The Power of Regular Constraint Propagation (Technical Report)

TL;DR

This paper introduces a generic regular constraint propagation method for string solving, demonstrating its theoretical soundness and completeness, and showing significant practical performance improvements in a solver.

Contribution

It proposes a simple, generic string solving technique based on regular constraint propagation, with theoretical guarantees and practical implementation showing improved solver performance.

Findings

RCP is sound and complete for a large fragment of string constraints.

Implementation in OSTRICH improves performance and competitiveness.

Outperforms other solvers on random PCP and bioinformatics benchmarks.

Abstract

The past decade has witnessed substantial developments in string solving. Motivated by the complexity of string solving strategies adopted in existing string solvers, we investigate a simple and generic method for solving string constraints: regular constraint propagation. The method repeatedly computes pre- or post-images of regular languages under the string functions present in a string formula, inferring more and more knowledge about the possible values of string variables, until either a conflict is found or satisfiability of the string formula can be concluded. Such a propagation strategy is applicable to string constraints with multiple operations like concatenation, replace, and almost all flavors of string transductions. We demonstrate the generality and effectiveness of this method theoretically and experimentally. On the theoretical side, we show that RCP is sound and complete for a large fragment of string constraints, subsuming both straight-line and chain-free constraints, two of the most expressive decidable fragments for which some modern string solvers provide formal completeness guarantees. On the practical side, we implement regular constraint propagation within the open-source string solver OSTRICH. Our experimental evaluation shows that this addition significantly improves OSTRICH's performance and makes it competitive with existing solvers. In fact, it substantially outperforms other solvers on random PCP and bioinformatics benchmarks. The results also suggest that incorporating regular constraint propagation alongside other techniques could lead to substantial performance gains for existing solvers.

Tables

Table 1. Table 1 : Solver results on the motivating examples in Section  0.2 . ✓= solved, ✗= timeout or unknown.

Solver	String Sanitization	PCP	Bioinformatics
RCP	✓	✓	✓
cvc5	✗	✗	✗
OSTRICH	✗	✗	✓
Z3	✗	✗	✗
Z3-alpha	✗	✗	✗
Z3-Noodler	✗	✗	✗

Table 2. Table 2 : Comparison of various solvers’ performance on 2000 SMT-LIB’24 benchmarks, 1000 PCP benchmarks, and 1000 Bioinformatics benchmarks. For SMT-LIB’24, we report the number of satisfiable (Sat), unsatisfiable (Unsat), and unknown (Unknown) instances, along with total solving time (Time(s)), including timeouts. For PCP and Bioinformatics, we report the number of solved instances and total solving time. For all benchmarks, we conservatively assign a time of 60 seconds to each unknown result, even if the solver terminated earlier.

	SMT-LIB’24				PCP		Bioinformatics
	Sat	Unsat	Unknown	Time(s)	Solved	Time(s)	Solved	Time(s)
RCP	1071	728	201	15416.8	901	7308.7	1000	5532.6
cvc5	1162	716	122	7954.3	0	60000.0	0	-
OSTRICH-BASE	833	653	514	32298.7	0	60000.0	1000	2596.2
OSTRICH-COMP	1009	733	258	22840.7	0	60000.0	1000	3911.0
Z3	1156	730	114	8286.0	0	60000.0	0	60000.0
Z3-alpha	1127	724	149	10681.2	0	60000.0	0	60000.0
Z3-Noodler	1236	749	15	797.0	0	60000.0	0	60000.0

Table 3. Table 3 : Benchmark Results for Different Solver Combinations. For each benchmark suite, we report the number of benchmarks left unknown by the portfolio (U), the additional benchmarks solved by RCP (C), and the resulting Improvement (I), defined as C C + U \displaystyle\frac{\text{C}}{\text{C}+\text{U}} . The last four rows below show additional RCP contribution when added to solvers already combined with OSTRICH-BASE (OB).

	SMT-LIB’24 (2000)			PCP (1000)			Bioinformatics (1000)
Solver Combination	U	C	I	U	C	I	U	C	I
RCP	201	–	–	99	–	–	0	–	–
cvc5 + RCP	61	61	0.50	99	901	0.90	0	1000	1.00
OSTRICH-COMP + RCP	68	197	0.74	99	901	0.90	0	0	0.00
Z3 + RCP	85	29	0.25	99	901	0.90	0	1000	1.00
Z3-alpha + RCP	87	65	0.43	99	901	0.90	0	1000	1.00
Z3-Noodler + RCP	11	4	0.27	99	901	0.90	0	1000	1.00
(cvc5 + OB) + RCP	61	2	0.03	99	901	0.90	0	0	0.00
(Z3 + OB) + RCP	85	5	0.06	99	901	0.90	0	0	0.00
(Z3-alpha + OB) + RCP	87	8	0.08	99	901	0.90	0	0	0.00
(Z3-Noodler + OB) + RCP	4	0	0.00	99	901	0.90	0	0	0.00

Equations

$$\text{decimal}\in \text{decimalReg}\wedge \text{mbox}$$

$$\text{decimal}=f_{\text{trim}}(\text{input})\wedge \text{mbox}$$

$$\text{decimal}=\text{integer}++\text{"."}++\text{fractional}\wedge \text{mbox}$$

$$\text{result}=g_{\text{lead}}\text{(integer)}++\text{"."}++g_{\text{trail}}\text{(fractional)}\wedge \text{mbox}$$

$$\text{result}\notin \text{correctFormat}$$

$$\text{x}\in {\text{"2"}}^{+}\wedge \text{y}=\text{replaceAll}(\text{x},\text{"2"},\text{"10"})\wedge$$

$$\text{z}=\text{replaceAll}(\text{x},\text{"2"},\text{"01"})\wedge \text{y}=\text{z}$$

$$\text{x}=\text{"TGAGTAT..."}\wedge$$

$$\text{y1}=\text{replaceAll}(\text{y},\text{"u"},\text{"A"})\wedge$$

$$\text{y2}=\text{replaceAll}(\text{y1},\text{"a"},\text{"T"})\wedge$$

$$\text{y3}=\text{replaceAll}(\text{y2},\text{"g"},\text{"C"})\wedge$$

$$\text{x}=\text{replaceAll}(\text{y3},\text{"c"},\text{"G"})\wedge$$

$$\text{z}=\text{"ucuc..."}\wedge$$

$$\psi ::=\varphi \mid \psi \wedge \psi \varphi ::=x\in e\mid x=f(x_1,\dots ,x_n)$$

$$\text{prftree}[r]ifL(e_1)\cap \cdots \cap L(e_n)=\varnothing \Gamma ,x\in e_1,\dots ,x\in e_n$$

$$\text{prftree}[r]ifL(e)=\bigcap _{i=1}^{n}L(e_i)\Gamma ,x\in e\Gamma ,x\in e_1,\dots ,x\in e_n$$

$$\text{prftree}[r]ifL(e)=f(L(e_1),\dots ,L(e_n))\Gamma ,x\in e,x=f(x_1,\dots ,x_n),x_1\in e_1,\dots ,x_n\in e_n\Gamma ,x_1\in e_1,\dots ,x_n\in e_n,x=f(x_1,\dots ,x_n)$$

$$\prftree[r]{\begin{array}[]{l}\text{if }f^{-1}(L(e))\\ \ =\bigcup^{k}_{i=1}(L(e^{i}_{1})\times\dots\times L(e^{i}_{n}))\end{array}}{\left\{\begin{array}[]{c}\Gamma,x\in e,x=f(x_{1},\dots,x_{n}),\\ x_{1}\in e^{i}_{1},\dots,x_{n}\in e^{i}_{n}\end{array}\right\}^{k}_{i=1}}{\Gamma,x\in e,x=f(x_{1},\dots,x_{n})}$$

$$(y\in a^{\ast }\wedge z\in a^{\ast }{b}^{\ast })\vee (y\in a^{\ast }{b}^{\ast }\wedge z\in b^{\ast }).$$

$$y=zu\wedge y=xx\wedge z\in b\wedge u\in a.$$

$$y=xx\wedge y\in a^{+}{b}^{+}.$$

$$\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},z)\wedge z\in L_z\wedge z=f(y_1,\dots ,y_n)\wedge \underset{i=1}{\overset{n}{\bigwedge }}{y}_i\in L_i$$

$$\equiv$$

$$\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},y_1,\dots ,y_n)\wedge z\in L_z\wedge z=f(y_1,\dots ,y_n)$$

$$\equiv \underset{j=1}{\overset{k}{\bigvee }}$$

$$\Gamma ,{\Gamma }^{\prime },y_1\in e_1,\dots ,y_n\in e_n,z=f(y_1,\dots ,y_n),$$

$$\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},z)\wedge z\in L_z\wedge z=f(y_1,\dots ,y_n)\wedge \underset{i=1}{\overset{n}{\bigwedge }}{y}_i\in L_i,$$

$$\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},z)\wedge z\in L_z\wedge z\in f(L_1,\dots L_n)\wedge \underset{i=1}{\overset{n}{\bigwedge }}{y}_i\in L_i.$$

$$\text{prftree}[r]\Gamma ,{\Gamma }^{\prime },z\in e,z=f(y_1,\dots ,y_n),y_1\in e_1,\dots ,y_n\in e_n\Gamma ,{\Gamma }^{\prime },y_1\in e_1,\dots ,y_n\in e_n,z=f(y_1,\dots ,y_n),$$

$$\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},y_1,\dots ,y_n)\wedge z\in L_z\wedge z=f(y_1,\dots ,y_n)$$

$$\underset{j=1}{\overset{k}{\bigvee }}\exists z\exists y_1,\dots ,y_n\varphi (\bar{x},y_1,\dots ,y_n)\wedge z\in L_z\wedge \underset{i=1}{\overset{n}{\bigwedge }}{y}_i\in L_{i,j}$$

$$\prftree[r]{}{\left\{\begin{array}[]{c}\Gamma,\Gamma^{\prime},z\in e,z=f(y_{1},\dots,y_{n}),\\ y_{1}\in e^{i}_{1},\dots,y_{n}\in e^{i}_{n}\end{array}\right\}^{k}_{i=1}}{\Gamma,\Gamma^{\prime},z\in e,z=f(y_{1},\dots,y_{n})}$$

$$xyxy=yxyx\wedge x\in a^{+}\wedge y\in a^{\ast }b{a}^{\ast }$$

$$\text{prftree}[r]ifL(e^{\prime })={\Sigma }^{\ast }\setminus L(e)\Gamma ,x\in e\Gamma ,x\in e^{\prime }\Gamma$$

$$\text{prftree}[r]\text{prfStackPremises}\Gamma [x/y],u[x/y]=v[x/y],\{y\in e{\}}_{e\in R_x\cup R_y}\{\Gamma [x/yx],x(u[x/yx])=v[x/yx],x\in e_x^i,y\in e_y^i{\}}_{i=1}^k\{\Gamma [y/xy],u[y/xy]=y(v[y/xy]),x\in e_x^i,y\in e_y^i{\}}_{i=k+1}^{\ell }\Gamma ,\{x\in e{\}}_{e\in R_x},\{y\in e{\}}_{e\in R_y},xu=yv$$

$$\exists x^{\prime }x=y{x}^{\prime }\wedge y\in L(e_y)\wedge x\in L(e_x)$$

Full text

0.1 Introduction

Strings are a fundamental data type in many programming languages, heavily utilized across popular languages like Python and JavaScript. These languages are often equipped with rich string libraries, enabling a programmer to “do more with less code”. However, string manipulation is error-prone, leading to security vulnerabilities such as cross-site scripting (XSS) [1, 2, 3]. Recent years have witnessed the emergence of string solving as a promising automated method for reasoning about string-manipulating programs, among others, the presence of security vulnerabilities like XSS. String solving has the theory of word equations as its foundation, a topic studied for over 50 years. While many decidability results have been established (e.g., [64, 45, 30, 10]), their underlying proofs are often intricate and remain difficult to implement in practice. The field also continues to face several long-standing open problems.

On the practical side of string solving, substantial progress has been made in recent years, with solvers adopting and optimizing foundational algorithms. A prevalent method remains the strategy of splitting word equations into multiple simpler equations, often combined with delayed handling of regular expressions [56, 62], and implemented in modern tools such as Z3, Z3-alpha, Z3-Noodler, and OSTRICH [38, 54, 30, 34]. This method, though effective, is far from straightforward: achieving good performance requires carefully crafted heuristics that determine the most efficient way to split equations and choose the branches to explore first, balancing the complexity and efficiency of the solving process. This is usually achieved by a combination of other reasoning rules (e.g. involving length, regular languages, etc.). Equation splitting is a fundamental method used by most existing string solvers.

While equation splitting has been the dominant strategy so far, an alternative technique grounded in constraint propagation (CP) [67] has also developed over time. The first major application of this approach in string constraint solving can be traced back approximately 20 years ago [41], with early work on regular constraint propagation (RCP) techniques over fundamental string functions such as length, concatenation, prefix, suffix and regular constraints. RCP, works by iteratively computing pre-images or post-images of regular languages under the string functions present in a formula, propagating regular constraints forwards and backwards. Propagation deduces increasingly more precise information about the possible values of string variables, until it either encounters a conflict, indicating that the formula is unsatisfiable, or reaches a point where the satisfiability of the string formula can be determined.

Over time, various solvers have incorporated RCP techniques to varying degrees, including STRANGER [74], CertiStr [47], OSTRICH [30, 28], and Z3-Noodler[33, 42, 24, 34]. However, these tools either lack completeness guarantees or support only restricted fragments.

