Abstract
In recent years, expansionbased techniques have been shown to be very powerful in theory and practice for solving quantified Boolean formulas (QBF), the extension of propositional formulas with existential and universal quantifiers over Boolean variables. Such approaches partially expand one type of variable (either existential or universal) for obtaining a propositional abstraction of the QBF. If this formula is false, the truth value of the QBF is decided, otherwise further refinement steps are necessary. Classically, expansionbased solvers process the given formula quantifierblock wise and use one SAT solver per quantifier block. In this paper, we present a novel algorithm for expansionbased QBF solving that deals with the whole quantifier prefix at once. Hence recursive applications of the expansion principle are avoided and only two incremental SAT solvers are required. While our algorithm is naturally based on the \(\forall \)Exp+Res calculus that is the formal foundation of expansionbased solving, it is conceptually simpler than present recursive approaches. Experiments indicate that the performance of our simple approach is comparable with the state of the art of QBF solving, especially in combination with other solving techniques.
Introduction
Efficient tools for deciding the satisfiability of Boolean formulas (SAT solvers) are the core technology in many verification and synthesis approaches [49]. However, verification and synthesis problems are often beyond the complexity class NP as captured by SAT, requiring more powerful formalisms like quantified Boolean formulas (QBFs) [7]. QBFs extend propositional formulas by universal and existential quantifiers over Boolean variables [34] resulting in a decision problem that is PSPACEcomplete. Applications from verification and synthesis [10, 15, 16, 20, 22, 26], realizability checking [21], bounded model checking [18, 52], and planning [19, 44] motivate the quest for efficient QBF solvers (see [45] for a survey).
Unlike for SAT, where conflictdriven clause learning (CDCL) is the single dominant solving approach for practical problems, two dominant approaches exist for QBF solving. On one hand, CDCL has been successfully extended to QCDCL that enables clause and cube learning [23, 37, 51]. On the other hand, variable expansion has become very popular. In short, expansionbased solvers eliminate one kind of variables by assigning them truth values and solve the resulting propositional formula with a SAT solver. For QBFs with one quantifier alternation (2QBF), a natural approach is to use two SAT solvers: one that deals with the existentially quantified variables and another one that deals with the universally quantified variables. For generalizing this SATbased approach to QBFs with an arbitrary number of quantifier alternations, expansion is recursively applied per quantifier block, requiring multiple SAT solvers realizing a counterexample guided extraction approach (CEGAR) [17]. As noted by Rabe and Tentrup [42], these CEGARbased approaches show poor performance for formulas with many quantifier alternations in general.
We also propose an approach that is guided by counterexamples, but that deals with quantifier alternations in a different manner than available CEGAR approaches. Inspired by CounterexampleGuided Inductive Synthesis (CEGIS), we present a novel solving algorithm based on nonrecursive expansion for QBFs with arbitrary quantifier prefixes using only two SAT solvers. In short, CEGIS is a generic framework initially devised in the context of syntaxguided synthesis [1]. It involves the interaction between two components:

The learner generates candidate solutions that are consistent with all currently found counterexamples or—if it does not find such a candidate solution—it has shown that the problem does not have a solution, i.e., it is unsatisfiable.

The verifier provides, given a candidate solution to a problem, a counterexample that disproves it, or it correctly proves that the candidate solution is indeed a valid solution.
We adopt the CEGIS paradigm for QBF solving as follows. Our approach instantiates all variables of the same kind (either the universal variables or the existential variables) at once with a candidate solution/counterexample and passes the resulting propositional abstraction of the QBF to a SAT solver. If the SAT solver finds the formula to be unsatisfiable, the truth value of the original QBF is decided, otherwise the model returned by the SAT solver is used as candidate solution/counter example for refining the propositional abstraction. In theory (i.e., from a proof complexity perspective), our approach of nonrecursive expansion is equivalent to approaches that apply recursive expansion since both nonrecursive and recursive expansion rely on the \(\forall \)Exp+Res proof system [6]. However, the nonrecursive expansion has practical implications such as a modified search strategy. That is, the use of recursive or nonrecursive expansion results in different search strategies for the proof. With respect to proof search, there is an analogy to, e.g., implementations of resolutionbased CDCL SAT solvers that employ different search heuristics.
In addition to the new algorithm, we also implemented a hybrid approach that combines clause learning with nonrecursive expansionbased solving for exploiting the power of QCDCL. Our experiments indicate that this hybrid approach performs very well, especially on formulas with multiple quantifier alternations.
This paper is structured as follows. After a review of related work in the next section, we introduce the necessary preliminaries in Sect. 3. After a short recapitulation of expansion in Sect. 4, our novel nonrecursive expansionbased algorithm is presented in Sect. 5. The relation between our solving approach and \(\forall \)Exp+Res is explained in Sect. 6. Implementation details are discussed in Sect. 7 together with a short discussion of the hybrid approach. In Sect. 8 we compare our approach to stateoftheart solvers.
This paper is an extended version of [9]. Besides a careful revision of the text, it contains more examples and illustrations, as well as an additional chapter relating our new solving approach to the \(\forall \)Exp+Res proof system. Furthermore, we added comprehensive experiments on the benchmark set used in QBFEval 2018.
Related work
Already the early QBF solvers Qubos [3] and Quantor [3] incorporate selective quantifier expansion for eliminating one kind of quantification to reduce the given QBF to a propositional formula. Qubos heuristically chooses which kind of quantifier to eliminate. If universal quantifiers are eliminated, subformulas of the form \(\forall x.\phi \) are replaced by \(\phi [x/\top ] \wedge \phi [x/\bot ]\). Dually, subformulas of the form \(\exists x.\phi \) are replaced by \(\phi [x/\top ] \vee \phi [x/\bot ]\). For handling the blowup, Qubos implements several simplification techniques. Qubos does not require the input QBF to be in prenex conjunctive normal form (PCNF), but it is able to process formulas of arbitrary structure. Even more, the expansion of existential variables destroys any PCNF structure. Quantor, in contrast, preserves the PCNF structure by expanding universal variables only. In both cases, the resulting propositional formula is then solved by calling a SAT solver once. Over 15 years ago, Qubos and Quantor impressively demonstrated the power of expanding universal variables but also showed its enormous memory consumption. As a pragmatic compromise, bounded universal expansion was introduced for efficient preprocessing [13, 24, 25, 50].
The first approach which uses two alternating SAT solvers A and B for solving 2QBF, i.e., QBFs of the form \(\forall U \exists E.\phi \), was presented in [43]. Solver A is initialized with \(\phi \), B with the empty formula. Both propositional formulas are incrementally refined with satisfying assignments found by the other solver. If A finds its formula unsatisfiable, then the QBF is false. Otherwise, the negation of the universal part of the satisfying assignment is passed to solver B. If solver B finds its formula unsatisfiable, then the QBF is true. Otherwise, the existential part of the satisfying assignment is passed to solver A. Janota and MarquesSilva generalized the idea of alternating SAT solvers [33] such that one solver deals with the existentially quantified variables and one solver deals with the universally quantified variables exclusively. Solver A gets instantiations of \(\phi \) in which the universal variables are assigned, and solver B gets instantiations of \(\lnot \phi \) in which the existential variables are assigned. The satisfying assignment found by one solver is used to obtain a new instantiation for the other. This loop is repeated until one solver returns unsatisfiable. This approach realizes a natural application of the counterexample guided abstraction refinement (CEGAR) paradigm [17]. A detailed survey on 2QBF solving is given in [4].
A significant advancement of expansionbased solving for QBF with an arbitrary number of quantifier alternations was made with the solver RAReQS [28, 29], which recursively applies the previously discussed 2QBF approach [33] for each quantifier alternation. The approach turned out to be highly competitive.^{Footnote 1} For formalizing this solving approach the calculus \(\forall \)Exp+Res was introduced [6], and prooftheoretical investigations revealed the orthogonal strength of \(\forall \)Exp+Res and Qresolution [35], the QBF variant of the resolution calculus that forms the basis for QCDCLbased solvers. Research on the proof complexity of QBF has identified an exponential separation between Qresolution and the \(\forall \)Exp+Res system. There are families of QBFs for which any Qresolution proof has exponential size, in contrast to \(\forall \)Exp+Res proofs of polynomial size, and vice versa. Hence these two systems have orthogonal strength.
Recent work successfully combines machine learning with this CEGAR approach [27]. Motivated by the success of expansionbased QBF solving, several other approaches [12, 32, 42, 46,47,48] have been presented that are based on levelised SAT solving, i.e., one SAT solver is responsible for the variables of one quantifier block. In this paper, we also introduce a solving approach that is based upon propositional abstraction but considers the whole quantifier prefix at once.
