DeepAI

# Combined Covers and Beth Definability

In ESOP 2008, Gulwani and Musuvathi introduced a notion of cover and exploited it to handle infinite-state model checking problems. Motivated by applications to the verification of data-aware processes, we proved in a previous paper that covers are strictly related to model completions, a well-known topic in model theory. In this paper we investigate cover transfer to theory combinations in the disjoint signatures case. We prove that for convex theories, cover algorithms can be transferred to theory combinations under the same hypothesis (equality interpolation property aka strong amalgamation property) needed to transfer quantifier-free interpolation. In the non-convex case, we show by a counterexample that cover may not exist in the combined theories. However, we exhibit a cover transfer algorithm operating also in the non-convex case for special kinds of theory combinations; these combinations (called `tame combinations') concern multi-sorted theories arising in many model-checking applications (in particular, in model-checking applications oriented to data-aware verification).

• 29 publications
• 15 publications
• 17 publications
• 39 publications
• 16 publications
08/09/2022

### Interpolation and SAT-Based Model Checking Revisited: Adoption to Software Verification

Interpolation-based model checking (McMillan, 2003) is a formal-verifica...
07/01/2021

### On the (Non-)Applicability of a Small Model Theorem to Model Checking STMs

Software Transactional Memory (STM) algorithms provide programmers with ...
04/25/2022

### General Interpolation and Strong Amalgamation for Contiguous Arrays

Interpolation is an essential tool in software verification, where first...
03/22/2022

### Reduction of Register Pushdown Systems with Freshness Property to Pushdown Systems in LTL Model Checking

Pushdown systems (PDS) are known as an abstract model of recursive progr...
11/10/2021

### Software Model-Checking as Cyclic-Proof Search

This paper shows that a variety of software model-checking algorithms ca...
02/17/2022

### Extended MSO Model Checking via Small Vertex Integrity

We study the model checking problem of an extended 𝖬𝖲𝖮 with local and gl...
07/18/2017

### Inspecting Maude Variants with GLINTS

This paper introduces GLINTS, a graphical tool for exploring variant nar...

## 1 Introduction

The cover of an existential formula (modulo a first-order theory ) is the strongest quantifier-free formula which is implied (modulo ) by . Covers do not always exist, however they exist in many theories arising in verification, like linear (integer or real) arithmetic, , etc. The usefulness of covers in model-checking was already stressed in [13] and further motivated for data-aware verification in recent papers of ours [6, 5, 3, 8]; it is also concretely witnessed in MCMT implementation since version 2.8.

An important question suggested by the application is the cover transfer problem for combined theories: suppose that covers exist in theories , under which conditions do they exist also in the combined theory ? In this paper we show that the answer is affirmative in the disjoint signatures convex case under the same hypothesis (namely under the equality interpolation condition) under which quantifier-free interpolation transfers. Thus for convex theories we essentially obtain a necessary and sufficient condition, in the sense explained by Theorem 6 below.

We also prove that if convexity fails, the non-convex equality interpolation property [2] may not be sufficient to ensure covers transfer property (we show that   combined with integer difference logic is a counterexample). Finally, we prove that for the ‘tame’ multi-sorted theory combinations used in our database-driven applications, covers existence transfers to the combined theory under only the stable infiniteness requirement for the shared sorts.

The main tool employed in our combination result if Beth definability theorem for primitive formulae (this theorem is shown to be equivalent to equality interpolation condition in [2]). In order to design a combined cover algorithm, we exploit the equivalence (supplied by Beth Theorem) between implicit and explicit definability. Implicit definability is reformulated, via covers for input theories, at quantifier-free level. Thus the algorithm guesses the implicitly definable variables, it eliminates them via explicit definability and uses the input covers algorithms to eliminate the remaining (non implicitly definable) variables.

Gulwani and Musuvathi in [13] also have a combined cover algorithm for convex, signature disjoint theories. Their algorithm looks quite different from ours; apart from the fact that a full correctness and completeness proof for such an algorithm seems not to have ever been published, we underline that our algorithm works on different hypotheses. In fact, we only need the equality interpolation condition and we show that such an hypothesis is not only sufficient, but also necessary for covers transfer in convex theories (thus our result is at least formally stronger). 111The equality interpolation condition was known to the authors of [13], in fact it was introduced by one of them some years before in [16]. Equality interpolation was extended to the non convex case in [2], where it was also semantically characterized via strong amalgamation property.

