Efficient Interpolant Generation in Satisfiability Modulo Linear Integer Arithmetic

The problem of computing Craig interpolants in SAT and SMT has recently received a lot of interest, mainly for its applications in formal verification. Efficient algorithms for interpolant generation have been presented for some theories of interest ---including that of equality and uninterpreted functions, linear arithmetic over the rationals, and their combination--- and they are successfully used within model checking tools. For the theory of linear arithmetic over the integers (LA(Z)), however, the problem of finding an interpolant is more challenging, and the task of developing efficient interpolant generators for the full theory LA(Z) is still the objective of ongoing research. In this paper we try to close this gap. We build on previous work and present a novel interpolation algorithm for SMT(LA(Z)), which exploits the full power of current state-of-the-art SMT(LA(Z)) solvers. We demonstrate the potential of our approach with an extensive experimental evaluation of our implementation of the proposed algorithm in the MathSAT SMT solver.


Introduction
Given two formulas A and B such that A ∧ B is inconsistent, a Craig interpolant (simply "interpolant" hereafter) for (A, B) is a formula I s.t.A entails I, I ∧ B is inconsistent, and all uninterpreted symbols of I occur in both A and B.
Interpolation in both SAT and SMT has been recognized to be a substantial tool for formal verification.For instance, in the context of software model checking based on counterexample-guided-abstraction-refinement (CEGAR) interpolants of quantifier-free formulas in suitable theories are computed for automatically refining abstractions in order to rule out spurious counterexamples.Consequently, the problem of computing interpolants in SMT has received a lot of interest in the last years (e.g., [McM05, RSS10, YM05, KMZ06, CGS10, JCG08, LT08, FGG + 09, GKT09, BKRW10, KLR10]).In the recent years, efficient algorithms and tools for interpolant generation for quantifier-free formulas in SMT have been presented for some theories of interest, including that of equality and uninterpreted functions (EU F) [McM05, FGG + 09], linear arithmetic over the rationals (LA(Q)) [McM05,RSS10,CGS10], fixed-width bit-vectors [KW07,Gri11], and for combined theories [YM05, RSS10, CGS10, GKT09], and they are successfully used within model-checking tools.
For the theory of linear arithmetic over the integers (LA(Z)), however, the problem of finding an interpolant is more challenging.In fact, it is not always possible to obtain quantifier-free interpolants starting from quantifier-free input formulas in the standard signature of LA(Z) (consisting of Boolean connectives, integer constants and the symbols +, •, ≤, =) [McM05].For instance, there is no quantifier-free interpolant for the LA(Z)formulas A def = (2x − y + 1 = 0) and B def = (y − 2z = 0).In order to overcome this problem, different research directions have been explored.One is to restrict to important fragments of LA(Z) where the problem does not occur.To this extent, efficient interpolation algorithms for the Difference Logic (DL) and Unit-Two-Variables-Per-Inequality (U T VPI) fragments of LA(Z) have been proposed in [CGS10].Another direction is to extend the signature of LA(Z) to contain modular equalities = c (or, equivalently, divisibility predicates), so that it is possible to compute quantifier-free LA(Z) interpolants by means of quantifier elimination -which is however prohibitively expensive in general, both in theory and in practice.For instance, I def = (−y+1 = 2 0) ≡ ∃x.(2x−y+1 = 0) is an interpolant for the formulas (A, B) above.Using modular equalities, Jain et al. [JCG08] developed polynomial-time interpolation algorithms for linear equations and their negation and for linear modular equations.A similar algorithm was also proposed in [LT08].The work in [BKRW10] was the first to present an interpolation algorithm for the full LA(Z) (augmented with divisibility predicates) which was not based on quantifier elimination.Finally, an alternative algorithm, exploiting efficient interpolation procedures for LA(Q) and for linear equations in LA(Z), has been presented in [KLR10].
The obvious limitation of the first research direction is that it does not cover the full LA(Z).For the second direction, the approaches so far seem to suffer from some drawbacks.In particular, some of the interpolation rules of [BKRW10] might result in an exponential blow-up in the size of the interpolants wrt. the size of the proofs of unsatisfiability from which they are generated.The algorithm of [KLR10] avoids this, but at the cost of significantly restricting the heuristics commonly used in state-of-the-art SMT solvers for LA(Z) (e.g. in the framework of [KLR10] both the use of Gomory cuts [Sch86] and of "cuts from proofs" [DDA09] is not allowed).More in general, the important issue of how to efficiently integrate the presented techniques into a state-of-the-art SMT(LA(Z)) solver is not immediate to foresee from the papers.
In this article we try to close this gap.After recalling the necessary background knowledge ( §2), we present our contribution, which is twofold.
First ( §3) we show how to extend the state-of-the art LA(Z)-solver of MathSAT [Gri12] in order to implement interpolant generation on top of it without affecting its efficiency.To this extent, we combine different algorithms corresponding to the different submodules of the LA(Z)-solver, so that each of the submodules requires only minor modifications, and implement them in MathSAT (MathSAT-modEq hereafter).An extensive empirical evaluation ( §5) shows that MathSAT-modEq outperforms in efficiency all existing interpolant generators for LA(Z).
Second ( §4), we propose a novel and general interpolation algorithm for LA(Z), independent from the architecture of MathSAT, which overcomes the drawbacks of the current approaches.The key idea is to extend both the signature and the domain of LA(Z): we extend the signature by adding the ceiling function ⌈•⌉ to it, and the domain by allowing non-variable terms to be non-integers.This greatly simplifies the interpolation procedure, and allows for producing interpolants which are much more compact than those generated by the algorithm of [BKRW10].Also this novel technique was easily implemented on top of the LA(Z)-solver of MathSAT without affecting its efficiency.(We call this implementation MathSAT-ceil.)An extensive empirical evaluation ( §5) shows that MathSAT-ceil drastically outperforms MathSAT-modEq, and hence all other existing interpolant generators for LA(Z), for both efficiency and size of the final interpolant.
Finally, in §6 we report some related work, and in §7 we present some conclusions.We recall that a shorter version of this article appeared at TACAS 2011 conference [GLS11].

