In the process of developing reliable and provably correct software, it is often necessary to express and then subsequently verify properties that belong to different logical languages. Thus, the correctness of a software system depends on being able to prove these conditions, expressed in distinct first-order signatures with equality. The search for a satisfying assignment of a given formula with respect to some background first-order theory is known as the SMT (Satisfiability Modulo Theories) problem.
SMT solvers 
are particularly useful tools for the automated verification of properties expressed with quantifier-free first-order formulae. Some theories usually integrated with common SMT solvers are the theory of arrays, of bit-vectors, of linear arithmetic, and the theory of uninterpreted functions.
Every background theory used in some SMT solver comes along with its own satisfiability procedure. The problem of modularly combining such special-purpose algorithms is highly non-trivial, since without the appropriate restrictions it is not even decidable .
We will now briefly introduce some definitions to understand how to tackle this question and under which assumptions one can do it effectively.
A first-order quantifier-free theory , identified with the set of its theorems, is stably infinite if every formula satisfiable in is satisfiable in an infinite model of . Let and be signatures for a first-order language. A -formula is pure if every literal in is a -literal or a -literal. It is easy to see that every quantifier-free -formula can be purified, yet maintaining satisfiability, by (i) substituting every impure subterm of the form with , where is a new variable, (ii) adding to the conjunct , and (iii) recursively purifying the term , if needed.
We say that two theories and over the signatures and , respectively, are disjoint when and do not share any non-logical symbols.111Besides propositional connectives, logical symbols comprise equality. The Nelson-Oppen  procedure provides a method for combining decision procedures for disjoint, stably infinite theories and into one for , namely the -theory defined as the deductive closure of the union of the theories and .
A theory is convex if for all conjunctions of literals in and for all nonempty disjunctions of equalities, implies in if and only if implies in for some .
Examples of convex theories are the theory of Linear Rational Arithmetic and the theory of list structure .
The non-logical symbols of the theory of are , , , , ; following [5, Chapter 3.4.2], its axioms (universally quantified) are:
where stands for . After , the non-logical symbols of the theory of list structure are car, cdr, cons, and atom, and its axioms are:
where (i) cons is a binary function, with representing the list constructed by prepending the object to the list , (ii) car and cdr are unary functions, the left and right projections, respectively, and (iii) atom is true if and only if is a single-element list.
Given two disjoint stable infinite theories and , the Nelson-Oppen combination technique establishes the satisfiability of a conjunction of pure formulae (where has signature ) in from the decision procedures for and . The key idea is to propagate equalities to whenever implies , and conversely. This iterative process can be performed quickly in polynomial time, when the theories involved are convex. On the other hand, case-splitting would occur when dealing with non-convex theories, since only one of the equalities of the disjunct implied by must be chosen at every step.
In [20, 22, 21], variants of the Nelson-Oppen method were used to combine theories involving sets/multisets of urelements (i.e., objects with no internal structure) with the theory of integers and with the theory of cardinal numbers in presence of a cardinality operator. The SMT problem in the context of the theory of finite sets is considered in .
In this paper, we start an investigation for combining decidable fragments of pure Zermelo-Fraenkel set theory (in which sets are recursively built up from other sets) with other theories within the Nelson-Oppen framework. More specifically, our main result is that the theory Multi-Level Syllogistic (the basic language of computable set theory—MLS for short) is convex and therefore its decision procedure (and those of its several polynomial fragments [9, 11]) can be efficiently combined with the decision procedures of other basic decidable theories, such as for instance the theory of lists and the theory of linear rational arithmetic, since set theory is plainly stably infinite.
The paper is organized as follows. Section 1 introduces the syntax and semantics of the theory MLS of our interest. Then, in Section 2, we prove the main result of the paper, namely that the theory MLS is convex. We also review several fragments of MLS endowed with polynomial-time decision procedures, since these inherit convexity from MLS and are therefore particularly interesting for efficient combinations with other convex decidable theories. Subsequently, in Section 3, we prove the non-convexity of various extensions of MLS. Finally, in Section 4, we provide some closing remarks and plans for future research.
