Extracting Certificates from Quantified Boolean Formulas

1 Introduction

The term "certificate" has a fairly general meaning, originating in language recognition and complexity theory. Once verified, a certificate proves that the string it refers to actually belongs to a language of interest. Applied to logic, the term denotes any means of providing evidence of (un)satisfiability for a given statement, other than a refutationally-compete deductive approach. In essence, we verify that a given logical formula belongs to the language of (un)satisfiable statements.

The most natural certificate of satisfiability (sat-certificate) for a formula is an explicit representation of some of its models. A formula is indeed satisfiable if and only if some model makes it evaluate to true. The validity of a certificate can be verified by whoever is knowledgeable about the evaluation apparatus of the logic (deductive capabilities are unnecessary), independently of how it was obtained.

In this paper, we focus on sat-certificates for Quantified Boolean Formulas (QBFs). Such certificates have never been proposed or used so far for a number of reasons. First, the intrinsic nature of a QBF confers a tree-shaped structure to its models, whose explicit representation may become unaffordable. Second, theoretical arguments exist that make it unlikely to find polynomial-time verification procedures (QBF satisfiability is PSPACE-complete [Stockmeyer and Meyer, 1973]). Finally, present QBF solvers find it either impractical or not straightforward to collect all the information needed to construct a model. As a consequence, QBF models feature no commonly accepted representation (if any at all), and all the current solvers return a little more than a sat/unsat answer.

∗This work is supported by PAT (Provincia Autonoma di Trento, Italy), under grant n. 3248/2003.

Despite these issues, sat-certificates for QBFs are extremely desirable thank to their potential benefits on applications and solvers. For example, a certificate is a conclusive means to judge conflicting answers given by different solvers on the very same instance. Clearly, this event reveals no finer problem than a bug in the implementation, which we might think is not worth considering. This happens fairly often though, and as long as we treat solvers as black boxes, a proof-of-satisfiability approach is the only realistic way to tell the truth. We quote [Le Berre et al., 2004]:

The question of how to check the answer of the QBF solvers in an effective way is still unanswered [...] the question of what is a good certificate of satisfiability/unsatisfiability [...] remains open. This point is not only an issue for the QBF evaluation, but also for the implementation: [...] we had soundness problems with 4 QBF solvers. [...]

Yet, a certificate is much more than a way to ensure satisfiability: It can be inspected to gather semantics from the underlying formula. This is of paramount importance in applications, where certificates add valuable information to a mere sat/unsat answer. For example, a sat answer to the propositional (PROP) encoding of (the negation of) a desired property over a logic circuit means that the circuit is faulty w.r.t. that property. But, it takes a certificate to outline a definite scenario in which the fault shows up. As opposed to QBF certificates, such PROP certificates are easy to represent and verify, hence they have had a wide application.

The relevance of certificates enlarges with the scope of application of the underlying logic. In this respect, QBF is a notable case with plenty of applications. Every problem that can be stated as a two-player finite game can be modeled in QBF. An insightful example is obtained by considering the famous game "Connect-4". It is known that the player who moves first can always win. The rules of the game and the existence of a winning strategy can be encoded into a QBF instance [Gent and Rowley, 2003], expected to be sat. Which is the winning strategy? A certificate would disclose such information: The first player would prevail by just inspecting the certificate at each move, whatever the opponent does.

The interesting point here is that many real-world applications can be modeled as two-player games: Unbounded model checking for finite-state systems [Rintanen, 2001] and conformant planning [Rintanen, 1999]-just to name two relevant examples-have handy QBF formulations.

In the rest of this paper, after a brief introduction to QBFs and their models (Section 2), we present a solver-independent representation for QBF sat-certificates (Section 3). As expected, we are able to describe how to verify them (Section 4) before the more complex task of their extraction is addressed (Section 5). We conclude by discussing the implementation of our approach and the future work (Section 6).