Background: SMT(LA(Z))
We first provide the necessary background.We will use the following notational conventions: • We denote formulas with A, B, S, I, ϕ, Γ.
• Given a formula ϕ partitioned into A and B, the variables in ϕ are denoted with x, y, z, s, v, x i , y j , z k , s h , v l : − x i for variables that occur only in A (A-local); − z k for variables that occur only in B (B-local); − y j for variables that occur both in A and in B (AB-common); − v l when we don't want to distinguish them as in the above cases.• We denote integer constants with a, b, c, d.
• We denote terms with t 1 , t 2 .We write t 1 ∼ = t 2 to denote that the two terms are syntactically identical, and t 1 = c t 2 to denote that they are congruent modulo c.With ϕ 1 ≡ ϕ 2 we denote the logical equivalence of the two formulas ϕ 1 and ϕ 2 .• We write t A to denote that all the uninterpreted symbols occurring in t occur also in A. In this case, we say that t is A-pure.Given two formulas A, B such that t (A ∪ B) but t A and t B, we say that t is AB-mixed.
2.1.1.Satisfiability Modulo Theory -SMT.Our setting is standard first order logic.We use the standard notions of theory, satisfiability, validity, logical consequence.A 0-ary function symbol is called a constant.A term is a first-order term built out of function symbols and variables.If t 1 , . . ., t n are terms and p is a predicate symbol, then p(t 1 , . . ., t n ) is an atom.A literal is either an atom or its negation.A formula φ is built in the usual way out of the universal and existential quantifiers, Boolean connectives, and atoms.We call a formula quantifier-free if it does not contain quantifiers, and ground if it does not contain free variables.A clause is a disjunction of literals.A formula is said to be in conjunctive normal form (CNF) if it is a conjunction of clauses.For every non-CNF T -formula ϕ, an equisatisfiable CNF formula ψ can be generated in polynomial time [Tse68].We call Satisfiability Modulo (the) Theory T , SMT(T ), the problem of deciding the satisfiability of quantifier-free formulas wrt. a background theory T .1 Given a theory T , we write φ |= T ψ (or simply φ |= ψ) to denote that the formula ψ is a logical consequence of φ in the theory T .With φ ψ we denote that all uninterpreted (in T ) symbols of φ appear in ψ.If C is a clause, C ↓ B is the clause obtained by removing all the literals whose atoms do not occur in B, and C \ B that obtained by removing all the literals whose atoms do occur in B. With a little abuse of notation, we might sometimes denote conjunctions of literals l 1 ∧ . . .∧ l n as sets {l 1 , . . ., l n } and vice versa.If η is the set {l 1 , . . ., l n }, we might write ¬η to mean ¬l 1 ∨ . . .∨ ¬l n .
We call T -solver a procedure that decides the consistency of a conjunction of literals in T .If S is a set of literals in T , we call T -conflict set w.r.t.S any subset η of S which is inconsistent in T .We call ¬η a T -lemma (notice that ¬η is a T -valid clause).
A standard technique for solving the SMT(T ) problem is to integrate a DPLL-based SAT solver and a T -solver in a lazy manner (see, e.g., [BSST09] for a detailed description).DPLL is used as an enumerator of truth assignments for the propositional abstraction of the input formula.At each step, the set of T -literals in the current assignment is sent to the T -solver to be checked for consistency in T .If S is inconsistent, the T -solver returns a conflict set η, and the corresponding T -lemma ¬η is added as a blocking clause in DPLL, and used to drive the backjumping and learning mechanism.(1) C is the root of P; (2) the leaves of P are either elements of S or T -lemmas; (3) each non-leaf node C ′ has two premises C p 1 and C p 2 such that The atom p is called the pivot of C p 1 and C p 2 .If C is the empty clause (denoted with ⊥), then P is a resolution proof of (T -)unsatisfiability for i C i .
2.1.2.Interpolation in SMT.We consider the SMT(T ) problem for some background theory T .Given an ordered pair (A, B) of formulas such that