Preliminaries
The QBFs considered in this paper are in prenex normal form \(\varPi .\phi \) where \(\varPi \) is a quantifier prefix \(Q_1x_1Q_2x_2\ldots Q_nx_n\) over the set of variables \(X = \{x_1,\ldots ,x_n\}\) with \(Q_i \in \{\forall , \exists \}\) and \(x_i \ne x_j\) for \(i \ne j\). The propositional formula \(\phi \) contains only variables from X. Unless stated otherwise, we do not make any assumptions on the structure of \(\phi \). Sometimes \(\varPi .\phi \) is in prenex conjunctive normal form (PCNF), i.e., \(\varPi \) is a prefix as introduced before and \(\phi \) is a conjunction of clauses. A clause is a disjunction of literals, and a literal is a variable or the negation of a variable. The prefix imposes the order \(<_\varPi \) on the elements of X such that \(x_i <_\varPi x_j\) if \(i < j\). By \(U_\varPi \) (\(E_\varPi \)) we denote the set of universally (existentially) quantified variables of the prefix \(\varPi \). If clear from the context we omit the subscript \(\varPi \). We assume the standard semantics of QBF. A QBF consisting of only the syntactic truth constant \(\bot \) (\(\top \)) is false (true). A QBF \(\forall x\varPi .\phi \) is true if \(\varPi .\phi [x \leftarrow \top ]\) and \(\varPi .\phi [x \leftarrow \bot ]\) are both true, where \(\phi [x \leftarrow t]\) is the substitution of each occurrence of x by t in \(\phi \). A QBF \(\exists x\varPi .\phi \) is true if \(\varPi .\phi [x \leftarrow \top ]\) or \(\varPi .\phi [x \leftarrow \bot ]\) is true.
Given a set X of variables, we call a total function \(\sigma :X \rightarrow \{\top ,\bot ,\epsilon \}\) an assignment for X. If there is an \(x\in X\) with \(\sigma (x) = \epsilon \) then \(\sigma \) is a partial assignment, otherwise \(\sigma \) is a full assignment of X. Informally, \(\sigma (x) = \epsilon \) means that \(\sigma \) does not assign a truth value to variable x. A restriction \(\sigma _Y:Y\rightarrow \{\top ,\bot ,\epsilon \}\) of assignment \(\sigma :X \rightarrow \{\top ,\bot ,\epsilon \}\) to \(Y \subseteq X\) is defined by \(\sigma _Y(x) = \sigma (x)\) if \(x \in Y\), otherwise \(\sigma _Y(x) = \epsilon \). By \(\varSigma _X\) we denote the set of all full assignments \(\sigma :X\rightarrow \{\top ,\bot \}\). Let \(\phi \) be a propositional formula over X. By \(\sigma (\phi )\) we denote the application of assignment \(\sigma :X \rightarrow \{\top ,\bot ,\epsilon \}\) on \(\phi \), i.e., \(\sigma (\phi )\) is the formula obtained by replacing variables \(x \in X\) by \(\sigma (x)\) if \(\sigma (x) \in \{\top ,\bot \}\) and performing standard propositional simplifications. Let \(\phi , \psi \) be propositional formulas over the set of variables X. If for every full assignment \(\sigma \in \varSigma _X\), \(\sigma (\phi ) = \sigma (\psi )\) then \(\phi \) and \(\psi \) are equivalent. Let \(\tau :X\rightarrow \{\top ,\bot ,\epsilon \}\) and \(\sigma :Y\rightarrow \{\top ,\bot ,\epsilon \}\) be assignments such that for every \(x \in X \cap Y\), \(\tau (x) = \sigma (x)\) if \(\tau (x) \not = \epsilon \) and \(\sigma (x) \not = \epsilon \). Then the composite assignment of \(\sigma \) and \(\tau \) is denoted by \(\sigma \tau :X\cup Y \rightarrow \{\top ,\bot ,\epsilon \}\) and for every propositional formula \(\phi \) over \(X \cup Y\), it holds that \(\sigma \tau (\phi ) = \tau \sigma (\phi ) = \sigma (\tau (\phi )) = \tau (\sigma (\phi ))\). Furthermore, we use the equality \(\sigma \sigma = \sigma \) for any assignment \(\sigma \).
Example 1
Let \(\sigma :X\rightarrow \{\top ,\bot ,\epsilon \}\) be an assignment over variables \(\{a, b, x, y\}\) defined by \(\sigma (a) = \top \), \(\sigma (b) = \epsilon \), \(\sigma (x) = \top \), and \(\sigma (y) = \epsilon \). The restriction \(\tau = \sigma _Y\) of \(\sigma \) to \(Y = \{x, y\}\) is given by \(\tau (a) = \epsilon \), \(\tau (b) = \epsilon \), \(\tau (x) = \top \), \(\tau (y) = \epsilon \). For the propositional formula \(\phi = (x \vee a \vee y) \wedge (\lnot x \vee \lnot a \vee y) \wedge (\lnot y \vee b)\), the application of \(\sigma \) and \(\tau \) on \(\phi \) gives us \(\sigma (\phi ) = y \wedge (\lnot y \vee b)\) and \(\tau (\phi ) = (\lnot a \vee y) \wedge (\lnot y \vee b)\).
Expansion
In the following, we introduce the notation and terminology used for describing expansionbased QBF solving in general, and the algorithm introduced in the next section in particular. We first define the notion of instantiation that is inspired by the axiom rule of the calculus \(\forall \)Exp+Res [31] which is introduced in Sect. 6.
Definition 1
Let \(\varPi .\phi \) be a QBF with prefix \(\varPi = Q_1x_1\ldots Q_nx_n\) over the set of variables \(X = \{x_1,\ldots ,x_n\}\) and \(\sigma :Y \rightarrow \{\top ,\bot ,\epsilon \}\) with \(Y \subseteq X\) an assignment. If \(Y \subset X\), we extend the domain of \(\sigma \) to X by setting \(\sigma (x) = \epsilon \) if \(x \in X\) but \(x \not \in Y\). The instantiation of \(\phi \) by \(\sigma \), denoted by \(\phi ^\sigma \), is obtained from \(\phi \) as follows:

1.
All variables \(x \in X\) with \(\sigma (x) \ne \epsilon \) are set to \(\sigma (x)\);

2.
All variables \(x \in X\) with \(\sigma (x) = \epsilon \) are replaced by \(x^\omega \) where annotation \(\omega \) is uniquely defined by the sequence \(\sigma (x_{k_1})\sigma (x_{k_2})\ldots \sigma (x_{k_m})\) such that the set formed from the variables \(x_{k_i}\) contains all variables of X with \(x_{k_i} <_\varPi x\) and \(\sigma (x_{k_i}) \ne \epsilon \). Furthermore, \(x_{k_i} <_\varPi x_{k_j}\) if \(k_i < k_j\);

3.
All truth constants occurring in the formula (not in the annotations) are eliminated by standard simplification rules.
If we instantiate a QBF \(\varPi .\phi \) with the full assignment \(\sigma :U_\varPi \rightarrow \{\top , \bot \}\) of the universal variables, we obtain a propositional formula that contains only (possibly annotated) variables from \(E_\varPi \). The dual holds for the instantiation by a full assignment \(\sigma :E_\varPi \rightarrow \{\top , \bot \}\) of the existential variables.
Example 2
Given the QBF \(\forall a \exists x \forall b \exists y .\phi \) with \(\phi = ( (x \vee a \vee y) \wedge (\lnot x \vee \lnot a \vee y) \wedge (\lnot y \vee b))\). Then \( U = \{a, b\}\) and \(E = \{x, y\}\). Let \(\sigma :U\rightarrow \{\top ,\bot ,\epsilon \}\) be defined by \(\sigma (a) = \top \) and \(\sigma (b) = \bot \). Then \(\phi ^\sigma = (\lnot x^{\top } \vee y^{\top \bot }) \wedge \lnot y^{\top \bot }\). Further, let \(\tau :E\rightarrow \{\top ,\bot ,\epsilon \}\) with \(\tau (x) = \bot \) and \(\tau (y) = \bot \). Then \(\phi ^\tau = a\). Note that a is not annotated because it occurs in the first quantifier block.