## 2 Preliminaries

We adopt the usual first-order syntactic notions of signature, term, atom, (ground) formula, and so on; our signatures are always finite or countable and include equality. We compactly represent a tuple of variables as . The notation means that the term , the formula has free variables included in the tuple . This tuple is assumed to be formed by distinct variables, thus we underline that when we write e.g. , we mean that the tuples are made of distinct variables are are also disjoint from each other.

A formula is said to be universal (resp., existential) if it has the form (resp., ), where is quantifier-free. Formulae with no free variables are called sentences. From the semantic side, we use the standard notion of -structure and of truth of a formula in a -structure under a free variables assignment. The support of is denoted as . The interpretation of a (function, predicate) symbol in is denoted .

A -theory is a set of -sentences; a model of is a -structure where all sentences in are true. We use the standard notation to say that is true in all models of for every assignment to the variables occurring free in . We say that is -satisfiable iff there is a model of and an assignment to the variables occurring free in making true in .

We now focus on the constraint satisfiability problem and quantifier elimination for a theory . A -formula is a -constraint (or just a constraint) iff it is a conjunction of literals. The constraint satisfiability problem for is the following: we are given a constraint and we are asked whether there exist a model of and an assignment to the free variables such that . A theory has quantifier elimination iff for every formula in the signature of there is a quantifier-free formula such that . Since we are in a computational logic context, when we speak of quantifier elimination, we assume that it is effective, namely that it comes with an algorithm for computing out of . It is well-known that quantifier elimination holds in case we can eliminate quantifiers from primitive formulae, i.e., formulae of the kind , with a constraint.

We recall also some further basic notions. Let be a first-order signature. The signature obtained from by adding to it a set of new constants (i.e., -ary function symbols) is denoted by . Analogously, given a -structure , the signature can be expanded to a new signature by adding a set of new constants (the name for ), one for each element in the support of , with the convention that two distinct elements are denoted by different “name” constants. can be expanded to a -structure just interpreting the additional constants over the corresponding elements. From now on, when the meaning is clear from the context, we will freely use the notation and interchangeably: in particular, given a -structure and a -formula with free variables that are all in , we will write, by abuse of notation, instead of .

A -homomorphism (or, simply, a homomorphism) between two -structures and is a map among the support sets of and of satisfying the condition for all -atoms ( is regarded as a -structure, by interpreting each additional constant into itself and is regarded as a -structure by interpreting each additional constant into ). In case the last condition holds for all -literals, the homomorphism is said to be an embedding and if it holds for all first order formulae, the embedding is said to be elementary. If is an embedding which is just the identity inclusion , we say that is a substructure of or that is an extension of . Universal theories can be characterized as those theories having the property that if and is a substructure of , then (see [9]). If is a structure and , then there is the smallest substructure of including in its support; this is called the substructure generated by . If is the set of elements of a finite tuple , then the substructure generated by has in its support precisely the such that for some term .

Let be a -structure. The diagram of , written (or just ), is the set of ground -literals that are true in . An easy but important result, called Robinson Diagram Lemma [9], says that, given any -structure , the embeddings are in bijective correspondence with expansions of to -structures which are models of . The expansions and the embeddings are related in the obvious way: is interpreted as .

## 3 Covers and Model Completions

We report the notion of cover taken from [13] and also the basic results proved in [7]. Fix a theory and an existential formula ; call a residue of any quantifier-free formula belonging to the set of quantifier-free formulae . A quantifier-free formula is said to be a -cover (or, simply, a cover) of iff and implies (modulo ) all the other formulae in . The following Lemma [7] (to be widely used throughout the paper) supplies a semantic counterpart to the notion of a cover:

###### Lemma.

A formula is a -cover of iff it satisfies the following two conditions: (i) ; (ii) for every model of , for every tuple of elements from the support of such that it is possible to find another model of such that embeds into and .

We underline that, since our language is at most countable, we can assume that the models , from (ii) above are at most countable too, by a Löwenheim-Skolem argument.

We say that a theory has uniform quantifier-free interpolation iff every existential formula (equivalently, every primitive formula ) has a -cover.

