\documentclass[t]{beamer}
\mode<presentation>

\newcommand{\lecnumber}{11}

\include{cocmacros}
\newcommand{\uuline}[1]{\underline{\underline{#1}}}
\newcommand{\ures}[3]{
  \begin{array}{c@{\hspace*{2em}}c} 
    #1 & #2 \\ \hline \multicolumn{2}{c}{#3} 
  \end{array}}
\newcommand{\uex}{\underline{Example}}
\newcommand{\un}{\underline{Note}}
\newcommand{\utitle}[1]{\underline{#1}\\\smallskip}

\title{\lecnumber. Arrays}
\date{}
\institute[Stanford University]

\begin{document}

\setbeamertemplate{footline}[text line]
{
	%\begin{large}
	\hspace*{\stretch{1}}\lecnumber - \insertframenumber \bigskip
	%\end{large}
}

\begin{frame}[c]
\Large
\textsc{The Calculus of Computation:}\\
Decision Procedures with\\
Applications to Verification

\bigskip
\bigskip
by\\
Aaron Bradley\\
Zohar Manna

\bigskip
\bigskip
Springer 2007
\end{frame}

\begin{frame}
	\titlepage
\end{frame}

\begin{frame}
(2) \utitle{Array Property Fragment of $\tarr$}

Decidable fragment of $\tarr$ that includes $\forall$ quantifiers

\medskip
\underline{Array property}\\
\smallskip
 $\sarr$-formula of form
 \[
 \forall \vi.\ F[\vi] \bimplies G[\vi]~,
 \]
where $\vi$ is a list of variables.
\begin{itemize}
\item \underline{index guard} $F[\vi]$:
\[
\begin{array}{r@{~~\rightarrow~~}l}
\mathsf{iguard} & \mathsf{iguard} \band \mathsf{iguard}\
|\ \mathsf{iguard} \bor \mathsf{iguard}\ |\ \mathsf{atom} \\
\mathsf{atom} & \mathsf{var} = \mathsf{var}\ |\ \mathit{evar} \ne \mathsf{var}\ |\ \mathsf{var} \ne \mathit{evar}\ |\ \true \\
\mathsf{var} & \mathit{evar}\ |\ \mathit{uvar}
\end{array}
\]
where {\it uvar} is any universally quantified index variable,\\
 and {\it evar} is any constant or unquantified variable.

\item \underline{value constraint} $G[\vi]$:
 a universally quantified index can occur in a value
constraint $G[\vi]$ only in a read $\ard{a}{i}$, where $a$ is an array
term.  The read cannot be nested; for example, $\ard{a}{\ard{b}{i}}$
is not allowed.

\end{itemize}


\end{frame}

\begin{frame}
\utitle{Array Property Fragment of $\tarr$}

Boolean combinations of quantifier-free $\tarr$-formulae and array properties

\bigskip
\uex: $\sarr$-formulae
\[
F:\ \forall i.\ i \ne \ard{a}{k} \bimplies \ard{a}{i} = \ard{a}{k}
\]
The antecedent is not a legal index guard since $\ard{a}{k}$ is not a variable
(neither a $\mathit{uvar}$ nor an $\mathit{evar}$); however, by simple
manipulation
\[
F':\ v = \ard{a}{k} \band \forall i.\ i \ne v \bimplies \ard{a}{i} = \ard{a}{k}
\]
Here, $i \ne v$ is a legal index guard, and $\ard{a}{i} = \ard{a}{k}$
is a legal value constraint.  $F$ and $F'$ are equisatisfiable.

However, no manipulation works for:
\[
G:\ \forall i.\ i \ne \ard{a}{i} \bimplies \ard{a}{i} = \ard{a}{k}~.
\]
Thus, $G$ is not in the array property fragment.

\end{frame}

\begin{frame}
\underline{Remark}: Array property fragment allows expressing equality between arrays
(\underline{extensionality}): two arrays are equal
precisely when their corresponding elements are equal.

