# On the Convexity of a Fragment of Pure Set Theory with Applications within a Nelson-Oppen Framework

The Satisfiability Modulo Theories (SMT) issue concerns the satisfiability of formulae from multiple background theories, usually expressed in the language of first-order predicate logic with equality. SMT solvers are often based on variants of the Nelson-Oppen combination method, a solver for the quantifier-free fragment of the combination of theories with disjoint signatures, via cooperation among their decision procedures. When each of the theories to be combined by the Nelson-Oppen method is convex (that is, any conjunction of its literals can imply a disjunction of equalities only when it implies at least one of the equalities) and decidable in polynomial time, the running time of the combination procedure is guaranteed to be polynomial in the size of the input formula. In this paper, we prove the convexity of a fragment of Zermelo-Fraenkel set theory, called Multi-Level Syllogistic, most of whose polynomially decidable fragments we have recently characterized.

• 14 publications
• 5 publications
• 2 publications
12/15/2017

### A Decidable Fragment of Second Order Logic With Applications to Synthesis

We propose a fragment of many-sorted second order logic ESMT and show th...
04/09/2020

### Politeness for the Theory of Algebraic Datatypes

Algebraic datatypes, and among them lists and trees, have attracted a lo...
04/15/2020

### Computing Tropical Prevarieties with Satisfiability Modulo Theories (SMT) Solvers

A novel way to use SMT (Satisfiability Modulo Theories) solvers to compu...
08/13/2018

### Proving Program Properties as First-Order Satisfiability

Program semantics can often be expressed as a (many-sorted) first-order ...
01/18/2018

### Complexity of Combinations of Qualitative Constraint Satisfaction Problems

The CSP of a first-order theory T is the problem of deciding for a given...
04/16/2020

### Solving bitvectors with MCSAT: explanations from bits and pieces (long version)

We present a decision procedure for the theory of fixed-sized bitvectors...
07/12/2018

### A Generic Framework for Implicate Generation Modulo Theories

The clausal logical consequences of a formula are called its implicates....

## Introduction

In the process of developing reliable and provably correct software, it is often necessary to express and then subsequently verify properties that belong to different logical languages. Thus, the correctness of a software system depends on being able to prove these conditions, expressed in distinct first-order signatures with equality. The search for a satisfying assignment of a given formula with respect to some background first-order theory is known as the SMT (Satisfiability Modulo Theories) problem.

SMT solvers [3]

are particularly useful tools for the automated verification of properties expressed with quantifier-free first-order formulae. Some theories usually integrated with common SMT solvers are the theory of arrays, of bit-vectors, of linear arithmetic, and the theory of uninterpreted functions.

Every background theory used in some SMT solver comes along with its own satisfiability procedure. The problem of modularly combining such special-purpose algorithms is highly non-trivial, since without the appropriate restrictions it is not even decidable [4].

We will now briefly introduce some definitions to understand how to tackle this question and under which assumptions one can do it effectively.

A first-order quantifier-free theory , identified with the set of its theorems, is stably infinite if every formula satisfiable in is satisfiable in an infinite model of . Let and be signatures for a first-order language. A -formula is pure if every literal in is a -literal or a -literal. It is easy to see that every quantifier-free -formula can be purified, yet maintaining satisfiability, by (i) substituting every impure subterm of the form with , where is a new variable, (ii) adding to the conjunct , and (iii) recursively purifying the term , if needed.

We say that two theories and over the signatures and , respectively, are disjoint when and do not share any non-logical symbols.111Besides propositional connectives, logical symbols comprise equality. The Nelson-Oppen [17] procedure provides a method for combining decision procedures for disjoint, stably infinite theories and into one for , namely the -theory defined as the deductive closure of the union of the theories and .

A theory is convex if for all conjunctions of literals in and for all nonempty disjunctions of equalities, implies in if and only if implies in for some .

Examples of convex theories are the theory of Linear Rational Arithmetic and the theory of list structure .