Sometimes we want to remove the annotations from an assignment or an instantiated formula. Therefore, we introduce the following notation. Let \(\phi ^\sigma \) be an instantiation by assignment \(\sigma :X\rightarrow \{\top ,\bot ,\epsilon \}\) and \(X^\sigma \) the set of annotated variables. If we have an assignment \(\tau :X^\sigma \rightarrow \{\top ,\bot , \epsilon \}\), then we define \(\tau ^{\sigma }:X\rightarrow \{\top ,\bot ,\epsilon \}\) by \(\tau ^{\sigma }(x) = \tau (x^\sigma )\) for \(x^\sigma \in X^\sigma \). If we have an instantiated formula \(\phi ^\sigma \), then \((\phi ^\sigma )^{\sigma }\) is the formula obtained by replacing every annotated variable \(x^\sigma \in X^\sigma \) by x. In general, \((\phi ^\sigma )^{\sigma } \ne \phi \).
Example 3
Reconsider the propositional formula \(\phi \) and assignments \(\sigma , \tau \) from Example 2 above. Then \((\phi ^\sigma )^{\sigma } = ((\lnot x^{\top } \vee y^{\top \bot }) \wedge \lnot y^{\top \bot })^{\sigma } = (\lnot x \vee y) \wedge \lnot y\). Furthermore, \((\phi ^\tau )^{\tau } = (a)^{\tau } = a\).
Lemma 1
Let \(\varPi .\phi \) be a QBF with variables X and \(\sigma :X\rightarrow \{\top ,\bot ,\epsilon \}\) be a partial assignment. Then \((\phi ^\sigma )^{\sigma }\) and \(\sigma (\phi )\) are equivalent.
Proof
By induction over the formula structure. For the base case let \(\phi = x\) with \(x \in X\). If \(\sigma (x) = \epsilon \), then \(\sigma (\phi ) = x\), \(\phi ^\sigma = x^\omega \), and \((\phi ^\sigma )^{\sigma } = x\). Otherwise, \(\phi ^\sigma = \sigma (x)\). Obviously, \(\sigma (\phi ) = \sigma (x) = (\sigma (x))^{\sigma } \in \{\top ,\bot \}\). The induction step naturally follows from the semantics of the logical connectives. \(\square \)
Finally, we specify the semantics of a QBF in terms of universal and existential expansion on which expansionbased QBF solving is founded.
Lemma 2
Let \(\varPhi = \varPi .\phi \) be a QBF with universal variables U. There is a set of assignments \(A \subseteq \varSigma _U\) with \(\bigwedge _{\alpha \in A}\phi ^\alpha \) is unsatisfiable if and only if \(\varPhi \) is false.
The lemma above has a dual version for true QBFs. This duality plays a prominent role in our novel solving algorithm.
Lemma 3
Let \(\varPhi = \varPi .\phi \) be a QBF with existential variables E. There is a set of assignments \(S \subseteq \varSigma _E\) with \(\bigvee _{\sigma \in S}\phi ^\sigma \) is valid if and only if \(\varPhi \) is true.
A nonrecursive algorithm for expansionbased QBF solving
The pseudocode in Fig. 1 summarizes the basic idea of our novel approach for solving the QBF \(\varPi .\phi \) with universal variables U and existential variables E.
First, an arbitrary assignment \(\alpha _0\) for the universal variables is selected in Line 1. The instantiation \(\phi ^{\alpha _0}\) is handed over to a SAT solver. If \(\phi ^{\alpha _0}\) is unsatisfiable, then \(\varPi .\phi \) is false and the algorithm returns. Otherwise, \(\tau :E^{\alpha _0}\rightarrow \{\top ,\bot \}\) is a satisfying assignment of \(\phi ^{\alpha _0}\). Let \(\sigma _1\) denote the assignment \(\tau ^{{\alpha _0}}\). Then \({\alpha _0}\sigma _1\) is a satisfying assignment of \(\phi \).
Next, the propositional formula \(\lnot \phi ^{\sigma _1}\) is handed over to a SAT solver for checking the validity of \(\phi ^{\sigma _1}\). If \(\lnot \phi ^{\sigma _1}\) is unsatisfiable, then \(\varPi .\phi \) is true and the algorithm returns. If \(\lnot \phi ^{\sigma _1}\) is satisfiable, then \(\rho :U^{\sigma _1}\rightarrow \{\top ,\bot \}\) is a satisfying assignment of \(\lnot \phi ^{\sigma _1}\). Let \(\alpha _1\) denote the assignment \(\rho ^{\sigma _1}\). Then \(\alpha _1\sigma _1\) is a satisfying assignment for \(\lnot \phi \). The following lemma shows that \(\alpha _0\) and \(\alpha _1\) are different.
Lemma 4
Let \(\varPi .\phi \) be a QBF with universal variables U and existential variables E. Further, let \(\alpha :U\rightarrow \{\top ,\bot \}\) be an assignment such that the instantiation \(\phi ^\alpha \) is satisfiable and has the satisfying assignment \(\tau :E^\alpha \rightarrow \{\top ,\bot \}\). Let \(\sigma :E \rightarrow \{\top ,\bot \}\) with \(\sigma = \tau ^{\alpha }\). Then \(\alpha \) falsifies \((\lnot \phi ^\sigma )^{\sigma }\).
Proof
Since \(\phi ^\alpha \) is satisfied by \(\tau \), \(\phi \) is satisfied by the composite assignment \(\alpha \tau ^{\alpha } = \alpha \sigma \), and therefore \(\lnot \phi \) is falsified by \(\alpha \sigma \). Then \(\alpha \) falsifies \(\sigma (\lnot \phi )\). According to Lemma 1\(\sigma (\lnot \phi )\) is equivalent to \((\lnot \phi ^\sigma )^{\sigma }\). Then \(\alpha \) also falsifies \((\lnot \phi ^\sigma )^{\sigma }\). \(\square \)
In the next round of the algorithm, the propositional formula \(\phi ^{\alpha _0} \wedge \phi ^{\alpha _1}\) is handed over to a SAT solver. If this formula is unsatisfiable, \(\varPi .\phi \) is false and the algorithm returns. Otherwise, it is satisfiable under some assignment \(\tau :E^{\alpha _0} \cup E^{\alpha _1} \rightarrow \{\top ,\bot \}\), then at least one new assignment \(\sigma _2:E\rightarrow \{\top ,\bot \}\) with \(\sigma _2 \ne \sigma _1\) can be extracted from \(\tau _{E^{\alpha _i}}\) with \(0 \le i \le 1\). This assignment is then used for obtaining a new propositional formula \(\phi ^{\sigma _1} \vee \phi ^{\sigma _2}\). To show the validity of this formula, its negation is passed to a SAT solver. If this formula is unsatisfiable, \(\varPi .\phi \) is true and the algorithm returns. Otherwise, it is satisfiable under the assignment \(\rho :U^{\sigma _1} \cup U^{\sigma _2} \rightarrow \{\top ,\bot \}\). A new assignment \(\alpha _2:U \rightarrow \{\top , \bot \}\) with \(\alpha _2 \ne \alpha _1 \ne \alpha _0\) is obtained from \(\rho _{A^{\sigma _i}}\) with \(1 \le i \le 2\). This assignment is then used in the next round of the algorithm. In this way, the propositional formulas \(\bigwedge _{\alpha \in \varSigma _U}\phi ^\alpha \) and \(\bigvee _{\sigma \in \varSigma _E}\phi ^\sigma \) are generated. If \(\bigwedge _{\alpha \in A}\phi ^\alpha \) is unsatisfiable for some \(A \subseteq \varSigma _U\), by Lemma 2\(\varPi .\phi \) is false. Dually, if \(\bigvee _{\sigma \in S}\phi ^\sigma \) is valid for some \(S \subseteq \varSigma _E\), by Lemma 3\(\varPi .\phi \) is true. The algorithm iteratively extends the sets A and S by adding parts of satisfying assignments of \(\phi \) to S and parts of falsifying assignments to A. In particular, A is extended by assignments of the universal variables and S is extended by assignments of the existential variables. The order in which assignments are considered depends on the used SAT solver.
Example 4
We show how to solve the QBF \(\forall a\exists x\forall b \exists y.\phi \) with \(E=\{x,y\}\), \(U=\{a,b\}\), and \(\phi = ((a \vee x \vee y) \wedge (\lnot a \vee \lnot x \vee y) \wedge (b \vee \lnot y))\) with the algorithm presented above. This formula can be solved in two iterations:
Init: We start with some random assignment \(\alpha _0:U \rightarrow \{\top ,\bot \}\), for example with \(\alpha _0(a) = \top \) and \(\alpha _0(b) = \bot \).