Our work builds upon these prior efforts by refining and extending RCP techniques. We demonstrate that a subset of the proof system is sufficient to achieve completeness in the chain-free fragment, while also capturing more complex string functions such as replaceAll, transducers, reverse operations, and polyregular functions. Additionally, we provide an intuitive, algorithmic characterization of the chain-free fragment and analyze the limitations of the proof system, even when augmented with additional proof rules like equation splitting.

Contributions.

We formalize RCP as a subset of the proof system from [28]. Our first contribution is to show that RCP is complete for a large natural fragment of string constraints, which we call the orderable fragment. This fragment subsumes two of the largest known decidable fragments called the chain-free string constraint fragment [10] (over concatenation and rational transducer functions) and the straight-line fragment [30] (over a more general class of string functions satisfying some semantic conditions). In doing so, we discover a substantially simplified formulation of the chain-free fragment in [10]. Our second contribution is the implementation of RCP within the state-of-the-art solver OSTRICH [31]. We demonstrate a significant improvement in OSTRICH’s performance, and our experiments indicate that our RCP-based solver is the only string solver capable of solving random PCP benchmarks. Moreover, when combined with other solvers, our approach reduces the number of unsolved benchmarks by improvements ranging from 25% up to 74%, thereby complementing existing techniques. Finally, given the power of regular constraint propagation, it is natural to wonder if it can prove unsatisfiability for all unsatisfiable string constraints with only word equations and regular constraints, which would give rise to a simple alternative for complete algorithms (e.g. Makanin’s algorithm [56] and recompression algorithm [45]). Our third contribution is a result exhibiting this theoretical limitation of RCP, even together with some other commonly used proof rules. In particular, we enrich RCP with two simple proof rules: (1) Nielsen’s transformation rule (which can be used to show decidability quadratic word equations [39]), and (2) The “Cut” rule [28]. This essentially amounts to the proof system of [28] enriched with Nielsen’s transformation. We show that there are string constraints with concatenation and regular constraints that are unsatisfiable but cannot be proved using only RCP, Nielsen, and Cut. To the best of our knowledge, this constitutes one of the handful of impossibility results for a string solving strategy, especially with a rich set of proof rules.

Organization.

The paper is structured as follows. Section 0.2 gives three motivating examples. Section 0.3 formalizes regular constraint propagation as a proof system. Section 0.4 discusses completeness and decidability. Theoretical limitations are addressed in Section 0.5. Finally, Section 0.6 presents experimental results, Section 0.7 discusses related work and Section 0.8 concludes with remarks on future work.

0.2 Motivating Examples

0.2.1 String Sanitization

To motivate the challenges in reasoning about real-world string-processing programs, we consider a transformation that normalizes decimal strings by first applying sanitization and then rewriting and restructuring the content.

Consider the function shown in Figure 1, which takes a string representation of a decimal number, removes leading and trailing whitespace, eliminates redundant zeros, and ensures a canonical form. The function would, for instance, normalize " 000123.45000 " to "123.45". This function can be fully expressed as a string constraint and solved within a constraint-solving framework. By adding an assertion that the output must be in normalized form, a solver can determine whether all inputs correctly transform into their canonical representation. This enables automated reasoning about the correctness and behavior of the function, allowing us to verify that any input will always yield a properly formatted decimal number.

It should be noted that the string transformations in Figure 1 are challenging for existing SMT solvers. With the most widely used SMT solvers, Z3 [38] andf cvc5 [17], the decimal.match step could only be modeled using the operations str.indexof and str.substr. Z3, cvc5 and Z3-noodler are not complete for string constraints involving those operations, however, so that no guarantees can be given that the solvers are able to verify desired properties of the normalize function. Related work implemented in the SMT solver OSTRICH [28] supports similar functionality using prioritized streaming transducers. These transducers can express the decimal.match operation, but result in a more complex and comparatively slower solving procedure. We show that RCP gives rise to a much simpler decision procedure that is still able to precisely model the transformations in Figure 1.

The function can be expressed in terms of functional transformations. The first step applies a trimming function $f_{\text{trim}}$, which removes leading and trailing whitespace. The result is then decomposed into an integer part $y$ and a fractional part $z$, separated by a decimal point. The transformation proceeds by applying two additional functions: $g_{\text{lead}}$ to remove leading zeros from $y$ and $g_{\text{trail}}$ to remove trailing zeros from $z$.

This transformation can be expressed using the following constraints:

[TABLE]

where $f_{\text{trim}}$, $g_{\text{lead}}$, and $g_{\text{trail}}$ can all be expressed as functional transducers. In this formulation, we use $++$ to denote string concatenation, and assert that the result string does not match some regular expression “correctFormat” to verify that no execution exists in which string normalization fails.

The constructed formula is unsatisfiable, but beyond the fragments decided by most of today’s string solvers. Solvers like Z3, cvc5, or Z3-noodler are not able to handle $f_{\text{trim}}$, $g_{\text{lead}}$, and $g_{\text{trail}}$ and again have to resort to functions like str.indexof and str.substr to encode those transformations. The solver OSTRICH [30, 28] supports reasoning over transducers and replace/replaceAll, but requires input formulas in the straight-line fragment to guarantee completeness. Our formula is not straight-line, since two equations with “decimal” as the left-hand side exist, causing OSTRICH to fail in solving the constraint. We will show that the formula is in a new fragment proposed in this paper, denoted the orderable fragment, which generalizes both the straight-line and chain-free fragments. Since RCP is complete for orderable formulas, it gives rise to a decision procedure for formulas like the one shown here and can easily show the formula to be unsatisfiable. We revisit this example in Section 0.6.2, Table 1, where RCP is the only solver to handle it successfully.

0.2.2 Post’s Correspondence Problem

Post’s Correspondence Problem (PCP) is a well-known undecidable problem that asks whether a given set of domino-like word pairs (tiles) can be arranged in sequence such that the concatenation of the top and bottom sequences produces the same string.

In general, PCP instances consist of multiple dominos, and the word lengths on either side of a domino may differ. However, even for highly restricted cases, the problem remains undecidable.

To illustrate, consider the following simplified instance, consisting of a single domino: $\frac{10}{01}$. This means we are given the tile $\frac{10}{01}$ and need to determine whether any non-empty sequence of these tiles produces the same string on both top and bottom.

In string constraint solving, we encode this problem using a string variable $x$ that selects repeated instances of this domino. Specifically:

[TABLE]

Here, $x$ is a non-empty string over the symbol "2" (denoted $\texttt{"2"}^{+}$), which represents repeated selections of the given domino. The replaceAll function maps each occurrence of "2" to its corresponding top ("10") and bottom ("01") strings. This formulation enforces that applying the same sequence of replacements to both top and bottom strings must yield the same result. However, this instance is unsatisfiable—no sequence of replacements can equate the top and bottom string. By propagating the regular constraints from $x$ forward onto $y$ and $z$, and using the fact that $y=z$, we find that any solution for $y$ and $z$ must lie in $(\texttt{"10"})^{+}\cap(\texttt{"01"})^{+}$. Since this intersection is empty, the formula is unsatisfiable. Notably, despite its simplicity, this small PCP instance is already beyond the reach of state-of-the-art string solvers. See Table 1 in Section 0.6.2 for solver performance on this example.

0.2.3 Reverse Transcription in Bioinformatics

This example models a reverse transcription process inspired by bioinformatics [61, 35]. Here, an unknown RNA string $y$ is converted into a DNA string by applying a series of replaceAll operations that simulate nucleotide base pairing. In addition, the RNA string is required to contain a specific pattern.

The following formula captures an instance of this problem (where the ..., as in "TGAGTAT..." and "ucuc...", indicate longer concrete strings omitted for brevity):

[TABLE]

In this instance, the solver must determine an RNA string $y$ such that, after sequentially replacing "u" with "A", "a" with "T", "g" with "C", and "c" with "G", the resulting DNA string $x$ matches a given constant. Moreover, $y$ must contain the RNA pattern specified by $z$, as enforced by str.contains(y, z). This example illustrates another application of complex string transformations in a biologically motivated context. Importantly, this instance falls within the straight-line fragment and can be solved by OSTRICH as well as by our solver. However, it also highlights the need for robust support for complex string functions such as replaceAll—a feature that receives only limited support in other state-of-the-art solvers. Solver performance on one instance of this benchmark is summarized in Table 1 in Section 0.6.2.

0.3 Regular Constraint Propagation as a Proof System

0.3.1 String Constraint Fragment

In this work, we focus on a subset of string constraint language that is most relevant for regular constraint propagation. In particular, we do not deal with length constraints, which can already be effectively dealt with after regular constraint propagation is done, for instance, by looking at the length abstraction of the equational constraints, regular constraints, together with the length constraints (e.g. see [33, 31, 52]). For simplicity, we also assume that formulas are provided in a normal form. The syntax of this normal form is defined as follows:

[TABLE]

This normal form is not restrictive, as any formula in the supported string language can be systematically transformed into an equivalent formula in this normal form.

To clarify the components of this normal form, we denote string variables by $x,x_{1},\ldots,x_{n}$ (and later using $y$ and $z$). A string constraint $\psi$ is a conjunction of string formulas $\phi$. There are two types of string formulas: regular constraints and equational constraints.

Regular constraints are regular membership tests $x\in e$ that assert that the value assigned to $x$ must belong to the regular language defined by a regular expression (RegEx) $e$. The exact supported regular expression syntax is not expanded on here, as it does not affect decidability. However, it may influence the applicability or efficiency of certain proof rules discussed later, depending on whether features like intersection or complement are supported. In an implementation, one could use equivalent representations of regular languages including (nondeterministic) finite automata.

Equational constraints are formulas $x=f(x_{1},\ldots,x_{n})$ that assert that the value of $x$ is equal to the result of applying string function $f$ to the values of $x_{1},\ldots,x_{n}$. We admit general string functions $f:(\Sigma^{*})^{n}\to(\Sigma^{*})$ (in fact, even when $f$ is a relation), but our approach works especially under the assumption of at least one of forwardability and backwardability, which will be expounded below. A plethora of string functions satisfy at least one of these conditions including concatenation, replace, replaceAll, reverse, and functions defined by various flavors of transducers (e.g. rational, two-way, and streaming transducers) (e.g. [30, 33, 20, 27, 11, 12]).

0.3.2 The Proof System

We introduce the RCP proof system, which is based on propagating regular languages. The system operates on one-sided sequents (i.e. left-sided) and can be interpreted similarly to Gentzen-style sequents [40]. A sequent in this system is a string constraint, denoted as $\Gamma=\{\phi_{1},\phi_{2},\dots,\phi_{n}\}$, where each $\phi_{i}$ is a string formula; it should be understood as a conjunction $\phi_{1}\land\phi_{2}\land\dots\land\phi_{n}$.

For convenience, we sometimes write sequents as a list $\Gamma,\phi_{1},\dots,\phi_{n}$ which represents the union $\Gamma\cup\{\phi_{1},\dots,\phi_{n}\}$, and when writing a string constraint, we sometimes write $\{\phi_{1},\phi_{2}\}$ instead of $\phi_{1}\land\phi_{2}$. A string constraint $\phi_{1}\land\cdots\land\phi_{n}$ naturally corresponds to a sequent $\{\phi_{1},\ldots,\phi_{n}\}$.

A proof (or proof tree) is a rooted tree $(V,E)$ where the nodes $V$ represent sequents. For the sake of presentation, we omit an explicit labeling function from nodes to sequents and assume that each node is uniquely identified within the tree. In particular, if the same sequent appears more than once in the proof tree, we treat each occurrence as a distinct node.

The root of the tree is located at the bottom and corresponds to the sequent whose unsatisfiability we want to prove, while the leaves at the top of the tree are called axioms, and represent unsatisfiable instances. We say a proof tree is closed if and only if all leaves correspond to the empty sequent $\Gamma=\emptyset$. The edge relation of the proof tree is given by the proof rules. Except for the initial sequent, every sequent in the proof tree must be derived by one of the proof rules shown in Figure 2.

A proof rule in our system takes the form $\frac{S_{1}S_{2}\dots S_{n}}{S}$, indicating that the sequent $S$ may be proved from a sequence of sequents $S_{1},S_{2},\dots,S_{n}$. If a sequent $S$ is derived from sequents $S_{1},\dots,S_{n}$ by a proof rule, then $S$ is the parent node of $S_{1},\dots,S_{n}$ in the proof tree. Formally, the edge relation $E\subseteq V\times V$ is defined so that for every proof step, we have $(S,S_{1}),\dots,(S,S_{n})\in E.$

Our RCP proof system consists of exactly the proof rules, as given in Figure 2; note that $\times$ in [Bwd-Prop] represents the Cartesian product. Before explaining the proof rules, we note that the proof system is a fragment of the proof system introduced in [28], from which we obtain that it is sound.

Lemma 0.3.1** (Soundness [28]).**

The RCP proof system is sound. That is, the root of a closed proof is an unsatisfiable sequent.

We explain the proof rules. The Close rule terminates a branch when a contradiction is found. That is, a variable is subject to an unsatisfiable combination of regular constraints. The Intersect rule computes the intersection of regular expressions. Forwards and backwards constraint propagation derive new regular constraints on string variables that arise due to function application. Forwards propagation transmits regular constraints from function inputs to function outputs, while backwards propagation propagates constraints from function outputs back to their inputs. Details and examples are given below.