The non-logical symbols of the theory of are , , , , ; following [5, Chapter 3.4.2], its axioms (universally quantified) are:

 x+0=x, x+(−x)=0, (x+y)+z=x+(y+z), x+y=y+x, x⩽y∧y⩽x→x=y, x⩽y∨y⩽x, x⩽y→x+z⩽y+z, x⩽y∧y⩽z→x⩽z, nx=0→x=0, (∃y) x=ny(for each positive integer n),

where stands for . After [17], the non-logical symbols of the theory of list structure are car, cdr, cons, and atom, and its axioms are:

 car(cons(x,y))=x, cdr(cons(x,y))=y, ¬atom(x)→cons(car(x),cdr(x))=x, ¬atom(cons(x,y)),

where (i) cons is a binary function, with representing the list constructed by prepending the object to the list , (ii) car and cdr are unary functions, the left and right projections, respectively, and (iii) atom is true if and only if is a single-element list.

Given two disjoint stable infinite theories and , the Nelson-Oppen combination technique establishes the satisfiability of a conjunction of pure formulae (where has signature ) in from the decision procedures for and . The key idea is to propagate equalities to whenever implies , and conversely. This iterative process can be performed quickly in polynomial time, when the theories involved are convex. On the other hand, case-splitting would occur when dealing with non-convex theories, since only one of the equalities of the disjunct implied by must be chosen at every step.

In [20, 22, 21], variants of the Nelson-Oppen method were used to combine theories involving sets/multisets of urelements (i.e., objects with no internal structure) with the theory of integers and with the theory of cardinal numbers in presence of a cardinality operator. The SMT problem in the context of the theory of finite sets is considered in [2].

In this paper, we start an investigation for combining decidable fragments of pure Zermelo-Fraenkel set theory (in which sets are recursively built up from other sets) with other theories within the Nelson-Oppen framework. More specifically, our main result is that the theory Multi-Level Syllogistic (the basic language of computable set theory—MLS for short) is convex and therefore its decision procedure (and those of its several polynomial fragments [9, 11]) can be efficiently combined with the decision procedures of other basic decidable theories, such as for instance the theory of lists and the theory of linear rational arithmetic, since set theory is plainly stably infinite.

—————

The paper is organized as follows. Section 1 introduces the syntax and semantics of the theory MLS of our interest. Then, in Section 2, we prove the main result of the paper, namely that the theory MLS is convex. We also review several fragments of MLS endowed with polynomial-time decision procedures, since these inherit convexity from MLS and are therefore particularly interesting for efficient combinations with other convex decidable theories. Subsequently, in Section 3, we prove the non-convexity of various extensions of MLS. Finally, in Section 4, we provide some closing remarks and plans for future research.

## 1 Syntax and semantics of Mls

Multi-Level Syllogistic (MLS) is the quantifier-free propositional closure of atoms of the types:

 x=∅,x=y,x⊆y,x∈y,x=y∖z,x=y∪z,x=y∩z, (1)

where stand for set variables. We denote by the collection of the set variables occurring in any MLS-formula .

The satisfiability problem for MLS has been first solved in the seminal paper [15]. Its NP-completeness (and that of its extension MLSS with the singleton operator) has been later proved in [12]. Several extensions of MLS have been proved decidable over the years, giving rise to the field of Computable Set Theory (see [10, 13, 19, 14] for an in-depth account).

The semantics of MLS is defined in the most natural way by means of set assignments.

A set assignment is any map from a finite collection of set variables , denoted , into the von Neumann universe .

We recall that is the cumulative hierarchy constructed in stages by transfinite recursion over the class of all ordinals. Specifically,

 V\coloneqq⋃α∈OnVα,

where, recursively,

 Vα\coloneqq⋃β<αP(Vβ),

for every , with denoting the powerset operator.

The notion of rank of a set is strictly connected to the construction steps of the von Neumann hierarchy. Specifically, for any set , the rank of (denoted ) is defined as the least ordinal such that . The rank function is extended to set assignments , by putting .

The set operators and relators of MLS are interpreted according to their usual semantics. Thus, given a set assignment , we put:

 M(x⋆y) \coloneqqMx⋆My and M(x=y)=true ⟺Mx=My, M(x∈y)=true ⟺Mx∈My, M(x=y⋆z)=true ⟺Mx=M(y⋆z),

where and .

Finally, for all MLS-formulae and , we put by structural recursion:

 M(¬φ)\coloneqq¬M(φ), M(φ∧ψ)\coloneqqMφ∧Mψ, M(φ∨ψ)\coloneqqMφ∨Mψ, M(φ→ψ)\coloneqqMφ→Mψ.