Iteration 1: The formula \(\phi ^{\alpha _0} = (\lnot x^\top \vee y^{\top \bot }) \wedge \lnot y^{\top \bot }\) is passed to a SAT solver and found satisfiable under the assignment \(\tau :E^{\alpha _0}\rightarrow \{\top ,\bot \}\) with \(\tau (x^\top ) = \bot \) and \(\tau (y^{\top \bot }) = \bot \). By removing the variable annotations we get assignment \(\sigma _1 = (\tau _{E^{\alpha _0}})^{\alpha _0}\), where \(\sigma _1:E\rightarrow \{\top ,\bot \}\) with \(\sigma _1(x) = \bot \) and \(\sigma _1(y) = \bot \). Based on this assignment we obtain \(\phi ^{\sigma _1} = a\). The formula \(\lnot \phi ^{\sigma _1}\) is passed to a SAT solver. It is satisfiable and has the satisfying assignment \(\rho :U^{\sigma _1}\rightarrow \{\top ,\bot \}\) with \(\rho (a) = \bot \) and \(\rho (b^\bot ) = \top \), which we then reduce to \(\alpha _1 = (\rho _{U^{\sigma _1}})^{\sigma _1}\) where \(\alpha _1:U\rightarrow \{\top ,\bot \}\) with \(\alpha _1(a) = \bot \) and \(\alpha _1(b) = \top \).
Iteration 2: The formula \(\phi ^{\alpha _0} \wedge \phi ^{\alpha _1} = (\lnot x^\top \vee y^{\top \bot }) \wedge \lnot y^{\top \bot } \wedge (x^\bot \vee y^{\bot \top }) \) is passed to a SAT solver in the second iteration. It is satisfiable and one satisfying assignment is \(\tau :E^{\alpha _0} \cup E^{\alpha _1} \rightarrow \{\top ,\bot \}\) with \(\tau (x^\top ) = \bot , \tau (x^\bot ) = \top , \tau (y^{\top \bot }) = \bot , \tau (y^{\bot \top }) = \bot \). From \(\tau \), we can extract the assignment \(\sigma _2 = (\tau _{E^{\alpha _1}})^{\alpha _1}\) where \(\sigma _2:E\rightarrow \{\top ,\bot \}\) with \(\sigma _2(x) = \top \) and \(\sigma _2(y) = \bot \). Note that for any choice of \(\tau \), \(\sigma _2 \ne \sigma _1\). Next, we construct \(\phi ^{\sigma _1} \vee \phi ^{\sigma _2} = a \vee \lnot a\). This formula is a tautology, so its negation that is passed to a SAT solver is unsatisfiable, hence \(\varPi .\phi \) is true.
The soundness of our algorithm immediately follows from Lemmas 2 and 3 : the algorithm returns false (true) if, in some iteration i, it finds that the current partial expansion \(\bigwedge _{\alpha \in A_{i1}}\phi ^\alpha \) (respectively \(\bigwedge _{\sigma \in S_i}\lnot \phi ^\sigma \)) is unsatisfiable.
Theorem 1
The algorithm shown in Fig. 1 is sound.
For showing that the algorithm also terminates, we argue that sets \(A_i\) and \(S_i\) increase in iteration \(i+1\). To this end, we have to relate the variables of the QBF, the annotated variables as well as their assignments. Before we give the proof, we first consider another example in which we illustrate how the different assignments are related.
Example 5
We show one possible run of the algorithm presented above for the QBF \(\varPhi := \forall a\exists x\forall b \exists y.\phi \) with
and how it iteratively generates the sets \(\varSigma _U\) and \(\varSigma _E\). Figure 2 shows the expansion trees that are implicitly built during the search. An expansion tree relates the variables of the partial expansion of \(\varPhi \) constructed from \(A_i\) (left column) and \(S_i\) (right column). Solid edges indicate that the variable on the top has been set by an assignment from \(A_i\) or \(S_i\), and dotted edges indicate that the variable has to be assigned a value by the SAT solver. The order of the (annotated) variables in the expansion tree respects the order of the (original) variables in the prefix.
Init: For the initialization of \(A_0\), an arbitrary assignment \(\alpha _0:U \rightarrow \{\top ,\bot \}\) is chosen. Let \(\alpha _0(a) = \bot \) and \(\alpha _0(b) = \bot \).
Iteration 1: \(\phi ^{\alpha _0} := x^\bot \wedge \lnot y^{\bot \bot }\) is satisfiable. Assignment \(\sigma _1:E \rightarrow \{\top ,\bot \}\), with \(\sigma _1(x) = \top \) and \(\sigma _1(y) = \bot \), is extracted from model \(\tau :E^{\alpha _1} \rightarrow \{\top ,\bot \}\) and added to \(S_1\). Now \(\phi ^{\sigma _1} := \lnot a \wedge \lnot b^{\top }\) is checked for validity. Assignment \(\alpha _1:U \rightarrow \{\top , \bot \}\), with \(\alpha _1(a) = \bot \) and \(\alpha _1(b) = \top \), obtained from counterexample \(\rho :U^{\sigma _1} \rightarrow \{ \top ,\bot \} \) is added to \(A_1\).
Iteration 2: Next, \(\phi ^{\alpha _0} \wedge \phi ^{\alpha _1}\) with \(\phi ^{\alpha _1} := x^\bot \wedge y^{\bot \top }\) is checked. From model \(\tau :E^{\alpha _0} \cup E^{\alpha _1} \rightarrow \{\top ,\bot \}\), again \(\sigma _1\) can be extracted for \(\phi ^{\alpha _0}\). For \(\phi ^{\alpha _1}\) a new assignment \(\sigma _2\) which is not in \(S_1\) is found and added to \(S_2\). In particular, we get \(\sigma _2:E \rightarrow \{\top ,\bot \}\) with \(\sigma _2(x) = \top \) and \(\sigma _2(y) = \top \). When the validity of \(\phi ^{\sigma _1} \vee \phi ^{\sigma _2}\) with \( \phi ^{\sigma _2} := \lnot a \wedge b^{\top }\) is checked, we get a counterexample \(\rho :U^{\sigma _1} \cup U^{\sigma _2} \rightarrow \{\top ,\bot \}\), from which \(\alpha _2 :U \rightarrow \{\top ,\bot \}\), with \(\alpha _2(a) = \top \) and \(\alpha _2(b) = \top \), can be extracted. Assignment \(\alpha _2\) is added to \(A_2\) leading to a new path in the left expansion tree (Iteration 3 in Fig. 2).
Iteration 3: Next, \(\phi ^{\alpha _0} \wedge \phi ^{\alpha _1} \wedge \phi ^{\alpha _2}\) with \( \phi ^{\alpha _2} := \lnot x^\top \wedge \lnot y^{\top \top }\) is checked. From model \(\tau :E^{\alpha _0} \cup E^{\alpha _1} \cup E^{\alpha _2} \rightarrow \{\top ,\bot \}\), \(\sigma _3 :E \rightarrow \{\top ,\bot \}\) is extracted, satisfying \(\phi ^{\alpha _2}\). This assignment is different from both \(\sigma _1\) and \(\sigma _2\): \(\sigma _3(x) = \bot \) and \(\sigma _3(y) = \bot \). This again results in a new branch of the expansion tree (see left expansion tree of Iteration 4 in Fig. 2). The resulting formula \(\phi ^{\sigma _1} \vee \phi ^{\sigma _2} \vee \phi ^{\sigma _3}\) with \(\phi ^{\sigma _3} := a \wedge b^\bot \) is not valid, and from the counterexample \(\rho :U^{\sigma _1} \cup U^{\sigma _2} \cup U^{\sigma _3} \rightarrow \{\top , \bot \}\) we get \(\alpha _3 :U \rightarrow \{\top ,\bot \}\) with \(\alpha _3(a) = \top \) and \(\alpha _3(b) = \bot \).
Iteration 4: Finally, the full expansion \(\phi ^{\alpha _0} \wedge \phi ^{\alpha _1} \wedge \phi ^{\alpha _2} \wedge \phi ^{\alpha _3}\) with \(\phi ^{\alpha _3} := \bot \) is not satisfiable, meaning that the original formula \(\forall a\exists x\forall b \exists y.\phi \) is false.
In the example above we saw that new assignments are generated in each iteration because \(A_i\) and \(S_i\) build models and countermodels of \(\phi \). The following definition formalizes the relationship between \(A_i\) and \(S_i\).
Definition 2
Let \(\varPi .\phi \) be a QBF over universally quantified variables U and existentially quantified variables E. Further, let \(A \subseteq \{ \alpha \mid \alpha :U \mapsto \{\top , \bot \}\Delta \}\) and \(S \subseteq \{ \sigma \mid \sigma :E \mapsto \{\top , \bot \}\Delta \}\). If for every assignment \(\sigma \in S\), there exists an assignment \(\alpha \in A\) such that \(\alpha \sigma (\lnot \phi )\) is true, then we say that A completes S. If for every assignment \(\alpha \in A\), there exists an assignment \(\sigma \in S\) such that \(\alpha \sigma (\phi )\) is true, then we say that S completes A.
