(s.check())
print(s.model())
When run, this prints:
sat
[y0 = False, z0 = False, x0 = False]
Giving you an assignment to x0, y0, and z0 as you're trying to find.
The idea here is to code f as a regular function, using z3's interface. I called this function fOriginal in the python code. We then define a version of fOriginal, which I called f in the code, which passes symbolic values for the last three arguments, but expects constants for the first three.
We then simply add the constraints for each of your cases. I added only 5 above following your example; you can add all 8 of course.
I hope this gets you started!
It's not clear to me what you need the model for and how much flexibility you need, but here is an idea: if it is acceptable to constrain the function on all argument values, via a single else-case, then the following might work:
(declare-fun f (Bool Bool Bool Bool) Bool)
(assert (forall ((x Bool) (y Bool) (z Bool) (p Bool)) (!
(=
(f x y z p)
(ite
(and (not x) y) true (ite ; 1. case
(and (not x) (not y) z) true (ite ; 2. case
(and x (not y) z) true ; 3. case
false)))) ; else-case
:pattern ((f x y z p)))))
At least for this simple case, Z3's model effectively ignored the irrelevant 4th parameter of function f:
(check-sat) ;; SAT --> good
(get-model)
; NOTE: 4th parameter x!3 is declared, but not used
; (model
; (define-fun p () Bool
; false)
; (define-fun f ((x!0 Bool) (x!1 Bool) (x!2 Bool) (x!3 Bool)) Bool
; (or (not (or x!0 (not x!1)))
; (not (or x!1 (not x!2) (not x!0)))
; (not (or x!1 x!0 (not x!2)))))
; )
I use Z3 with :fixedpoint.engine set to datalog.
I have an enumerated filter relation (f pos min max). Let us say that we have (f #x10 #x100000 #x200000), (f #x20 #x150000 #x200000) and (f #x20 #x300000 #x500000).
For a given x, I search the greatest pos such that (f pos min max) and min <= x <= max (Here I use intervals but filters can be arbitrarily complex). Priority (sort t) and values (sort s) are BitVectors but x, min and max are on a rather large space (eg. 24 bits).
; configuration
(set-option :fixedpoint.engine datalog)
; sorts
(define-sort s () (_ BitVec 24))
(define-sort t () (_ BitVec 8))
; Relations
(declare-rel f (t s s))
(declare-rel match (t s))
(declare-rel better (t s))
(declare-rel best (t s))
(declare-rel a (t))
(declare-rel b ())
(declare-rel c ())
(declare-var x s)
(declare-var xmin s)
(declare-var xmax s)
(declare-var p t)
(declare-var q t)
; Facts (EDB)
(rule (f #x10 #x100000 #x200000))
(rule (f #x20 #x150000 #x200000))
(rule (f #x20 #x300000 #x500000))
; Rules
(rule (=> (and (f p xmin xmax) (bvule xmin x) (bvule x xmax))
(match p x)))
(rule (=> (and (match q x) (bvugt q p))
(better p x)))
(rule (=> (and (match p x) (not (better p x)))
(best p x)))
; Queries
(rule (=> (match p #x170000) (a p)))
(rule (=> (better #x10 #x170000) b))
(rule (=> (best #x10 #x170000) c))
; output: sat
; (or (= (:var 0) #x20) (= (:var 0) #x10))
(query (a p) :print-answer true)
; output: sat
(query b)
; Output 'WARNING: creating large table of size 16777216 for relation better' and fails
(query c)
(match p x) codes the fact that a filter at priority p filters x.
(better p x) if a rule with a better priority than p filters x.
(best p x) codes that the best filter matching x has priority p.
If I query (match p #x170000), I quickly get #x10 and #x20. If I ask (better #x10 #x170000) I quickly get
an answer same for priority #20. But the query on (best p #x170000) fails to execute in reasonable time and reasonable space.
It seems that (not (better p x)) is computed independently of (match p x) and so is represented by a very large table (the possible values of x are not forwarded). In some cases I can restrict x by some tricks in better (sometimes I know that I am only interested by x that explicitly appear in other relations) so that the space is reduced but this is not a real generic solutions and sometimes I am stuck.
How should I rephrase the problem or which options should I use to avoid this problem ?
Z3's default Datalog tables are over concrete values, so if you use large bit-vectors, Z3 may end-up creating huge tables.
You can try a simpler table data-structure, that supports fewer operations but it's sparse (uses "don't care" bits).
You can try it out with: z3 fixedpoint.engine=datalog fixedpoint.datalog.default_relation=doc file.smt2
Given the following code:
from z3 import *
a,b,c = BitVecs('a b c', 32)
f1 = Exists([a, b, c], And(a + b == c, a < b, c == 1337))
f2 = And(a + b == c, a < b, c == 1337)
prove(f1 == f2)
I would assume that z3 implicitly existential quantifies a, b and c, in this example. Why aren't the two formulas equal, what is the difference?