\medskip
  For given formula
\[
F:\ \cdots \band a = b \band \cdots
\]
with array terms $a$ and $b$, rewrite $F$ as
\[
F':\ \cdots \band (\forall i.\ \true \bimplies \ard{a}{i} = \ard{b}{i}) \band \cdots~.
\]
$F$ and $F'$ are equisatisfiable.
\end{frame}

\begin{frame}
\utitle{Decision Procedure for Array Property Fragment}

The idea of the decision procedure for the array property fragment is
to reduce universal quantification to finite conjunction.  That is, it
constructs a \underline{finite set of index terms} s.t. examining only these
positions of the arrays is sufficient.

\medskip
\uex: Consider
\\ \qquad $F:\ \awt{a}{i}{v} = a \band \ard{a}{i} \ne v~,$\\
which expands to
\\ \qquad $F':\ \forall j.\ \ard{\awt{a}{i}{v}}{j} = \ard{a}{j} \band \ard{a}{i} \ne v~.$\\
Intuitively, to determine that $F'$ is $\tarr$-unsatisfiable requires
merely examining index $i$:
\\ \qquad $\displaystyle F'':\ \left(\bigwedge_{j \in \set{i}} \ard{\awt{a}{i}{v}}{j} = \ard{a}{j}\right) \band \ard{a}{i} \ne v~,$\\
or simply
\\ \qquad $\ard{\awt{a}{i}{v}}{i} = \ard{a}{i} \band \ard{a}{i} \ne v~.$\\
Simplifying,
\\ \qquad $v = \ard{a}{i} \band \ard{a}{i} \ne v~,$\\
it is clear that this formula, and thus $F$, is $\tarr$-unsatisfiable.

\end{frame}

\newcommand{\iset}{{\mathcal{I}}}
\begin{frame}[shrink=5]
\utitle{The Algorithm}

Given array property formula $F$, decide its $\tarr$-satisfiability by
the following steps:

\smallskip
{\bf Step 1}

Put $F$ in NNF.

\smallskip
{\bf Step 2}

Apply the following rule exhaustively to remove writes:\\
\smallskip
$\begin{array}{c}
F[\awt{a}{i}{v}] \\
\hline
F[a'] \band a'[i] = v \band
(\forall j.\ j \ne i \bimplies a[j] = a'[j])
\end{array}~
\mbox{for fresh $a'$}
~~~~
(\mathsf{write})$\\
\smallskip
After an application of the rule, the resulting formula
contains at least one fewer write terms than the given formula.

\smallskip
{\bf Step 3}

Apply the following rule exhaustively to remove existential
quantification:\\
\smallskip
\qquad $\begin{array}{c}
F[\exists \vi.\ G[\vi]] \\
\hline
F[G[\vectr{j}]]
\end{array}\
\mbox{for fresh $\vectr{j}$}
~~~~
(\mathsf{exists})$\\
\smallskip
Existential quantification can arise during Step 1 if the given
formula has a negated array property.

\end{frame}

\begin{frame}[shrink=5]

Steps 4-6 accomplish the reduction of universal quantification to
finite conjunction.\\
Main idea: select a set of symbolic
index terms on which to instantiate all universal quantifiers.  The
set is sufficient for correctness.

\medskip
{\bf Step 4}

From the output $F_3$ of Step 3, construct the \defn{index set}
$\iset$:\\
\[
\iset\ =\
\begin{array}{@{}l@{\ }l@{}}
     & \set{\lambda} \\
\cup & \set{t\ :\ \cdot[t] \in F_3\ \mbox{such that $t$ is not a universally quantified variable}} \\
\cup & \set{t\ :\ \mbox{$t$ occurs as an {\it evar} in the parsing of index guards}}
\end{array}
\]
This index set is the finite set of indices that need to be examined.
It includes
\begin{itemize}
\item all terms $t$ that occur in some read $\ard{a}{t}$
anywhere in $F$ (unless it is a universally quantified variable)
\item all terms $t$ (constant or unquantified variable) that are compared to a universally quantified variable
in some index guard.  
\item $\lambda$ is a fresh constant that represents
all other index positions that are not explicitly in $\iset$.
\end{itemize}
\end{frame}

\begin{frame}
{\bf Step 5} (Key step)

Apply the following rule exhaustively to remove universal
quantification:
\[
\begin{array}{c}
H[\forall \vi.\ F[\vi] \bimplies G[\vi]] \\ \hline {\displaystyle
H\left[\bigwedge_{\vi \in \iset^n} \left(F[\vi] \bimplies
G[\vi]\right) \right]}
\end{array}~~~~
\begin{array}{@{}c@{}}
(\mathsf{forall}) \\
\vspace{3.5ex}
\end{array}
\]
where $n$ is the size of the list of quantified variables $\vi$.