2 QBFs and their models

With no loss of generality, we consider QBFs in prenex conjunctive normal form (CNF). They consist in a prefix exhibiting an arbitrary number of alternations of existentially and universally quantified variables, followed by a matrix, i.e. a conjunction of clauses. For example:

Given a QBF F, we denote by ˜ F its matrix, by var∃(F) (var∀(F)) the set of existentially (universally) quantified variables in F, and by var∀(F, e) ⊆ var∀(F) the set of universal variables preceding (or dominating) e ∈ var∃(F) in the prefix (we pose δ(e) .= |var∀(F, e)|). Given a CNF matrix ˜ F, the formula ˜ F ∗ l is the CNF obtained by assigning the literal l, i.e. by removing from F each ¬l literal and each clause containing l. This notation is readily extended to sets of literals. Amatrix ˜ F is satisfied by a set of literals M (writtenM |= ˜ F) when ˜ F ∗M is the empty formula.

The alternations of quantifiers in the prefix guide us to extending this notion of satisfiability from matrixes to QBFs. For example, the satisfiability problem on (1) asks whether for each possible (consistent) combination of literals on a and b there exists a way to choose a literal on c such that for both possible literals over d, two literals on e and f exist such that the resulting set satisfies the matrix. Hence, a QBF model is a set of |var∃(F)| functions, each one specifying the literal

to be chosen (if any) on the existential variable e as a function of the choices on all the universal variables dominating e. To represent all these functions at once we can use a labeled tree, such as the one aside, depicting a model for (1). If we call universal hypothesis every consistent set of universal literals (or, equivalently, every assignment

[u1 = ψ1, . . . , un = ψn] to the universal variables, with ψi ∈ B = {0, 1}), we may say, informally, that a tree structure like the one above is a model for a QBF with matrix ˜ F iff for every universal hypothesis U the set of existential literals collected along the branch individuated by U satisfies ˜ F ∗ U (see [B¨ uning and Zhao, 2004] for details).

3 Certificate representation

A QBF model can be represented explicitly by employing data structures such as trees or truth tables. Or, we may pursue compactness at the expense of managing an implicit representation 1 requiring computation to yield values.

An ideal certificate should be compact (easy to manage) and explicit (easy to verify and query). A successful tradeoff is obtained by employing Binary Decision Diagrams [Bryant, 1986]. We consider their reduced ordered version (ROBDDs, or just BDDs henceforth) with complemented arcs. A BDD E representing a total function F(u1, u2, . . . , un) from Bn to B is a directed acyclic graph with one root (labeled by F ) and one sink node (labeled by "1"). Each internal node is labeled by one variable in U = {u1, u2, . . . un}, and always has two children, one attached to the outcoming then-arc, the other to the else-arc. The else-arc may or may not be complemented. A unique path from the root to the sink is identified by assigning a value to each variable in U: The then-arc is chosen for variables assigned to 1, the else-arc is followed otherwise. The function F represented by E evaluates to 1 on 〈ψ1, ψ2, . . . , ψn〉 ∈ Bn iff an even number of complemented arcs is encountered along the path defined by ψ1, ψ2, . . . , ψn.

As an example, let us consider the BDD aside, where solid arrows denote then-arcs, while dashed (dotted) arcs are used for regular (complemented) else-arcs. It represents a binary function F(a, b, c) of three binary variables a, b and c. It is, for example, F(0, 1, 1) = 1 and F(1, 1, 1) = 0. The represented function may be written as F = b ∧ (a ∨ c) ∧ (¬a ∨ ¬c). In a set-oriented interpretation, this BDD represents the one-set of F, i.e. the set having F as characteristic function. In our case, it stands for the set {〈0, 1, 1〉, 〈1, 1, 0〉} where F evaluates to 1.

The BDDs we utilize are ordered and reduced: The same variable ordering is followed along each path, and no two nodes representing the same set exist, so that each function has only one canonic representation. Furthermore, the version with complemented arcs is such that the set S is denoted by the same node as S (referred to with a complemented arc).

The BDD way of representing sets is regarded as symbolic in that it avoids the explicit enumeration of sets' elements in favor of a more abstract, diagram-based way of computing characteristic functions. Such representations may be exponentially more succinct than explicit ones (see [Wegener, 2000]), and all the operations on the sets/functions they represent (union/disjunction, intersection/conjunction, etc.) can be performed by manipulating the involved BDDs [Bryant, 1986]. With a small abuse of notation, we treat BDDs as if they were the sets they represent. For example, x ∈ E is an element in the subset of Bn individuated by E.

When we manage collections of BDDs, canonicity spans over their set of nodes as a whole. This allows the sharing of structural information among diagrams. A BDD in such a set of interconnected diagrams-called a forest-is identified by a (complemented) arc pointing to its root node.