An MLS-formula is satisfiable if there exists a set assignment over such that , in which case we also write and say that is a model for . If is satisfied by all set assignments, we say that is true and write .

By way of disjunctive normal form, the satisfiability problem for MLS can be reduced to the satisfiability problem for conjunctions of MLS-literals, namely MLS-atoms of types (1) and their negation. In addition, for the purposes of simplifying some proofs, we can further restrict ourselves to MLS-conjunctions involving a minimal number of literal types. As shown in [9], all the atoms in (1) and their negations can be rewritten in terms of atoms of type and only by repeatedly applying the following equivalences much as rewrite rules (the existential quantifiers are then just dropped while the quantified variables are replaced by fresh ones):

• ,

• ,

• ,

• ,

• ,

• ,

• ,

• ,

• ,

where .

Henceforth, we will restrict ourselves to MLS-formulae that are conjunctions of atoms of the following two types only:

 x∈y,x=y∖z. (2)

In the rest of the paper, these will be simply referred to as MLS-conjunctions.

Finally, as a piece of notation, for any given finite set of literals, we write (resp., ) to denote the conjunction (resp., disjunction) of all the literals in .

## 2 Convexity of Mls

Our main goal is to prove that the theory MLS is convex, namely that, for any MLS-conjunction and any given finite nonempty set of equalities among variables, we have:

 ⊨φ⟶⋁E⟹⊨φ⟶x=y, \leavevmode\nobreak\ for some equality x=y% in E.

To prove that the theory MLS is convex, we will proceed by way of contradiction.

Thus, let us suppose that there exists an MLS-conjunction (namely a conjunction of literals of type (2)) and a finite, nonempty set of equalities among variables such that:

1. [label=(C0)]

2. ;

3. , for any in
(that is, for every in there exists some set assignment such that ).

It is not restrictive to additionally assume that .222Indeed, without disrupting conditions 1 and 2, for any variable one may add to the literal , where stands for some fresh variable.

In view of condition 2, our conjunction is satisfiable. Among all the models for , we select one, say , that satisfies as few as possible equalities in , namely such that the cardinality of is minimal. We also set , so is the collection of the inequalities such that is in and (hence, ).

Plainly, we have . Notice that, while may be empty, the conjunction must contain at least one literal, since by condition 1.

Let be any equality in , which will be referred to in the rest of our proof as the designated equality of . We will prove that the conjunction

 φ∗ \makebox[0.0pt]\tiny Def:= φ ∧ ⋀(E+M∖{¯ℓ}) ∧ ⋀E−M ∧ ¯¯¯x≠¯¯¯y

is satisfiable, thereby contradicting the assumed minimality of , since for every model for we would have , and therefore .

Before diving into the details of the proof, we provide an overview of how the set assignment can be suitably enlarged into another set assignment that satisfies all the conjuncts of but the designated equality , thus proving that is satisfiable.

#### Proof overview

The construction of consists in two phases: the first one, the Boolean phase, takes care of the satisfiability of the Boolean literals of , namely the literals in of type , , and , whereas the second one, the membership phase, takes care of the satisfiability of the membership literals of , namely those of the form .

In order to model , we add to exactly one between and a new member not already occurring in . The set must be chosen with care to prevent that no set produced during the subsequent membership phase is new to the current set assignment. In addition, the set must be added to the right sets in order that the resulting assignment keeps satisfying all of the Boolean literals in other than the designated equality . The first problem is solved by selecting as any set of rank strictly greater than that of . As for the second condition, recalling that, by 2, the conjunction is satisfiable, we can select a model for it. Therefore , and so we can pick some element belonging to exactly one of the sets and . By adding our special set as an element to all and only those sets such that , for , we obtain a new assignment, which will be denoted . It turns out that correctly models all the conjuncts in , but the membership literals for which . We denote by the collection of variables in such that .

###### Example 2.1.

We illustrate the Boolean phase of our enlargement process with the following MLS-conjunction

 φ \makebox[0.0pt]\tiny Def:= x=¯¯¯y∖z ∧ x=¯¯¯x∖w ∧ x≠¯¯¯y ∧ ¯¯¯y∈w ∧ w∈v ∧ z∈v

and with the equality .