It is clear that if has uniform quantifier-free interpolation, then it has ordinary quantifier-free interpolation [2], in the sense that if we have (for quantifier-free formulae ), then there is a quantifier-free formula such that and . In fact, if has uniform quantifier-free interpolation, then the interpolant is independent on (the same can be used as interpolant for all entailments , varying ).

We say that a universal theory has a model completion iff there is a stronger theory (still within the same signature of ) such that (i) every -constraint that is satisfiable in a model of is satisfiable in a model of ; (ii) eliminates quantifiers. Other equivalent definitions are possible [9]: for instance, (i) is equivalent to the fact that and prove the same universal formulae or again to the fact that every model of can be embedded into a model of . We recall that the model completion, if it exists, is unique and that its existence implies the amalgamation property for  [9]. The relationship between uniform interpolation in a propositional logic and model completion of the the equational theory of the variety algebraizing it was extensively studied in [12]. In the context of first order theories, we prove an even more direct connection:

###### Theorem.

Suppose that is a universal theory. Then has a model completion iff has uniform quantifier-free interpolation. If this happens, is axiomatized by the infinitely many sentences , where is a primitive formula and is a cover of it.

The proof (via Lemma 3, by iterating a chain construction) is in [3] (see also [4]).

## 4 Strong Amalgamation and Equality Interpolation

We report here the main results from [2] and from old literature like [1] concerning amalgamation, strong amalgamation and quantifier-free interpolation (some definitions and results are slightly simplified because we restrict them to the case of universal theories).

###### Definition.

A universal theory has the amalgamation property iff whenever we are given models and of and a common substructure of them, there exists a further model of endowed with embeddings and whose restrictions to coincide.222For the results of this paper to be correct, the notion of structure (and of course that of substructure) should encompass the case of structures with empty domains. Readers feeling uncomfortable with empty domains can assume that signatures always contain an individual constant.

A universal theory has the strong amalgamation property if the above embeddings and the above model can be chosen so to satisfy the following additional condition: if for some we have , then there exists an element in such that .

Amalgamation and strong amalgamation are strictly related to quantifier-free interpolation and to combined quantifier-free interpolation, as the results below show:

###### Theorem.

[1] A universal theory has the amalgamation property iff it admits quantifier-free interpolants.

A theory is stably infinite iff every -satisfiable constraint is satisfiable in an infinite model of . The following Lemma comes from a trivial compactness argument:

###### Lemma.

If is stably infinite, then every finite or countable model of can be embedded in a model of such that is countable.

###### Proof.

Consider , where is a countable set of fresh constants: by the Diagram Lemma and the downward Löweneheim-Skolem theorem [9], it is sufficient to show that this set is consistent. Suppose not; then by compactness is not satisfiable, for a finite subset of and a finite subset of . However, this is a contradiction because by stable infiniteness, (being satisfiable in ) is satisfiable in an infinite model of .

###### Theorem.

[2] Let and be two universal stably infinite theories over disjoint signatures and . If both and have the strong amalgamation property, then so does (hence, in particular, the quantifier-free interpolation property transfers from and to their combination ).

There is a converse of the previous result; for a signature , let us call the pure equality theory over the signature (this theory is easily seen to have the strong amalgamation property).

###### Theorem.

[2] Let be a stably infinite universal theory and let be a signature disjoint from the signature of containing at least a unary predicate symbol. Then, has quantifier-free interpolation iff has the strong amalgamation property.

According to Theorem 4, the amalgamation property has a syntactic counterpart (namely quantifier-free interpolation); there is an analogous syntactic characterization for strong amalgamation [2], which can be exploited in the design of combined interpolation algorithms [2]. Since such a condition is rather complex, we report it here only for the simplified case of convex theories, where it coincides with a well-known condition previously introduced in [16]. Recall that a theory is convex iff for every constraint , if then holds for some .

###### Definition.

A convex universal theory is equality interpolating iff for every pair of variables and for every pair of constraints such that

 T⊢δ1(x––,z–1,y1)∧δ2(x––,z–2,y2)→y1=y2 (1)

there exists a term such that

 T⊢δ1(x––,z–1,y1)∧δ2(x––,z–2,y2)→y1=t∧y2=t. (2)

###### Theorem.

[2] A convex universal theory having quantifier-free interpolation has the strong amalgamation property iff it is equality interpolating.