1 Syntax and semantics of Mls
Multi-Level Syllogistic (MLS) is the quantifier-free propositional closure of atoms of the types:
where stand for set variables. We denote by the collection of the set variables occurring in any MLS-formula .
The satisfiability problem for MLS has been first solved in the seminal paper . Its NP-completeness (and that of its extension MLSS with the singleton operator) has been later proved in . Several extensions of MLS have been proved decidable over the years, giving rise to the field of Computable Set Theory (see [10, 13, 19, 14] for an in-depth account).
The semantics of MLS is defined in the most natural way by means of set assignments.
A set assignment is any map from a finite collection of set variables , denoted , into the von Neumann universe .
We recall that is the cumulative hierarchy constructed in stages by transfinite recursion over the class of all ordinals. Specifically,
for every , with denoting the powerset operator.
The notion of rank of a set is strictly connected to the construction steps of the von Neumann hierarchy. Specifically, for any set , the rank of (denoted ) is defined as the least ordinal such that . The rank function is extended to set assignments , by putting .
The set operators and relators of MLS are interpreted according to their usual semantics. Thus, given a set assignment , we put:
where and .
Finally, for all MLS-formulae and , we put by structural recursion:
An MLS-formula is satisfiable if there exists a set assignment over such that , in which case we also write and say that is a model for . If is satisfied by all set assignments, we say that is true and write .
By way of disjunctive normal form, the satisfiability problem for MLS can be reduced to the satisfiability problem for conjunctions of MLS-literals, namely MLS-atoms of types (1) and their negation. In addition, for the purposes of simplifying some proofs, we can further restrict ourselves to MLS-conjunctions involving a minimal number of literal types. As shown in , all the atoms in (1) and their negations can be rewritten in terms of atoms of type and only by repeatedly applying the following equivalences much as rewrite rules (the existential quantifiers are then just dropped while the quantified variables are replaced by fresh ones):
Henceforth, we will restrict ourselves to MLS-formulae that are conjunctions of atoms of the following two types only:
In the rest of the paper, these will be simply referred to as MLS-conjunctions.
Finally, as a piece of notation, for any given finite set of literals, we write (resp., ) to denote the conjunction (resp., disjunction) of all the literals in .
2 Convexity of Mls
Our main goal is to prove that the theory MLS is convex, namely that, for any MLS-conjunction and any given finite nonempty set of equalities among variables, we have:
To prove that the theory MLS is convex, we will proceed by way of contradiction.
Thus, let us suppose that there exists an MLS-conjunction (namely a conjunction of literals of type (2)) and a finite, nonempty set of equalities among variables such that:
, for any in
(that is, for every in there exists some set assignment such that ).
In view of condition 2, our conjunction is satisfiable. Among all the models for , we select one, say , that satisfies as few as possible equalities in , namely such that the cardinality of is minimal. We also set , so is the collection of the inequalities such that is in and (hence, ).
Plainly, we have . Notice that, while may be empty, the conjunction must contain at least one literal, since by condition 1.
Let be any equality in , which will be referred to in the rest of our proof as the designated equality of . We will prove that the conjunction
is satisfiable, thereby contradicting the assumed minimality of , since for every model for we would have , and therefore .
Before diving into the details of the proof, we provide an overview of how the set assignment can be suitably enlarged into another set assignment that satisfies all the conjuncts of but the designated equality , thus proving that is satisfiable.
The construction of consists in two phases: the first one, the Boolean phase, takes care of the satisfiability of the Boolean literals of , namely the literals in of type , , and , whereas the second one, the membership phase, takes care of the satisfiability of the membership literals of , namely those of the form .