and (iii) I A and I B.
Following [McM05], an interpolant for (A, B) in SMT(T ) can be generated by combining a propositional interpolation algorithm for the Boolean structure of the formula A ∧ B with a T -specific interpolation procedure that deals only with negations of T -lemmas (that is, with T -inconsistent conjunctions of T -literals), as described in Algorithm 2.2.The algorithm works by computing a formula I C for each clause in the resolution refutation, such that the formula I ⊥ associated to the empty root clause is the computed interpolant.Therefore, in the rest of the article, we shall consider algorithms for conjunctions/sets of literals only, which can be extended to general formulas by simply "plugging" them into Algorithm 2.2.
Algorithm 2.2.Interpolant generation for SMT(T ) (1) Generate a resolution proof of unsatisfiability P for A ∧ B.
(3) For every input clause C in P, set (5) Output I ⊥ as an interpolant for (A, B).
Example 2.3.Consider the following two formulas in LA(Q): Figure 1(a) shows a resolution proof of unsatisfiability for A ∧ B, in which the clauses from A have been underlined.The proof contains the following LA(Q)-lemma (displayed in boldface): 2.2.Efficient SMT(LA(Z)) solving.In this section, we describe our algorithm for efficiently solving SMT(LA(Z)) problems, as implemented in the MathSAT 5 SMT solver [Gri12].They key feature of our solver is an extensive use of layering and heuristics for combining different known techniques, in order to exploit the strengths and to overcome the limitations of each of them.Both the experimental results of [Gri12] and the SMT solvers competition SMT-COMP'102 demonstrate that this is a state-of-the-art solver in SMT (LA(Z)).
The architecture of the solver is outlined in Fig. 2. It is organized as a layered hierarchy of submodules, with cheaper (but less powerful) ones invoked earlier and more often.The general strategy used for checking the consistency of a set of LA(Z)-constraints is as follows.
First, the rational relaxation of the problem is checked, using a Simplex-based LA(Q)solver similar to that described in [DdM06].If no conflict is detected, the model returned by the LA(Q)-solver is examined to check whether all integer variables are assigned to an integer value.If this happens, the LA(Q)-model is also a LA(Z)-model, and the solver can return sat.
Otherwise, the specialized module for handling linear LA(Z) equations (Diophantine equations) is invoked.This module is similar to the first part of the Omega test described in [Pug91]: it takes all the equations in the input problem, and tries to eliminate them by computing a solution of the system and then substituting each variable in the inequalities with its expression.If the system of equations itself is infeasible, this module is also able to detect the inconsistency, and to produce one unsatisfiability proof expressed as a linear combination of the input equations (see [Gri12] for details).Otherwise, the inequalities obtained by substituting the variables with their expressions are normalized, tightened 3 and then sent to the LA(Q)-solver, in order to check the LA(Q)-consistency of the new set of constraints.
If no conflict is detected, the branch and bound module is invoked, which tries to find a LA(Z)-solution via branch and bound [Sch86].This module is itself divided into two submodules operating in sequence.First, the "internal" branch and bound module is activated, which performs case splits directly within the LA(Z)-solver.The internal search is performed only for a bounded (and small) number of branches, after which the "external" branch and bound module is called.This works in cooperation with the DPLL engine, using the "splitting on-demand" approach of [BNOT06]: case splits are delegated to DPLL, by sending to it LA(Z)-valid clauses of the form (t−c ≤ 0)∨(−t+c+1 ≤ 0) (called branch-andbound lemmas) that encode the required splits.Such clauses are generated with the "cuts from proofs" algorithm of [DDA09]: "normal" branch-and-bound steps -splitting cases on an individual variable -are interleaved with "extended" steps, in which branch-and-bound lemmas involve an arbitrary linear combination of variables, generated by computing proofs of unsatisfiability of particular systems of Diophantine equations.

From LA(Z)-solving to LA(Z)-interpolation
Our objective is that of devising an interpolation algorithm that could be implemented on top of the LA(Z)-solver described in the previous section without affecting its efficiency.To this end, we combine different algorithms corresponding to the different submodules of the LA(Z)-solver, so that each of the submodules requires only minor modifications.
3.1.Interpolation for Diophantine equations.We first consider only conjunctions of positive LA(Z)-equations in the form l a l v l + c = 0. We recall a fundamental property of LA(Z).
Property 3.1.The equation l a l v l + c = 0 is unsatisfiable in LA(Z) if the GCD of the coefficients a l does not divide the constant c.
An interpolation procedure for systems of Diophantine equations was given by Jain et al. in [JCG08].The procedure starts from a proof of unsatisfiability expressed as a linear combination of the input equations whose result is an LA(Z)-inconsistent equation as in Property 3.1.Given one such proof of unsatisfiability for a system of equations partitioned into A and B, let ( x i ∈A∩B c i x i + y j ∈B b j y j +c = 0) be the linear combination of the equations from A with the coefficients given by the proof of unsatisfiability.Then, Example 3.2.Consider the following interpolation problem for the set of equalities 3 An LA(Z)-inequality l a l v l + c ≤ 0 can be tightened by dividing the constant c by the GCD g of the coefficients, taking the ceiling of the result, and then multiplying it again by g: One unsatisfiability proof expressed as a linear combination of the input equations is the following: By property 3.1 the root equation 5y 2 − 5x 2 + 10z 1 + 1 = 0 is LA(Z)-inconsistent since GCD({5, 5, 10}) = 5 does not divide 1.The proof combines three equations from A with coefficients 7, 3 and 4 respectively.Considering only these equations4 we have: [Sch86] of the system of equations.However, this is only one possible way of obtaining such proof.In particular, as shown in [Gri12], the submodule of our LA(Z)solver that deals with Diophantine equations can directly produce proofs of unsatisfiability expressed as a linear combination of the input equations.Therefore, we can apply the interpolation algorithm of [JCG08] without any modification to the solver.