In conclusion, if are universal, convex, stably infinite,333 A convex theory is ‘almost’ stably infinite in the sense that every constraint which is -satisfiable in a -model whose support has at least two elements is satisfiable also in an infinite -model. The one-element model can be used to build counterexamples, though: e.g. the theory of Boolean algebras is convex (like any other universal Horn theory) but the constraint is only satisfiable in the degenerate one-element Boolean algebra. have disjoint signatures and have quantifier-free interpolation, in order for to have quantifier-free interpolation too, we need to ask that both and are equality interpolating; in view of Theorem 4, this condition is not only sufficient but also (almost) necessary.

In [2] a long list of universal strongly amalgamable (i.e. both quantifier-free interpolating and equality interpolating) theories is given, comprising both convex and non-convex theories. The list includes , recursive data theories, as well as linear (both integer and real) arithmetics. For linear arithmetics (and fragments of its), it is essential to make a very careful choice of the signature, see again [2] (especially Subsection 4.1) for details. All the above theories admit a model completion (which coincides with the theory itself in case the theory admits quantifier elimination).

The equality interpolating property in a convex theory can be equivalently characterized using Beth definability as follows. Consider a primitive formula (here is a conjunction of literals); we say that implicitly defines in iff the following formula

 ∀y∀y′(∃z–ϕ(x––,z–,y)∧∃z–ϕ(x––,z–,y′)→y=y′) (3)

is -valid. We say that explicitly defines in iff there is a term such that the formula

 ∀y(∃z–ϕ(x––,z–,y)→y=t(x––)) (4)

is -valid.

For future use, we notice that, by trivial logical manipulations, the formulae (3) and (4) are logically equivalent to

 ∀y∀z–∀y′∀z–′(ϕ(x––,z–,y)∧ϕ(x––,z–′,y′)→y=y′)   . (5)

and to

 ∀y∀z–(ϕ(x––,z–,y)→y=t(x––)) (6)

respectively (we shall use such equivalences without explicit mention).

We say that a theory has the Beth definability property for primitive formulae iff whenever a primitive formula implicitly defines the variable then it also explicitly defines it.

###### Theorem.

[2] A convex theory having quantifier-free interpolation is equality interpolating iff it has the Beth definability property for primitive formulae.

###### Proof.

We recall the easy proof of the left-to-right side (this is the only side we need in this paper). Suppose that is equality interpolating and that

 T⊢ϕ(x––,z–,y)∧ϕ(x––,z–′,y′)→y=y′  ;

then there is a term such that

 T⊢ϕ(x––,z–,y)∧ϕ(x––,z–′,y′)→y=t(x––)∧y′=t(x––)  .

Replacing by via a substitution, we get precisely (6).

## 5 Convex Theories

We now collect some useful facts concerning convex theories. We fix for this section a convex, stably infinite, strongly amalgamable universal theory admitting a model completion . We let be the signature of . We fix also a -constraint , where we assume that (recall that the tuple is disjoint from the tuple according to our conventions from Section 2).

For , we let the formula be the quantifier-free formula equivalent in to the formula

 ∀y–∀y–′(ϕ(x––,y–)∧ϕ(x––,y–′)→yi=y′i) (7)

where the are renamed copies of the .

###### Lemma.

Suppose that we are given a model of and elements from the support of such that for all . Then there exists an extension of such that for some we have .

###### Proof.

By strong amalgamability, we can freely assume that is generated, as a -structure, by the . What we need is to prove the consistency of with the set of ground sentences

 {ϕ(a––,b–)}∪{bi≠t(a––)}t,bi

where varies over -terms, the are fresh constants and vary over . By convexity, this set is inconsistent iff there exist a term and such that

 T∪Δ(M)⊢ϕ(a––,y–)→yi=t  .

This however implies that has the formula

 ∀y–∀y–′(ϕ(a––,y–)∧ϕ(a––,y–′)→yi=y′i)

as a logical consequence. If we now embed into a model of , we have that , which is in contrast to (because is a substructure of and is quantifier-free).