For example, when $x=\texttt{concat}(y,z)$, we can combine any known regular constraints $y\in e_{1}$ and $z\in e_{2}$ to derive that $x\in e_{1}e_{2}$. For readability, we will from now on write $x=yz$ instead of $x=\texttt{concat}(y,z)$ to denote string concatenation. For this forward propagation, we require that the image of a function on regular languages is also regular, which is the case when concatenating two different variables. In general, the forward-propagated constraint is only an overapproximation of the true constraint on $x$: Consider $x=f(y)\wedge y\in e$, where $f(y)=yy$, in this case, the obtained regular constraint $x\in ee$ is a superset of the true constraint, which is $\{ww:w\in L(e)\}$. Although overapproximations can be easily added in our RCP implementation (and are in fact sound when proving unsatisfiability), we do not admit this in our theoretical study and hence not in our proof system above.

In the backwards direction, when $x=yz$, a regular constraint $x\in e$ can be split into a finite disjunction of conjuncts of the form $y\in e_{1}^{i}$ and $y\in e_{2}^{i}$ for any $\{e_{1}^{i}\}_{i=1}^{k}$ and $\{e_{2}^{i}\}_{i=1}^{k}$ such that $L(e)=\bigcup_{i=1}^{k}L(e_{1}^{i}e_{2}^{i})$. For example, if $x\in a^{*}b^{*}$, one potential disjunction could be

[TABLE]

The same in fact is true for $x=f(y)\wedge y\in e$, with $f(y)=yy$. The condition for a finite number of alternatives for $e_{1}$ and $e_{2}$ is expressed by the side-condition $f^{-1}(L(e))=\bigcup^{k}_{i=1}(L(e^{i}_{1})\times\dots\times L(e^{i}_{n}))$ and causes branching in the proof trees (all $k$ alternatives are considered).

As mentioned, propagations can be performed for functions that allow these in at least one of the two directions. We formalize this in terms of forwardability and backwardability. We lift string functions $f:(\Sigma^{*})^{k}\to\Sigma^{*}$ to act on languages in the standard way.

Definition 0.3.2** (Forwardable).**

A function $f:(\Sigma^{*})^{k}\to\Sigma^{*}$ is forwardable if, for all regular languages $L_{1},\ldots,L_{k}\subseteq\Sigma^{*}$, the image $f(L_{1},\ldots,L_{k})$ is also a regular language, and there exists an algorithm that, given representations of $L_{1},\ldots,L_{k}$, computes a representation of $f(L_{1},\ldots,L_{k})$.

Definition 0.3.3** (Backwardable).**

A function $f:(\Sigma^{*})^{k}\to\Sigma^{*}$ is backwardable if, for all regular languages $L\subseteq\Sigma^{*}$, the preimage $f^{-1}(L)$ is a recognizable relation [20], and there exists an algorithm that, given a representation of $L$, computes a representation of $f^{-1}(L)$.

The recognizable relation in the definition corresponds exactly to the notion in Bwd-Prop: $R\subseteq(\Sigma^{*})^{n}$ is recognizable, if it can be represented as $R=\bigcup_{i=1}^{k}L_{i,1}\times\cdots\times L_{i,k}$, with each $L_{i,j}$ being a regular language. Note that such a representation is not unique.

The following lemmas summarize conditions on concatenation functions to be forwardable.

Lemma 0.3.4**.**

Suppose $t=f(x_{1},\ldots,x_{n})$ is a term over the function symbol concat (possibly with string constants). Then, if each $x_{i}$ appears at most once in $t$, then the string function associated with $t$ is forwardable.

The proof is a simple application of the closure of regular languages under concatenation. In the case when a variable appears multiple times in $t$, we have also remarked above that the associated function is generally not forwardable. That said, string functions using unrestricted concatenation and string constants are always backwardable.

Lemma 0.3.5**.**

Suppose $t=f(x_{1},\ldots,x_{n})$ is a term over the function symbol concat (possibly with string constants). Then, the string function associated with $t$ is backwardable.

Proof of this lemma is folklore (and already exploited, e.g., in [30, 33]). Other functions are also known to be forwardable including the string-reverse function, replaceAll(x,v,w) — which replaces every occurrence of the constant string $v\in\Sigma^{*}$ in $x$ by the constant string $w\in\Sigma^{*}$ — and more generally rational transducers (e.g. see [20]), which are standard finite automata with input and output (i.e. each transition has a label $(v,w)\in\Sigma^{*}\times\Sigma^{*}$, and has the semantics of consuming $v$ in the input and then outputting $w$). The same is no longer true for replaceAll(x,v,y) (i.e. where the replacement string is a variable) [27], and two-way transducers (i.e. head of the input/output tapes can move left/right), or equivalently, streaming transducers [11, 12]. Interestingly, all of these aforementioned functions are backwardable [30].

Example 0.3.6**.**

Given the string constraint:

[TABLE]

we apply the proof rule Fwd-Prop to propagate the regular constraints $z\in b$ and $u\in a$ through the equational constraint $y=zu$, allowing us to deduce that $y\in ab$.

Next, applying Bwd-Prop on $y\in ab$, we propagate this information backwards through $y=xx$. This leads to a contradiction in all branches of the proof. The proof tree illustrating this contradiction is shown in Figure 3.

0.4 Completeness and Decidability

Here we provide a general completeness condition for RCP for proving unsatisfiability. By complete, we mean that, for every unsatisfiable string constraint, there exists a closed RCP proof. In general, this suffices to guarantee decidability since if the constraint is satisfiable, then—by a standard argument in computability theory, based on the finiteness of the alphabet and the number of variables—one can enumerate all assignments of increasing length until a satisfying model is eventually found; otherwise, a closed RCP proof of unsatisfiability will be discovered. Our completeness condition can be understood in terms of finding a “flow” of regular constraints through forwardable and backwardable functions. In a set $Eqs=\{x_{1}=f_{1}(y_{1}\ldots y_{k}),\ldots\}$ of equational constraints, a variable $x$ that occurs only once in $Eqs$ (say in equation $\phi\in Eqs$, on either left- or right-hand side) is a potential “source point” of a flow. That is, the only way $x$ can affect other variables is via the equation $\phi$. Therefore, by propagating all the regular constraints on $x$ through $\phi$ to other variables in $\phi$, we may eliminate $x$, as well as $\phi$, from $Eqs$, while preserving satisfiability. As an example, consider $Eqs=\{y=zu,y=xx\}$ along with regular constraints $z\in a^{+}\wedge u\in b^{+}$. Since $z$ and $u$ occur only once and $f(z,u):=zu$ is forwardable, we could order the flow of the regular constraints $z\in a^{+}\wedge u\in b^{+}$ in the “forward” direction of $y=f(z,u)$ resulting in the equisatisfiable constraint:

[TABLE]

In turn, since $g(x):=xx$ is a backwardable function and $y$ occurs only once, we could order the flow of the regular constraint $y\in a^{+}b^{+}$ in the “backward” direction resulting in the equisatisfiable constraint $\bot$. That is, we found the flow sequence $(y=zu,\leftarrow),(y=xx,\rightarrow)$, where each pair depicts the equational constraint and the direction of propagation. The propagation steps in a flow sequence can be visualized using a flow graph. Given a flow sequence, we construct a directed graph where nodes represent variables. Each propagation rule $(\phi,d)$, with $\phi$ an equation like $y=f(x_{1},\ldots,x_{k})$, contributes edges from the variables on the source side of the propagation to those on the target side—i.e., from $x_{1},\ldots,x_{k}$ to $y$ for a forward step, or from $y$ to $x_{1},\ldots,x_{k}$ for a backward step. This flow graph helps visualize how information is propagated through equations. Notably, regular constraints do not influence the graph’s structure, as it is determined solely by the equational relationships. An example of the flow graph for the constraint above is shown in Figure 4. This intuition is formalized in the Marking Algorithm (Algorithm 1) and the condition of orderable set of equations, as given below.

0.4.1 Orderable Constraints

Given a set of equational constraints $Eqs$, a flow sequence is a sequence of pairs $(\phi,d)$ where $\phi\in Eqs$ and $d\in\{\leftarrow,\rightarrow\}$. Each such pair is called a propagation rule. A pair $(\phi,\leftarrow)$ indicates that the rule Fwd-Prop should be applied against the equational constraint $\phi$. Conversely, $(\phi,\rightarrow)$ indicates a use of the Bwd-Prop rule.

Definition 0.4.1**.**

A set $Eqs$ of equations is said to be orderable if, on input $Eqs$, Algorithm 1 outputs a flow sequence. A string constraint $\varphi$ is orderable if the equational part is orderable.

It can be easily checked that $\{y=zu,y=xx\}$ is orderable. An example of a set of equations that is not orderable is $\{y=zu,y=xx,y=uv\}$; the reason being that $u$ occurs on the right hand side of two equations,

The main result of this section is that the flow sequence returned by the Marking Algorithm gives a strategy to apply the forward and backward propagation in RCP that is sound and complete.

Theorem 0.4.2**.**

Given a set of orderable constraints applying the forward propagation and backward propagation by RCP according to the flow sequence returned by Algorithm 1 is sound and complete. In particular, if such a string constraint is not satisfiable, the proof system will produce a proof with all closed branches.

In particular, if the instance of orderable constraints is not satisfiable, RCP can produce a proof of that.

Corollary 0.4.3**.**

Every unsatisfiable orderable constraint admits a proof in RCP system with the following rules: Close, Intersect, Fwd-Prop, and Bwd-Prop.

To prove Theorem 0.4.2 we use the following Lemmas 0.4.4 and 0.4.5, which show that the removal of the equational constraint by Algorithm 1 yields an equisatisfiable string constraint, in cases of forward and backwards propagation, respectively. Note that the proof system does not actually remove the equations.

Lemma 0.4.4**.**

If $z=f(y_{1},\ldots,y_{n})$ is an equational constraint in a string constraint and $y_{1},\ldots,y_{n}$ have exactly one occurrence in the equational part of string constraint and $f$ is forwardable then the string constraint obtained by propagating the constraints on $y_{1},\ldots,y_{n}$ forward and removal of the equation are equisatisfiable. Formally

[TABLE]

Lemma 0.4.5**.**

If $z=f(y_{1},\ldots,y_{n})$ is an equational constraint in a string constraint and $z$ has no other occurrence in equational part of the string constraint, then the string constraint obtained by propagating the regular constraints on $z$ backwards and removal of the equation are equisatisfiable. Formally:

[TABLE]

where $f^{-1}(L_{z})=\bigcup^{k}_{j=1}L_{1,j}\times\dots\times L_{n,j}$.

Proof of Theorem 0.4.2.

By Lemma 0.3.1 RCP is sound in general, so in particular it is sound for some specific order of applying the proof rules.

By assumption that the constraints are orderable we obtain that Algorithm 1 terminates with a flow sequence that gives an order on equational constraints (and information, whether we should propagate forwards or backwards). We will propagate them in this order.

Note, that applying the backwards propagation creates many branches in the proof tree and when constructing the proof tree we need to take care of each open branch. However, we treat all open branches in the same way: we will apply the same rule to each open branch (and implicitly close branches on which contradiction was obtained). We apply the intersection rule for each variable, before each of the propagations (on each open branch), without mentioning it explicitly.

Observe that the proof rules do not modify nor remove the equational constraints. Therefore, the set of equational constraints is the same in each sequent, except for the axioms. However, as a tool of the construction, we mark some equational constraints in the open branches, and as an invariant:

• •

in each of the open branches the same set of equations is marked and it is the same as the set of equations $\mathrm{remainingEqs}$ from Algorithm 1 at the corresponding step

• •

after application of a rule, which changes the sequent $\Gamma$ to $\{\Gamma_{i}\}_{i=1}^{k}$, the constraint obtained by removing the unmarked constraints from $\Gamma$ is equivalent to the (disjunction of) constraints obtained by removing the unmarked constraints from each $\Gamma_{i}$.

In particular, a variable occurs once in a marked equational constraints in some open sequent if and only if it occurs once in a marked equational constraints in each of the open sequents.

The proof follows by applying the propagation according to the order returned by Algorithm 1. Note that the above invariants are clearly satisfied at the beginning, when the root is the open sequent and we set all equations as marked and the Algorithm 1 has not removed any of the equational constraints.

First, consider Intersect rule, which rewrites sequent $\Gamma$ as $\Gamma^{\prime}$. We mark exactly the same set of equational constraints in $\Gamma^{\prime}$ as they are marked in $\Gamma$. Also none equational constraints were changed. Hence the first invariant clearly holds. For the second invariant note that we replaced some regular constraints $x\in e_{1},\ldots,x\in e_{k}$ with $x\in e$, where $L(e)=\bigcap_{i=1}^{k}L(e_{i})$, so clearly those are equivalent and so the second invariant holds as well.

Consider the next equational constraint for the propagation (in the sequence returned by Algorithm 1). If we are to propagate forwards for $z=f(y_{1},\ldots,y_{n})$, then variables $y_{1},\ldots,y_{n}$ appear only once in the set of equational constraints in $\mathrm{remainingEqs}$ and so in each of the open sequents they appear exactly once in the marked equations (by the invariant). Hence the string constraint (in an open sequent and restricted to marked equational constraints) is of the form as in Lemma 0.4.4, so of a form

[TABLE]

where $\Gamma^{\prime}$ are the unmarked equational constraints. Let the corresponding formula be

[TABLE]

where $\phi(\bar{x},z)$ is the concatenation of all constraints in $\Gamma$. Using the Lemma 0.4.4 we can remove the equational constraint obtaining an equisatisfiable formula

[TABLE]

On the other hand, the proof system applies the Fwd-Prop rule, i.e.