Interpolation for inequalities.
The second submodule of our LA(Z)-solver checks the LA(Q)-consistency of a set of inequalities, some of which obtained by substitution and tightening [Gri12].In this case, we produce interpolants starting from proofs of unsatisfiability in the cutting-plane proof system, a complete proof system for LA(Z), which is based on the following rules [Sch86]: (1) where d > 0 is an integer that divides all the c i 's.
(Notationally, hereafter we omit representing the Hyp rule explicitly, writing its implied atom as a leaf node in a proof tree; moreover, we often omit the labels "Comb".) 3.2.1.Generating cutting-plane proofs in the LA(Z)-solver.The equality elimination and tightening step generates new inequalities (t ′ + c ′ + k ≤ 0) starting from a set of input equalities {e 1 = 0, . . ., e n = 0} and an input inequality (t + c ≤ 0).Thanks to its proofproduction capabilities [Gri12], we can extract from the Diophantine equations submodule the coefficients {c 1 , . . ., c n } such that ( i c i e i + t + c ≤ 0) ≡ (t ′ + c ′ ≤ 0).Thus, we can generate a proof of (t ′ + c ′ ≤ 0) by using the Comb and Hyp rules.We then use the Strengthen rule to obtain a proof of (t ′ + c ′ + k ≤ 0).The new inequalities generated are then added to the LA(Q)-solver.If a LA(Q)-conflict is found, then, the LA(Q)-solver produces a LA(Q)-proof of unsatisfiability (as described in [CGS10]) in which some of the leaves are the new inequalities generated by equality elimination and tightening.We can then simply replace such leaves with the corresponding cutting-plane proofs to obtain the desired cutting-plane unsatisfiability proof.
Example 3.3.Consider the following sets of LA(Z)-constraints: E ∪ I is satisfiable over the rationals, but not over the integers.Therefore, the LA(Z)-solver invokes the equality elimination procedure, which generates a new set I ′ of inequalities by "inlining" the equalities of E in I.In particular, I ′ is generated as follows: The inequalities in I ′ can now be tightened by dividing the constant by the GCD of the coefficients, taking the ceiling of the result, and then multiplying again: I ′′ is then sent back to the LA(Q)-solver, which can now easily detect its inconsistency, producing the following LA(Q)-proof of unsatisfiability P LA(Q) for it: 3 ≤ 0 The final cutting-plane proof P LA(Z) for the LA(Z)-unsatisfiability of E ∪ I can then be constructed by replacing the two inequalities in P LA(Q) with their proofs P 1 and P 2 constructed with the information (3.1) computed by the equality elimination procedure: From proofs to interpolants.In analogy to previous work on LA(Q) and LA(Z) [McM05,BKRW10], we produce interpolants by annotating each step of the proof of unsatisfiability of A ∧ B, such that the annotation for the root of the proof (deriving an inconsistent inequality (c ≤ 0) with c ∈ Z >0 ) is an interpolant for (A, B).Definition 3.4 (Valid annotated sequent).An annotated sequent is a sequent in the form (A, B) ⊢ (t ≤ 0)[I] where A and B are conjunctions of equalities and inequalities in LA(Z), and where I (called annotation) is a set of pairs (t i ≤ 0), E i in which E i is a (possibly empty) conjunction of equalities and modular equalities.It is said to be valid when: (1) Definition 3.5 (Interpolating Rules).The LA(Z)-interpolating inference rules that we use are the following: (1) where: where: and d > 0 is an integer that divides all the c i 's; denotes the result of the existential elimination from (t ′ +j = 0) of all and only the variables x 1 , ..., x n not occurring in B. (We recall that ∃(x 1 , . . ., x n ).( i c i x i + j d j y j + c = 0) ≡ ( j d j y j + c = GCD(c i ) 0), and that (t = 0 0) ≡ (t = 0).)Theorem 3.6.All the interpolating rules preserve the validity of the sequents.
(4) Strengthen (4.1)We observe that in this case ϕ I is equivalent to We also observe that, in LA(Z), (t ′ ≤ 0) is equivalent to By hypothesis, A |= (t ′ ≤ 0), and thus A |= ψ I .Since ψ I |= ϕ ′ I , we can immediately conclude.
(4.2) The hypothesis in this case is: We want to prove that (i) The latter follows immediately from the hypothesis.As regards (i), from the hypothesis and the fact that (t ′ + j = 0) |= (t ′ + j ≤ 0) we have We can then conclude by observing that: − From the validity of the premise of the Strengthen rule, we have that ( (1) A |= ϕ I .Trivial from the first validity condition.

and thus
(3) ϕ I A and ϕ I B. Trivial from the third validity condition.
Notice that the first three rules correspond to the rules for LA(Q) given in [McM05], whereas Strengthen is a reformulation of the k-Strengthen rule given in [BKRW10].Moreover, although the rules without annotations are refutationally complete for LA(Z), in the above formulation the annotation of Strengthen might prevent its applicability, thus losing completeness.In particular, it only allows to produce proofs with at most one strengthening per branch.Such restriction has been put only for simplifying the proofs of correctness, and it is not present in the original k-Strengthen of [BKRW10].However, for our purposes this is not a problem, since we use the above rules only in the second submodule of our LA(Z)-solver, which always produces proofs with at most one strengthening per branch.
Example 3.8.Consider the following interpolation problem [KLR10]: Using the above interpolating rules, we can construct the following annotated cutting-plane proof of unsatisfiability: Since (j − 4 ≤ 0) |= ⊥ when j ≥ 5, the generated interpolant I is: 3.2.3.Conditional strengthening.In [BKRW10] some optimizations of the k-Strengthen rule are given for some special cases.Here, we present another one, which lets us avoid performing case splits under certain conditions, and thus results in more concise interpolants than the general Strengthen rule.In particular, if both the result of a Strengthen rule and the linear combination of all the inequalities from B in the subtree on top of the Strengthen contain only AB-common symbols, then it is possible to perform a conditional strengthening as follows: Conditional-Strengthen: where: 0 is the single inequality obtained by combining all the constraints from B in the subtree on top of the premise (with the coefficients occurring in the subtree); − P is AB-local.We observe that this is similar to what we do in Case 4 of our interpolation algorithm for U T VPI [CGS10].Further, notice that in the definition above, with a little abuse of notation, we are storing an inequality as the second component of the first pair of I, and not an equality.However, this does not affect the validity of Hyp-A, Hyp-B and Comb.Together with the fact that we only generate proofs with at most one strengthening per branch (see above), the following Theorem is then enough to ensure that Corollary 3.7 still holds.