1 In [B¨ uning and Zhao, 2004] propositional formulas and QBFs with free variables are used. Implicitness is not an issue for the authors as they focus on characterizing classes of models/formulas.

Definition 3.1 (QBF sat-certificate, validity) A sat-certificate for a QBF F with var∃(F)={e1, . . . , em}, var∀(F)= {u1, . . . , un}, and δi=δ(ei) is a forest of BDDs containing two roots 〈E + i , E - i 〉 for each i in [1,m]. Both E + i and E - i are defined over var∀(F, ei)={u1, . . . , uδi }. The certificate

is consistent when ∀i ∈ [1,m] it is E + i ∩E - i = ∅. It is valid for F when for any 〈ψ1, . . . , ψn〉 ∈ Bn the formula ˜ F[u1=ψ1,...,un=ψn] is satisfied by {ei=s(i) (ψ1, . . . , ψδi ), i ∈ [1,m]}, where the functions s(i) : Bδi →B are defined as

In essence, a sat-certificate is a compact but explicit representation of the dependencies that have to exist between existential (dependent) and universal (independent) variables in order to satisfy the matrix whichever the universal hypothesis.

Lemma 3.1 If C(F) is valid for a QBF F, then F is satisfiable. Every satisfiable QBF has at least one valid certificate.

Proof sketch. A QBF is satisfiable iff it has at least one model, i.e. iff we find at least one tree-like structure (like the one introduced in Section 2), such that for every assignment U = [u1=ψ1, . . . , un=ψn] to the universal variables the set of existential literals collected along the branch individuated by U satisfies ˜ F ∗ U. Given a consistent certificate C for F, we insert the literal ei into the label of the node reached following the u1 = ψ1, . . . , uδi = ψδi path iff 〈ψ1, . . . , ψδi 〉 ∈ E + i (and, dually, ¬ei appears in the label iff 〈ψ1, . . . , ψδi 〉 ∈ E - i ). By construction, if the certificate is valid according to the notion of validity given in Definition 3.1, the tree-like structure obtained is a model. □

A valid sat-certificate for (1) is depicted in Figure 1.

4 Certificate verification

The first thing we wish to do with a consistent certificate C for F is to verify its validity. We check that by choosing the truth values of the existential variables according to what the certificate suggests, we always satisfy the matrix.

Function checkValidity(QBF F, certificate C)

An easy but impractical way of checking a certificate would be to check that M produces a satisfying assignment under all the possible universal hypotheses. Fortunately, the symbolic nature of the certificate helps us to perform a much more efficient, clause by clause, BDD-based verification. Let us use the exclusive or "⊗" to construct literals out of variables (ϕ⊗v means v when ϕ = 0, and ¬v when ϕ = 1).

Lemma 4.1 The algorithm checkValidity answers TRUE on 〈F, C〉 if and only if C is a valid certificate for F .

Let us consider, for example, the clause ¬u1 ∨ e1 ∨ u2 ∨ ¬e2 ∨ e3 under the prefix ∀u1∃e1∀u2∃e2∃e3. The only relevant universal hypotheses for this clause are those assigning both u1=1 and u2=0: All the others immediately satisfy the clause via one of its universal literals. So, it remains to verify that under the assignment [u1=1, u2=0] at least one of the three remaining literals in the clause is true, i.e. that every universal hypothesis containing u1 = 1, u2 = 0 falls within the one-set of at least one out of E + 1 (for e1), E - 2 (for ¬e2), and E + 3 (for e3). This is a two-step check: First, we collect the universal hypotheses E = E + 1 ∪E - 2 ∪E + 3 under which the clause is satisfied by some existential literal. Then, we check that all the hypotheses E (in which no existential literal satisfies the clause) assign either u1 = 1, or u2 = 0, or both, so that the clause is satisfied by a universal literal.

The meaning of a successful verification is twofold: We are ensured that the formula is sat, and that the certificate encodes a model. Conversely, the verification fails when either the certificate is invalid or the formula is unsat (we cannot tell right away which circumstance has occurred). Validity check is a coNP-complete problem [B¨ uning and Zhao, 2004].