Let and be the set assignments over so defined, where to enhance readability we use the shorthand —likewise, will denote the set :

 Mx =∅, M¯¯¯x =M¯¯¯y={∅}, Mz =Mw={∅,{∅}}, Mv ={{∅,{∅}}}, ¯¯¯¯¯¯Mx =∅, ¯¯¯¯¯¯M¯¯¯y =¯¯¯¯¯¯Mz={∅}, ¯¯¯¯¯¯M¯¯¯x =¯¯¯¯¯¯Mw={∅}2, ¯¯¯¯¯¯Mv ={{∅},{∅}2}.

It can easily be checked that  and  hold.

Let , so that . Since , we can put , and so we have:

 M0u=⎧⎨⎩{∅,s}if u=¯¯¯y{∅,{∅},s}if u=zMuotherwise

and .

Plainly, satisfies all literals in but the literals and . ∎

The subsequent membership phase performs the following enlargement step, for , until needed:

extend the assignment by putting, for each ,

 Mk+1u \coloneqq Mku ∪ {Mkv∣v∈Vk and Mv∈Mu},

while setting for the remaining variables in , and define as the collection of variables in such that .

For , it turns out that each correctly models all the Boolean literals in and all the membership literals in but those of the form with . Hence, as soon as some is empty, the assignment is plainly a model for , and so the membership phase can stop. By the well-foundedness of the membership relation, such a situation occurs in at most steps, and therefore is a model for , proving that is satisfiable.

###### Example 2.1 (cont’d).

We continue our example by illustrating the membership phase of our enlargement process. We recall that . Since and , we have , , , , and for all . Next, since and , we have , for all , and

Finally, since , we can actually stop. In fact, at this point we have

 M2=M3=M4=⋯.

Plainly, . ∎

#### Proof details

For any , we will use the notation to denote the set . Let be any fixed set whose rank is larger than the rank of , namely such that .

We define by recursion two sequences and , respectively of subsets of and of set assignments over , by putting:

 V0 \coloneqq{u∈Vars(φ) | t∈¯¯¯¯¯¯Mu}, (3) Vn \coloneqq{u∈Vars(φ) | Mu∩MVn−1≠∅},  for n⩾1, (4) and M0v \coloneqq{Mv∪{s}if v∈V0Mvif v∈Vars(φ)∖V0, (5) Mnv \coloneqq{Mn−1v∪Mn−1{u∈Vn−1∣Mu∈Mv}if v∈VnMn−1vif v∈Vars(φ)∖Vn, (6) \coloneqq   for n⩾1 and v∈Vars(φ).

As a direct consequence of (5) and (6), the following results can be easily proved by induction:

###### Lemma 2.2.
1. [label=()]

2. For every , we have

 Mv ⊆ M0v ⊆ ⋯ ⊆ Mnv ⊆ ⋯\/.
3. For all and , we have:

 Mnv ⊆ Mv ∪ {s} ∪ n−1⋃k=0Mk{u∈Vk∣Mu∈Mv}.

Lemma 2.21 implies that the sequence of assignments is plainly pointwise convergent. As a consequence of the next lemma and corollary, it will follow in fact that converges “uniformly”, and it does so in at most steps.

###### Lemma 2.3.

Let . We have:

1. [label=()]

2. if then, for all ,

1. [label=(a)]

2. ,

3. ;

3. if , then

 k ⩽ min(|Vars(φ)|−1,rk(M)). (7)
###### Proof.

If , then and by (4) and (6), respectively. By iterating the same argument, one can easily prove that and , for all , proving 1.

As for 2, we preliminarily observe that, by (4), for all and we have

 v∈Vn⟹(∃u∈Vn−1)Mu∈Mv. (8)

Thus, if , by picking any and by repeatedly applying (8), it follows that there exist such that

 Mv0 ∈ Mv1 ∈ ⋯ ∈ Mvk−1 ∈ Mvk. (9)

By the well-foundedness of , the variables must be pairwise distinct. Hence, . In addition, (9) also yields . Thus, (7) follows, proving 2. ∎

The preceding lemma yields immediately the following result.

###### Corollary 2.4.

For all , we have .

Letting , Corollary 2.4 implies that , for all .

