Introduction
In the process of developing reliable and provably correct software, it is often necessary to express and then subsequently verify properties that belong to different logical languages. Thus, the correctness of a software system depends on being able to prove these conditions, expressed in distinct firstorder signatures with equality. The search for a satisfying assignment of a given formula with respect to some background firstorder theory is known as the SMT (Satisfiability Modulo Theories) problem.
SMT solvers [3]
are particularly useful tools for the automated verification of properties expressed with quantifierfree firstorder formulae. Some theories usually integrated with common SMT solvers are the theory of arrays, of bitvectors, of linear arithmetic, and the theory of uninterpreted functions.
Every background theory used in some SMT solver comes along with its own satisfiability procedure. The problem of modularly combining such specialpurpose algorithms is highly nontrivial, since without the appropriate restrictions it is not even decidable [4].
We will now briefly introduce some definitions to understand how to tackle this question and under which assumptions one can do it effectively.
A firstorder quantifierfree theory , identified with the set of its theorems, is stably infinite if every formula satisfiable in is satisfiable in an infinite model of . Let and be signatures for a firstorder language. A formula is pure if every literal in is a literal or a literal. It is easy to see that every quantifierfree formula can be purified, yet maintaining satisfiability, by (i) substituting every impure subterm of the form with , where is a new variable, (ii) adding to the conjunct , and (iii) recursively purifying the term , if needed.
We say that two theories and over the signatures and , respectively, are disjoint when and do not share any nonlogical symbols.^{1}^{1}1Besides propositional connectives, logical symbols comprise equality. The NelsonOppen [17] procedure provides a method for combining decision procedures for disjoint, stably infinite theories and into one for , namely the theory defined as the deductive closure of the union of the theories and .
A theory is convex if for all conjunctions of literals in and for all nonempty disjunctions of equalities, implies in if and only if implies in for some .
Examples of convex theories are the theory of Linear Rational Arithmetic and the theory of list structure .
The nonlogical symbols of the theory of are , , , , ; following [5, Chapter 3.4.2], its axioms (universally quantified) are:
where stands for . After [17], the nonlogical symbols of the theory of list structure are car, cdr, cons, and atom, and its axioms are:
where (i) cons is a binary function, with representing the list constructed by prepending the object to the list , (ii) car and cdr are unary functions, the left and right projections, respectively, and (iii) atom is true if and only if is a singleelement list.
Given two disjoint stable infinite theories and , the NelsonOppen combination technique establishes the satisfiability of a conjunction of pure formulae (where has signature ) in from the decision procedures for and . The key idea is to propagate equalities to whenever implies , and conversely. This iterative process can be performed quickly in polynomial time, when the theories involved are convex. On the other hand, casesplitting would occur when dealing with nonconvex theories, since only one of the equalities of the disjunct implied by must be chosen at every step.
In [20, 22, 21], variants of the NelsonOppen method were used to combine theories involving sets/multisets of urelements (i.e., objects with no internal structure) with the theory of integers and with the theory of cardinal numbers in presence of a cardinality operator. The SMT problem in the context of the theory of finite sets is considered in [2].
In this paper, we start an investigation for combining decidable fragments of pure ZermeloFraenkel set theory (in which sets are recursively built up from other sets) with other theories within the NelsonOppen framework. More specifically, our main result is that the theory MultiLevel Syllogistic (the basic language of computable set theory—MLS for short) is convex and therefore its decision procedure (and those of its several polynomial fragments [9, 11]) can be efficiently combined with the decision procedures of other basic decidable theories, such as for instance the theory of lists and the theory of linear rational arithmetic, since set theory is plainly stably infinite.
—————
The paper is organized as follows. Section 1 introduces the syntax and semantics of the theory MLS of our interest. Then, in Section 2, we prove the main result of the paper, namely that the theory MLS is convex. We also review several fragments of MLS endowed with polynomialtime decision procedures, since these inherit convexity from MLS and are therefore particularly interesting for efficient combinations with other convex decidable theories. Subsequently, in Section 3, we prove the nonconvexity of various extensions of MLS. Finally, in Section 4, we provide some closing remarks and plans for future research.
1 Syntax and semantics of Mls
MultiLevel Syllogistic (MLS) is the quantifierfree propositional closure of atoms of the types:
(1) 
where stand for set variables. We denote by the collection of the set variables occurring in any MLSformula .
The satisfiability problem for MLS has been first solved in the seminal paper [15]. Its NPcompleteness (and that of its extension MLSS with the singleton operator) has been later proved in [12]. Several extensions of MLS have been proved decidable over the years, giving rise to the field of Computable Set Theory (see [10, 13, 19, 14] for an indepth account).
The semantics of MLS is defined in the most natural way by means of set assignments.
A set assignment is any map from a finite collection of set variables , denoted , into the von Neumann universe .
We recall that is the cumulative hierarchy constructed in stages by transfinite recursion over the class of all ordinals. Specifically,
where, recursively,
for every , with denoting the powerset operator.
The notion of rank of a set is strictly connected to the construction steps of the von Neumann hierarchy. Specifically, for any set , the rank of (denoted ) is defined as the least ordinal such that . The rank function is extended to set assignments , by putting .
The set operators and relators of MLS are interpreted according to their usual semantics. Thus, given a set assignment , we put:
and  
where and .
Finally, for all MLSformulae and , we put by structural recursion:
An MLSformula is satisfiable if there exists a set assignment over such that , in which case we also write and say that is a model for . If is satisfied by all set assignments, we say that is true and write .
By way of disjunctive normal form, the satisfiability problem for MLS can be reduced to the satisfiability problem for conjunctions of MLSliterals, namely MLSatoms of types (1) and their negation. In addition, for the purposes of simplifying some proofs, we can further restrict ourselves to MLSconjunctions involving a minimal number of literal types. As shown in [9], all the atoms in (1) and their negations can be rewritten in terms of atoms of type and only by repeatedly applying the following equivalences much as rewrite rules (the existential quantifiers are then just dropped while the quantified variables are replaced by fresh ones):