5 Certificate Extraction

For certificate extraction to be symbolic in the same sense as our certificate is, we want it to work on a BDD-based representation of the problem. We describe one such representation (Section 5.1), and show how it relates to certificates (Section 5.2). Then, a two-step procedure is discussed to (a) evaluate the instance (Section 5.3), and (b) construct a certificate on the basis of the steps taken in the evaluation (Section 5.4).

5.1 Symbolic Formulas via Skolemization

The Skolem theorem shows how to transform any given First Order Logic (FOL) statement F into a skolemized formula Sk(F) that has two properties: (1) Sk(F) contains no existential quantifier, and (2) Sk(F) is satisfiable iff F is satisfiable. Existential quantifiers are eliminated by replacing the variables they bind with Skolem functions whose definition domains are appositely chosen to preserve satisfiability. In the outer form of skolemization, the function introduced for e ∈ var∃(F) depends on the universal variables var∀(F, e) that have e in their scope (for prenex formulas: all the universal variables to the left of e in the prefix).

Skolemization-based solvers replace the original formula F with the satisfiability-equivalent instance Sk(F). Such instance is no longer propositional. Nevertheless, we are able to capture its semantics without exceeding the expressive power of propositional logic, by explicitly managing the truth values of the (interpretation of) skolem terms in each point of their definition domains, as shown in [Benedetti, 2005].

The duty we pay is a (possibly) exponential blowup in the size of the problem. BDDs come out to be precious in keeping this space explosion problem under control: What we actually manage is a symbolic formula, i.e. a compact BDD-based representation of a propositional instance representing the definability of the set of skolem terms introduced in Sk(F).

Let as denote by Ψ|k the k-bit long prefix of Ψ ∈ Bn , n ≥ k. The notion is extended to sets: I|k = {Ψ|k.Ψ ∈ I}.

Definition 5.1 (Symbolic formula) A symbolic formula F is a BDD-based representation of a CNF instance. It consists of a symbolic prefix [e1]δ1 . . . [em]δm on the variables var(F) = {e1, . . . , em}, with 0 ≤ δ1 ≤ · · · ≤ δm, followed by a symbolic matrix ˜ F, i.e. a conjunction of symbolic clauses. A symbolic clause ΓI is made up by a consistent set Γ = [ϕ1 ⊗ ei1 , . . . , ϕh ⊗ eih ] of literals on var(F), and a (BDD represented) subset I of Bδ(Γ) , δ(Γ) .= maxl∈Γ δ(l). The CNF represented by F is called propositional expansion of F. It has variables {s(i) Φ , i ∈ [1,m],Φ∈Bδ(ei) }, and is defined as Prop(F) .= ∧ΓI∈FProp(ΓI), where

Symbolic formulas inherit the semantics of their propositional expansions (which we also call ground counterparts). Noticeably, a consistent set M= {[l1]I1 , . . . , [lm]Im } of symbolic literals satisfies F (M |= F) iff its expansion P rop(M)=∪[l]J ∈MP rop([l]J ) satisfies P rop(F).

Definition 5.2 (Symbolic skolemization) The symbolic skolemization SymbSk(F) of a QBF F with var∃(F) = {e1, . . . , em} is a symbolic formula with prefix [e1]δ(ei) · · · [em]δ(em), having one symbolic clause [l1, . . . , lh]I for each clause Λ ∈ F, where {l1, . . . , lh} are the existential literals in Λ, {ϕ1⊗ei1 , . . . , ϕh⊗eih } are the universal literals in Λ, and I = {〈ψi, . . . , ψk〉 ∈ Bk | ∀j.ψij ̸= ϕj}, k = δ(Λ).

As an example, the symbolic skolemization of (1) is given in Figure 2. In essence, a symbolic skolemization F = SymbSk(F) is a compact representations for a purely existential instance Prop(F) having the following key property.