The way you formulated your query doesn't really check whether f1 equals f2. Your query is essentially asking the solver to find a, b, c such that the following fails to hold:
Exists([a, b, c], And(a + b == c, a < b, c == 1337))
=
And(a + b == c, a < b, c == 1337))
And indeed, you can instantiate the outer a, b, and c such that the right hand-side is false; but the left hand side is an existential which is true; thus failing the equivalence you asked for.
It might be easier to see this with a simpler example; with just one boolean variable. You're essentially asking:
x == (Exists [x], x)
You see that those xs are actually different, so we can rename the inner one to (say) y; we get:
x == (Exist [y]. y)
Now, the right-hand-side is clearly true since there is a y that makes (Exist [y]. y) true. So, you are essentially asking the prover to establish that no matter what x you pick, it is true. Which is definitely not the case when you pick x to be false.
Indeed, you can ask Z3 to give you the formula it's trying to prove, and this is what it returns for your original query:
(set-info :status unknown)
(declare-fun c () (_ BitVec 32))
(declare-fun b () (_ BitVec 32))
(declare-fun a () (_ BitVec 32))
(assert
(let (($x24 (exists ((a (_ BitVec 32))
(b (_ BitVec 32))
(c (_ BitVec 32)) )
(and (= (bvadd a b) c) (bvslt a b) (= c (_ bv1337 32))))))
(let (($x57 (= $x24 (and (= (bvadd a b) c) (bvslt a b) (= c (_ bv1337 32))))))
(and $x57))))
(check-sat)
Which is clearly satisfiable, by the above reasoning.
(See Z3: convert Z3py expression to SMT-LIB2 from Solver object for the code that converts a z3-python query to smt-lib.)
How can I simplify the Boolean expression obtained as a result of evaluating an uninterpreted function?
For instance, in the example: http://rise4fun.com/Z3/G8sL,
(eval (f x y))
yields (not (and (not x) (not y)))
I want to instead get the expression (or x y).
(simplify (eval (f x y))
gives an error.
This is not supported in the SMT-LIB 2.0 front-end.
You should consider one the programmatic front-ends for Z3.
For example, here is how to do it using the Z3 Python front-end (also available here):
B = BoolSort()
f = Function('f', B, B, B)
x, y = Bools('x y')
b1, b2 = Bools('b1 b2')
s = Solver()
s.add(ForAll([b1, b2], Implies(Or(b1, b2), f(b1, b2))))
s.add(Exists([b1, b2], Not(f(b1, b2))))
print(s.check())
m = s.model()
print(m.evaluate(f(x, y)))
print(simplify(m.evaluate(f(x, y)), elim_and=True))
I am trying to remove existential quantifiers in my theory using Skolemization. This means that I replace existential quantifiers with functions that are parameterized by the universally quantified variables in the scope of the existential quantifiers.
Here I found an explanation how to do this in Z3, but I am still having troubles doing it. Suppose the following two functions:
(define-fun f1 ((t Int)) Bool (= t 3))
(define-fun f2 () Bool (exists ((t Int)) (f1 t)))
I believe that f2 should be true, because there exists an integer t such that (f1 t) is true, namely t=3. I apply Skolemization by introducing a constant for the existentially quantified formula:
(define-const c Int)
Then the formula with the existential quantifier is rewritten to:
(define-fun f2 () Bool (f1 c))
This does not work, that is, the constant c does not have the value 3. I suspect it is because we have not given an interpretation to the constant c, because if we add (assert (= c 3)) it works fine, but this takes away the whole idea of the existential quantifier. Is there a way in which I give a less explicit interpretation to c so that this will work?
So, I think you have it about right actually, here's the script I used with automatic (via Z3's SNF tactic) and manual (via adding the constant c) skolemization, which gave the value 3 in the model for the skolem constant as expected (smt-lib script: http://rise4fun.com/Z3/YJy2 ):
(define-fun f1 ((t Int)) Bool (= t 3))
(define-fun f2 () Bool (exists ((t Int)) (f1 t)))
(declare-const c Int)
(define-fun f2a () Bool (f1 c))
(push)
(assert f2)
(check-sat) ; sat
(get-model) ; model gives t!0 = 3 (automatic skolemization in Z3)
(pop)
(push)
(assert f2a)
(check-sat) ; sat
(get-model) ; model gives c = 3 after manual skolemization
(pop)
Also, note that Z3 has a Skolem normal form (SNF) conversion tactic built in, and here's an example in z3py (link to script: http://rise4fun.com/Z3Py/ZY2D ):
s = Solver()
f1 = Function('f1', IntSort(), BoolSort())
t = Int('t')
f2 = Exists(t, f1(t))
f1p = ForAll(t, f1(t) == (t == 3)) # expanded define-fun macro (define-fun f1 ((t Int)) Bool (= t 3))
s.add(f1p)
s.add(f2)
print f1p
print f2
print s.check()
print s.model() # model has skolem constant = 3
g = Goal()
g.add(f1p)
g.add(f2)
t = Tactic('snf') # use tactic to convert to SNF
res = t(g)
print res.as_expr()
s = Solver()
s.add( res.as_expr() )
print s.check()
print s.model() # model has skolem constant = 3