,

,

,

,

,

,

,

,

,
where .
Henceforth, we will restrict ourselves to MLSformulae that are conjunctions of atoms of the following two types only:
(2) 
In the rest of the paper, these will be simply referred to as MLSconjunctions.
Finally, as a piece of notation, for any given finite set of literals, we write (resp., ) to denote the conjunction (resp., disjunction) of all the literals in .
2 Convexity of Mls
Our main goal is to prove that the theory MLS is convex, namely that, for any MLSconjunction and any given finite nonempty set of equalities among variables, we have:
To prove that the theory MLS is convex, we will proceed by way of contradiction.
Thus, let us suppose that there exists an MLSconjunction (namely a conjunction of literals of type (2)) and a finite, nonempty set of equalities among variables such that:

[label=(C0)]

;

, for any in
(that is, for every in there exists some set assignment such that ).
It is not restrictive to additionally assume that .^{2}^{2}2Indeed, without disrupting conditions 1 and 2, for any variable one may add to the literal , where stands for some fresh variable.
In view of condition 2, our conjunction is satisfiable. Among all the models for , we select one, say , that satisfies as few as possible equalities in , namely such that the cardinality of is minimal. We also set , so is the collection of the inequalities such that is in and (hence, ).
Plainly, we have . Notice that, while may be empty, the conjunction must contain at least one literal, since by condition 1.
Let be any equality in , which will be referred to in the rest of our proof as the designated equality of . We will prove that the conjunction
is satisfiable, thereby contradicting the assumed minimality of , since for every model for we would have , and therefore .
Before diving into the details of the proof, we provide an overview of how the set assignment can be suitably enlarged into another set assignment that satisfies all the conjuncts of but the designated equality , thus proving that is satisfiable.
Proof overview
The construction of consists in two phases: the first one, the Boolean phase, takes care of the satisfiability of the Boolean literals of , namely the literals in of type , , and , whereas the second one, the membership phase, takes care of the satisfiability of the membership literals of , namely those of the form .
In order to model , we add to exactly one between and a new member not already occurring in . The set must be chosen with care to prevent that no set produced during the subsequent membership phase is new to the current set assignment. In addition, the set must be added to the right sets in order that the resulting assignment keeps satisfying all of the Boolean literals in other than the designated equality . The first problem is solved by selecting as any set of rank strictly greater than that of . As for the second condition, recalling that, by 2, the conjunction is satisfiable, we can select a model for it. Therefore , and so we can pick some element belonging to exactly one of the sets and . By adding our special set as an element to all and only those sets such that , for , we obtain a new assignment, which will be denoted . It turns out that correctly models all the conjuncts in , but the membership literals for which . We denote by the collection of variables in such that .
Example 2.1.
We illustrate the Boolean phase of our enlargement process with the following MLSconjunction
and with the equality .
Let and be the set assignments over so defined, where to enhance readability we use the shorthand —likewise, will denote the set :
It can easily be checked that and hold.
Let , so that . Since , we can put , and so we have:
and .
Plainly, satisfies all literals in but the literals and . ∎
The subsequent membership phase performs the following enlargement step, for , until needed:
extend the assignment by putting, for each ,
while setting for the remaining variables in , and define as the collection of variables in such that .
For , it turns out that each correctly models all the Boolean literals in and all the membership literals in but those of the form with . Hence, as soon as some is empty, the assignment is plainly a model for , and so the membership phase can stop. By the wellfoundedness of the membership relation, such a situation occurs in at most steps, and therefore is a model for , proving that is satisfiable.
Example 2.1 (cont’d).
We continue our example by illustrating the membership phase of our enlargement process. We recall that . Since and , we have , , , , and for all . Next, since and , we have , for all , and
Finally, since , we can actually stop. In fact, at this point we have
Plainly, . ∎
Proof details
For any , we will use the notation to denote the set . Let be any fixed set whose rank is larger than the rank of , namely such that .
We define by recursion two sequences and , respectively of subsets of and of set assignments over , by putting:
(3)  
(4)  
and  
(5)  
(6)  
Lemma 2.2.