We now show that \(S_{i}\) completes \(A_{i1}\) and \(A_{i}\) completes \(S_{i}\) if the algorithm does not terminate in iteration i because of the unsatisfiability of the respective expansion.
Lemma 5
Let \(\varPi .\phi \) be a QBF over universally quantified variables U and existentially quantified variables E. Further, let \(A_{i1}\) and \(A_i\) with \(A_{i1} \subseteq A_i\) be two sets of full assignments to the universal variables and let \(S_{i}\) be a set of full assignments to the existential variables obtained by iteration i during an execution of the algorithm shown in Fig. 1.

(1)
If \(\bigwedge _{\alpha \in A_{i1}}\phi ^\alpha \) is satisfiable, then \(S_{i}\) completes \(A_{i1}\), i.e., for every \(\mu \in A_{i1}\), there is an assignment \(\nu \in S_i\) such that \(\mu \nu (\phi )\) is true.

(2)
If \(\bigwedge _{\sigma \in S_i}\lnot \phi ^\sigma \) is satisfiable, then \(A_i\) completes \(S_i\), i.e., for every \(\nu \in S_i\), there is an assignment \(\mu \in A_{i}\) such that \(\nu \mu (\lnot \phi )\) is true.
Proof
By contradiction. For (1), assume there is an assignment \(\mu \in A_{i1}\) such that there is no assignment \(\nu \in S_i\) with \(\mu \nu (\phi )\) is true. By assumption \(\bigwedge _{\alpha \in A_{i1}}\phi ^\alpha \) is satisfiable, so there is a satisfying assignment \(\tau \) with \(\tau _{E^{\mu }}(\phi ^{\mu })\) is true. Then also \(\mu (\tau _{E^{\mu }})^{\mu }(\phi )\) is true. But \((\tau _{E^{\mu }})^{\mu } \in S_i\). For (2), assume that there is an assignment \(\mu \in S_i\) such that there is no \(\nu \in A_i\) with \(\mu \nu (\lnot \phi )\) is true. The rest of the argument is similar as in (1). \(\square \)
Next, we show that the addition of new assignments \(A'\) to a set A of universal assignments forces a set S of existential assignments to increase if some completion criteria hold.
Lemma 6
Let \(\varPhi = \varPi .\phi \) be a QBF over universally quantified variables U and existentially quantified variables E. Further, let \(A \cup A'\) be a set of universal assignments such that \(A \cap A' = \emptyset \) and \(A' \not = \emptyset \). Let S be a set of existential assignments and assume that \(\bigwedge _{\sigma \in S}\lnot \phi ^\sigma \) has the satisfying assignment \(\rho \), \(A' \subseteq \{(\rho _{U^\sigma })^{\sigma } \mid \sigma \in S\}\).
If S completes A, and \(A \cup A'\) completes S, and \(\bigwedge _{\alpha \in A\cup A'}\phi ^\alpha \) evaluates to true under assignment \(\tau \), then there exists an assignment \(\nu \in \{(\tau _{E^\alpha })^{\alpha } \mid \alpha \in A \cup A'\}\) with \(\nu \not \in S\).
Proof
By induction over the number of variables in \(\varPi \).
Base Case. Assume that \(\varPhi \) has only one variable, i.e., \(\varPi = Qx\). Note that \(A' = 1\) because x is outermost in the prefix and \(A'\) is obtained from subassignments of \(\rho \). If \(Q = \forall \), then the elements of A are full assignments of \(\phi \), and S is either empty, or it contains the empty assignment \(\omega :\emptyset \mapsto \{\top , \bot \}\). Let \(A' = \{\mu \}\). If S is empty, so is A (because S has to complete A). If \(\tau \) is a satisfying assignment of \(\phi ^\mu \), then \(\nu = \tau = \omega \) is the empty assignment and \(\nu \not \in S\). Otherwise, \(\omega \in S\). If there is an assignment \(\alpha \in A\), then \(\phi ^\alpha \wedge \phi ^\mu \) is a full expansion of \(\varPhi \). If this full expansion is true, then \(\lnot \phi \) is unsatisfiable. Otherwise, \(\phi ^\alpha \wedge \phi ^\mu \) is unsatisfiable. In both cases, the necessary preconditions for the lemma are not fulfilled. If \(A = \emptyset \), then \(\mu \omega (\lnot \phi )\) is true. Then \(\phi ^\mu \) is unsatisfiable, again violating a precondition. If \(Q = \exists \), then \(\mu = \omega \) and \(A = \emptyset \). If \(S = \emptyset \) and \(\phi ^\omega = \phi \) has the satisfying assignment \(\tau \), then \(\nu = \tau \) and \(\nu \not \in S\). Otherwise, if there is an assignment \(\sigma \in S\), then \(\omega \sigma (\lnot \phi )\) is true, because \(A \cup \{\mu \} = \{\omega \}\) completes S. Hence, if assignment \(\tau \) satisfies \(\phi ^\mu \), then \(\nu = \tau \), so \(\nu \not \in S\).
Induction Step. Assume the lemma holds for QBFs with n variables. We show that it also holds for QBFs with \(n+1\) variables. Let \(\varPhi = Qx\varPi .\phi \) be a QBF over existential variables E and universal variables U with \(\varPi = Q_1x_1\ldots Q_nx_n\) and \(A \cup A'\) and S be as required (S completes A, \(A \cup A'\) completes S, \(\bigwedge _{\alpha \in A \cup A'}\phi ^\alpha \) has a satisfying assignment \(\tau \), and \(\bigwedge _{\sigma \in S}\lnot \phi ^\sigma \) has a satisfying assignment \(\rho \) from which \(A'\) is obtained).
If \(Q = \forall \), then all assignments \(\alpha \in A'\) assign the same value t to x, i.e., \(\alpha (x) = t\), because these assignments are extracted from assignment \(\rho \) and since x is the outermost variable of the prefix of \(\varPhi \), \(\rho (x) = t\). Further, let \(A^t = \{ \alpha \in A \mid \alpha (x) = t\}\). It is easy to argue that for \(\varPi .\phi [x \leftarrow t]\) together with the assignment sets \(A^t \cup A'\) and S the induction hypothesis applies, i.e., there is an assignment \(\nu \not \in S\) with \(\nu \in \{(\tau ' _{E^\alpha })^{\alpha } \mid \alpha \in A^t \cup A'\}\) where \(\tau '\) is the part of \(\tau \) that satisfies \(\bigwedge _{\alpha \in A^t \cup A'}(\phi [x \leftarrow t])^\alpha \). Obviously, \(\nu \in \{(\tau _{E^\alpha })^{\alpha } \mid \alpha \in A \cup A'\}\).
If \(Q = \exists \), assume that \(\tau (x) = t\). Let \(\{ \sigma \in S \mid \sigma (x) = t\} \subseteq S^t \subseteq S\), and let \(A^t \subseteq A\) such that the induction hypothesis applies to \(\varPi .\phi [x \leftarrow t]\), \(A^t \cup A'\), and \(S^t\). Let \(\tau ^t\) be those subassignments of \(\tau \) that satisfy \(\bigwedge _{\alpha \in A^t}\phi ^\alpha \). Then there is an assignment \(\nu \) that can be extracted from \(\tau ^t\) with \(\nu \not \in S^t\). Since \(\nu (x) = t\), \(\nu \not \in S\). This concludes the proof. \(\square \)
This property also holds in the other direction, i.e., adding a set \(S'\) of new assignments to S will force the set A to increase.
Lemma 7
Let \(\varPhi = \varPi .\phi \) be a QBF over universally quantified variables U and existentially quantified variables E. Further, let \(S \cup S'\) be a set of existential assignments such that \(S \cap S' = \emptyset \), \(S' \not = \emptyset \), let A be a set of universal assignments, \(\bigwedge _{\alpha \in A}\phi ^\alpha \) has the satisfying assignment \(\tau \), \(S' \subseteq \{(\tau _{E^\alpha })^{\alpha } \mid \alpha \in A\}\).
If A completes S and \(S \cup S'\) completes A and \(\bigwedge _{\sigma \in S\cup S'}\lnot \phi ^\sigma \) evaluates to true under assignment \(\rho \), then there exists an assignment \(\nu \in \{(\rho _{U^\sigma })^{\sigma } \mid \sigma \in S \cup S'\}\) with \(\nu \not \in A\).