###### Lemma.

Let be the disjunctive normal form (DNF) of . Then, for every , there is a -term such that

 T⊢Lij(x––)∧ϕ(x––,y–)→yi=tij  . (8)

As a consequence, a formula of the kind is equivalent (modulo ) to the formula

 ki⋁j=1∃y–(yi=tij∧Lij(x––)∧ϕ(x––,y–)∧ϕ′)  . (9)

###### Proof.

We have that is a tautology, hence from the definition of , we have that

 T∗⊢Lij(x––)→∀y–∀y–′(ϕ(x––,y–)∧ϕ(x––,–y′)→yi=y′i)  ;

however this formula is trivially equivalent to a universal formula, hence since and prove the universal formulae, we get

 T⊢Lij(x––)∧ϕ(x––,y–)∧ϕ(x––,y–′)→yi=y′i  .

Using Beth definability property (Theorem 4), we get (8), as required, for some terms . Finally, (9) follows from (8) by trivial logical manipulations.

In all our concrete examples, the theory has decidable quantifier-free fragment (nameley it is decidable whether a quantifier-free formula is a logical consequence of or not), thus the terms mentioned in Lemma 5 can be computed just by enumerating all possible -terms: the computation terminates, because the above proof shows that the appropriate terms always exist. However, this is terribly inefficient and, from a practical point of view, one needs to have at disposal dedicated algorithms to find the required equality interpolating terms.

## 6 The Convex Combined Cover Algorithm

Let us now fix two theories over disjoint signatures . We assume that both of them satisfy the assumptions from the previous section, meaning that they are convex, stably infinite, strongly amalgamable, universal and admit model completions respectively. We shall supply a cover algorithm for (thus proving that has a model completion too).

We need to compute a cover for , where is a conjunction of -literals. By applying rewriting purification steps like

 ϕ⟹∃d(d=t∧ϕ(d/t))

(where is a fresh variable and is a pure term, i.e. it is either a - or a -term), we can assume that our formula is of the kind , where is a -formula and is a -formula. Thus we need to compute a cover for a formula of the kind

 ∃e–(ϕ1(x––,e–)∧ϕ2(x––,e–)), (10)

where is a conjunction of -literals (). We also assume that both and contain the literals (for ) as a conjunct: this can be achieved by guessing a partition of the and by replacing each with the representative element of its equivalence class.444Usually, for efficiency reasons, when combining costraint satisfiability algorithms in convex theories, instead of guessing a partition, entailed equalities are propagated between the two theories. Here however, as already strongly pointed out in [13], equality propagation is not sufficient and one needs more complicated mechanisms like propagation of conditional equalities or specific case-splitting rules. Thus, in the end, we preferred to introduce the algorithm in a plain way via partitions guessings - this is easier to explain and more transparent.

To manipulate formulae, our algorithm employs acyclic explicit definitions as follows. When we write (where are tuples of distinct variables), we mean any formula of the kind (let )

 m⋀j=1zi=ti

where the term is pure and only the variables can occur in it. When we assert a formula like , we are in fact in the condition of recursively eliminating the variables from it via terms containing only the parameters (the ’explicit definitions’ are in fact arranged acyclically).

A working formula is a formula of the kind

 ∃z–(ExplDef(z–,x––)∧∃e–(ψ1(x––,z–,e–)∧ψ2(x––,z–,e–)))  , (11)

where is a conjunction of -literals and is a conjunction of -literals. The variables are called parameters, the variables are called defined variables and the variables (truly) existential variables. The parameters do not change during the execution of the algorithm. We assume that in a working formula (11) always contain the literals (for distinct from ) as a conjunct.

In our starting formula (10), there are no defined variables. However, if via some syntactic check it happens that some of the existential variables can be recognized as defined, then it is useful to display them as such (this observation may avoid redundant cases - leading to inconsistent disjuncts - in the computations below).

A working formula like (11) is said to be terminal iff for every esistential variable we have that

 T1⊢ψ1→¬ImplDefT1ψ1,ei(–x,z–)  and  T2⊢ψ2→¬ImplDefT2ψ2,ei(x––,z–)   . (12)

Roughly speaking, we can say that in a terminal working formula, all variables which are not parameters are either explicitly definable or recognized as not implicitly definable by both theories; of course, a working formula with no existential variables is terminal.

