The abstract CDCL calculus by Nieuwenhuis et al. [43] forms the first layer of our refinement chain. The formalization relies on basic Isabelle libraries for lists and multisets and on custom libraries for propositional logic. Properties such as partial correctness and termination (given a suitable strategy) are inherited by subsequent layers.
Propositional Logic
The DPLL and CDCL calculi distinguish between literals whose truth value has been decided arbitrarily and those that are entailed by the current decisions; for the latter, it is sometimes useful to know which clause entails it. To capture this information, we introduce a type of annotated literals, parameterized by a type
of propositional variables and a type
of clauses:
The simpler calculi do not use
; they take
, a singleton type whose unique value is (). Informally, we write A, \(\lnot \,A\), and \(L^\dag \) for positive, negative, and decision literals, and we write \(L^C\) (with
) or simply L (if
or if the clause C is irrelevant) for propagated literals. The unary minus operator is used to negate a literal, with \(- (\lnot \,A) = A\).
As is customary in the literature [1, 57], clauses are represented by multisets, ignoring the order of literals but not repetitions. A
is a (finite) multiset over
. Clauses are often stored in sets or multisets of clauses. To ease reading, we write clauses using logical symbols (e.g., \(\bot \), L, and \(C \vee D\) for \(\emptyset \), \(\{L\}\), and \(C \uplus D\)). Given a clause C, we write \(\lnot \,C\) for the formula that corresponds to the clause’s negation.
Given a set or multiset I of literals, \(I \vDash C\) is true if and only if C and I share a literal. This is lifted to sets and multisets of clauses or formulas:
. A set or multiset is satisfiable if there exists a consistent set or multiset of literals I such that \(I \vDash N\). Finally,
These notations are also extended to formulas.
DPLL with Backjumping
Nieuwenhuis et al. present CDCL as a set of transition rules on states. A state is a pair
, where M is the trail and N is the multiset of clauses to satisfy. In a slight abuse of terminology, we will refer to the multiset of clauses as the “clause set.” The trail is a list of annotated literals that represents the partial model under construction. The empty list is written
. Somewhat nonstandardly, but in accordance with Isabelle conventions for lists, the trail grows on the left: Adding a literal L to M results in the new trail \(L \cdot M\), where
. The concatenation of two lists is written \(M \mathbin {@} M'\). To lighten the notation, we often build lists from elements and other lists by simple juxtaposition, writing \(M L M'\) for \(M \mathbin {@} L \cdot M'\).
The core of the CDCL calculus is defined as a transition relation
, an extension of classical DPLL [17] with nonchronological backtracking, or backjumping. The
part of the name refers to Nieuwenhuis, Oliveras, and Tinelli. The calculus consists of three rules, starting from an initial state
. In the following, we abuse notation, implicitly converting \(\vDash \)’s first operand from a list to a set and ignoring annotations on literals:
The
rule is more general than necessary for capturing DPLL, where it suffices to negate the leftmost decision literal. The general rule can also express nonchronological backjumping, if \(C'\vee L'\) is a new clause derived from N (but not necessarily in N).
We represented the calculus as an inductive predicate. For the sake of modularity, we formalized the rules individually as their own predicates and combined them to obtain
:
Since there is no call to
in the assumptions, we could also have used a plain
here, but the
command provides convenient introduction and elimination rules. The predicate operates on states of type
. To allow for refinements, this type is kept as a parameter of the calculus, using a locale that abstracts over it and that provides basic operations to manipulate states:
where
converts an abstract state of type
to a pair (M, N). Inside the locale, states are compared extensionally:
is true if the two states have identical trails and clause sets (i.e., if
). This comparison ignores any other fields that may be present in concrete instantiations of the abstract state type
.
Each calculus rule is defined in its own locale, based on
and parameterized by additional side conditions. Complex calculi are built by inheriting and instantiating locales providing the desired rules. For example, the following locale provides the predicate corresponding to the
rule, phrased in terms of an abstract DPLL state:
Following a common idiom, the
calculus is distributed over two locales: The first locale,
, defines the
calculus; the second locale,
, extends it with an assumption expressing a structural invariant over
that is instantiated when proving concrete properties later. This cannot be achieved with a single locale, because definitions may not precede assumptions.