[TABLE]

where $e$ denotes a regular expression such that $L(e)=f(L(e_{1}),\ldots,L(e_{n}))$. In the new sequent we additionally unmark $z=f(y_{1}\ldots,y_{n})$. Clearly, in all open branches the same sets of equational constraints are marked (as we unmark exactly the same equation $z=f(y_{1}\ldots,y_{n})$) and this the set that remain in Algorithm 1.

It is left to observe that the sequent without the unmarked constraints $\Gamma,z\in e,y_{1}\in e_{1},\dots,y_{n}\in e_{n}$ corresponds exactly to formula from (1), which we already know is equivalent to formula corresponding to old sequent without marked constraints. Hence, the second invariant was shown, which ends the proof for Fwd-Prop.

So consider the case when the equational constraint $z=f(y_{1},\ldots,y_{n})$ is scheduled for backwards propagation. Then $z$ appears only once in the set of equational constraints in $\mathrm{remainingEqs}$ and so in each of the open sequents it appears exactly once in the marked equations (by the invariant). Fix an open sequent $\Gamma,\Gamma^{\prime},z\in e,z=f(y_{1},\dots,y_{n})$, where $\Gamma^{\prime}$ contains all unmarked equation constraints. Let the formula corresponding to $\Gamma,z\in e,z=f(y_{1},\dots,y_{n})$ be

[TABLE]

where $L_{z}=L(e)$. Then it is of the form as in Lemma 0.4.5 and we can remove the equational constraint obtaining an equisatisfiable formula:

[TABLE]

On the other hand, the proof system applies the Bwd-Prop rule, i.e.

[TABLE]

where each $e_{i,j}$ is a regular expression such that $L_{i,j}=L(e_{i,j})$. In the new sequents we additionally unmark $z=f(y_{1}\ldots,y_{n})$. Clearly, in all open branches the same sets of equational constraints are marked (as we unmarked the same equation $z=f(y_{1}\ldots,y_{n})$) and this the set $\mathrm{remainingEqs}$ in Algorithm 1.

It is left to observe that the formula from (2) corresponds to the (disjunction of) new sequents without unmarked equational constraints $\left\{\Gamma,z\in e,y_{1}\in e^{i}_{1},\dots,y_{n}\in e^{i}_{n}\right\}^{k}_{i=1}$. Which ends the proof for all rules.

As Algorithm 1 eventually removes all equations, at this step all open branches in the proof have all equational constraints unmarked, by the invariant. At each open branch we apply the Intersect rule for each variable. If the intersection is empty for some variable then we close the branch. If at some branch all intersections are non-empty, then we claim that initial formula is satisfiable: at this sequent we can find a substitution satisfying the regular constraints and there are no marked equational constraints in this sequent. Using the second invariant we conclude that on each sequent on the path to the root the constraint obtained by removing the unmarked constraints are satisfiable: the only needed observation is that if some sequent $\Gamma_{j}$ is satisfiable, then also $\left\{\Gamma_{i}\right\}_{i=1}^{k}$ is satisfiable. In particular, in the root sequent there are only marked equations, so the whole input constraint is satisfiable, contradiction with the assumption that it is unsatisfiable. Thus, if the initial sequent is not satisfiable then we obtain that all branches are eventually closed when we follow an order of propagations returned by Algorithm 1, which shows that the proof rules are complete for unsatisfiable formulas. Note that this does not immediately yield a solution of the original string constraint for satisfiable constraints, as only equisatisfiability is guaranteed. ∎

0.4.2 Straight-Line Constraints are Orderable

The straight-line fragment of string constraints in [30] corresponds to constraints in which the equational part can be ordered with a flow sequence of the form $(\phi_{1},\rightarrow),\ldots,(\phi_{n},\rightarrow)$. The fragment permits all string functions that are backwardable, which is called in [30] as a RegInvRel condition. This includes a rich class of functions such as the transductions and replaceAll functions described in Section 0.3.5.111The straight-line fragment also permits string relations that can be effectively expressed as recognizable relations, which can be reduced to regular constraints.

Corollary 0.4.6**.**

RCP is sound and complete on straight-line constraints. In particular, every unsatisfiable straight-line constraint admits a proof in the RCP system with the following rules: Close, Intersect, and Bwd-Prop.

0.4.3 Chain-free Constraints are Orderable

We show that orderable constraints subsume the class of chain-free constraints [10]. In fact, when we restrict to functions allowed in the chain-free fragment then those two classes coincide; in particular: unsatisfiable chain-free constraints admit a proof in RCP.

Theorem 0.4.7**.**

A string constraint given by string terms and rational transducers, is chain-free if and only if it is orderable.

Corollary 0.4.8**.**

RCP is sound and complete on chain-free constraints. In particular, every unsatisfiable chain-free constraint admits a proof in the RCP system with the following rules: Close, Intersect, Fwd-Prop, and Bwd-Prop.

Below we define chain-free constraints and show Lemmata needed for the proof of Theorem 0.4.7.

Chain-free fragment

The chain-free fragment of string constraints [10] is defined via a splitting graph: Consider a string constraint $\psi=\bigwedge^{n}_{i=1}\phi_{i}$, where each $\phi_{j}$ is of a form $t_{2j-1}=\mathcal{T}(t_{2j})$, where $\mathcal{T}$ is a rational function (so given by a rational transducer) and $t_{2j-1},t_{2j}$ are string terms; in particular this includes an equation $t_{2j-1}=t_{2j}$. Each term $t_{i}$ is a concatenation of variables $x_{i,1},\dots,x_{i,n_{j}}$ and constants, one variable can occur many times in the concatenation. We construct the splitting graph as follows:

Nodes

The graph contains nodes $\{(j,i)|1\leq j\leq 2n,1\leq i\leq n_{j}\}$. The node $(2j-1,i)$ represents the $i$-th term on the left-hand side, while node $(2j,i)$ represent the $i$-th term on the right-hand side and they are labelled with the corresponding variables.

Edges

There is an edge from a node $p$ to node $q$ if there exists a node $p^{\prime}$ (different from $q$) such that

• •

$p$ and $p^{\prime}$ represents the nodes on opposite sides of the same constraint (say $\phi_{i}$), and

• •

$p^{\prime}$ and $q$ have the same label.

A chain in the graph is a sequence of edges of the form $(p_{0},p_{1}),(p_{1},p_{2}),\ldots,(p_{n},p_{0})$. A splitting graph is chain-free if it has no chains; a set of equational string constraints is chain-free if its splitting graph is chain-free; a string constraint is chain-free if its equational part is chain-free.

Note that the original definition of chain-free fragment allowed rational relations, so $t_{2j-1}\in\mathcal{T}(t_{2j})$ (or $\mathcal{T}(t_{2j-1},t_{2j})$, depending on the preferred syntax); our approach and methods generalize to this case, yet all relevant applications and examples in the SMT-LIB benchmarks use rational functions only, so for simplicity of presentation we use only rational functions. On the other hand, the original algorithm showing the decidability of chain-free constraints [10] assumed that the rational transducer is length-preserving, which is not needed in the case of orderable constraints (we omit this assumption for ease of presentation).

Lemma 0.4.9**.**

A chain-free constraint $\psi$ is orderable.

Proof.

As regular constraints do not affect whether the set of constraints is chain free, nor whether it is orderable, we ignore them for the purpose of the proof.

By Lemma .9.1 we can assume that the string constraint is in normal form, let it be $\psi:=\bigwedge^{m}_{j=1}\phi_{j}$ and $\phi_{j}:=x_{j}=f(y_{1},\ldots,y_{k_{j}})$ or $x_{j}=\mathcal{T}(y)$, where $f$ is an (arbitrary) concatenation of its variables and $\mathcal{T}(y)$ is a rational transducer. Note that in general $f$ does not need to be forwardable. Assume that the string constraint $\psi$ is chain-free, thus the splitting graph defined by $\psi$ has no cycles. For the sake of contradiction, assume that Algorithm 1 returns $\bot$. That is, all equational constraints in $Eqs$ are eliminated. Observe that merging all nodes $(2j,i)$ over various $i$, so all nodes corresponding to a single r.h.s., does not create a cycle: all nodes $(2j,i)$ over various $i$ have the outgoing edges to exactly the same nodes, so if there is an incoming edge to $(2j,i)$ and outgoing from $(2j,i^{\prime})$ to $p$ then there is also outgoing from $(2j,i)$ to $p$.

So let us merge all nodes corresponding to one r.h.s. to one node. Consider an equational constraint, say $\phi_{j}$. Then the variable on its left-hand side, say $x$, is not marked, as otherwise $f$ (or $\mathcal{T}$) is backwardable and so the equational constraint would have been removed. Hence this variable appears in some other equational constraint, say $\phi_{j^{\prime}}$. Then the node corresponding to the right-hand side of $\phi_{j}$ has an outgoing edge (to the node representing $x$ in $\phi_{j^{\prime}}$). Moreover, the node representing the other side of $\phi_{j^{\prime}}$ has an edge to the l.h.s. of $\phi_{j}$. Observe that at least one variable of the r.h.s. of $\phi_{j}$ is not marked: if all of them were marked and the equational constraint is $x=\mathcal{T}(y)$ then $\mathcal{T}$ is forwardable and so this equational constraints should be removed, if the equational constraint is $x=f(y_{1},\ldots,y_{k})$ then as all $y_{i}$ are marked, each occurs once in the concatenation defined by $f$, and so $f$ is forwardable, so it also should be removed. Thus, one of the variables on the r.h.s. of $\phi_{j}$ appears somewhere else; using the same argument we show that the l.h.s. of $\phi_{j}$ also has at least one outgoing edge and the r.h.s. has at least one incoming edge. Thus, each node has an outgoing edge and an incoming edge, therefore the simplified splitting graph has a cycle, and so also the splitting graph has a cycle.

Note that the observation that if all variables of $f$ are marked then $f$ is forwardable is crucial for the argument. ∎

Lemma 0.4.10**.**

If a string constraint given by string terms and rational transducers is orderable then it is chain-free.

Proof.

As in Lemma 0.4.9 we can ignore the regular constraints.

Note that if $\mathrm{remainingEqs}$ is not chain-free then $\mathrm{remainingEqs}\cup\{\phi\}$ is not chain-free: each edge in splitting graph for $\mathrm{remainingEqs}$ exists in the splitting graph for $\mathrm{remainingEqs}\cup\{\phi\}$.

We show that whenever the Marking Algorithm removes an equational constraint $\phi$ from $\mathrm{remainingEqs}\cup\{\phi\}$, then in the splitting graph this corresponds to a removal of some nodes without incoming edges and some nodes without outgoing edges together with the edges leading from and to them, respectively, which clearly cannot remove nor create a cycle.

So suppose that $\phi$ is an equational constraint $x=f(y_{1},\ldots,y_{k})$ or $x=\mathcal{T}(y_{1})$ is removed because $x$ is marked. Then the node corresponding to $x$ has no incoming edges (as there is no other copy of $x$) and each $y_{i}$ has no outgoing edges (as there is no other occurrence of $x$).

Finally, observe that the edges that are missing in the splitting graph for $\mathrm{remainingEqs}$ with respect to splitting graph $\mathrm{remainingEqs}\cup\{\phi\}$ are the edges to nodes corresponding to $y_{1},\ldots,y_{k}$ and edges from $x$.

The analysis in the case when $y_{1},\ldots,y_{k}$ are marked are done in a similar manner (this time there are no incoming edges to each of $y_{1},\ldots,y_{k}$ and no outgoing edge from $x$). ∎

Lemmata 0.4.9, Lemma 0.4.10 prove Theorem 0.4.7; Corollary 0.4.8 follows from Corollary 0.4.3.

0.5 Lower Bounds

We now show that RCP paired with Nielsen’s transform and the Cut rule (for regular constraints, described in detail below) cannot solve some string constraints; those string constraints of course are not chain-free. The concrete example in question is

[TABLE]

It is easy to see that the constraints in (3) are not satisfiable, by looking at the first position of $b$ in any candidate solution. Note that length-analysis can reduce this equation into two copies of $xy=yx$, for which Nielsen’s transform can detect unsatisfiability, even without the Cut rule or regular constraint propagation.

For the sake of completeness, we give proof system rules for the Cut rule and Nielsen transformation, see Fig. 5: For the Cut rule we create two branches by adding an arbitrary regular constraint and its complement on a variable.

Nielsen’s transform considers leading symbols of an equation and branches into three cases, depending on which symbol is a prefix of the other (there is also a symmetric version for the suffix). In Figure 5 the cases from top-to-bottom are: $x$ equals $y$, $y$ is a prefix of $x$, and finally $x$ is a prefix of $y$. In particular, it makes substitutions such as $x\leftarrow yx^{\prime}$ (when $y$ is a prefix of $x$) and needs to compute the regular constraints for $x^{\prime}$. After the substitution and computation of the constraints, $x^{\prime}$ is renamed to $x$. We use the notation $u[x/y]$ to denote that $y$ is substituted in place of $x$ in the term $u$.