\medskip
{\bf Step 6}

From the output $F_5$ of Step 5, construct
\[
F_6:\ F_5 \band \bigwedge_{i\ \in\ \iset \setminus \set{\lambda}} \lambda \ne i~.
\]
The new conjuncts assert that the variable $\lambda$ introduced in Step
4 is indeed unique.

\medskip
{\bf Step 7}

Decide the $\tarr$-satisfiability of $F_6$ using the decision
procedure for the quantifier-free fragment.

\end{frame}

\begin{frame}
\uex: Consider array property formula
\[
F:\ \ard{\awt{a}{\ell}{v}}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v \band 
\underbrace{(\forall i.\ i \ne \ell \bimplies \ard{a}{i} = \ard{b}{i})}_{\mbox{array property}}
\]
Index guard is $i \ne \ell$ and the value constraint is
$\ard{a}{i} = \ard{b}{i}$.  It is already in NNF.  By Step
2, rewrite $F$ as
\[
F_2:\
\begin{array}{@{}c@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v \band (\forall i.\ i \ne \ell \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band \ard{a'}{\ell} = v \band (\forall j.\ j \ne \ell \bimplies \ard{a}{j} = \ard{a'}{j})
\end{array}
\]
$F_2$ does not contain any existential quantifiers.  Its index set is
\[
\begin{array}{@{}rcl@{}}
\iset & = & \set{\lambda}\ \cup\ \set{k}\ \cup\ \set{\ell} \\
      & = & \set{\lambda,k,\ell}~.
\end{array}
\]
Thus, by Step 5, replace universal quantification:
\[
F_5:\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v \band {\displaystyle \bigwedge_{i\ \in\ \iset} \left(i \ne \ell \rightarrow \ard{a}{i} = \ard{b}{i}\right)} \\
\mbox{} \band \ard{a'}{\ell} = v \band {\displaystyle \bigwedge_{j\ \in\ \iset} \left(j \ne \ell \bimplies \ard{a}{j} = \ard{a'}{j}\right)}
\end{array}
\]

\end{frame}

\begin{frame}
\[
F_5:\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v \band {\displaystyle \bigwedge_{i\ \in\ \iset} \left(i \ne \ell \rightarrow \ard{a}{i} = \ard{b}{i}\right)} \\
\mbox{} \band \ard{a'}{\ell} = v \band {\displaystyle \bigwedge_{j\ \in\ \iset} \left(j \ne \ell \bimplies \ard{a}{j} = \ard{a'}{j}\right)}
\end{array}
\]
Expanding produces
\[
F_5':\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{b}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{b}{k})
\band (\ell \ne \ell \bimplies \ard{a}{\ell} = \ard{b}{\ell}) \\
\mbox{} \band \ard{a'}{\ell} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{a'}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{a'}{k})
\band (\ell \ne \ell \bimplies \ard{a}{\ell} = \ard{a'}{\ell})
\end{array}
\]
Simplifying produces
\[
F_5'':\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{b}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{b}{k}) \\
\mbox{} \band \ard{a'}{\ell} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{a'}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{a'}{k})
\end{array}
\]