[label=()]

For every , we have

For all and , we have:
Lemma 2.21 implies that the sequence of assignments is plainly pointwise convergent. As a consequence of the next lemma and corollary, it will follow in fact that converges “uniformly”, and it does so in at most steps.
Lemma 2.3.
Let . We have:

[label=()]

if then, for all ,

[label=(a)]

,

;


if , then
(7)
Proof.
If , then and by (4) and (6), respectively. By iterating the same argument, one can easily prove that and , for all , proving 1.
As for 2, we preliminarily observe that, by (4), for all and we have
(8) 
Thus, if , by picking any and by repeatedly applying (8), it follows that there exist such that
(9) 
By the wellfoundedness of , the variables must be pairwise distinct. Hence, . In addition, (9) also yields . Thus, (7) follows, proving 2. ∎
The preceding lemma yields immediately the following result.
Corollary 2.4.
For all , we have .
Letting , Corollary 2.4 implies that , for all .
Next we prove a number of technical lemmas that will culminate in the proof that
where is the designated equality of . Thus, we will have that
contradicting the minimality of . Hence, the convexity of MLS will follow, since our initial assumption on and that conditions 1 and 2 hold will be proved to be untenable.
The following lemma provides some useful bounds on the rank of , for and .
Lemma 2.5.
For all and , we have

[label=]

, if ,

, if .
Proof.
We proceed by induction on . For and , from (5) we have . Hence, , since . On the other hand, if , then .
Next, let and . By (6), we have:
(10) 
By inductive hypothesis, we readily have

[label=]

, and

.
In addition, since , then by (4), for some . Hence, again by inductive hypothesis, , and since , we have
Thus, by (10), we get .
On the other hand, if , then by (6) and by the inductive hypothesis we have . ∎
Next we prove that the set can enter only when .
Lemma 2.6.
For all and , we have:

[label=()]

;

.
Proof.
Concerning 1, we proceed by induction on .
For the inductive step, let . If , then by Lemma 2.5 we have , and therefore . On the other hand, if , then , by (6) and by the inductive hypothesis.
Next we prove 2 by induction on .
The base case is trivial.
For the inductive step, let . If , then Lemma 2.21 yields readily . Conversely, let . If , then by (6) we have , and therefore by inductive hypothesis . On the other hand, if , then again by (6) we have
In view of 1, the latter formula yields , and therefore follows again by inductive hypothesis, completing the proof of 2, and in turn of the lemma. ∎
The following lemma proves that, at each construction step of the assignments ’s, only elements of rank at least can enter into play.
Lemma 2.7.
For every set , for some and , if then .
Proof.
All the inequalities satisfied by are satisfied by every , as proved in the following corollary.
Corollary 2.8.
If , for some , then , for every .
Proof.
To show that every membership satisfied by is correctly modeled by , we will need the following result.
Lemma 2.9.
For all and , if and , then and .
Proof.
We are now ready to prove our main lemma.
Lemma 2.10.
The assignment satisfies .
Proof.
We prove the lemma, by showing that correctly models all the conjuncts in . We recall that, in view of the reduction process outlined in Section 1, our formula contains conjuncts of two types only, namely and .
Conjuncts of type .
Conjuncts of type .
Let occur in , so that holds. We will prove that , by proving that and hold.
Proof of . From Lemma 2.22, we have:
Let . We first consider that case in which . Then . Hence, by Lemma 2.21, . In addition, since and , Lemma 2.7 yields . Thus, .
Next, let . Hence, (by Lemma 2.62), so that (by (5) and (3)), and therefore . Since