The rule is somewhat similar to the rule for backward propagation, in particular it has several branches. This is not surprising, as for a fixed $y$ we can treat $yx^{\prime}$ as function that prepends $y$ to its argument $x^{\prime}$. We have a regular constraint ($e_{x}$) on its output and want to compute (propagate) the constraint $e_{x^{\prime}}$ on its input. In particular, we will replace the constraints $e_{x},e_{y}$ with a family $\{(e_{y}^{i},e_{x}^{i})\}$, one pair for each branch. The actual formula for $\{(e_{y}^{i},e_{x}^{i})\}$ can be given.222 We consider DFA $A$ recognizing $L(e_{x})$ and consider the possible state $q$ reached by $A$ after reading $y$ and require that $A$ starting in $q$ and reading $x^{\prime}$ ends in a final state; alternatively, this can be handled using matrix transition functions or the semigroup-approach to regular languages.

However, for the purpose of the lower bound we do not need this exact formula and we can in fact allow the proof system to overapproximate it — it is enough to assume “soundness of the substitution”. Let $e_{x},e_{y}$ be the intersection of all constraints on $x,y$, i.e. $L(e_{x})=\bigcap_{e\in R_{x}}L(e),L(e_{y})=\bigcap_{e\in R_{y}}L(e)$, we assume

[TABLE]

Note that in general Nielsen’s rule (as given above) does not detect a solution in which initially some variable has an empty substitution. However, such substitutions are forbidden by the regular constraints in (3).

We say that a set $A$ is co-finite in $B$, when $B\setminus A$ is finite. Consider a condition:

if the regular constraint on $x$ defines a language $L_{x}$ and for $y$ a language $L_{y}$ then there is $m$ such that $L_{x}$ is co-finite in $\left(a^{m}\right)^{*}$ and there are languages $L_{y,\ell},L_{y,r}$ co-finite in $\left(a^{m}\right)^{*}$ satisfying $L_{y,\ell}bL_{y,r}\subseteq L_{y}$.

Theorem 0.5.1**.**

Consider a proof system that uses: Nielsen’s rule, regular constraint propagation and the Cut rule only and a proof for (3) using this system. If Condition 1 holds at some sequent, then after application of a proof rule it holds in at least one of the obtained sequents (perhaps for some other value of $m$).

In this way we obtain the main result of this section:

Corollary 0.5.2**.**

A proof system that uses: Nielsen’s rule, regular constraint propagation and the Cut rule only, cannot prove the unsatisfiability of (3).

Proof.

Condition (1) implies in particular that there are (infinitely many) words satisfying the regular constraints, so in particular we cannot close a sequent satisfying the condition.

Clearly, condition (1) holds for the initial regular constraints and so by Theorem 0.5.1 there exists an infinite path of sequents, in particular, we cannot close the whole proof, which shows the claim. ∎

To prove Theorem 0.5.1 we use two auxiliary Lemmata:

Lemma 0.5.3**.**

Given regular sets $L_{x}\subseteq a^{*},L_{y}\subseteq a^{*}ba^{*}$ there is a number $m$ such that

[TABLE]

for appropriate values $k_{i},k_{i,\ell},k_{i,r}$ (over all $i$). In particular, each $L_{i},L_{i,\ell},L_{i,r}$ is either finite or co-finite in $\left(a^{m}\right)^{*}$. Furthermore, if such a representation exists for $m$, then it exists for each multiple of $m$. In particular, if we are given several such sets, then there is a representation of all of them for a common $m$.

In case of subsets of $a^{*}$ the proof follows from application of well-known characterizations of unary regular languages, say Chrobak normal form. The proof for subsets of $a^{*}ba^{*}$ requires some additional simple arguments.

Lemma 0.5.4**.**

If regular sets $L_{x}\subseteq a^{*},L_{y}\subseteq a^{*}ba^{*}$ are represented as in Lemma 0.5.3 for a common $m$ and there are infinite sequences of words $x_{i}=a^{k_{i}m}\in L_{x}$, $y_{i}=a^{k_{i,\ell}m}ba^{k_{i,r}m}\in L_{y}$ where all $k_{i}$ are pairwise different, all $k_{i,\ell}$ are pairwise different and all $k_{i,r}$ are pairwise different, then $L_{x}$ is co-finite in $\left(a^{m}\right)^{*}$and there are $L_{y,\ell},L_{y,r}$ co-finite in $\left(a^{m}\right)^{*}$such that $L_{y,\ell}bL_{y,r}\subseteq L_{y}$.

The proof follows from simple observations applied to Lemma 0.5.3: for appropriate $m$, if a regular language has an infinite intersection with $\left(a^{m}\right)^{*}$ ($\left(a^{m}\right)^{*}b\left(a^{m}\right)^{*}$) then it is in fact co-finite in it (for subsets of $a^{*}ba^{*}$ please consult the statement).

To prove Theorem 0.5.1 we apply Lemma 0.5.4: given a sequent with regular constraints $e_{x},e_{y}$ on $x,y$ we choose appropriate infinite sequences in the regular languages $L(e_{x})\cap\left(a^{m}\right)^{*},L(e_{y})\cap\left(a^{m}\right)^{*}b\left(a^{m}\right)^{*}$, which is possible by the assumption that they satisfy condition (1), and show that after a rule application at least one of the sequents has regular constraints $e_{x}^{\prime},e_{y}^{\prime}$, which have infinitely many elements from the sequences, and so by Lemma 0.5.4 they in fact satisfy condition (1). The choice of sequences depends on the applied rule; say, for a Cut rule, in which we replace the regular constraint $e_{y}$ with $e_{y},e$ and $e_{y},\overline{e}$ observe that infinitely many elements of the sequence in $L(e_{y})$ are in at least one of $L(e_{y})\cap L(e)$ or $L(e_{y})\cap\overline{L(e)}$.

0.6 Experiments

For evaluation, we have implemented a new string solver, RCP, which is built on top of OSTRICH. OSTRICH relies on a robust foundation—including the BRICS automata framework [59], transducer support, and pre-implemented backward propagation—that enabled us to straightforwardly extend the solver with RCP.

To isolate the impact of RCP, we implemented it on top of the basic OSTRICH configuration, which combines backward propagation with equation splitting. In doing so, we disabled other advanced techniques used in OSTRICH’s SMT-COMP portfolio, such as cost-enriched automata (CEA) [29] and the algebraic data type (ADT)-based solver [43]. As a result, our evaluation considers two configurations of OSTRICH: (1) the SMT-COMP portfolio version, which integrates basic OSTRICH, CEA-OSTRICH, and the ADT-based solver; and (2) the basic OSTRICH, on which we directly implement and evaluate RCP.

This setup allows us to measure the isolated benefits of regular constraint propagation and compare it both to the unmodified basic configuration and the full SMT-COMP portfolio variant.

We evaluate RCP, as well as cvc5 [17], OSTRICH [31], Z3 [38], Z3-alpha [54], and Z3-Noodler [33], using their latest versions configured as in SMT-COMP 2024 [4]. The experiments were conducted on a MacBook Pro with 16 GB of RAM, running macOS Sonoma 14.5. The system was powered by an Apple M3 chip. The timeout for each experiment was set to 60 seconds.

0.6.1 Proof Search

To transform the proof system (Figure 2) into a practical algorithm, one must define a strategy for applying the various proof rules. In principle, this can be done using Algorithm 1 for the case of orderable string constraints, as the algorithm outputs a sequence of propagation rules that can be executed to prove (un)satisfiability. While this provides a complete propagation order for formulas within the orderable fragment, it does not generalize to formulas outside this fragment. Moreover, our goal is to define a uniform procedure that applies broadly, even when completeness cannot be guaranteed.

As a baseline, we describe a simple “fair” scheduling strategy (see Appendix .11) that is easy to implement and ensures that every applicable propagation rule is eventually considered. To improve on this baseline, we employ a priority-based refinement of fair scheduling that guides propagation using a cost heuristic. Our solver introduces a bias toward inexpensive and potentially informative propagation steps, e.g., forward propagation from small automata or from functions with constant arguments while at the same time delaying applications that involve large automata or only yield coarse approximations. This heuristic assigns priorities to applications of forward/backward propagation using a weighted sum of factors, including:

• •

Concrete arguments: high priority is given to rules whose input or output language is a ground string;

• •

Information gain: backward rules propagating from universal automata (e.g., $x\in\Sigma^{*}$) receive lower priority;

• •

Exactness: forward rules involving functions without exact post-images (e.g., replaceAll with symbolic patterns) are penalized;

• •

Cost: rules are penalized in proportion to the combined size of input and result automata;

• •

Fairness: newer rule applications are penalized, preferring those that have waited longer in the queue.

0.6.2 Benchmarks

We evaluate our solver on three benchmark sets. The first benchmark set consists of 2,000 formulas randomly selected from the QF_S and QF_SLIA divisions of SMT-LIB 2024 [65]. To ensure representativeness, we sampled proportionally to the distribution of benchmarks in the full SMT-LIB 2024 dataset, which contains approximately 100,000 benchmarks. This resulted in a subset of roughly 400 benchmarks from QF_S and 1,600 from QF_SLIA, preserving the overall ratio between the divisions.

Below, we provide descriptions for some of the different benchmark categories within the SMT-LIB:

• •

Regular Constraints + Word Equations: Benchmarks from SyGuS, Automatark [36], Woorpje-lu [37], String Fuzz [25], ReDoS Attack [50] and Kepler [49], which combine word equations with regular constraints and length.

• •

String Constraints from Programs: Extracted from concolic execution engines Conpy [32], PyExZ3 [16] symbolic execution of Python programs [66], covering operations such as replace, indexof, substr.

• •

String Rewrite: Consists of benchmarks derived from axioms over string predicates and functions [63].

• •

WebApp: A variation of SLOG [73] using replaceAll instead of simple replace, derived from real web applications.

A key limitation of the SMT-LIB benchmark set is the relative scarcity of benchmarks containing complex string functions. While modern programming languages such as JavaScript heavily rely on operations like replaceAll, such functions are significantly underrepresented in the SMT-LIB benchmark releases. For example, only 0.4% of the benchmarks in the SMT-LIB 2024 release include replaceAll.

The second benchmark set consists of instances of PCP, specifically in the form PCP[3,3], meaning each instance contains three dominos, and each word on a domino has length three. We generate 1,000 random instances over a binary alphabet, following the structure outlined in Example 0.2.2.

The third benchmark set is inspired by bioinformatics [61, 35] and models a reverse transcription process. In these benchmarks, an unknown RNA string $y$ is transformed into a DNA string by applying a sequence of replaceAll operations that simulate nucleotide base pairing. The solver must determine an RNA string such that, after these replacement operations, a given concrete DNA string is produced, while ensuring that the RNA string contains a specific pattern. We generate 1000 instances, with 500 instances being satisfiable (where a suitable $y$ exists) and 500 unsatisfiable. Each formula contains 4 replaceAll constraints, a constant DNA string of length 200, and a pattern string of length 15.

We also evaluated solver performance on the three illustrative formulas from Section 0.2: the string sanitization example, a simplified PCP tile instance, and a representative example from the bioinformatics benchmark set. Table 1 summarizes the results. RCP successfully solved all three instances, while existing solvers either timed out or returned unknown. The PCP formula is unsatisfiable, and only RCP was able to prove this. The normalization task lies outside the straight-line fragment and involves multiple transductions on the same variable; while OSTRICH supports transducers, it fails to solve this instance. By contrast, the bioinformatics example is within the straight-line fragment and can be solved by both RCP and OSTRICH, but not by any other solvers.

0.6.3 Performance of Individual Solvers

We begin by analyzing Table 2, which presents the performance of all solvers across both benchmark sets. We report results using different metrics for the two benchmark sets. We focus on unsolved benchmarks to highlight solver weaknesses.

For the first benchmark set, Z3-Noodler emerges as the best-performing solver, solving nearly all instances and leaving only $\scriptstyle\mathtt{\sim}$1% of the benchmarks unsolved. It is closely followed by Z3 and cvc5, both of which leave 6% of the benchmarks unsolved. Next, Z3-alpha performs slightly worse, failing to solve 7.5% of the benchmarks. RCP leaves 10% of the benchmarks unsolved. OSTRICH-COMP fails to solve 13% of the benchmarks, while OSTRICH fails on 25%.

These results demonstrate that while RCP does not achieve top-tier performance, it remains competitive using simple strategies, effectively solving a significant portion of the benchmark set. Notably, it reduces the number of unsolved benchmarks from 25% (roughly 500) with OSTRICH to 10% (around 200), a 60% reduction in the number of failures.

A different trend emerges in the second and third benchmark sets, which consist of 1,000 PCP benchmarks and 1,000 bioinformatics benchmarks. In contrast to the SMT-LIB’24 benchmarks, most solvers fail to solve any instances from these categories. RCP is the only exception, solving nearly all PCP instances (with only around 10% remaining unsolved). While OSTRICH is unable to solve the PCP benchmarks, it manages to handle the bioinformatics benchmarks. This disparity for OSTRICH can be attributed to the underlying structure of the benchmarks: while the PCP benchmarks involve a more complex structure, the bioinformatics benchmarks fall into the straight-line fragment, for which OSTRICH is effective. These results highlight that outside of the SMT-LIB benchmark sets, many challenging benchmarks remain unsolved by existing solvers. However, our propagation-based approach solves a significant portion of these previously unsolved benchmarks, demonstrating that constraint propagation can be crucial for tackling problems beyond the reach of current solvers.

0.6.4 Impact of Enhancing Solver Performance with RCP

Table 3 presents the performance of RCP and its impact when combined with various solvers. Specifically, for each solver, we compute the virtual best portfolio (VBP), which considers the union of benchmarks solved either by the solver alone or by RCP. This is a particularly useful measure of impact, as many practical approaches for solving string constraints rely on a portfolio of solvers running in parallel. Evaluating the VBP provides insight into whether including a given solver in such a portfolio is beneficial, thereby helping to assess the practical value of RCP when integrated into a multi-solver strategy. We omit OSTRICH-BASE as base solver from this evaluation, as its technique is very close to RCP, and the previous experiments have already demonstrated the superior performance of RCP over this baseline.