Proof
The proof is analogous to the proof of Lemma 6. \(\square \)
Now that we have identified the relations between the sets of universal and existential assignments, we use them to show that the algorithm from Fig. 1 terminates.
Theorem 2
The algorithm shown in Fig. 1 terminates for any QBF \(\varPhi = \varPi .\phi \).
Proof
By induction over the number of iterations i, we argue that sets \(A_{i1} \subset A_i\) and \(S_{i1} \subset S_i\).
Base Case. Let \(i = 1\) and \(A_0 = \{\alpha _0\}\). \(S_0 \subset S_1\), because \(S_0 = \emptyset \) and \(\sigma _1 \in S_1\) is a satisfying assignment of \(\phi ^{\alpha _0}\) (if \(\phi ^{\alpha _0}\) is unsatisfiable, the algorithm terminates). \(A_0 \subset A_1\) directly follows from Lemma 4.
Induction Step. For \(i > 1\), we argue that \(S_i \subset S_{i+1}\). By induction hypothesis the theorem holds for iteration i, i.e., \(A_i = A_{i1} \cup A'\) with \(A_{i1} \cap A' = \emptyset \) and \(A' \not = \emptyset \) and \(S_i = S_{i1} \cup S'\) with \(S_{i1} \cap S' = \emptyset \) and \(S' \not = \emptyset \). Because of Lemma 5, \(S_{i}\) completes \(A_{i1}\), and \(A_{i}\) completes \(S_i\). Furthermore, if \(\bigwedge _{\sigma \in S_i}\lnot \phi ^\sigma \) is satisfiable under some assignment \(\rho \) (otherwise the algorithm would terminate), by construction \(A' \subseteq \{(\rho _{U^\sigma })^{\sigma } \mid \sigma \in S_i\}\). Hence, Lemma 6 applies and if \(\bigwedge _{\alpha \in A_i}\phi ^\alpha \) is satisfiable under some assignment \(\tau \) (otherwise the algorithm would immediately terminate), then there is an assignment \(\nu \in \{(\tau _{E^\alpha })^{\alpha } \mid \alpha \in A_i\}\) with \(\nu \not \in S_i\).
The argument for \(A_i \subset A_{i+1}\) is similar and uses the property shown in Lemma 7. \(\square \)
Note that the algorithm presented above does not make any assumptions on the formula structure, i.e., for a QBF \(\varPi .\phi \) it is not required that \(\phi \) is in conjunctive normal form. Without any modification, our algorithm also works on formulas in PCNF—as SAT solvers typically process formulas in CNF only, we focus on this representation for the rest of the paper.
Relation to the \(\forall \)Exp+Res calculus
The \(\forall \)Exp+Res calculus [6, 30, 31] yields the theoretical foundation of our algorithm for refuting a formula \(\varPi .\phi \) in PCNF with universal variables U and existential variables E. The \(\forall \)Exp+Res calculus consists of the two rules shown in Fig. 3. Given an assignment \(\tau :U_\varPi \rightarrow \{\top , \bot \}\) of the universal variables \(U_\varPi \) and a clause occurring in a QBF \(\varPi .\phi \), then the axiom rule instantiates C such that all universal literals u are assigned value \(\tau (u)\) and the remaining existential literals l are annotated by \([\tau ]\), i.e., by those universals that precede the variable of l in the prefix. In the notation introduced before, we can write the axiom rule by
Note that only clauses that do not contain \(\tau (l) = \top \) are of interest for a refutation proof. Further, any occurrences of \(\bot \) are omitted in the proof.
The resolution rule corresponds exactly to propositional resolution, i.e., the annotated variables are seen as propositional variables. Resolution between two clauses is only possible, if one contains a literal \(x^\sigma \) and the other clause contains a literal \(\lnot x^\tau \) and \(\sigma = \tau \), i.e., the pivot literals must have the same annotation. Note that we represent clauses as sets of literals.
A derivation in \(\forall \)Exp+Res is a sequence of clauses where each clause is either obtained by the axiom rule or derived from previously derived clauses by the application of the resolution rule. A refutation of a PCNF \(\varPi .\phi \) is a derivation of the empty clause. The application of the axiom rule instantiates the universal variables of one clause of \(\phi \). If enough of these instantiations can be found in order to derive the empty clause by the application of the resolution rule, the QBF \(\varPi .\phi \) is false.
Our algorithm presented in Fig. 1 does not instantiate selected clauses of the input formula, but all clauses of the matrix \(\phi \) at once using a particular assignment of the universal variables. Hence, when the SAT solver finds \(\psi _\forall = \bigwedge _{\alpha \in A_i}\phi ^\alpha \) unsatisfiable for some \(A_i\), not necessarily all clauses of \(\psi _\forall \) are required to derive the empty clause via resolution, but only one minimal unsatisfiable core of \(\psi _\forall \), i.e., a subset of the clauses such that the removal of any clause would make this formula satisfiable. This observation leads us to the following proposition.
Proposition 1
Let \(\varPi .\phi \) be a false QBF. Further, let \(\psi _\forall = \bigwedge _{\alpha \in A_i}\phi ^\alpha \) be obtained by the application of the algorithm in Fig. 1. Further, let \(\psi _\forall '\) be a minimal unsatisfiable core of \(\psi _\forall \). Then there is a \(\forall \)Exp+Res refutation such that all clauses that are introduced by the axiom rule occur in \(\psi _\forall '\).
Example 6
Consider the false QBF
When fully expanding universal a, we obtain the propositional formula
For proving unsatisfiability of this formula, it is enough to consider the formula \(((\lnot x \vee y^\top ) \wedge (\lnot y^\top ) \wedge (x \vee y^\bot ) \wedge (\lnot y^\bot )).\) The corresponding \(\forall \)Exp+Res proof is shown in Fig. 4. Since existential variable x occurs outermost in the prefix, it is not annotated during the applications of the axiom rule.
Currently our implementation supports the generation of refutation proofs for false formulas and checking them for correctness. In consequence, we are now able to efficiently check the correctness of the solving results for false formulas, because the correctness check is linear in the proof size. For such proofs, we designed a novel proof format, because to best of our knowledge recent QBF solvers implementing expansionbased approaches do not support any proof generation.
Conceptually, proof generation for true QBFs works dually: instead of refuting a set of clauses, a set of cubes (conjunctions of literals) is shown to be valid. For this purpose, the resolution rule has to be modified to operate on cubes instead of clauses. In practice, however, SAT solvers are used that operate on clauses, hence an extra transformation step introducing fresh variables is required. This is currently not supported by our checker and is subject to future work.
Implementation
The algorithm described in Sect. 5 is realized in the solver Ijtihad^{Footnote 2} The most recent version of Ijtihad is available at
https://extgit.iaik.tugraz.at/scos/ijtihad
The solver is implemented in C++ and currently processes formulas in PCNF available in the QDIMACS format. For accessing SAT solvers, Ijtihad uses the IPASIR interface [5], which makes changing the SAT solver very easy. The SAT solver used in all of our experiments is Glucose [2]. Although the base implementation does reasonably well, we have realized various optimizations to make Ijtihad even more viable in practice. Some of them are discussed in the following.
For solving a QBF \(\varPi .\phi \), the basic algorithm shown in Fig. 1 adds instantiations of \(\phi \) to \(\psi _\forall = \bigwedge _{\alpha \in A_{i1}}\phi ^\alpha \) and \(\psi _\exists = \bigwedge _{\sigma \in S_{i}}\lnot \phi ^\sigma \) in each iteration i until the formula is decided. The calls to the SAT solver in Line 5 and Line 8 are done incrementally, i.e., we create two instances of the SAT solver and provide them with the clauses stemming from new instantiations of \(\phi \) at each iteration. For simplicity, we omit indices of sets A and S and refer to an arbitrary iteration of the execution of the algorithm in the following discussion.
Figure 5 relates set sizes of A and S as well as the accumulated time that one SAT solver needs to solve \(\psi _\forall \) with the time the other SAT solver needs to solve \(\psi _\exists \) for the formulas of the PCNF track of QBFEVAL’17 (preprocessed with Bloqqer [8]). In this paper, we also distinguish between true and false formulas. In Fig. 5a we see that for true formulas, set S tends to be larger than A, while for false instances the picture is less clear. Figure 5b shows the overall time needed for solving \(\psi _\forall \) (yaxis) and \(\psi _\exists \) (xaxis). In almost all cases, the solver that handles \(\psi _\forall \) needs more time than the solver that handles \(\psi _\exists \). This may be founded on the observation that many QBFs have considerably more existential variables than universal variables [39], hence the instantiations added to \(\psi _\forall \) are much larger than the instantiations added to \(\psi _\exists \).