In order to model , we add to exactly one between and a new member not already occurring in . The set must be chosen with care to prevent that no set produced during the subsequent membership phase is new to the current set assignment. In addition, the set must be added to the right sets in order that the resulting assignment keeps satisfying all of the Boolean literals in other than the designated equality . The first problem is solved by selecting as any set of rank strictly greater than that of . As for the second condition, recalling that, by 2, the conjunction is satisfiable, we can select a model for it. Therefore , and so we can pick some element belonging to exactly one of the sets and . By adding our special set as an element to all and only those sets such that , for , we obtain a new assignment, which will be denoted . It turns out that correctly models all the conjuncts in , but the membership literals for which . We denote by the collection of variables in such that .
We illustrate the Boolean phase of our enlargement process with the following MLS-conjunction
and with the equality .
Let and be the set assignments over so defined, where to enhance readability we use the shorthand —likewise, will denote the set :
It can easily be checked that and hold.
Let , so that . Since , we can put , and so we have:
Plainly, satisfies all literals in but the literals and . ∎
The subsequent membership phase performs the following enlargement step, for , until needed:
extend the assignment by putting, for each ,
while setting for the remaining variables in , and define as the collection of variables in such that .
For , it turns out that each correctly models all the Boolean literals in and all the membership literals in but those of the form with . Hence, as soon as some is empty, the assignment is plainly a model for , and so the membership phase can stop. By the well-foundedness of the membership relation, such a situation occurs in at most steps, and therefore is a model for , proving that is satisfiable.
Example 2.1 (cont’d).
We continue our example by illustrating the membership phase of our enlargement process. We recall that . Since and , we have , , , , and for all . Next, since and , we have , for all , and
Finally, since , we can actually stop. In fact, at this point we have
Plainly, . ∎
For any , we will use the notation to denote the set . Let be any fixed set whose rank is larger than the rank of , namely such that .
We define by recursion two sequences and , respectively of subsets of and of set assignments over , by putting:
For every , we have
For all and , we have:
Lemma 2.21 implies that the sequence of assignments is plainly pointwise convergent. As a consequence of the next lemma and corollary, it will follow in fact that converges “uniformly”, and it does so in at most steps.
Let . We have:
if then, for all ,
if , then
Thus, if , by picking any and by repeatedly applying (8), it follows that there exist such that
The preceding lemma yields immediately the following result.
For all , we have .
Letting , Corollary 2.4 implies that , for all .
Next we prove a number of technical lemmas that will culminate in the proof that
where is the designated equality of . Thus, we will have that
The following lemma provides some useful bounds on the rank of , for and .
For all and , we have
, if ,
, if .
We proceed by induction on . For and , from (5) we have . Hence, , since . On the other hand, if , then .
Next, let and . By (6), we have:
By inductive hypothesis, we readily have
In addition, since , then by (4), for some . Hence, again by inductive hypothesis, , and since , we have
Thus, by (10), we get .
On the other hand, if , then by (6) and by the inductive hypothesis we have . ∎
Next we prove that the set can enter only when .
For all and , we have:
Concerning 1, we proceed by induction on .
Next we prove 2 by induction on .
The base case is trivial.
For the inductive step, let . If , then Lemma 2.21 yields readily . Conversely, let . If , then by (6) we have , and therefore by inductive hypothesis . On the other hand, if , then again by (6) we have
The following lemma proves that, at each construction step of the assignments ’s, only elements of rank at least can enter into play.
For every set , for some and , if then .
All the inequalities satisfied by are satisfied by every , as proved in the following corollary.
If , for some , then , for every .
To show that every membership satisfied by is correctly modeled by , we will need the following result.
For all and , if and , then and .
We are now ready to prove our main lemma.
The assignment satisfies .
We prove the lemma, by showing that correctly models all the conjuncts in . We recall that, in view of the reduction process outlined in Section 1, our formula contains conjuncts of two types only, namely and .
Conjuncts of type .
Conjuncts of type .
Let . We first consider that case in which . Then . Hence, by Lemma 2.21, . In addition, since and , Lemma 2.7 yields . Thus, .
Next, let . Hence, (by Lemma 2.62), so that (by (5) and (3)), and therefore . Since