We assess the unique contribution of RCP, defined as the number of benchmarks solved by RCP that the individual solver could not solve on its own. For each benchmark suite, we report three key quantities: the number of benchmarks left unsolved by the portfolio solver, the contribution provided by RCP, and the resulting improvement. The improvement is computed as $(\frac{\text{contribution}}{\text{unsolved}+\text{contribution}})$ which quantifies the relative gain achieved by including RCP in a portfolio. This metric effectively demonstrates the impact of RCP in complementing existing solvers.

First, it is immediately apparent that for the PCP benchmarks, no other solver is able to solve any instances, making RCP solely responsible for a contribution of 901 solved benchmarks in this set. As a result, all solver combinations with RCP show an improvement of approximately 90% on the PCP benchmarks. In addition, for the bioinformatics benchmarks the improvement is 100% for all solver combinations except for OSTRICH + RCP, as OSTRICH can already solve the entire benchmark suite (yielding an improvement of 0%).

For the SMT-LIB benchmark set, the contribution of RCP varies noticeably across the different base solvers. For instance, when combined with cvc5, RCP contributes an additional 61 solved instances from 122 unknown benchmarks, resulting in an improvement of 50%. Meanwhile, combinations with Z3 and Z3-alpha show intermediate improvements of roughly 25% and 43%, respectively. These improvements follow the same pattern, primarily benefiting from enhanced handling of regular constraints, word equations, and length reasoning across various benchmark categories. In contrast, the combination of OSTRICH with RCP yields a significantly higher contribution, solving an extra 197 out of 258 unknown cases—translating to an improvement of about 74%.333This also provides a strong indication of the potential improvement in OSTRICH-COMP if the OSTRICH-BASE component were replaced by our RCP implementation—reducing the number of unsolved instances to just 3%, and ranking just behind Z3-Noodler.

The improvements are most pronounced in the String Constraints from Programs and String Rewrite benchmarks. Its propagation strategy proves less effective on benchmarks involving more complex string functions and predicates, leading to weaker performance in those cases. Finally, Z3-Noodler sees a more modest contribution (4 additional instances from 11 unknown, or 27% improvement). This outcome is unsurprising, as Z3-Noodler also employs RCP as part of its strategy and solves already most of the benchmarks in this suite. The remaining unsolved benchmarks fall into two categories: one originates from String Constraints from Programs, while three belong to the WebApp category, which relies on replaceAll. Since this operation is currently unsupported in Z3-Noodler, these results indicate that while its propagation techniques are effective, its coverage of string functions in the SMT-LIB 2.7 format remains incomplete.

Notably, while Z3-Noodler showed only a minor absolute improvement on the SMT-LIB benchmarks, this can largely be attributed to the underrepresentation of complex string functions such as replaceAll in the SMT-LIB dataset. Since Z3-Noodler already excels at solving the predominant types of string constraints in SMT-LIB, its gains from RCP are limited. However, as observed in the WebApp benchmarks, where replaceAll is more frequently used, RCP provided improvements.

The last four rows of Table 3 show the additional contribution of RCP when added to portfolios already containing OSTRICH-BASE. As expected, the improvements on SMT-LIB’24 benchmarks are marginal (ranging from 0% to 8%), due to significant overlap between the constraints solved by RCP and OSTRICH-BASE. This highlights a natural trend: as more solvers are combined in a portfolio, the marginal contribution of each individual technique diminishes. Nonetheless, the value of RCP becomes more apparent on harder or previously unaddressed benchmarks. In particular, while OSTRICH-BASE fails to solve any PCP instances, adding RCP recovers 901 solved cases across all configurations, demonstrating its unique strength in handling expressive string constraints beyond SMT-LIB.

0.7 Related Work

String solving has been extensively studied in the past decade or so, e.g., see the survey [13]. Our work contributes to both the theoretical and practical aspects of string solving. In this section, we organize the related literature into two complementary parts. First, we review the theoretical foundations that underpin string constraint solving—ranging from early results on decidability. Second, we discuss practical string solvers, highlighting the evolution of implementations from early prototypes to state-of-the-art tools.

Theoretical Foundations.

Early work on the satisfiability of word equations established decidability with significant complexity results. Makanin [56] and later Plandowski [64] showed that the problem is decidable and lies in PSPACE, while subsequent work by Jeż [45] introduced the recompression technique—a simpler method that streamlined earlier approaches. In practice, Nielsen’s transformation [62] has emerged as an effective technique for handling quadratic word equations, maintaining the same theoretical complexity bounds. Although the lower bound is known to be NP, establishing tight bounds remains challenging.

The decidability of word equations with linear length constraints such as $|x|=|y|$ remains an open problem. However, for quadratic word equations, some positive results have been obtained by combining Nielsen’s transformation with counters to track variable lengths [51]. Moreover, even simple extensions incorporating transducers render the problem undecidable, which motivated the definition of the straight-line fragment [52]. This fragment restricts constraints so that each variable is assigned at most once—an intuitively appealing condition that nonetheless captures a rich class of problems. While the computational complexity of the straight-line fragment is EXPSPACE in general, it drops to PSPACE for constraints of small dimensions (i.e., when the structure of the constraints is sufficiently limited) and remains decidable even when augmented with additional constraints such as length, letter counting, and disequality. Recent work has further refined these ideas: a comprehensive proof system for string constraints that captures the straight-line fragment was introduced in [28], providing a formal framework that informs our approach, and the straight-line condition was extended to the theory of sequences in [46] by applying constraint propagation techniques on parametric languages rather than on regular languages (following a similar approach to that in [30]).

Building on the idea of limiting variable assignments to ensure decidability, the chain-free fragment [10] extends the decidable class of string constraints by allowing variables to be assigned more than once, provided that these assignments do not form a chain. Although this extension builds on the concepts underlying the straight-line fragment, the techniques employed are fundamentally different. In the chain-free fragment, a splitting graph is introduced to systematically manage the interactions between variables—particularly when a variable appears multiple times on the same side of an equation—thus enabling a richer set of constraints while preserving decidability.

In this context, our work shows that the proof system from [28], specifically the rules for regular constraint propagation, is sufficient to subsume the chain-free fragment, providing a novel algorithmic characterization of it.

String Solvers.

Over the past decade, a wide range of string solvers have emerged, employing techniques such as reductions to other theories, word equation splitting, and automata-based reasoning. Many automata-based solvers apply constraint propagation, typically using limited forms of automata splitting over concatenation.

Kaluza [68] and HAMPI [48] handle string constraints over bounded-length variables by translating them into bit-vector constraints. Similarly, G-Strings [14] and Gecode+s [69] model strings as arrays of integers along with explicit length constraints, relying on constraint propagation in those domains. nfa2sat [53] and Woorpje [37] encode string problems into propositional logic and solve them via SAT solvers, although Woorpje is limited to bounded-length word equations while nfa2sat supports more general cases. Sloth [44], Qzy [15], and SLOG/Slent [73, 72] use automata to represent string constraints and reduce the problem to a model checking task—often solved using tools like IC3 [26]. PISA [71], on the other hand, maps string constraints to monadic second-order logic on finite strings handling indexOf and replace operations.

The Z3Str family—comprising Z3Str/2/3/4 [76, 75, 22, 60]—iteratively decomposes constant strings into substrings and splits variables into subvariables until they become bounded. Z3str2 introduces new search heuristics and detects overlapping variables, while Z3str3 extends this with theory-aware branching to prioritize easier constraints. Z3STR3RE [21, 23] further refines the approach by handling regular constraints directly without reducing them to word equations. Building on these ideas, Z3-alpha [54, 55] employs an SMT strategy synthesis technique to select appropriate solving strategies based on the underlying solver (e.g., Z3 or Z3Str4). Z3 [38] integrates multiple techniques—including those from Z3-alpha and Z3seq [70], which is based on symbolic automata and derivatives—to capture the theory of sequences. While many state-of-the-art string solvers use rewriting as a preprocessing step or to handle specific string functions, cvc5 [17] distinguishes itself by relying on derivation rules as a core strategy, lazily reducing complex string functions to word equations.

Other solvers focus on automata-based techniques and constraint propagation. Early ideas[41] applied simplistic regular constraint propagation, while later work [58] introduced forward propagation for web page analysis, supporting complex string functions and transductions. STRANGER [74] uses both forward and backward propagation to over-approximate the inputs of string variables at various program points. Norn [8, 9] guarantees termination on the acyclic fragment through automata splitting and length propagation.

Trau [6, 5, 7] extends Norn’s approach with counterexample-guided abstraction refinement to approximate regular languages using arithmetic formulas and is the first solver to handle the chain-free fragment [10], supporting features such as string transductions and replaceAll. CertiStr [47] adopts a forward propagation strategy over regular constraints and concatenation. OSTRICH [30] employs refined backward propagation—along with word equation splitting, length abstraction, and letter counting—to propagate regular constraints across string functions (including replaceAll and transductions), thereby guaranteeing completeness for the straight-line fragment. In practice, OSTRICH is run at SMT-COMP using a portfolio configuration with timeslicing, where three different base solvers are executed sequentially within a fixed time budget: the basic OSTRICH (which combines backward propagation with equation splitting), CEA-OSTRICH [29] (which uses cost-enriched automata for improved reasoning about length, indexOf, and subString constraints), and a solver based on algebraic data types [43]. Z3-Noodler [24, 33, 42] introduces a specialized stabilization algorithm, applying a combination of forward and backward propagation to a selected word equation until the inferred regular languages on both sides stabilize. Its techniques have been extended to handle length constraints, disequalities, and string-to-integer conversion. Although complete for the chain-free fragment (on supported string functions), Z3-Noodler does not support string transductions and replaceAll—a gap our solver addresses.

Owing to the interest in and the demands of string solving, a standard file format has been recently agreed and adopted as part of SMT-LIB 2.6 [19], called the theory of Unicode strings (introduced in 2020). This has made it possible to create a track on string problems at the SMT-COMP [18].444Not all aforementioned solvers support SMT-LIB 2.6 format.

0.8 Conclusion and Future Work

In this paper, we demonstrated that a simple strategy like RCP can effectively solve a wide range of benchmarks in string solving. We first established its completeness on the orderable fragment, which subsumes two of the largest known decidable fragments: chain-free and straight-line constraints.

We introduced a fair proof search strategy for applying RCP, ensuring that every constraint is eventually propagated and no propagation rule is indefinitely postponed. However, the efficiency of proof search may vary depending on the structure of the input constraints. For instance, the Marking Algorithm provides a specialized strategy that is complete for the orderable fragment but does not generalize beyond it. Furthermore, our strategies are not without limitations. They are not complete for certain simple equations, and our exploration has not utilized the entire proof system. There are rules that are theoretically not fully understood yet, such as the “Cut” rule, which allows splitting the search around arbitrary regular constraints. While this rule can be advantageous in many cases, its integration poses a challenge as it is not clear how to algorithmically choose a constraint to split around. Developing adaptive heuristics for proof search, tailored to specific classes of string constraints, remains an interesting direction for future work.

Beyond our theoretical contributions, we implemented RCP based on our proof system and evaluated its performance on standard SMT string benchmarks. Although RCP does not outperform state-of-the-art solvers on the overall SMT-COMP datasets, it remains competitive, solving up to 90% of the benchmarks—compared to other solvers that solve between 75% and 99% of the set. Notably, our work significantly improves the performance of base OSTRICH, increasing its benchmark-solving ratio from 75% to 90%. When combined with the remainder of the OSTRICH portfolio, the resulting virtual best portfolio achieves up to 97% of solved benchmarks—second only to Z3-Noodler on the SMT-COMP benchmarks. Moreover, RCP excels in previously unsolved benchmark categories, namely on PCP instances and on bioinformatics benchmarks, where only OSTRICH achieves comparable results. Finally, integrating RCP with existing solvers significantly enhances their performance, reducing the number of unsolved benchmarks by 25% to 74% on SMT-COMP datasets and by up to 100% on both PCP and bioinformatics benchmarks.

While our work primarily focuses on string constraints over regular languages, an interesting direction for future research is to explore the applicability of our techniques in the theory of sequences, where the underlying languages are specified by parametric automata. As noted in the related work, preliminary investigations using constraint propagation methods in this domain have yielded promising results. Further exploration could provide valuable insights into both the theoretical and practical implications of extending our approach to sequence constraints.

s

Acknowledgments

This work was supported by the Engineering and Physical Sciences Research Council (EPSRC) under Grant No. EP/T00021X/1; the European Research Council (ERC) under Grant No. 101089343 (LASD); and the Swedish Research Council under Grant No. 2021-06327.

Data Availability Statement

The complete implementation of RCP, along with the benchmark suites (including the SMT-LIB, PCP, and bioinformatics benchmarks) are available on Zenodo [57].

.9 Proofs for Section 0.4

RCP assumes that all equational constraints are in a normal form, i.e. they are of the form $x=f(y_{1},\ldots,y_{k})$, where $f$ uses concatenation only, or $x=\mathcal{T}(y)$, where $\mathcal{T}$ is a rational function. We show that the natural translation to the normal form, in which we replace an equational constraint $t=\mathcal{T}(t^{\prime})$ with $x=t,y=t^{\prime},x=\mathcal{T}(y)$, preserves the chain-freeness:

Lemma .9.1**.**

A set of equational constraints $\chi$ is chain-free if and only if the set of its normal forms $\psi$ is chain-free.