In Line 1 of Fig. 1, the set of universal assignments \(A\) is initialized with one arbitrary assignment \(\alpha _0\). Obviously, the set \(A\) may also be initialized with multiple assignments. In our current implementation, we initialize \(A\) with the assignments that set the variables of one universal quantifier block to \(\bot \) and the variables of all other universal quantifier blocks to \(\top \). The impact of various initialization heuristics remains to be investigated in future work.
In Line 7 and Line 10 our algorithm increases the size of \(S\) and \(A\) in each iteration of the main loop, as argued in Theorem 2. In the worst case, this leads to an exponential increase in space consumption. Although we detect shared clauses among the instantiations, that alone is not enough to significantly reduce the space consumption. However, some of the assignments found in an earlier iteration could become obsolete after better assignments were found. It is therefore beneficial to empty either \(S\) or \(A\) and then reconstruct them from \(\psi _\forall \) and \(\psi _\exists \), similarly to what is done in Line 7 and Line 10. We evaluated several heuristics for scheduling these set resets, and we found that resetting periodically and close to the memory limit works best. The regular resetting of one set has a similar effect as restarts in SAT solvers, and we observed a considerable improvement in performance, especially in terms of memory consumption. Our implementation periodically resets the set \(A\), since experiments indicate that the resulting formula \(\psi _\forall \) is much harder to solve than \(\psi _\exists \) as seen in Fig. 5b. Besides the aforementioned imbalance between universal and existential variables, it is also likely due to the structure of \(\psi _\exists \) which is a conjunction of formulas in disjunctive normal form. Note that this reset of A does not affect the termination argument presented in Theorem 2, since the sets A and S still complete each other.
Finally, we extended the presented approach with orthogonal reasoning techniques like QCDCL [23] for exploiting the different strengths of \(\forall \)Exp+Res and Qresolution, yielding a hybrid solver that smoothly integrates both solving paradigms. To this end, we implemented the prototypical solver called Heretic which pursues the following idea: The main loop of the algorithm shown in Fig. 1 (Lines 412) is extended in a sequential portfolio style such that a QCDCL solver is periodically called. After each call, all clauses that were learned through QCDCL are added to \(\varPi .\varPhi \), making them available in further iterations. These new clauses potentially exclude assignments that would otherwise be possible and that could result in more iterations of the main loop.
The solver Heretic extends Ijtihad by additional invocations of the QCDCL solver DepQBF [38]. About every 30 seconds, DepQBF is called and run for about 30 seconds. The learned clauses are obtained via the API of DepQBF. Leveraging learned cubes is subject to future work.
Evaluation
We evaluate nonrecursive expansion as implemented in our solvers Ijtihad and its hybrid variant Heretic on the benchmarks from the PCNF track of the QBFEVAL’18 competition. All experiments were carried out on a cluster of Intel Xeon CPUs (E52650v4, 2.20 GHz) running Ubuntu 16.04.1 with a CPU time limit of 1800 seconds and a memory limit of 7 GB. We considered the following topperforming solvers from QBFEVAL’18: Qute [41], RevQfun [27], RAReQS [28], CAQE [42, 47], DynQBF [14], GhostQ [28, 36], DepQBF [38], QESTO [32], and QSTS [11, 12]. Our experiments are based on original benchmarks without preprocessing and benchmarks preprocessed using QRATPre + [40], HQSpre [50], and Bloqqer [8, 25] with a timeout of one hour.
The tables in the left column of Fig. 6 show the total numbers of solved instances (S), solved unsatisfiable (\(\bot \)) and satisfiable ones (\(\top \)), and total CPU time including timeouts. The plots in the right column of Fig. 6 visualize the runtimes of the respective solvers. In the first row, the results without any preprocessing are shown. Our solver Heretic is ranked third solving the most false formulas of all solvers. If the preprocessor QRATPre + is applied, Heretic is ranked second. Only CAQE solves more formula instances. Also with the other two preprocessors, CAQE seems to be the solver that benefits most from the additional preprocessing step. In general, preprocessing has a considerable impact on the number of solved instances. With preprocessing enabled, Heretic solves up to 142 more formulas than without preprocessing. Also Ijtihad strongly benefits from preprocessing: alone it solves 151 formulas, and with a preprocessor it solves up to 229 formulas.
Notably Heretic, despite its simple design, significantly outperforms Ijtihad on the QBFEVAL’18 benchmark set. Moreover, Heretic is ranked third and second on preprocessed instances and thus is on par with stateoftheart solvers. On the considered benchmark set, the gap in solved instances between RAReQS and Heretic is considerably smaller than the one between RAReQS and Ijtihad.
A direct comparison of our solver Heretic with RAReQS is shown in Fig. 7a. Unlike our solver, RAReQS is based on a recursive implementation of expansion. While the plot looks very balanced for the whole benchmark set, the picture changes for formulas with four or more quantifier blocks, i.e., three or more quantifier alternations (see Fig. 7b and below).
On such formulas with many quantifier blocks, the strength of Heretic becomes apparent, cf. [39]. As shown in Tables 8a, 8c and 8e, Heretic outperforms all other solvers on original instances and on instances with preprocessing by QRATPre + and Bloqqer. The only exception are instances preprocessed by HQSpre (Table 8g).
Moreover, on entire benchmark sets without and with preprocessing (Tables 6a, 6c, 6e, and 6g), Heretic significantly outperforms both DepQBF and Ijtihad. These results indicate the potential of combining the orthogonal proof systems \(\forall \)Exp+Res as implemented in Ijtihad and Qresolution as implemented in DepQBF in a hybrid solver like Heretic.
Although RAReQS outperforms both Ijtihad and Heretic on instances preprocessed by Bloqqer (Table 6e) RAReQS failed to solve certain instances that were solved by Ijtihad or Heretic. Table 1 shows related statistics. E.g., on instances preprocessed by HQSpre (row “HQ”), 258 instances were solved by both RAReQS and Heretic (column “R vs. H), 34 only by RAReQS, and 39 only by Heretic. Summing up these numbers yields a total of 331 solved instances (more than any individual solver in Table 6g) that could have been solved by a hypothetical solver combining RAReQS and Heretic. This observation underlines the strength of expansion in general and, in particular, of the hybrid approach implemented in Heretic. Heretic solved a significant amount of instances not solved by RAReQS, and it clearly outperformed Ijtihad and DepQBF on all benchmarks (columns “I vs. H” and “D vs. H”).
Conclusion
We presented a novel nonrecursive algorithm for expansionbased QBF solving that uses only two SAT solvers for incrementally refining the propositional abstraction and the negated propositional abstraction of a QBF. We gave a concise proof of termination and soundness and demonstrated with several experiments that our prototype compares well with the state of the art. In addition to nonrecursive expansion, we also studied the impact of combining Qresolution and \(\forall \)Exp+Res in a hybrid approach. To this end, we coupled a QCDCL solver and nonrecursive expansion to make clauses derived by the QCDCL solver available to the expansion solver. Experimental results indicated that the hybrid approach significantly outperforms our implementation of nonrecursive expansion indicating the potential of combining expansionbased approaches with Qresolution which gives rise to an exciting direction of future work. Further, our current implementation supports only formulas in conjunctive normal form while in theory, our approach does not make any assumptions on the structure of the propositional part of the QBF. We also plan to investigate how this formula structure can be exploited for efficiently processing the negation of the formula.
Notes
The name Ijtihad refers to the effort of solving cases in Islamic law (for details see https://en.wikipedia.org/wiki/Ijtihad).