≡ F. Proof sketch. By applying outer skolemization as described in [Benedetti, 2005] we turn the QBF instance F into a sat-equivalent purely universal formula: We substitute every existential variable v dominated by {u1, u2, . . . , un} ⊆

var∀(F) with a Skolem function sv (u1, u2, . . . , un). For example, the instance (1) with matrix ˜ N, is sat-equivalent to

Then, we propositionally encode the definability of the Skolem terms introduced, leveraging a noteworthy feature: They all map Bn onto B (for some n ≥ 0), hence they are fully specified by 2n boolean parameters, and have a direct CNF representation. For example, if we denote by {scαβ , 〈α, β〉 ∈ B2 } the four boolean parameters representing the truth value of sc over 〈x, y〉, we obtain for sc (a, b) the following propositional skolemization Sk(sc ) ≡ sc (a, b):

By replacing each v∈var∃(F ) with Sk(sv ) we obtain Sk(F )

where ∃sc stands for ∃sc00∃sc01∃sc10∃sc11 , and similarly for the other functions. This formula is easily turned-clause by clause-into a CNF. By distributing the connectives, removing clauses with complementary literals, and eliminating literals over universal quantifiers, we obtain 2δ(Γ)-m clauses out of a QBF clause Γ with m universal literals. For example, we obtain 23-1=4 clauses from the clause a∨c∨f in (1):

All the clauses coming out of a given QBF clause mention the same skolem functions. What makes one differ from another are the subscripted indexes. This allows us to write them compactly by representing function names apart from indexes. For example, the four clauses above may be succinctly represented as ΓI = [c, f]{000,001,010,011}, where I ⊆ Bδ(Γ) contains one element per clause, and the i-th component of each Ψ ∈ I refers to the universal variable ui: Once Ψ ∈ I is selected, each literal l obtains its own subscript by projecting Ψ onto the subspace related to the first δ(l) components, written Ψ|δ(l) . For example, given Ψ=010 it is Ψ|δ(c)=Ψ|2=01 and Ψ|δ(f)=Ψ|3=010, hence [c, f]{010}=sc01 ∨sf010 . This property allows us to recover the ground meaning of a factored clause through the Prop function. The factored representation becomes symbolic as soon as we represent and manipulate sets of indexes via BDDs over var∀(F), thus obtaining the (linear-size) representation SymbSk(F ). □

For example, the propositional expansion of the formula in Figure 2 yields a CNF instance equivalent to (1).

5.2 From symbolic models to certificates

The connection between a symbolic model and a certificate is so close that the former is smoothly turned into the latter. Let i(M, l) .=∪[l]I∈MI be the indexes on the literal l mentioned in a symbolic model M.

Theorem 5.2 IfM |= SymbSk(F), then the certificate

with C+ e = i(M, e), and Ce = i(M, ¬e) is valid for F.

Proof. The propositional variable siΨ in Prop(F), F = SymbSk(F) represents, for each i ∈ [1,m] and each Ψ = 〈ψ1, . . . , ψk〉 ∈ Bk , k=δ(ei), the value the Skolem function s(i) (u1, . . . , uk) (introduced to skolemize ei ∈ var∃(F)) assumes under the universal hypothesis [u1=ψ1, . . . , uk=ψk]. By construction, F embodies the definability of the skolem terms, i.e. all the mutual constraints among (interpretation of) terms that have to be obeyed to always satisfy the matrix. A model M for F is a way to comply with all these constraints at once: s(i) (ψ1, . . . , ψk) has to evaluate to 1 if s(i) Ψ ∈ Prop(M), to 0 if ¬s(i) Ψ ∈ Prop(M), and is unconstrained otherwise. By comparing the resulting functions

with Definition 3.1 (valid certificates) the thesis follows. □

5.3 Evaluating symbolic formulas

We devote our attention to solution-based procedures [Biere, 2004; Pan and Vardi, 2004; Benedetti, 2005], as they may be lifted to extract models symbolically. We consider a solver that manipulates symbolic clauses through rules designed to achieve at once on ΓI the same result ground rules would obtain if applied separately to each clause in Prop(ΓI).

• Resolution: Given two resolving clauses containing the same variable e in opposite polarities, we construct a necessary consequence-called resolvent clause-made up by all the literals from both originating clauses apart from e and ¬e. For the symbolic version to produce at most one symbolic resolvent per step, we only resolve on variables with the same universal depth as all the clauses in which they appear. The resolvent of ΓI and Γ′I ′ on e, with e∈Γ, ¬e∈Γ′ , δ(Γ)=δ(Γ′ )=δ(e), is 2 .

If either I ∩ I ′ = ∅ or Γ and Γ′ share further couples of complementary literals other than e and ¬e, the resolvent represents an empty set of clauses and is removed.