Proof.
(1) We observe that in this case ϕ I is equivalent to ϕ ′ I where By hypothesis, A |= (t ′ ≤ 0), and by definition P ∼ = ( i c i x i + c − t ′ ≤ 0).Therefore,

and so
(2) We observe that (3) Follows immediately from the hypothesis.
Example 3.10.Consider the following variant of Example 3.8: By applying Hyp-A, Hyp-B, Comb and Strengthen rules, we can obtain the following unsatisfiability proof with an interpolant I 1 : where I 1 is defined as follows: We observe from the above proof that all the inequalities from B above the tightened inequality (10y 3 −10y 2 +1 ≤ 0), and this inequality itself, contain only AB-common symbols.Therefore, we can replace the Strengthen rule with the Conditional-Strengthen rule in the above proof to obtain a more concise interpolant I 2 : where I 2 is defined as follows: (which can then be simplified to ((y 2 − y 3 ≤ 0) ∧ (y 1 + 10y 2 ≤ 0)) ∨ (−y 1 − 10y 2 + 6 ≤ 0).) 3.3.Interpolation with branch-and-bound.

3.3.1.
Interpolation via splitting on-demand.In the splitting on-demand approach, the LA(Z) solver might not always detect the unsatisfiability of a set of constraints by itself; rather, it might cooperate with the DPLL solver by asking it to perform some case splits, by sending to DPLL some additional LA(Z)-lemmas encoding the different case splits.In our interpolation procedure, we must take this possibility into account.
Let (t−c ≤ 0)∨(−t+c+1 ≤ 0) be a branch-and-bound lemma added to the DPLL solver by the LA(Z)-solver, using splitting on-demand.If t A or t B, then we can exploit the Boolean interpolation algorithm also for computing interpolants in the presence of splittingon-demand lemmas.The key observation is that the lemma (t − c ≤ 0) ∨ (−t + c + 1 ≤ 0) is a valid clause in LA(Z).Therefore, we can add it to any formula without affecting its satisfiability.Thus, if t A we can treat the lemma as a clause from A, and if t B we can treat it as a clause from B; if both t A and t B, we are free to choose between the two alternatives.
Example 3.11.Consider the following LA(Z) set of constraints S, which is first fed to the LA(Q)-Solver, producing the LA(Q) model µ S : By splitting-on-demand, the LA(Z)-solver adds the branch-and-bound lemmas which are passed back to the DPLL engine.Suppose DPLL first "decides" (y 3 ≤ 0) (plus possibly some literal in the first clause) invoking the layered LA(Z)-solver.The inconsistency of the branch is detected directly by the LA(Q)-solver, which produces the LA(Q)-proof and the corresponding LA(Q)-lemma: Then DPLL unit-propagates ¬(y 3 ≤ 0), (−y 3 + 1 ≤ 0) and decides (y 2 ≤ 0).As before, the LA(Q)-solver is sufficient to detect the inconsistency of the assignment, producing: Consequently, also ¬(y 2 ≤ 0), (−y 2 + 1 ≤ 0) are unit-propagated.Likewise, the next step produces: Then no more assignment can be generated, so that DPLL returns unsat, and can produce a resolution proof P .
If S is partitioned into A, B, since the lemmas involve only one variable and thus cannot be AB-mixed, then an interpolant can be computed from the Boolean resolution proof P and the LA(Q)-proofs P 1 , P 2 , P 3 in the standard way with Algorithm 2.2.
Thanks to the observation above, in order to be able to produce interpolants with splitting on-demand the only thing we need is to make sure that we do not generate lemmas containing AB-mixed terms.This is always the case for "normal" branch-and-bound lemmas (since they involve only one variable), but this is not true in general for "extended" branchand-bound lemmas generated from proofs of unsatisfiability using the "cuts from proofs" algorithm of [DDA09].The following example shows one such case.
Example 3.12.Let A and B be defined as When solving A ∧ B using extended branch and bound, we might generate the following AB-mixed lemma: Since we want to be able to reuse the Boolean interpolation algorithm also for splitting on-demand, we want to avoid generating AB-mixed lemmas.However, we would still like to exploit the cuts from proofs algorithm of [DDA09] as much as possible.We describe how we do this in the following.
3.3.2.Interpolation with the cuts from proofs algorithm.The core of the cuts from proofs algorithm is the identification of the defining constraints of the current solution of the rational relaxation of the input set of LA(Z) constraints.A defining constraint is an input constraint i c i v i + c ⊲⊳ 0 (where ⊲⊳ ∈ {≤, =}) such that i c i v i + c evaluates to zero under the current solution for the rational relaxation of the problem.After having identified the defining constraints D, the cuts from proofs algorithm checks the satisfiability of the system of Diophantine equations is unsatisfiable, then it is possible to generate a proof of unsatisfiability for it.The root of such proof is an equation i c ′ i v i + c ′ = 0 such that the GCD g of the c ′ i 's does not divide c ′ .From such equation, it is generated the extended branch and bound lemma: Example 3.13.Consider the following set of LA(Z)-constraints and its rational relaxation The set of defining constraints D for S, µ S is then: resulting in the following inconsistent system of Diophantine equations D E : The Diophantine equations handler generates −5v 1 + 5v 2 + 2 = 0 as proof of unsatisfiability for D E , resulting in the following branch-and-bound lemma: we can generate the above lemma also when computing interpolants.If i c ′ i g v i is AB-mixed, instead, we generate a different lemma, still exploiting the unsatisfiability of (the equations corresponding to) the defining constraints.Since D E is unsatisfiable, we know that the current rational solution µ is not compatible with the current set of defining constraints.If the defining constraints were all equations, the submodule for handling Diophantine equations would have detected the conflict.Therefore, there is at least one defining constraint i ci v i + c ≤ 0. Our idea is that of splitting this constraint into ( i ci v i + c + 1 ≤ 0) and ( i ci v i + c = 0), by generating the lemma In this way, we are either "moving away" from the current bad rational solution µ (when ( i ci v i + c + 1 ≤ 0) is set to true), or we are forcing one more element of the set of defining constraints to be an equation (when ( i ci v i + c = 0) is set to true): if we repeat the splitting, then, eventually all the defining constraints for the bad solution µ will be equations, thus allowing the Diophantine equations handler to detect the conflict without the need of generating more branch-and-bound lemmas.Since the set of defining constraints is a subset of the input constraints, lemmas generated in this way will never be AB-mixed.
It should be mentioned that this procedure is very similar to the algorithm used in the recent work [KLR10] for avoiding the generation of AB-mixed cuts.However, the criterion used to select which inequality to split and how to split it is different (in [KLR10] such inequality is selected among those that are violated by the closest integer solution to the current rational solution).Moreover, we don't do this systematically, but rather only if the cuts from proofs algorithm is not able to generate a non-AB-mixed lemma by itself.In a sense, the approach of [KLR10] is "pessimistic" in that it systematically excludes certain kinds of cuts, whereas our approach is more "optimistic".