\end{frame}

\begin{frame}
Step 6 distinguishes $\lambda$ from other members of $\iset$:
\[
F_6:\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{b}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{b}{k}) \\
\mbox{} \band \ard{a'}{\ell} = v
\band (\lambda \ne \ell \bimplies \ard{a}{\lambda} = \ard{a'}{\lambda}) \\
\mbox{} \band (k \ne \ell \bimplies \ard{a}{k} = \ard{a'}{k}) \\
\mbox{} \band \lambda \ne k \band \lambda \ne \ell
\end{array}
\]
Simplifying,
\[
F_6':\
\begin{array}{@{}l@{}}
\ard{a'}{k} = \ard{b}{k} \band \ard{b}{k} \ne v \band \ard{a}{k} = v \\
\mbox{} \band \ard{a}{\lambda} = \ard{b}{\lambda}
\band (k \ne \ell \bimplies \ard{a}{k} = \ard{b}{k}) \\
\mbox{} \band \ard{a'}{\ell} = v \band \ard{a}{\lambda} = \ard{a'}{\lambda}
\band (k \ne \ell \bimplies \ard{a}{k} = \ard{a'}{k}) \\
\mbox{} \band \lambda \ne k \band \lambda \ne \ell
\end{array}
\]
There are two cases to consider.  
\begin{itemize}
\item If $k = \ell$, then $\ard{a'}{\ell}
= v$ and $\ard{a'}{k} = \ard{b}{k}$ imply $\ard{b}{k} = v$, yet
$\ard{b}{k} \ne v$.  
\item If $k \ne \ell$, then $\ard{a}{k} = v$ and
$\ard{a}{k} = \ard{b}{k}$ imply $\ard{b}{k} = v$, but again
$\ard{b}{k} \ne v$.
\end{itemize}
Hence, $F_6'$ is $\tarr$-unsatisfiable,
indicating that $F$ is $\tarr$-unsatisfiable.

\end{frame}

\begin{frame}
(3) \utitle{Theory of Integer-Indexed Arrays $\tarrz$}
\medskip
$\le$ enables reasoning about subarrays and properties such as
subarray is sorted or partitioned.

\medskip
signature of $\tarrz$: $\sarrz = \sarr \cup \sint$\\
\medskip
axioms of $\tarrz$: both axioms of $\tarr$ and $\tint$

\end{frame}

\begin{frame}
\underline{Array property}: $\sarrz$-formula of the form\\
\smallskip
\qquad $\forall \vi.\ F[\vi] \bimplies G[\vi]~,$\\
\smallskip
where $\vi$ is a list of integer variables.
\begin{itemize}
\item $F[\vi]$ \underline{index guard}:\\
\qquad $\begin{array}{r@{~~\rightarrow~~}l}
\mathsf{iguard} & \mathsf{iguard} \wedge \mathsf{iguard}\
|\ \mathsf{iguard} \vee \mathsf{iguard}\ |\ \mathsf{atom} \\
\mathsf{atom} & \mathsf{expr} \le \mathsf{expr}\
|\ \mathsf{expr} = \mathsf{expr} \\
\mathsf{expr} & \mathit{uvar}\ |\ \mathsf{pexpr} \\
\mathsf{pexpr} & \mathsf{pexpr'} \\
\mathsf{pexpr'} & \integers\ |\ \integers \cdot \mathit{evar}\
|\ \mathsf{pexpr'} + \mathsf{pexpr'}
\end{array}$\\
where {\it uvar} is any universally quantified integer variable,\\
and {\it evar} is any existentially quantified or free integer variable.
\item $G[\vi]$ \underline{value constraint}:\\
Any occurrence of a quantified index variable $i$ must be as a read into
an array, $\ard{a}{i}$, for array term $a$.  Array reads may not be
nested; \eg, $\ard{a}{\ard{b}{i}}$ is not allowed.
\end{itemize}
\underline{Array property fragment of $\tarrz$} consists of
formulae that are Boolean combinations of quantifier-free
$\sarrz$-formulae and array properties.

\end{frame}

\begin{frame}
\utitle{A Decision Procedure}

The idea again is to reduce universal quantification to finite conjunction.\\
Given $F$ from the array property fragment of $\tarrz$, decide its
$\tarrz$-satisfiability as follows:

\medskip
{\bf Step 1}

Put $F$ in NNF.

\medskip
{\bf Step 2}

Apply the following rule exhaustively to remove writes:
\[
\begin{array}{c}
F[\awt{a}{i}{e}] \\
\hline
F[a'] \band \ard{a'}{i} = e \band
(\forall j.\ j \ne i \bimplies \ard{a}{j} = \ard{a'}{j})
\end{array}~
\mbox{for fresh $a'$}
~~~~
(\mathsf{write})
\]
To meet the syntactic requirements on an index guard, rewrite the
third conjunct as
\[
\forall j.\ j \le i - 1 \bor i + 1 \le j \bimplies \ard{a}{j} = \ard{a'}{j}~.
\]

\end{frame}

\begin{frame}
{\bf Step 3}

Apply the following rule exhaustively to remove existential
quantification:
\[
\begin{array}{c}
F[\exists \vi.\ G[\vi]] \\
\hline
F[G[\vectr{j}]]
\end{array}\
\mbox{for fresh $\vectr{j}$}
~~~~
(\mathsf{exists})
\]
Existential quantification can arise during Step 1 if the given
formula has a negated array property.