• Subsumption: ΓI is subsumed by Γ′I ′ when all the ground clauses in ΓI are subsumed by some clause in

2 To simplify the notation, we omit the projection of the index sets of derived clauses onto the proper subspaces: Whenever ΓI is derived, the clause actually inserted into the formula is ΓI|δ(Γ) .

• Γ′I ′ , i.e. when Γ′ ⊆ Γ and I ⊆ I ′ . Under this condition, ΓI can be removed. In partial subsumption (Γ′ ⊆ Γ but I ̸⊆ I ′ ) the subsumed clause is replaced by ΓI∩I ′ .
• Substitution: We write [l/a]J , δ(l) ≤ δ(a), to denote the substitution of lΨ|δ(φ) for aΨ for each Ψ ∈ J :

The rules above establish primitive manipulation capabilities for the solver. It arranges these components into the following higher-level, satisfiability-preserving transformations.

Assignment. When [l]J is realized to be a consequence of F (i.e.: for all Ψ ∈ J , it is Prop(F) ⊢ lΨ), the formula is simplified to F ∗ [l]J by assigning [l]J , i.e. resolving against [¬l]J and subsuming against [l]J .

• Equivalence reasoning. If the solver discovers a proof that [a] J↔[l] (i.e.: ∀Ψ∈J , Prop(F) ⊢ aΨ|δ(a)↔lΨ), it is entitled to simplify F by applying the substitution [l/a]J .

Redundancy removal. Subsumption is applied to eliminate subsumed clauses. This may heavily reduce the burden on the solver, while logical equivalence is preserved.

Variable elimination. The clauses containing a variable d are replaced by the set of resolvents of every clause containing d against each clause containing ¬d (Figure 3). Symbolic elimination rules out one symbolic variable, hence all the related ground variables at once.

As far as we are concerned, a solution-based evaluation procedure is an algorithm that produces a (memory and time affordable) sequence of instantiations of the above rules, and guarantees to end up with the empty formula on sat instances, and with a contradiction (an empty clause) on unsat formulas. Each step is a back-chaining reduction from a problem F ′ to a problem F. Hence, a model for the original instance is not directly extracted. Rather, satisfiability equivalence guarantees that at each step, should F have a model, than a model for F ′ could be (easily) derived.

This apparent drawback suddenly turns into an advantage. It indeed allows to decouple evaluation from model reconstruction, with almost no overhead for the former and a clear semantics for the latter. The two meshes of the chain are connected through an inference log, produced by the solver, and subsequently read by a model reconstructor.

Definition 5.3 (Inference log and trace) An inference log is a list of entries, each one describing an instantiation of one of the above sat-preserving transformations. It contains:

• 〈assign, l,J〉, for an assignment [l]J .
• 〈subst, a, l, J , G〉, for a substitution [l/a]J , where G is the set of clauses containing {a, ¬l} or {¬a, l}.
• 〈elim, d, G+, G-〉, for the elimination of d, where G+ and G- are the sets of clauses containing d and ¬d.

Let us denote with I(F, op) the formula obtained by applying to F the transformation described by the entry op. An inference log L = [op1, op2, . . . , opt] induces an inference trace [F0,F1, . . . ,Ft] where Fi = I(Fi-1, opi), with F0 = F. A log such that Ft is empty is called sat-log for F. Clearly, a sat-log for F exists iff F is sat. For example, the reader may verify that Figure (4) depicts a sat-log for (1).

5.4 Inductive model reconstruction

Once a sat-log is known, the reconstructor comes into play. It trusts the solver about the log being a sat-log, and parses it backward, reasoning by induction on the number of entries:

Base case. At the end of the inference trace we find the empty formula Ft, satisfied by an empty model Mt.

Inductive case. Given a modelMi for Fi, the reconstructor computes a model Mi-1 =R(Mi, opi) for Fi-1 by reasoning on how opi turned Fi-1 into Fi.

This leads to a model M0 for F, hence to a certificate for F , once the function R has been properly defined. Let us denote by i(F) .=∪ΓI∈FI the set of indexes mentioned in F.

Theorem 5.3 When applied to any sat-log for F, the inductive model reconstruction procedure defined by the following function R computes a model M0 for F0 = F.

Proof. For each op we show that R(M, op) |= F ′ , working under the inductive hypothesis of knowing a model M for F = I(F ′ , op) (i.e. F ∗M is the empty formula).