3.3.3.
Interpolation for the internal branch-and-bound module.From the point of view of interpolation the subdivision of the branch-and-bound module in an "internal" and an "external" part poses no difficulty.The only difference between the two is that in the former the case splits are performed by the LA(Z)-solver instead of DPLL.However, we can still treat such case splits as if they were performed by DPLL, build a Boolean resolution proof for the LA(Z)-conflicts discovered by the internal branch-and-bound procedure, and then apply the propositional interpolation algorithm as in the case of splitting on-demand.
More specifically, a branch-and-bound proof is a tree in which the leaves are LA(Q)proofs of unsatisfiability, the root is a LA(Z)-conflict set, and each internal node has two children that are labeled with two "complementary" atoms (v −n ≤ 0) and (−v +n+1 ≤ 0).From a branch-and-bound proof, a resolution proof for the LA(Z)-lemma corresponding to the root LA(Z)-conflict set can be generated by replacing each leaf LA(Q)-proof P with the corresponding LA(Q)-lemma C, and by introducing, for each internal node, a branchand-bound lemma (v − n ≤ 0) ∨ (−v + n + 1 ≤ 0) and two resolution steps, according to the following pattern: The following example shows how this is done.
Example 3.14.Consider the same set of S as in Example 3.11, partitioned as follows: A branch-and-bound proof P that shows the unsatisfiability of A∧ B is the following:6 A corresponding resolution proof, is then: large) sets of inequalities and equalities.Moreover, we replace the Strengthen rule with the equivalent Division rule: Division: where: all the a i 's, c j 's and b k 's As before, if we ignore the presence of annotations, the rules Hyp-A, Hyp-B, Comb and Division form a complete proof systems for LA(Z) [Sch86].Notice also that all the rules Hyp-A, Hyp-B, Comb and Division preserve the following invariant: the coefficients a i of the A-local variables are always the same for the implied inequality and its annotation.This makes the Division rule always applicable.Therefore, the above rules can be used to annotate any cutting-plane proof.In particular, this means that our new technique can be applied also to proofs generated by other LA(Z) techniques used in modern SMT solvers, such as those based on Gomory cuts or on the Omega test [Pug91].
Theorem 4.3.All the interpolating rules preserve the validity of the sequents.
Proof.The theorem can be easily proved for Hyp-A, Hyp-B and Comb.Therefore, here we focus only on Division.
(1) By hypothesis, A |= i a i x i + j c ′ j y j + c ′ ≤ 0. Since d > 0, we have that From the definition of ceiling, therefore Since d divides the a i 's by hypothesis, i a i x i d is an integer, and since ⌈n + x⌉ ≡ n + ⌈x⌉ if n is an integer, we have that (2) By hypothesis, B |= ( By observing that ⌈x − y⌉ ≥ ⌈x⌉ − ⌈y⌉, we have: By observing that ⌈n + x⌉ ≡ n + ⌈x⌉ when n is an integer, we have finally: (3) Follows directly from the hypothesis.The following is an annotated cutting-plane proof of unsatisfiability for A ∧ B: Using the ceiling function, we do not incur in any blowup of the size of the generated interpolant wrt. the size of the proof of unsatisfiability. 7In particular, by using the ceiling function we might produce interpolants which are up to exponentially smaller than those generated using modular equations.The intuition is that the use of the ceiling function in the annotation of the Division rule allows for expressing symbolically the case distinction that the Strengthen rule of §3.2 was expressing explicitly as a disjunction of modular equations.
Example 4.6.Consider again the parametric interpolation problem of Example 4.1: Using the ceiling function, we can generate the following annotated proof: The interpolant corresponding to such proof is then (2n y 1 2n − y 1 − n + 1 ≤ 0), whose size is linear in the size of the input.4.1.Solving and interpolating formulas with ceilings.Any SMT solver supporting LA(Z) can be easily extended to support formulas containing ceilings.In fact, we notice that we can eliminate ceiling functions from a formula ϕ with a simple preprocessing step as follows: (1) Replace every term ⌈t i ⌉ occurring in ϕ with a fresh integer variable Moreover, we remark that for using ceilings we must only be able to represent nonvariable terms with rational coefficients, but we don't need to extend our LA(Z)-solver to support Mixed Rational/Integer Linear Arithmetic.This is because, after the elimination of ceilings performed during preprocessing, we can multiply both sides of the introduced constraints (x ⌈t i ⌉ − 1 < t i ) and (t i ≤ x ⌈t i ⌉ ) by the least common multiple of the rational coefficients in t i , thus obtaining two LA(Z)-inequalities.
For interpolation, it is enough to preprocess A and B separately, so that the elimination of ceilings will not introduce variables common to A and B.