References
Alur R, Bodík R, Dallal E, Fisman D, Garg P, Juniwal G, KressGazit H, Madhusudan P, Martin MMK, Raghothaman M, Saha S, Seshia SA, Singh R, SolarLezama A, Torlak E, Udupa A (2015) Syntaxguided synthesis. In: Dependable Software Systems Engineering, volume 40 of NATO Science for Peace and Security Series, D: Information and Communication Security. IOS Press, pp 1–25
Audemard G, Simon L (2009) Predicting learnt clauses quality in modern SAT solvers. In: IJCAI, pp 399–404
Ayari A, Basin DA (2002) QUBOS: deciding quantified Boolean logic using propositional satisfiability solvers. In: FMCAD, volume 2517 of LNCS. Springer, pp 187–201
Balabanov V, Jiang JHR, Scholl C, Mishchenko A, Brayton RK (2016) 2QBF: challenges and Solutions. In: SAT, volume 9710 of LNCS. Springer, pp 453–469
Balyo T, Biere A, Iser M, Sinz C (2016) SAT Race 2015. Artif Intell 241:45–65
Beyersdorff O, Chew L, Janota M (2014) On unification of QBF resolutionbased calculi. In: MFCS, volume 8635 of LNCS. Springer, pp 81–93
Beyersdorff O, Janota M, Lonsing F, Seidl M (2021) Quantified Boolean formulas. In: Handbook of satisfiability, 2nd edn. Frontiers in artificial intelligence and applications. IOS Press
Biere A, Lonsing F, Seidl M (2011) Blocked clause elimination for QBF. In: CADE, volume 6803 of LNCS. Springer, pp 101–115
Bloem R, BraudSantoni N, Hadzic V, Egly U, Lonsing F, Seidl M (2018)Expansionbased QBF solving without recursion. In: FMCAD. IEEE, pp 1–10
Bloem R, Könighofer R, Seidl M (2014) SATbased synthesis methods for safety specs. In: VMCAI, volume 8318 of LNCS. Springer, pp 1–20
Bogaerts B, Janhunen T, Tasharrofi S (2016) SATtoSAT in QBFEval 2016. In: QBF workshop, volume 1719 of CEUR workshop proceedings. CEURWS.org, pp 63–70
Bogaerts B, Janhunen T, Tasharrofi S (2016) Solving QBF instances with nested SAT solvers. In: Beyond NP, volume WS1605 of AAAI Workshops. AAAI Press
Bubeck U, Kleine Büning H (2007) Bounded universal expansion for preprocessing QBF. In: SAT, volume 4501 of LNCS. Springer, pp 244–257
Charwat G, Woltran S (2016) Dynamic programmingbased QBF solving. In: QBF workshop, volume 1719 of CEUR workshop proceedings. CEURWS.org, pp 27–40
Cheng CH, Hamza Y, Ruess H (2016) Structural synthesis for GXW specifications. In: CAV, volume 9779 of LNCS. Springer, pp 95–117
Cheng CH, Lee EA, Ruess H (2017) autoCode4: structural controller synthesis. In TACAS, volume 10205 of LNCS. Springer, pp 398–404
Clarke EM, Grumberg O, Jha S, Yuan L, Veith H (2003) Counterexampleguided abstraction refinement for symbolic model checking. J ACM 50(5):752–794
Dershowitz N, Hanna Z, Katz J (2005) Bounded model checking with QBF. In: SAT, volume 3569 of LNCS. Springer, pp 408–414
Egly U, Kronegger M, Lonsing F, Pfandler A (2017) Conformant planning as a case study of incremental QBF solving. Ann Math Artif Intell 80(1):21–45
Faymonville P, Finkbeiner B, Rabe MN, Tentrup L (2017) Encodings of bounded synthesis. In: TACAS, volume 10205 of LNCS. Springer, pp 354–370
Bernd F, Leander T (2015) Detecting unrealizability of distributed faulttolerant systems. Logic Methods Comput Sci 11(3):1–31
Gascón A, Tiwari A (2014) A synthesized algorithm for interactive consistency. In: NASA formal methods, volume 8430 of LNCS. Springer, pp 270–284
Giunchiglia E, Marin P, Narizzano M (2009) Reasoning with quantified Boolean formulas. In: Handbook of satisfiability, volume 185 of FAIA. IOS Press, pp 761–780
Giunchiglia E, Marin P, Narizzano M (2010) sQueezeBF: an effective preprocessor for QBFs based on equivalence reasoning. In: SAT, volume 6175 of LNCS. Springer, pp 85–98
Heule M, Järvisalo M, Lonsing F, Seidl M, Biere A (2015) Clause elimination for SAT and QSAT. JAIR 53:127–168
Heyman T, Smith D, Mahajan Y, Leong L, AbuHaimed H (2014) Dominant controllability check using QBFsolver and netlist optimizer. In: SAT, volume 8561 of LNCS. Springer, pp 227–242
Janota M (2018) Towards generalization in QBF solving via machine learning. AAAI Press, In AAAI
Janota M, Klieber W, MarquesSilva J, Clarke E (2016) Solving QBF with counterexample guided refinement. Artif Intell 234:1–25
Janota M, Klieber W, MarquesSilva J, Clarke EM (2012) Solving QBF with counterexample guided refinement. In: SAT, volume 7317 of LNCS. Springer, pp 114–128
Janota M, MarquesSilva J (2013) On propositional QBF expansions and Qresolution. In: SAT, volume 7962 of LNCS. Springer, pp 67–82
Janota M, MarquesSilva J (2015) Expansionbased QBF solving versus Qresolution. Theor Comput Sci 577:25–42
Janota M, MarquesSilva J (2015) Solving QBF by clause selection. In: IJCAI. AAAI Press, pp 325–331
Janota M, Silva JPM (2011) Abstractionbased algorithm for 2QBF. In: SAT, volume 6695 of LNCS. Springer, pp 230–244
Büning HK, Bubeck U (2009) Theory of quantified Boolean formulas. In: Handbook of satisfiability, volume 185 of FAIA. IOS Press, pp 735–760
Büning HK, Karpinski M, Flögel A (1995) Resolution for quantified Boolean formulas. Inf Comput 117(1):12–18
Klieber W, Sapra S, Gao S, Clarke EM (2010) A nonprenex, nonclausal QBF Solver with gamestate learning. In: SAT, volume 6175 of LNCS. Springer, pp 128–142
Letz R (2002) Lemma and model caching in decision procedures for quantified Boolean formulas. In: TABLEAUX, volume 2381 of LNCS. Springer, pp 160–175
Lonsing F, Egly U (2017) DepQBF 6.0: a searchbased QBF solver beyond traditional QCDCL. In: CADE, volume 10395 of LNCS. Springer, pp 371–384
Lonsing F, Egly U (2018) Evaluating QBF solvers: quantifier alternations matter. In: CP, volume 11008 of LNCS. Springer, pp 276–294
Lonsing F, Egly U (2019) Qratpre+: effective QBF preprocessing via strong redundancy properties. In: SAT, volume 11628 of LNCS. Springer, pp 203–210
Peitl T, Slivovsky F, Szeider S (2017) Dependency Learning for QBF. In: SAT, volume 10491 of LNCS. Springer, pp 298–313
Rabe MN, Tentrup L (2015) CAQE: a certifying QBF solver. In: FMCAD. IEEE, pp 136–143
Ranjan DP, Tang D, Malik S (2004) A comparative study of 2QBF algorithms. In: SAT
Rintanen J (2007) Asymptotically optimal encodings of conformant planning in QBF. In: AAAI. AAAI Press, pp 1045–1050
Shukla A, Biere A, Pulina L, Seidl M (2019) A survey on applications of quantified Boolean formulas. In: ICTAI. IEEE, pp 78–84
Tentrup L (2016) Nonprenex QBF solving using abstraction. In: SAT, volume 9710 of LNCS. Springer, pp 393–401
Tentrup L (2017) On expansion and resolution in CEGAR based QBF solving. In: CAV, volume 10427 of LNCS. Springer, pp 475–494
Tu KH, Hsu TC, Jiang JHR (2015) QELL: QBF reasoning with extended clause learning and levelized SAT solving. In: SAT, volume 9340 of LNCS. Springer, pp 343–359
Vizel Y, Weissenbacher G, Malik S (2015) Boolean satisfiability solvers and their applications in model checking. Proc IEEE 103(11):2021–2035
Wimmer R, Reimer S, Marin P, Becker B (2017) Hqspre—an effective preprocessor for QBF and DQBF. In: TACAS, volume 10205 of LNCS, pp 373–390
Zhang L, Malik S (2002) Towards a symmetric treatment of satisfaction and conflicts in quantified Boolean formula evaluation. In: CP, volume 2470 of LNCS. Springer, pp 200–215
Zhang W (2014) QBF encoding of temporal properties and QBFbased verification. In: IJCAR, volume 8562 of LNCS. Springer, pp 224–239
Funding
Open access funding provided by Graz University of Technology.
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
This work has been supported by the Austrian Science Fund (FWF) under Projects W1255N23, S11406N23, S11408N23, and S11409N23, and the LIT AI Lab funded by the State of Upper Austria.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Bloem, R., BraudSantoni, N., Hadzic, V. et al. Two SAT solvers for solving quantified Boolean formulas with an arbitrary number of quantifier alternations. Form Methods Syst Des 57, 157–177 (2021). https://doi.org/10.1007/s10703021003717
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10703021003717
Keywords
 Quantified Boolean formulas
 Decision procedures
 CEGAR