Assignment. F ∗M = (F ′ ∗ [l]I ) ∗M = F ′ ∗ ({[l]I }∪M) is empty, hence {[l]I}∪M satisfies F ′ .

Equivalence. Let F ′ be F ′0 ∪ F ′1 ∪ F ′2+ ∪ F ′2-, where no clause in F ′0 mentions e, all the clauses in F ′1 mention e but not l, ¬l; all the clauses in F ′2+ contain both e and l (or ¬e and ¬l), and the clauses in F ′2- contain e and ¬l (or ¬e and l). M satisfies F=F ′ [l/e]I=F0 ∪ (F ′1 ∪F ′2+)[l/e]I , hence it satisfies F ′0 = F0 with no modification. It also satisfies F ′1 ∪F ′2+ provided we mirror on e the assignments collected so far over l, by adding [e]I∩i(M,l) and [¬e]I∩i(M,¬l). In general, the resulting model M+ = M ∪ {[e]I∩i(M,l), [¬e]I∩i(M,¬l)} satisfies all the clauses in F ′ but some in F ′2-: By construction, such clauses failed to pass to F because F ′2-[l/e]I = G[l/e]I is empty (clauses satisfied by complementary e/¬l literals). To satisfy the (possibly) nonempty remaining set G ∗M+ of

#1 〈substitute, f, ¬e, {010, 011}, {[e, f]{010,011,110,111},

[¬e, ¬f ]{000,001,010,011}}〉

#2 〈assign, ¬e, {001, 011, 100, 110}〉

#3 〈resolve, f, {[f]{110}, [c, f]{000,001}, [e, f]{111}},

{[¬c, ¬f ]{100,101,110,111}, [¬e, ¬f ]{000}}〉

#4 〈assign, e, {111}〉

#5 〈resolve, c, {[c]{00,01}}, {[¬c]{10,11}}〉

Figure 4: A sat-log that solves the QBF (1).

clauses, we extendM+ by applying the ext s function: It adds an arbitrary truth assignment to all (and only) the indexes for e mentioned in G ∗M+, i.e. it adds [e]i(G∗M+).

Variable elimination. We focus on the insightful groundcase proof (see Figure 3). The extension to the symbolic case is a matter of notation. Suppose that the model M for F satisfies at least one clause of each 〈Γ+i , Γ-j 〉 couple, i ∈ [1, n], j ∈ [1,m]. This implies that it either satisfies the whole set G+d =∧iΓ+i , or the whole G-d =∧iΓ-i , or both. Hence, we are free to choose a literal on d in such a way to satisfy F ′ : M ∪ {a} satisfies F ′ when G+d ∗M is non-empty, M∪{¬a} when G-d ∗M is non-empty, while M itself suffices when both sets are empty. Now, we show that every model M for F either satisfies at least one clause in each 〈Γ+i , Γ-j 〉 couple, or can be extended to a model ext e (M) that fulfills this property. The former case happens (at least) when no resolvent clause has been satisfied by complementary literals during variable elimination. In this case, F contains exactly m∗n resolvents, one for each couple in G+d ×G-d . Every model of a resolvent is valid for at least one of its resolving clauses, hence the thesis. Now, suppose that the couple 〈Γ+i , Γ-j 〉 is not satisfied byM. It follows that M doesn't model the resolvent of Γ+i and Γ-j , hence such resolvent failed to pass to F: It was satisfied by complementary literals on some still unassigned variable v ̸= d. A literal on v can be arbitrarily added to themodel under construction to satisfy either Γ+i or Γ-j (no conflict arises: v would have not appeared as unassigned if involved in any past-w.r.t. the solver's standpoint-inference step). This extension of M to ext e (M) is repeated until no unsatisfied couple is left. □