Theorem 1
(Termination [20,
]) The relation
is well founded.
Termination is proved by exhibiting a well-founded relation \(\prec \) such that
whenever
. Let
and
with the decompositions
$$\begin{aligned} M&= \smash {M_n L_n^\dag \cdots M_1 L_1^\dag M_0}&M'&= \smash {M'_{n'} \smash {L'}_{\!\!n\smash {'}}^\dag \cdots M'_1 \smash {L'}_{\!\!\!1}^\dag M'_0} \end{aligned}$$
where the trail segments \(M_0,\ldots ,M_n,M'_0,\ldots ,M'_{n\smash {'}}\) contain no decision literals. Let V be the number of distinct variables occurring in the initial clause set N. Now, let \(\nu \,M = V - \left| M\right| \), indicating the number of unassigned variables in the trail M. Nieuwenhuis et al. define \(\prec \) such that
if
-
(1)
there exists an index \(i \le n, n'\) such that \([\nu \, M'_0,\, \cdots ,\, \nu \, M'_{i-1}] = [\nu \, M_0,\, \cdots ,\, \nu \, M_{i-1}]\) and \(\nu \,M'_i < \nu \,M_i\); or
-
(2)
\([\nu \, M_0,\, \cdots ,\, \nu \, M_{n}]\) is a strict prefix of \([\nu \, M'_0,\, \cdots ,\, \nu \, M'_{n'}]\).
This order is not to be confused with the lexicographic order: We have
by condition (2), whereas
. Yet the authors justify well-foundedness by appealing to the well-foundedness of
on bounded lists over finite alphabets. In our proof, we clarify and simplify matters by mapping states
to lists \(\bigl [\left| M_0\right| , \cdots ,\left| M_n\right| \bigr ]\), without appealing to \(\nu \). Using the standard lexicographic order, states become larger with each transition:
The lists corresponding to possible states are bounded by the list \([V, \dots , V]\) consisting of V occurrences of V, thereby delimiting a finite domain \(D = \{[k_1,\ldots ,k_n] \mid k_1,\cdots ,k_n,n \le V\}\). We take \(\prec \) to be the restriction of
to D. A variant of this approach is to encode lists into a measure
and let
, building on the well-foundedness of > over bounded sets of natural numbers.
A final state is a state from which no transitions are possible. Given a relation
, we write
for the right-restriction of its reflexive transitive closure to final states (i.e.,
if and only if
).
Theorem 2
(Partial Correctness [20,
]) If
, then N is satisfiable if and only if \(M\vDash N.\)
We first prove structural invariants on arbitrary states
reachable from
, namely: (1) each variable occurs at most once in \(M'\); (2) if \(M' = M_2 L M_1\) where L is propagated, then \(M_1, N \vDash L\). From these invariants, together with the constraint that
is a final state, it is easy to prove the theorem.
Classical DPLL
The locale machinery allows us to derive a classical DPLL calculus from DPLL with backjumping. We call this calculus
. It is achieved through a
locale that restricts the Backjump rule so that it performs only chronological backtracking:
Because of the locale parameters,
is strictly speaking a family of calculi.
Lemma 3
(Backtracking [20,
]) The
rule is a special case of the
rule.
The
rule depends on two clauses: a conflict clause C and a clause \(C'\vee L'\) that justifies the propagation of \(L'\!.\) The conflict clause is specified by
. As for \(C'\vee L'\), given a trail \(M'L^\dag M\) decomposable as \(M_nL^\dag M_{n-1}L_{n\smash {-1}}^\dag \cdots M_1 L_1^ \dag M_0\) where \(M_0,\cdots ,M_n\) contain no decision literals, we can take \(C' = -L_1\vee \cdots \vee -L_{n-1}\).