###### Lemma.

Every working formula is equivalent (modulo ) to a disjunction of terminal working formulae.

###### Proof.

To compute the required terminal working formulae, it is sufficient to apply the following non-deterministic procedure (the output is the disjunction of all possible outcomes). Notice that the following formula is trivially a tautology:

 (⋀ei∈e–¬ImplDefT1ψ1,ei(x––,z–)∧⋀ei∈e–¬ImplDefT2ψ2,ei(x––,z–))∨ ∨ ⋁ei∈e–ImplDefT1ψ1,ei(x––,z–)∨⋁ei∈e–ImplDefT2ψ2,ei(x––,z–)

The nondeterministic procedure applies one of the following alternatives.

(1)

Update by adding it a disjunct from the DNF of and by adding it a disjunct from the DNF of ;

(2i)

Select and ; then update by adding it a disjunct from the DNF of ; the equality (where is the term mentioned in Lemma 5) is added to ; the variable becomes in this way part of the defined variables.

If alternative (1) is chosen, the procedure stops, otherwise it is recursively applied again and again (we have one truly existential variable less after applying alternative (2i), so we eventually terminate).

Thus we are left to the problem of computing a cover of a terminal working formula; this is an easily solvable problem:

###### Proposition.

A cover of a terminal working formula (11) can be obtained just by unravelling the explicit definitions of the variables from the formula

 ∃z–(ExplDef(z–,x––)∧θ1(x––,z–)∧θ2(x––,z–)) (13)

where is the -cover of and is the -cover of .

###### Proof.

We prove that for every -model , for every tuple from such that there is an extension of such is still a model of and (this is actually more than what we need, because according to Lemma 5, we need this only for the case where is the unique tuple satisfying ). By a Löwhenheim-Skolem argument, since our languages are countable, we can suppose that is at most countable and actually that it is countable by stable infiniteness of our theories, see Lemma 4 (the fact that is stably infinite in case both are such, comes from the proof of Nelson-Oppen combination result, see [14],[15], [10]).

According to the conditions (12) and the definition of a cover (notice that the formulae do not contain the and are quantifier-free) we have that

 T1⊢θ1→¬ImplDefT1ψ1,ei(x––,z–)  and  T2⊢θ2→¬ImplDefT2ψ2,ei(x––,z–)

(for every ). Thus, since and holds for every , we can apply Lemma 5 and conclude that there exist a -model and a -model such that and for tuples and , both disjoint from . By a Löwhenheim-Skolem argument, we can suppose that are countable and by Lemma 4 even that they are both countable extensions of .

The tuples and have equal length because the from our working formulae entail , where are different existential variables. Thus there is a bijection fixing all elements in and mapping componentwise the onto the . But this means that, exactly as it happens in the proof of the completeness of the Nelson-Oppen combination procedure, the -structure on can be moved back via to in such a way that the -substructure from is fixed and in such a way that the tuple is mapped to the tuple . In this way, becomes a -structure which is a model of and which is such that , as required.

From Lemma 6 and Proposition 6, we immediately get

###### Theorem.

Let be convex, stably infinite, strongly amalgamable, universal theories admitting a model completion. Then admits a model completion too. Covers in can be effectively computed as shown above.

Notice that the input cover algorithms in the above combined cover computation algorithm are used not only in the final step described in Proposition 6, but also every time we need to compute a formula : according to its definition, this formula is obtained by eliminating quantifiers in from (7) (this is done via a cover computation, reading as ). In practice, implicit definability is a rather sparse phenomenon, so that in many concrete cases is trivially equivalent to (in such cases, Step (2i) above can obviously be disregarded).

###### Example.

Our results apply for instance to the case where is (where just contains the unary symbol ) and is linear real arithmetic. We recall that covers are computed in real arithmetic by quantifier elimination, whereas for one can apply the superposition-based algorithm from [7]. Let us compute the cover of

 ∃e1⋯∃e4 ⎛⎜⎝e1=f(x1)∧e2=f(x2)∧∧f(e3)=e3∧f(e4)=x1∧∧x1+e1≤e3∧e3≤x2+e2∧e4=x2+e3⎞⎟⎠ (14)

This is the following formula

 [x2=0∧f(x1)=x1∧x1≤0∧x1≤f(0)] ∨ [x1+f(x1)