Examples: M ′ = {a, ¬b, c} is a model for F ′ = (¬a∨c) ∧ (a∨b∨¬c) ∧ (¬a∨¬b) because M = {a, ¬b} is a model for F = F ′ ∗ c = (a∨b) ∧ (¬a∨¬b). M ′ = {¬a, b, c} is a model for F ′ = (¬a∨c) ∧ (a∨b∨¬c) ∧ (¬a∨¬b) because M = {b, c} is a model for F ′ [¬c/a] = c ∧ (b∨¬c) ∧ (c∨¬b). In Figure 3, the assignment M1 ={a, b, c} satisfies F and also F ′ : d is left unassigned. The model M2={a, ¬b} satisfies G+d but not G-d , hence M ′=M2 ∪ {¬d} is constructed to satisfy F ′ . The couple 〈Γ+2 , Γ-1 〉 is untouched by M3={a}, so no truth value for d helps. But the resolvent of Γ+2 and Γ-1 was satisfied by complementary literals on b, so we construct ext e (M3)= M3 ∪ {b}, then satisfy F ′ with M ′ = ext e (M3) ∪ {¬d} = {a, b, ¬d}. As a complete example, the reader may verify that by performing inductive model reconstruction according to the rules given in Theorem 5.3 over the sat-log in Figure 4 for the SymbSk(F) in Figure 2, a model is extracted which through Theorem 5.2 produces the sat-certificate in Figure 1.

6 Discussion and Conclusions

We presented a solution to an open question on QBFs, namely the problem of representing, verifying and extracting their sat-certificates. The importance of such solution is twofold: It gives means of conveying solver-independent evidence of satisfiability, and enables the extraction of precious information from certified formulas. The former feature can be used, for example, to effectively test the decisions of QBF solvers. The latter contribution is valuable to applications, in that a certificate is needed to exemplify a definite scenario in which QBF-encoded problems reveal their satisfiability. For example, a sat-answer suffices to know that at least one winning strategy exists in a QBF-encoded two-player game, but it takes a certificate to exhibit an actual strategy.

Stand-alone certificates convey no self-contained semantics, as the meaning of each variable is a piece of information held by the "encoders". To allow semantics' owners to interrogate their own QBF models, we have implemented a solver/verifier suite [Benedetti, 2004b; 2004a] to produce, verify, dump to file (in open formats), and query certificates.

This implementation is helping to shed light on further open questions on QBFs. For example: Is QBF certification impractical? Let us define the certification of F "impractical" when it is affordable to solve F while it is not feasible to memorize and/or verify any certificate C(F). Our approach suggests that impracticality is not an issue. For instance, the certificates in Table 1 are well within the manipulation capabilities of current machines, while the formulas they certify are hard for present solvers 3 . Another crucial question we are enabled to address is the following: Given a certificate C for F, how much in practice the trio 〈F, C, verify〉 improves on the couple 〈F, decide〉 as a means to prove that F is sat? Metrics such as the time · space product will be used to precisely compare the two strategies. Our results already suggest that the improvement is quite large, as exemplified in Table 1.

We observed a surprising phenomenon: The time taken to reconstruct a model may overcome the time needed to solve the instance. This is rather unusual when compared, for example, with search-based SAT reasoning, where a model is extracted with no overhead on the satisfiability decision. Conversely, we have not yet observed an expected phenomenon: checkValidity would operate in polynomial time should we employ a constant-time BDD oracle. The non-polynomiality of verification stems from the size of the forest of BDDs, which should grow exponentially for some parametrically scalable family of instances. This unfavorable phenomenon doesn't show up in Table 1: Certificates scale up polynomially with instance size. These effects and upper bounds on the certificate size will be further investigated.

We showed how to extract certificates using a particular class of QBF solvers (the skolemization-based ones). However, the BDD-based representation we employ is solverindependent. It comes out that not only the mere representation but also the technique for constructing certificates can be lifted to work with other families of QBF-solvers. The key ingredient stays the same: Inductive model reconstruction detached from instance evaluation, with an inference log in between. What changes is the kind of information recorded in the log (and the way it is to be interpreted).

3 The "adder" family belongs to a set of benchmarks related to equivalence checking of partial implementations of circuits, and is regarded as extremely challenging [Le Berre et al., 2004]

We are extending our technique towards solvers based on (1) non-symbolic q-resolution, (2) SAT reasoning, and (3) symbolic/non-symbolic DPLL-like branching reasoning. The ultimate goal is to build a QBF model reconstructor able to extract certificates by interpreting generic QBF inference logs 4 , whichever the evaluation strategy adopted to solve the instance (including hybrid strategies such as the one leveraged by the QBF solver sKizzo [Benedetti, 2004b]).

Acknowledgments

We thank Amedeo Cesta and Gigina Aiello for their comments on how to improve the organization of the paper, Marco Cadoli for helpful discussions on technical issues, and the anonymous referees for their precious remarks.