Consequently, the inclusion
holds. In Isabelle, this is expressed as a locale instantiation:
is made a sublocale of
, with a side condition restricting the application of the
rule. The partial correctness and termination theorems are inherited from the base locale.
instantiates the abstract state type
with a concrete type of pairs. By discharging the locale assumptions emerging with the
command, we also verify that these assumptions are consistent. Roughly:
If a conflict cannot be resolved by backtracking, we would like to have the option of stopping even if some variables are undefined. A state
is conclusive if \(M \vDash N\) or if N contains a conflicting clause and M contains no decision literals. For
, all final states are conclusive, but not all conclusive states are final.
Theorem 4
(Partial Correctness [20,
])
If
and
is a conclusive state, N is satisfiable if and only if \(M\vDash N\).
The theorem does not require stopping at the first conclusive state. In an implementation, testing \(M\vDash N\) can be expensive, so a solver might fail to notice that a state is conclusive and continue for some time. In the worst case, it will stop in a final state—which is guaranteed to exist by Theorem 1. In practice, instead of testing whether \(M\vDash N\), implementations typically apply the rules until every literal is set. When N is satisfiable, this produces a total model.
The CDCL Calculus
The abstract CDCL calculus extends
with a pair of rules for learning new lemmas and forgetting old ones:
In practice, the
rule is normally applied to clauses built exclusively from atoms in M, because the learned clause is false in M. This property eventually guarantees that the learned clause is not redundant (e.g., it is not already contained in N).
We call this calculus
. In general,
does not terminate, because it is possible to learn and forget the same clause infinitely often. But for some instantiations of the parameters with suitable restrictions on
and
, the calculus always terminates.
Theorem 5
(Termination [20,
])
Let
be an instance of the
calculus (i.e.,
). If
admits no infinite chains consisting exclusively of
and
transitions, then
is well founded.
In many SAT solvers, the only clauses that are ever learned are the ones used for backtracking. If we restrict the learning so that it is always done immediately before backjumping, we can be sure that some progress will be made between a
and the next
or
. This idea is captured by the following combined rule:
The calculus variant that performs this rule instead of
and
is called
. Because a single
transition corresponds to two transitions in
, the inclusion
does not hold. Instead, we have
. Each step of
corresponds to a single step in
or a two-step sequence consisting of
followed by
.
Restarts
Modern SAT solvers rely on a dynamic decision literal heuristic. They periodically restart the proof search to apply the effects of a changed heuristic. This helps the calculus focus on a part of the initial clauses where it can make progress. Upon a restart, some learned clauses may be removed, and the trail is reset to
. Since our calculus has a
rule, the
rule needs only to clear the trail. Adding
to
yields
. However, this calculus does not terminate, because
can be applied infinitely often.
A working strategy is to gradually increase the number of transitions between successive restarts. This is formalized via a locale parameterized by a base calculus
and an unbounded function
. Nieuwenhuis et al. require f to be strictly increasing, but unboundedness is sufficient.
The extended calculus
operates on states of the form
, where
is a state in the base calculus and n counts the number of restarts. To simplify the presentation, we assume that bases states
are pairs (M, N). The calculus
starts in the state
and consists of two rules:
The symbol
represents the base calculus
transition relation, and
denotes an m-step transition in
. The
in
reminds us that we count the number of transitions; in Sect. 4.5, we will review an alternative strategy based on the number of conflicts or learned clauses. Termination relies on a measure \(\mu _V\) associated with
that may not increase from restart to restart: If
, then
. The measure may depend on V, the number of variables occurring in the problem.
We instantiated the locale parameter
with
and f with the Luby sequence (\(1, 1, 2, 1, 1, 2, 4, \cdots \)) [35], with the restriction that no clause containing duplicate literals is ever learned, thereby bounding the number of learnable clauses and hence the number of transitions taken by
.
Figure 1a summarizes the syntactic dependencies between the calculi reviewed in this section. An arrow
indicates that
is defined in terms of
. Figure 1b presents the refinements between the calculi. An arrow
indicates that we proved
or some stronger result—either by locale embedding (
) or by simulating
’s behavior in terms of
.