Proof.

We show the proof by induction on the number of equations turned into normal form, i.e. we fix one constraint $\phi_{j}=`t_{2j-1}=\mathcal{T}(t_{2j})^{\prime}$ and replace it with three equations

[TABLE]

and show that $G$ has a cycle if and only if $G^{\prime}$ has a cycle. Let $x_{1},\ldots,x_{n}$ be all variables used in both $t_{2j-1}$ and $t_{2j}$. For simplicity of proof we will use the same names as in $G$ for the corresponding nodes in $G^{\prime}$; the only new nodes are those corresponding to $x,y$ (two nodes each). For simplicity, let them be called $(x,1)$ for the node in $x=t_{2j-1}$, $(y,1)$ for $y=t_{2j}$ and $(x,2),(y,2)$ for the last equation.

Consider an edge $(2j-1,i)\to(j^{\prime},i^{\prime})$ (so from node corresponding to a variable in $t_{2j-1}$ to some other variable) in $G$. Then in $G^{\prime}$ there is a path $(2j-1,i)\to(x,2)\to(y,1)\to(j^{\prime},i^{\prime})$, moreover,

• •

$(x,2)$ has incoming edges only of the form $(2j-1,i)\to(x,2)$;

• •

$(x,2)$ has only one outgoing edge: $(x,2)\to(y,1)$ and this is the only incoming edge of $(y,1)$;

• •

$(y,1)$ has outgoing edges to $(j^{\prime},i^{\prime})$ if and only if there is an edge $(2j-1,i)\to(j^{\prime},i^{\prime})$ (this is independent of the choice of $i$).

So, in a sense, this edge was replaced with a path of length $3$ (this is not strict in the sense that $(x,2)\to(y,1)$ is shared by many such paths).

Similarly, consider an edge $(2j,i)\to(j^{\prime},i^{\prime})$ (so from node corresponding to a variable in $t_{2j}$ to some other variable) in $G$. Then in $G^{\prime}$ there is a path $(2j,i)\to(y,2)\to(x,1)\to(j^{\prime},i^{\prime})$, moreover:

• •

$(y,2)$ has incoming edges only of the form $(2j,i)\to(y,2)$;

• •

$(y,2)$ has only one outgoing edge: $(y,2)\to(x,1)$ and this is the only incoming edge of $(x,1)$;

• •

$(x,1)$ has outgoing edges to $(j^{\prime},i^{\prime})$ if and only if there is an edge $(2j,i)\to(j^{\prime},i^{\prime})$ (this is indepoendent of the choice of $i$).

So, as above, this edge was replaced with a path of length $3$.

It is easy to see that if there is a cycle in $G$ then there is one in $G^{\prime}$ (obtained by replacing appropriate edges by paths; they may in general share node and edges).

In the other direction, if there is a cycle in $G^{\prime}$ then we can create a cycle in $G$: any edge that does not use $(x,1),(x,2),(y,1),(y,2)$ exists also in $G$. If the cycle uses, say, $(y,1)$ then it needs to use a path of the form $(2j-1,i)\to(x,2)\to(y,1)\to(j^{\prime},i^{\prime})$ (for some $i,j^{\prime},i^{\prime}$) and this corresponds to an edge $(2j-1,i)\to(j^{\prime},i^{\prime})$ in $G$, the other case are shown in the same way. Iterating this process yields a path in $G$. ∎

proof of Lemma 0.4.4.

The claim follows from

[TABLE]

which is the definition of the image of $f$. ∎

proof of Lemma 0.4.5.

Denote by $\psi$ $\psi^{\prime}$ the first and second formula.

$\Rightarrow$: Assume that $\psi$ holds. Then there is a model that satisfies $\psi$ and there exists a $z$ that satisfies $z\in L_{z}$ and $z=f(y_{1},\ldots,y_{n})$. We know that $f$ is backwardable and by assumption $f^{-1}(L_{z})=\bigcup^{k}_{j=1}L_{1,j}\times\dots\times L_{n,j}$, hence there exists at least one $j$ such that $(y_{1},\ldots,y_{n})\in L_{1,j}\times\dots\times L_{n,j}$ and $z=f(y_{1},\ldots,y_{n})$. Therefore one of the disjuncts in $\psi^{\prime}$ is true and so $\psi^{\prime}$ is also true.

$\Leftarrow$: Assume that $\psi^{\prime}$ holds. Then there is a model that satisfies it. Since $f^{-1}(L_{z})=\bigcup^{k}_{j=1}L_{1,j}\times\dots\times L_{n,j}$ and at least one of the disjuncts in $\psi^{\prime}$ is true, for some $j$ we have $(y_{1},\ldots,y_{n})\in L_{1,j}\times\dots\times L_{n,j}$ and so $f(y_{1},\ldots,y_{n})\in L_{z}$, we take it as a witness $z$; note that this might be a different witness than in $\psi^{\prime}$. Hence, the same model satisfies $\psi$. ∎

.10 Proofs for Section 0.5

We first show how the equation and regular constraints can look like in different sequents of the proof system applied on (3) .

Lemma .10.1**.**

Consider a sequent in a branch of a proof (in a proof system using only rules Nielsen, Cut, Intersect, Fwd-Prop, Bwd-Prop and Close). used on example (3) such that Nielsen was applied $\ell$ times at the prefix and $r$ times at the suffix. Then the equation is

[TABLE]

Moreover, the regular constraints are of the form $x\in e_{x},y\in e_{y}$, where $L(e_{x})\subseteq a^{+}\;\land\;L(e_{y})\subseteq a^{*}ba^{*}$.

Proof.

We show the claim by induction on the number of rules’ application. It clearly holds for the initial equation for $r=\ell=0$.

If we apply a Cut rule or regular constraint propagation then either we end up with a contradiction (terminating a branch) or we make the constraint for $x,y$ stricter, i.e. we restrict the regular set, so the upper-bounds on them still hold; we also do not modify the equation.

Suppose that we apply the Nielsen’s transform to the prefix. Taking $x/y$ implies an update in the regular constraint for $x$, i.e. $e_{x},e_{y}$, which is clearly empty, as each string in $L(e_{y})$ contains $b$ and no string in $L(e_{x})$ contains $b$.

Taking $x/yx$ implies an update in the regular constraint for $x$, i.e. $e_{x}^{\prime}$ which by (6) should satisfy $L(e_{x}^{\prime})\subseteq\{v\>:\>\exists u\,uv\in L(e_{x})\land u\in L(e_{y})\}$, which is empty, as each string in $L(e_{y})$ contains $b$ and no string in $L(e_{x})$ contains $b$.

Hence the only possible branch uses $y/xy$ and the equation $xyx^{\ell+r}xy=yxx^{\ell+r}yx$ is replaced (after removing of the two leading $x$’s) with

[TABLE]

as claimed. Note that the analysis for the application of Nielsen’s transform to the suffix is similar, with the difference that we consider substitutions $x/xy$ and $y/yx$, but the resulting equation is the same.

For the regular constraint observe that we update the constraint $e_{y}$, and by (6) it should hold that $L(e_{y}^{\prime})\subseteq L(e_{x})^{-1}L(e_{y})$ or $L(e_{y}^{\prime})\subseteq L(e_{y})L(e_{x})^{-1}$, but as $L(e_{x})\subseteq a^{+},L(e_{y})\subseteq a^{*}ba^{*}$ this ends in a (perhaps empty) subset of $a^{*}ba^{*}$, so the claim still holds. ∎

In the following we represent the regular constraints on $x,y$ using the lengths of strings from $a^{*}$; roughly speaking, the set of those lengths are unions of arithmetic progressions with the same step. We say that a set $A$ is finite (co-finite) in $B$, when $A\cap B$ is finite ($B\setminus A$ is finite).

proof of Lemma 0.5.3.

Consider first $L_{x}$. By known characterizations of unary regular languages, say Chrobak normal form of DFA recognizing a unary regular language, we get that $L_{x}$ is recognized by a DFA which is a finite path followed by a cycle of $m$ states, then the accepting states on the finite path correspond to $a^{k_{i}}$ and the accepting states on the cycle yield sets of the form $a^{k_{i}}\left(a^{m}\right)^{*}$ for appropriate $k_{i}$, and the whole $L_{x}$ is a union of such languages. Now, if there is some $k_{i}\equiv_{m}0$ with $L_{i}=a^{k_{i}}\left(a^{m}\right)^{*}$ then $L_{x}$ is co-finite in $\left(a^{m}\right)^{*}$ and otherwise it is finite in $\left(a^{m}\right)^{*}$.

If $m^{\prime}=\ell m$ then we can easily compute the representation for $m^{\prime}$ from the one for $m$, as $\left(a^{m}\right)^{*}=\bigcup_{k=0}^{\ell-1}a^{km}\left(a^{m^{\prime}}\right)^{*}$. Consequently, if we are given several such representations then it is enough to take new $m$ as the smallest common multiplier of all such $m$s and use the remark above.

For $L_{y}$ observe that we cannot simply claim that $L_{y}=L_{y}^{\prime}bL_{y}^{\prime\prime}$ for some regular sets $L_{y}^{\prime},L_{y}^{\prime\prime}$, as there could be some connection between lengths before and after $b$ in $L_{y}$. We can resolve this by a simple argument: given an NFA recognizing $L_{y}$ we find all, say $t$, transitions by $b$ in it and make a separate copy of the NFA for each such a transition by $b$, in which this transition remains and all other $b$-transitions are removed, clearly $L_{y}=\bigcup_{i=1}^{t}L_{y,i}$, where $L_{y,i}$ is the language for the automaton with $i$th $b$-transition remaining (and other removed). Then $L_{y,i}=L_{y,i}^{\prime}bL_{y,i}^{\prime\prime}$ for appropriate regular languages $L_{y,i}^{\prime},L_{y,i}^{\prime\prime}\subseteq a^{*}$ and we can represent them as union as in the argument above. Using distributivity, we get the required form, note that we need to use common $m$ for $L_{y,i}^{\prime},L_{y,i}^{\prime\prime}$, which is done as before. Finally, we need to take one $m$ for $L_{x},L_{y}$, which is done in the same way. Other claims follow in the same way as for $L_{x}$. ∎

proof of Lemma 0.5.4.

The claim for $L_{x}$ is clear, as by Lemma 0.5.3 it is either finite or co-finite in $\left(a^{m}\right)^{*}$. Similarly, represent $L_{y}$ as

[TABLE]

Then for some $j$ we have that infinitely many $y_{i}$ are in $L_{j,\ell}bL_{j,r}$ and hence infinitely many $a^{k_{i,\ell}m}$ are in $L_{j,\ell}$ and infinitely many $a^{k_{i,r}m}$ are in $L_{j,r}$. By Lemma 0.5.3 each $L_{j,\ell},L_{j,r}$ is either finite or co-finite in $\left(a^{m}\right)^{*}$, so both are in fact co-finite in $\left(a^{m}\right)^{*}$, which ends the proof of the claim.

∎

proof of Theorem 0.5.1.

We show that if a sequent contains regular constraints $x\in e_{x},y\in e_{y}$ (for simplicity we will represents perhaps many constraints as one, which can be obtained by intersecting them), where the representation of $L(e_{x}),L(e_{y})$ according to Lemma 0.5.3 (for a common $m$) are $L(e_{x})=\bigcup_{i}L_{x,i}$ and $L(e_{y})=\bigcup_{j}L_{y,\ell,j}bL_{y,r,j}$ then for some $i,j$ the $L_{x,i},L_{y,\ell,j},L_{y,r,j}$ are all co-finite in $\left(a^{m}\right)^{*}$.

In many case the exact index is not needed and we will refer to those sets as $L_{x},L_{y,\ell},L_{y,r}$.

We show the claim of the Lemma by induction on the number $m$ of times a rule is applied; clearly it holds at the beginning, as for $m=1$ we have $L_{x}=L_{y,\ell}=L_{y,r}=a^{*}$.

For a Cut rule: In a Cut rule we consider an arbitrary regular expression $e$ (defining a language language $R$) and consider separately two branches: the constraint on $y$ replaced with $e_{y}^{\prime}$ such that $L(e_{y}^{\prime})=L_{y}\cap R$ and in the other case: with $L_{y}\cap\overline{R}$ (we can also perform a Cut for $e_{x}$, in the following we discuss the one for $e_{y}$ as it is more involved, the analysis in case of $e_{x}$ can be done in a similar, yet simplified way). Consider $R^{\prime}=R\cap a^{*}ba^{*}$ and $R^{\prime\prime}=\overline{R}\cap a^{*}ba^{*}$, clearly $L_{y}\cap R=L_{y}\cap R^{\prime}$ and $L_{y}\cap\overline{R}=L_{y}\cap R^{\prime\prime}$ and $R^{\prime}\cup R^{\prime}=a^{*}ba^{*}$. Represent $L_{y},R^{\prime},R^{\prime\prime}$ as in Lemma 0.5.3 with a common $m$. By assumption there are $L_{y,\ell},L_{y,r}$ co-finite in $\left(a^{m}\right)^{*}$such that $L_{y}\supseteq L_{y,\ell}bL_{y,r}$.