4.2.
Generating sequences of interpolants.One of the most important applications of interpolation in Formal Verification is abstraction refinement [HJMM04,McM06].In such setting, every input problem φ has the form φ def = φ 1 ∧ . . .∧ φ n , and the interpolating solver is asked to compute a sequence of interpolants I 1 , . . ., I n−1 corresponding to different partitions of φ into A i and B i , such that ∀i, A i def = φ 1 ∧ . . .∧ φ i , and B i def = φ i+1 ∧ . . .∧ φ n .Moreover, I 1 , . . ., I n−1 should be related by the following: As stated (without proof) in [HJMM04], a sufficient condition for (4.1) to hold is that all the I i 's are computed from the same proof of unsatisfiability for φ.In our previous work [CGS10] (Theorem 6.6, page 7:46), we have formally proved that such sufficient condition is valid for every SMT(T )-proof of unsatisfiability, independently of the background theory T .By observing that all the techniques that we have described in this article do not involve modifications/manipulations of the proofs of unsatisfiability, we can immediately conclude that this approach can be applied without modifications also in our context, for computing sequences of interpolants for LA(Z)-formulas using our interpolation algorithms.

Experimental evaluation
The techniques presented in previous sections have been implemented within the MathSAT 5 SMT solver [Gri12].In this section, we experimentally evaluate our approach.
5.1.Experiments on large SMT formulas.In the first part of our experimental analysis, we evaluate the performance of our techniques on relatively-large formulas taken from the set of benchmark instances in the QF LIA ("quantifier-free LA(Z)") category of the SMT-LIB.8More specifically, we have selected the subset of LA(Z)-unsatisfiable instances whose rational relaxation is (easily) satisfiable, so that LA(Z)-specific interpolation techniques are put under stress.In order to generate interpolation problems, we have split each of the collected instances in two parts A and B, by collecting about 40% and making sure that A contains some symbols not occurring in B (so that A is never a "trivial" interpolant).In total, our benchmark set consists of 513 instances.
We have run the experiments on a machine with a 2.6 GHz Intel Xeon processor, 16 GB of RAM and 6 MB of cache, running Debian GNU/Linux 5.0.We have used a time limit of 1200 seconds and a memory limit of 3 GB.For MathSAT, we use two configurations: MathSAT-modEq, which produces interpolants with modular equations using the Strengthen rule of §3, and MathSAT-ceil, which uses the ceiling function and the Division rule of §4.
Results on execution times for generating interpolants are reported in Fig. 3.Both MathSAT-modEq and MathSAT-ceil could successfully generate an interpolant for 478 of the 513 interpolation problems (timing out on the others), whereas iPrincess, Inter-polatingOpenSMT and SmtInterpol were able to successfully produce an interpolant in 62, 192 and 217 cases respectively.Therefore, MathSAT can solve more than twice as many instances as its closer competitor SmtInterpol, and in most cases with a significantly shorter execution time (Fig. 3).
For the subset of instances which could be solved by at least one other tool, therefore, the two configurations of MathSAT seem to perform equally well.The situation is the same also when we compare the sizes of the produced interpolants, measured in number of nodes in a DAG representation of formulas.Comparisons on interpolant size are reported in Fig. 4 which shows that, on average, the interpolants produced by MathSAT are comparable to those produced by other tools.In fact, there are some cases in which SmtInterpol produces significantly-smaller interpolants, but we remark that MathSAT can solve 261 more instances than SmtInterpol. 12The differences between MathSAT-modEq and MathSAT-ceil become evident when we compare the two configurations directly.The plots in Fig. 5(a) show that MathSATceil is dramatically superior to MathSAT-modEq, with gaps of up to two orders of magnitude in execution time, and up to four orders of magnitude in the size of interpolants.Such differences are solely due to the use of the ceiling function in the generated interpolants, which prevents the blow-up of the formula wrt. the size of the proof of unsatisfiability.Since most of the differences between the two configurations occur in benchmarks that none of the other tools could solve, the advantage of using ceilings was not visible in Figs. 3 and 4.
Finally, in Fig. 5(b) we compare the execution time of producing interpolants with MathSAT-ceil against the solving time of MathSAT with interpolation turned off.The plot shows that the restriction on the kind of extended branch-and-bound lemmas generated when computing interpolants (see §3.3) can have a significant impact on individual benchmarks.However, on average MathSAT-ceil is not worse than the "regular" Math-SAT, and the two can solve the same number of instances, in approximately the same total execution time.