\medskip
{\bf Step 4}

From the output of Step 3, $F_3$, construct the index set $\iset$:
\[
\iset\ =\
\begin{array}{@{}l@{\ }l@{}}
     & \set{t\,:\,\cdot[t] \in F_3\ \mbox{such that $t$ is not a universally quantified variable}} \\
\cup & \set{t\,:\,\mbox{$t$ occurs as a {\sf pexpr} in the parsing of index guards}}
\end{array}
\]
If $\iset = \emptyset$, then let $\iset = \set{0}$.  The index set
contains all relevant symbolic indices that occur in $F_3$.

\end{frame}

\begin{frame}
{\bf Step 5}

Apply the following rule exhaustively to remove universal
quantification:
\[
\begin{array}{c}
H[\forall \vi.\ F[\vi] \bimplies G[\vi]] \\
\hline
{\displaystyle
H\left[\bigwedge_{\vi \in \iset^n}
\left(F[\vi] \bimplies G[\vi]\right)
\right]}
\end{array}~~~~
\begin{array}{@{}c@{}}
(\mathsf{forall}) \\
\vspace{3.5ex}
\end{array}
\]
$n$ is the size of the block of universal quantifiers over
$\vi$.

\medskip
{\bf Step 6}

$F_5$ is quantifier-free in the combination theory $\tarr \cup \tint$.  Decide the $(\tarr \cup
\tint)$-satisfiability of the resulting formula.
\end{frame}

\begin{frame}
\uex: $\sarrz$-formula:
\[
F:\
\begin{array}{l}
(\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band
\bnot(\forall i.\ \ell \le i \le u+1 \bimplies \ard{\awt{a}{u+1}{\ard{b}{u+1}}}{i} = \ard{b}{i})
\end{array}
\]
In NNF, we have
\[
F_1:\
\begin{array}{l}
(\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band
(\exists i.\ \ell \le i \le u+1 \band \ard{\awt{a}{u+1}{\ard{b}{u+1}}}{i} \ne \ard{b}{i})
\end{array}
\]
Step 2 produces
\[
F_2:\
\begin{array}{l}
(\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band
(\exists i.\ \ell \le i \le u+1 \band \ard{a'}{i} \ne \ard{b}{i}) \\
\mbox{} \band
\ard{a'}{u+1} = \ard{b}{u+1} \\
\mbox{}\band
(\forall j.\ j \le u+1-1 \bor u+1+1 \le j \bimplies \ard{a}{j} = \ard{a'}{j})
\end{array}
\]

\end{frame}

\begin{frame}
Step 3 removes the existential quantifier by introducing a fresh
constant $k$:
\[
F_3:\
\begin{array}{l}
(\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band
\ell \le k \le u+1 \band \ard{a'}{k} \ne \ard{b}{k} \\
\mbox{} \band
\ard{a'}{u+1} = \ard{b}{u+1} \\
\mbox{} \band (\forall j.\ j \le u+1-1 \bor u+1+1 \le j \bimplies \ard{a}{j} = \ard{a'}{j})
\end{array}
\]
Simplifying,
\[
F_3':\
\begin{array}{l}
(\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}) \\
\mbox{} \band
\ell \le k \le u+1 \band \ard{a'}{k} \ne \ard{b}{k} \\
\mbox{} \band
\ard{a'}{u+1} = \ard{b}{u+1} \\
\mbox{} \band (\forall j.\ j \le u \bor u+2 \le j \bimplies \ard{a}{j} = \ard{a'}{j})
\end{array}
\]
The index set is
\[
\iset = \set{k,u+1}\ \cup\ \set{\ell,u,u+2}~,
\]
which includes the read terms $k$ and $u+1$ and the terms $\ell$, $u$,
and $u+2$ that occur as {\sf pexpr}s in the index guards.
\end{frame}

\begin{frame}
 Step 5
rewrites universal quantification to finite conjunction over this set:
\[
F_5:\
\begin{array}{l}
{\displaystyle \bigwedge_{i\ \in\ \iset} (\ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i})} \\
\mbox{} \band
\ell \le k \le u+1 \band \ard{a'}{k} \ne \ard{b}{k} \\
\mbox{} \band
\ard{a'}{u+1} = \ard{b}{u+1} \\
\mbox{} \band {\displaystyle \bigwedge_{j\ \in\ \iset} (j \le u \bor u+2 \le j \bimplies \ard{a}{j} = \ard{a'}{j})}
\end{array}
\]