Consider the language

[TABLE]

At least one of $R^{\prime},R^{\prime\prime}$ contains infinitely many element of it, say $R^{\prime}$ does. Then by Claim 0.5.4 there are $L_{\ell},L_{r}$ co-finite in $\left(a^{m}\right)^{*}$ such that $L_{\ell}bL_{r}\subseteq R^{\prime}$. Then also $L_{\ell}\cap L_{y,\ell}$, $L_{r}\cap L_{y,r}$ are co-finite in $\left(a^{m}\right)^{*}$and clearly

[TABLE]

as required.

For a Nielsen’s rule: by Lemma .10.1 only rules $y/xy$ or $y/yx$ do not lead to immediate contradiction; consider the former, the other is symmetric. Then the regular constraints $x\in e_{x}$ and $y\in e_{y}$ are updated, into $e_{x}^{i},e_{y}^{i}$ (on $i$-th branch). Take $m$ as in Lemma 0.5.3, which is common for $L(e_{x}),L(e_{y})$ and all $L(e^{i}_{x}),L(e^{i}_{y})$. By assumption there are $L_{x},L_{y,\ell},L_{y,r}$, all co-finite in $\left(a^{m}\right)^{*}$, such that $L_{x}\subseteq L(e_{x})$ and $L_{y,\ell}bL_{y,r}\subseteq L(e_{y})$. Consider the triples $(a^{km},a^{2km},a^{km})$, co-finitely many of them are in $L_{x}\times L_{y,\ell}\times L_{y,r}$ and so $x_{k}:=a^{km}\in L_{x},y_{k}:=a^{2km}ba^{km}\in L_{y,\ell}bL_{y,r}$ for each $k\geq k_{0}$ for some $k_{0}$; define $y_{k}^{\prime}$ such that $y_{k}=x_{k}y_{k}^{\prime}$, i.e. $y_{k}^{\prime}=a^{km}ba^{km}$. By (4) for each $k\geq k_{0}$ there is $i$ such that $x_{k}\in L(e_{x}^{i}),y^{\prime}_{k}\in L(y_{x}^{i})$, so for some $i$ we have that for infinitely many $k$ we have $x_{k}\in L(e_{x}^{i})$ and $y^{\prime}_{k}\in L(e_{y}^{i})$; fix this $i$. Then by Claim 0.5.4 $L_{x}^{i}$ is co-finite in $\left(a^{m}\right)^{*}$and there are $L_{y,\ell}^{i},L_{y,r}^{i}$ co-finite in $\left(a^{m}\right)^{*}$such that $L_{y,\ell}^{i}bL_{y,r}^{i}\subseteq L(e_{y}^{i})$, as required. The argument for rule $y\leftarrow yx$ is symmetric.

For regular constraint propagation: formally, the format of the equations required by RCP, i.e. the normal form, forces us to introduce new variable $z$ and rewrite the equation $xyxy=yxyx$ as $z=xyxy$ and $z=yxyx$ and then $z$ is used as a vehicle to transfer the regular constraints from one side to the other (using forward and backward propagation). For the purpose of the proof we will use a common generalization of both (forward and backward) propagation, for simplicity we will use only two variables, the generalization to many variables is clear, but not needed for the proof:

[TABLE]

where here $f,g$ are string functions using only concatenation, so in particular their image of regular sets is regular and and pre-image of regular sets are recognizable relations. It can be seen as applying first the forward and then backward propagation: we compute the regular constraint on $g(x,y)$ (forward propagation) and then transfer it to $f(x,y)$ (backwards propagation).

By Lemma .10.1 the considered equation is of the form: $xyx^{r+\ell}xy=yxx^{r+\ell}yx$ for some $r,\ell$.

The analysis is symmetric for the sides, so let us apply the propagation from the left-hand side to the right-hand side. Let $L(e_{x})=L_{x},L(e_{y})=L_{y}$, define $f(L_{1},L_{2})=L_{2}L_{1}L_{1}^{\ell+r}L_{2}L_{1}$ and $g(L_{1},L_{2})=L_{1}L_{2}L_{1}^{\ell+r}L_{1}L_{2}$; that is, the equation can be represented as $g(x,y)=f(x,y)$. By definition we can branch into new pairs of constraints $\{e_{x}^{i},e_{y}^{i}\}_{i\in I}$, on $x,y$, when

[TABLE]

Consider the representation of $L_{x},L_{y},\{L_{x}^{i},L_{y}^{i}\}_{i\in I}$ according to Lemma 0.5.3 for a common $m$. We want to show that for some $i$ the $L_{x}^{i},L_{y,\ell}^{i},L_{y,r}^{i}$ are all co-finite in $\left(a^{m}\right)^{*}$and $L_{y,\ell}^{i}bL_{y,r}^{i}\subseteq L_{y}^{i}$.

By assumption there are $L_{y,\ell},L_{y,r}$ such that $L_{x},L_{y,\ell},L_{y,r}$ are co-finite in $\left(a^{m}\right)^{*}$and $L_{y,\ell}bL_{y,r}\subseteq L_{y}$. Then

[TABLE]

Now consider

[TABLE]

Hence, except for finitely many elements, $f(x_{i},y_{i})\in g(L_{x},L_{y})$ and so for co-finitely many $i$s we have

[TABLE]

In particular, for some $j$ infinitely many $x_{i}$ belong to $L(e_{x}^{j})$, which is then co-finite in $\left(a^{m}\right)^{*}$ by Claim 0.5.4, and infinitely many $y_{i}$ belong to $L(e_{y}^{j})$, so by Claim 0.5.4 there are $L_{y,\ell}^{j},L_{y,r}^{j}$ co-finite in $\left(a^{m}\right)^{*}$such that $L_{y,\ell}^{j}bL_{y,r}^{j}\subseteq L(e_{y}^{j})$, as required. ∎

.11 Proof Search Strategies

We begin with some observations. Every equational constraint $x=f(\bar{y})$ defines two propagation rules:$(x=f(\bar{y}),\leftarrow)$ and $(x=f(\bar{y}),\rightarrow)$. The set of propagation rules derived from a string constraint $\psi$ consists of all such propagation rules for each equational constraint occurring in $\psi$.

Note, none of the proof rules adds equational constraints to a string constraint. For the sake of presentation and simplicity, we assume that each string variable is associated with exactly one regular constraint. This assumption is justified by the fact that multiple constraints can be combined through Intersect, ensuring a unified representation without loss of generality. If no such constraint is explicitly given, we assume $\Sigma^{*}$ as a default constraint.

We extend the definition of a proof tree in Section 0.3 to an annotated proof tree, where each node is annotated with propagation rules and associated clocks. We call the clocks associated with a leaf and propagation rule, propagation clock and the clocks only associated with a leaf branch clock.

Definition .11.1**.**

Let $T=(V,E,P,B)$ be an annotated proof tree, where $(V,E)$ forms the underlying proof tree. The annotation $P$ is defined as follows:

[TABLE]

where $L$ is the set of leaf nodes in $T$, $\mathcal{P}$ is the set of all propagation rules induced by occurring equational constraints in $T$ and $\mathbb{N}$ tracks clock values. The annotation $B$ is defined as follows:

[TABLE]

For a given string constraint $\psi=\bigwedge_{i=1}^{n}\phi_{i}$, the initial proof tree has a single root node $\Gamma=\phi_{1},\ldots,\phi_{n}$. The annotation assigns $P(\Gamma)=\{((\phi,\leftarrow),0),((\phi,\rightarrow),0)\mid\phi\in\Gamma\}$. That is, the clock for each propagation rule is [math]. Furthermore, the annotation assigns $B(\Gamma)=0$. That is, the clock for the initial branch is set to 0.

We say an annotated proof tree is closed if the underlying proof tree is closed. Next, we formally define what it means to apply a proof rule in the context of constructing a proof tree. More precisely, we define how a proof tree is expanded through the application of a proof rule. We start with the rule Close which closes branches of the proof tree.

Definition .11.2**.**

Let $T=(V,E,P,B)$ be an annotated proof tree, where $P,B$ are the annotation functions. Given a leaf node $\Gamma\in V$, suppose there exists a regular constraint $\phi:=x\in\emptyset$ such that $\phi\in\Gamma$.

Then $\Gamma$ satisfies the condition for the Close rule:

[TABLE]

We define the expansion $\mathcal{E}$ of $T$ with respect to $\Gamma$ using Close as the function:

[TABLE]

The updated proof tree $T^{\prime}=(V^{\prime},E^{\prime},P^{\prime},B^{\prime})$ is constructed as follows:

• •

The new set of nodes is given by $V^{\prime}=V\cup\{\bot\}$, where $\bot$ represents a fresh dead-end node.

• •

The set of edges is updated to $E^{\prime}=E\cup\{(\Gamma,\bot)\}$.

• •

The annotation function $P^{\prime},B^{\prime}$ are updated as follows:

• –

The new dead-end node $\bot$ is also marked as closed:

[TABLE]

• –

For all other leaf nodes $\Gamma^{\prime}\neq\Gamma$, the annotation remains unchanged:

[TABLE]

Definition .11.3**.**

Let $T=(V,E,P,B)$ be an annotated proof tree, where $P,B$ are the annotation functions. Given a leaf node $\Gamma\in V$ containing the equation $\phi_{f}:=x=f(\bar{y})$, suppose there exists a backward propagation rule $(\phi_{f},\leftarrow)$ with clock value $c$, such that $((\phi_{f},\leftarrow),c)\in P(\Gamma)$. Additionally, assume that $\Gamma$ includes the regular constraint $\phi_{e}:=x\in e$.

If $\phi_{f},\phi_{e}$ under sequents $S_{1},\dots,S_{n}$ form a valid proof rule:

[TABLE]

Then, we define the expansion $\mathcal{E}$ of $T$ with respect to $\Gamma$ and $(\phi_{f},\leftarrow)$ as the function:

[TABLE]

First for each $i\in\{1,\ldots,n\}$ we can define $S_{i}^{\prime}:=S_{i}\cup\Gamma$. Then we construct a proof tree $T^{\prime}=(V^{\prime},E^{\prime},P^{\prime},B^{\prime})$ where:

• •

The new set of nodes is given by $V^{\prime}=V\cup\{S_{1}^{\prime},\dots,S_{n}^{\prime}\}$.

• •

The set of edges is updated as $E^{\prime}=E\cup\{(\Gamma,S_{i}^{\prime})\mid i=1,\dots,n\}$.

• •

The annotation function $P^{\prime}$ is updated as follows:

• –

Each new node $S_{i}^{\prime}$ inherits the remaining annotations from $\Gamma$ and resets the clock of $(\phi_{f},\leftarrow)$, increments all other propagation clocks, and initializes a new branch clock:

[TABLE]

• –

The propagation clocks of all other leaves $\Gamma^{\prime}\notin\{S_{1}^{\prime},\dots,S_{n}^{\prime}\}$ stay the same and the branch clocks are incremented by 1:

$P^{\prime}(\Gamma^{\prime})=P(\Gamma^{\prime})\\ B^{\prime}(\Gamma^{\prime})=B(\Gamma^{\prime})+1$**

The expansion of a proof tree using Fwd-Prop can be defined analogously to the backward propagation case. We define the expansion $\mathcal{E}$ of $T$ with respect to $(\phi,\rightarrow)$ as the function:

[TABLE]

which produces a new annotated proof tree $T^{\prime}=(V^{\prime},E^{\prime},P^{\prime},B^{\prime})$ from $T$ by applying an analogous expansion process for forward propagation. Next, we define a proof search as a sequence of proof tree expansions, formally described as follows.

Definition .11.4**.**

A proof search on a set of string constraints $\Gamma$ is a sequence of annotated proof trees

[TABLE]

where the initial tree is given by $T_{0}=(\{\Gamma\},\emptyset,P_{0},B_{0})$, consisting of a single node $\Gamma$ with the annotation functions

[TABLE]

For each subsequent tree $T_{i+1}$, there exists either:

• •

A propagation rule $(\phi,d)$ in the annotation function of some leaf node $\Gamma^{\prime}$, where $d\in\{\leftarrow,\rightarrow\}$, such that

[TABLE]

or

• •

A leaf node $\Gamma^{\prime}$ containing a regular constraint of the form $x\in\emptyset$, in which case the Close rule is applied:

[TABLE]

Finally, we can give the fairness definition.

Definition .11.5**.**

A proof search $T_{0},T_{1},T_{2},\dots$ is fair if it satisfies the following two conditions:

For each propagation rule $(\phi,d)$ with $d\in\{\leftarrow,\rightarrow\}$, there exists a constant $c_{j}>0$ such that whenever

[TABLE]

it holds that

[TABLE] 2. 2.

For each leaf node $\Gamma\in V_{i}$ that is not closed (i.e., extendable), there exists a constant $c_{\Gamma}>0$ such that, if $\Gamma$ remains as a leaf node in some subsequent proof tree $T_{j}$ (with $j\geq i$), then its branch clock value satisfies

[TABLE]

This condition ensures that for a given bound, no propagation rule is indefinitely postponed during the proof search. For example, consider a string constraint $\psi=\bigwedge_{i=1}^{n}\phi_{i},$ where each $\phi_{i}$ is an equational constraint. In this case, a natural choice for an upper bound on the propagation clock is $2n$. This ensures that each propagation rule is applied at least once along any single branch of the proof tree.

In contrast, the upper bounds for the branch clocks must be chosen dynamically, since the width of the proof tree can increase as new branches are created by the application of proof rules. For a given proof tree $T_{i}$, a simple bound is $|L_{i}|$, where $L_{i}$ denotes the set of open (i.e., not closed) leaf nodes in $T_{i}$. This bound guarantees that every branch is expanded at least once before any branch is revisited for further expansion.