Experiments on model checking problems.
In the second part of our experimental analysis, we evaluate the performance of MathSAT and all the other interpolant generators for LA(Z) described above ( §5.1.1)when used in an interpolation-based model checking context.In particular, we have implemented the original interpolation-based model 12 The plots of Fig. 4 show also some apparently-strange outliers in the comparison with Interpolatin-gOpenSMT.A closer analysis revealed that those are instances for which InterpolatingOpenSMT was able to detect that the inconsistency of A ∧ B was due solely to A or to B, and thus could produce a trivial interpolant ⊥ or ⊤, whereas the proof of unsatisfiability produced by MathSAT involved both A and B. An analogous situation is visible also in the comparison between MathSAT and SmtInterpol, this time in favor of MathSAT.
The results are reported in Table 1.They clearly show that both MathSAT-ceil and MathSAT-modEq outperform the other tools also when applied in a model checking context.Moreover, it is interesting to observe the following: • for these particular benchmarks, MathSAT-modEq and MathSAT-ceil seem to be substantially equivalent: the only significant difference is in the num conversion 4 benchmark, in which MathSAT-ceil leads to a slightly faster convergence, requiring one interation less; • the equality elimination layer seems to be very important, and disabling it leads to a dramatic decrease in performance; • somewhat surprisingly, the decrease in performance due to the disabling of the equality elimination module can be mitigated by disabiling also the internal branch and bound module.We attribute this to the different "quality" of the interpolants generated, which seems to be somehow "better" for MathSAT-noEq-noBB than for MathSAT-noEQ.However, we remark that the notion of "quality" of interpolants is still vague and unclear, and in particular we are not aware of any satisfactory characterization of it in the literature.Investigating the issue more in depth could be part of interesting future work.

Related Work
The general algorithm for interpolation in SMT(T ) was given by McMillan in [McM05], together with algorithms for sets of literals in the theories EU F, LA(Q) and their combination.Algorithms for other theories and/or alternative approaches are presented in [RSS10, YM05, KW07, KMZ06, CGS10, JCG08, LT08, FGG + 09, GKT09, BKRW10, KLR10].In particular, [CGS10, FGG + 09, GKT09] explicitly focus on building efficient interpolation procedures on top of state-of-the-art SMT solvers.Efficient interpolation algorithms for the Difference Logic and Unit-Two-Variables-Per-Inequality fragments of LA(Z) are given in [CGS10].Some preliminary work on interpolation on the theory of fixed-width bit-vectors is presented in [KW07,Gri11].As regards interpolation in the full LA(Z), McMillan showed in [McM05] that it is in general not possible to obtain quantifier-free interpolants (starting from a quantifier-free input) in the standard signature of LA(Z) (consisting of Boolean connectives, integer constants and the symbols +, •, ≤, =).By extending the signature to contain modular equalities (or, equivalently, divisibility predicates) it is possible to compute quantifier-free LA(Z) interpolants by means of quantifier elimination, which is however prohibitively expensive in general, both in theory and in practice.Using modular equalities, Jain et al. [JCG08] developed polynomial-time interpolation algorithms for linear equations and disequations and for linear modular equations.A similar algorithm was also proposed in [LT08].The work in [BKRW10] was the first to present an interpolation algorithm for the full LA(Z) (augmented with divisibility predicates) not based on quantifier elimination.Finally, an alternative algorithm, exploiting efficient interpolation procedures for LA(Q) and for linear equations in LA(Z), has been recently presented in [KLR10].

Conclusions
In this article, we have presented a novel interpolation algorithm for LA(Z) that allows for producing interpolants from arbitrary cutting-plane proofs without the need of performing quantifier elimination.We have also shown how to exploit this algorithm, in combination with other existing techniques, in order to implement an efficient interpolation procedure on top of a state-of-the-art SMT(LA(Z))-solver, with almost no overhead in search, and with up to orders of magnitude improvements -both in execution time and in formula size -wrt.existing techniques for computing interpolants from arbitrary cutting-plane proofs.

Definition 2. 1 (
Resolution proof).Given a set of clauses S def = {C 1 , . . ., C n } and a clause C, we call a resolution proof of the deduction i C i |= T C a DAG P such that:

Figure 1 :
Figure 1: Resolution proof of unsatisfiability (a) and interpolant (b) for the pair (A, B) of formulas of Example 2.3.In the tree on the left, T -lemmas are displayed in boldface, and clauses from A are underlined.

Figure 1 Figure 2 :
Figure 1(b) shows, for each clause Θ i in the proof, the formula I Θ i generated by Algorithm 2.2.For the LA(Q)-lemma, it is easy to see that (−4y − 1 ≤ 0) is an interpolant for .2) where d > 0 divides all the c i 's.By definition, k = d c d − c and j < k.Therefore fact and (3.2) it follows that

(4. 3 )
Follows immediately from the hypothesis and the fact that variables not occurring in B are eliminated from equations.Corollary 3.7.If we can derive a valid sequent (A, B) ⊢ c ≤ 0[I] with c ∈ Z >0 , then

Figure 3 :
Figure 3: Comparison between MathSAT and the other LA(Z)-interpolating tools, execution time.

Figure 4 :
Figure 4: Comparison between MathSAT and the other LA(Z)-interpolating tools, interpolants size (measured in number of nodes in the DAG of the interpolant).(See also footnote 12.)