Expanding the conjunctions according to the index set $\iset$ and
simplifying according to trivially $\truev$ or $\falsev$ antecedents
(\eg, $\ell \le u+1 \le u$ simplifies to $\false$, while $u \le u \bor
u+2 \le u$ simplifies to $\true$) produces:
\end{frame}

\begin{frame}
\[
F_5':\
\begin{array}{ll}
(\ell \le k \le u \bimplies \ard{a}{k} = \ard{b}{k}) & (1)\\
\mbox{} \band
(\ell \le u \bimplies \ard{a}{\ell} = \ard{b}{\ell} \band \ard{a}{u} = \ard{b}{u}) & (2)\\
\mbox{} \band
\ell \le k \le u+1 & (3)\\
\mbox{} \band \ard{a'}{k} \ne \ard{b}{k} & (4)\\
\mbox{} \band
\ard{a'}{u+1} = \ard{b}{u+1} & (5)\\
\mbox{} \band
(k \le u \bor u+2 \le k \bimplies \ard{a}{k} = \ard{a'}{k}) & (6)\\
\mbox{} \band
(\ell \le u \bor u+2 \le \ell \bimplies \ard{a}{\ell} = \ard{a'}{\ell}) & (7)
\\
\mbox{} \band
\ard{a}{u} = \ard{a'}{u} \band
\ard{a}{u+2} = \ard{a'}{u+2} & (8)
\end{array}
\]

$(\tarr \cup \tint)$-unsatisfiability of this quantifier-free $(\sarr
\cup \sint)$-formula can be decided using the techniques of
Combination of Theories.\\
Informally, $\ell \le k \le u+1$ (3)
\begin{itemize}
\item If $k \in [\ell,u]$ then $\ard{a}{k} = \ard{b}{k}$ (1).
Since $k \le u$ then $\ard{a}{k} = \ard{a'}{k}$ (6), contradicting $\ard{a'}{k}
\ne \ard{b}{k}$ (4).
\item if $k = u+1$,
$\ard{a'}{k} \ne \ard{b}{k} = \ard{b}{u+1} = \ard{a'}{u+1} =
\ard{a'}{k}$ by (4) and (5), a contradiction.
\end{itemize}
Hence, $F$ is $\tarrz$-unsatisfiable.

\end{frame}

\begin{frame}
Application: array property fragments
\begin{itemize}
\item Array equality $a = b$ in $\tarr$:
\[
\forall i.\ \ard{a}{i} = \ard{b}{i}
\]
\item Bounded array equality $\pbeq(a,b,\ell,u)$ in $\tarrz$:
\[
\forall i.\ \ell \le i \le u \bimplies \ard{a}{i} = \ard{b}{i}
\]
\item Universal properties $F[x]$ in $\tarr$:
\[
\forall i.\ F[\ard{a}{i}]
\]
\item Bounded universal properties $F[x]$ in $\tarrz$:
\[
\forall i.\ \ell \le i \le u \bimplies F[\ard{a}{i}]
\]
\item Bounded and unbounded sorted arrays $\psort(a,\ell,u)$ in $\tarrz
\cup \tint$ or $\tarrz \cup \trat$:
\[
\forall i,j.\ \ell \le i \le j \le u \bimplies \ard{a}{i} \le \ard{a}{j}
\]
\item Partitioned arrays $\ppart(a,\ell_1,u_1,\ell_2,u_2)$ in $\tarrz
\cup \tint$ or $\tarrz \cup \trat$:
\[
\forall i,j,\ \ell_1 \le i \le u_1 < \ell_2 \le j \le u_2 \bimplies \ard{a}{i} \le \ard{a}{j}
\]
\end{itemize}

\end{frame}

\end{document}