Next we prove a number of technical lemmas that will culminate in the proof that

 M¯¯¯n ⊨ φ ∧ ⋀E−M ∧ ¯¯¯x≠¯¯¯y,

where is the designated equality of . Thus, we will have that

 E−M⊊E−M¯nand|E+M¯n|<|E+M|,

contradicting the minimality of . Hence, the convexity of MLS will follow, since our initial assumption on and that conditions 1 and 2 hold will be proved to be untenable.

The following lemma provides some useful bounds on the rank of , for and .

###### Lemma 2.5.

For all and , we have

1. [label=-]

2. , if ,

3. , if .

###### Proof.

We proceed by induction on . For and , from (5) we have . Hence, , since . On the other hand, if , then .

Next, let and . By (6), we have:

 rk(Mnv)=max(rk(Mn−1v),rk(Mn−1{z∈Vn−1∣Mz∈Mv})). (10)

By inductive hypothesis, we readily have

1. [label=-]

2. , and

3. .

In addition, since , then by (4), for some . Hence, again by inductive hypothesis, , and since , we have

 rk(Mn−1{z∈Vn−1∣Mz∈Mv})=rk(s)+n+1.

Thus, by (10), we get .

On the other hand, if , then by (6) and by the inductive hypothesis we have . ∎

Next we prove that the set can enter only when .

###### Lemma 2.6.

For all and , we have:

1. [label=()]

2. ;

3. .

###### Proof.

Concerning 1, we proceed by induction on .

For , by (5) we have:

1. [label=-]

2. , if  (by Lemma 2.5);

3. , if .

In both cases, it follows that .

For the inductive step, let . If , then by Lemma 2.5 we have , and therefore . On the other hand, if , then , by (6) and by the inductive hypothesis.

Next we prove 2 by induction on .

The base case is trivial.

For the inductive step, let . If , then Lemma 2.21 yields readily . Conversely, let . If , then by (6) we have , and therefore by inductive hypothesis . On the other hand, if , then again by (6) we have

 s ∈ Mnx = Mn−1x ∪ Mn−1{y∈Vn−1∣My∈Mx}.

In view of 1, the latter formula yields , and therefore follows again by inductive hypothesis, completing the proof of 2, and in turn of the lemma. ∎

The following lemma proves that, at each construction step of the assignments ’s, only elements of rank at least can enter into play.

###### Lemma 2.7.

For every set , for some and , if then .

###### Proof.

Let , , and , with . From Lemma 2.22, we have

 Mnx ⊆ Mx ∪ {s} ∪ n−1⋃k=0Mk{y∈Vk∣My∈Mx}.

Since, by Lemma 2.5, the rank of each member of is greater than or equal to , then necessarily

All the inequalities satisfied by are satisfied by every , as proved in the following corollary.

###### Corollary 2.8.

If , for some , then , for every .

###### Proof.

W.l.o.g., let us assume that , and let . Also, let . By Lemma 2.21, . Plainly, and . Thus, Lemma 2.7 yields , proving that . ∎

To show that every membership satisfied by is correctly modeled by , we will need the following result.

###### Lemma 2.9.

For all and , if and , then and .

###### Proof.

Let and assume that , for some , and that . Then, by (4), . In addition, from (6), the latter membership relation yields immediately that . ∎

We are now ready to prove our main lemma.

###### Lemma 2.10.

The assignment satisfies .

###### Proof.

We prove the lemma, by showing that correctly models all the conjuncts in . We recall that, in view of the reduction process outlined in Section 1, our formula contains conjuncts of two types only, namely and .

##### Conjuncts of type x∈y.

Let occur in , so that holds. If for all , then (by Lemma 2.21), from which follows.
Conversely, if , for some , we set . In addition, since and , Lemma 2.9 implies and therefore, by Lemma 2.32, . Thus, Lemma 2.9 again together with Lemma 2.21 yields , from which follows.

##### Conjuncts of type x=y∖z.

Let occur in , so that holds. We will prove that , by proving that and hold.
Proof of .  From Lemma 2.22, we have:

 M¯¯¯nx ⊆ Mx ∪ {s} ∪ ¯¯¯n−1⋃k=0Mk{u∈Vk∣Mu∈Mx}.

Let . We first consider that case in which . Then . Hence, by Lemma 2.21, . In addition, since and , Lemma 2.7 yields . Thus, .
Next, let . Hence, (by Lemma 2.62), so that (by (5) and (3)), and therefore . Since