Small model property reflects in games and automata

by   Maciej Zielenkiewicz, et al.
University of Warsaw

Small model property is an important property that implies decidability. We show that the small model size is directly related to some important resources in games and automata for checking provability.



There are no comments yet.


page 1

page 2

page 3

page 4


Good-for-games ω-Pushdown Automata

We introduce good-for-games ω-pushdown automata (ω-GFG-PDA). These are a...

Weakness Makes Muller Delay Games Hard

We show that solving delay games with winning conditions given by determ...

Property-Directed Verification of Recurrent Neural Networks

This paper presents a property-directed approach to verifying recurrent ...

Reducing (to) the Ranks: Efficient Rank-based Büchi Automata Complementation (Technical Report)

This paper provides several optimizations of the rank-based approach for...

Small coherence implies the weak Null Space Property

In the Compressed Sensing community, it is well known that given a matri...

On detectability of labeled Petri nets and finite automata

Detectability is a basic property of dynamic systems: when it holds one ...

Trees in partial Higher Dimensional Automata

In this paper, we give a new definition of partial Higher Dimension Auto...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Dependent types is one of the popular logic-based approaches developed in the field of functional programming. With the help of such types it is possible to more precisely capture the behaviour of programs. Intuitionistic first order logic is the primary form of dependent types and the Curry-Howard isomorphism strictly relates functional program synthesis and construction of proofs in intuitionistic first order logic.

One of the well established ways towards understanding different aspects of logic, proofs and proof search is through correspondence with different representations, e.g. ones that are more abstract like games and tableaux or ones that are more detailed like linear logic. One of the most fruitful ideas fulfilling the pattern is the game based approach, in the spirit of Ehrenfeucht-Fraïssé games [Fraisse, Ehrenfeucht]. Another game-based technique was introduced for intuitionistic first order logic [Urzyczyn2016]. The duality between proof-search and countermodel search [vanBenthem] has been interpreted there in terms of games and was used to make one unified game that yields either a proof or a Kripke countermodel.

We extend the game based approach [Urzyczyn2016] to classes that have the finite model property which, for algorithmically well-behaved classes, implies decidability [Borger97, p. 240]. A stronger property, the small model property, that also gives an upper bound on the complexity of the satisfiability problem, is also studied. As it turns out these two properties are equivalent for many interesting classes.

We show in the current work a correspondence between the limit of the model size given by the small model property and some resources in automata and games used for the description of logic. Section 2 contains preliminaries and definitions. Section 3 discusses the automata and Theorem 2 bounds the size of the set of eigenvariables with a number dependent on the number of subformulas in the formula, the limit on the model size and the number of variables in the initial formula. Section 4 covers games and Theorem 4.3 shows that a strategy can be constructed that uses a number of maximal variables at most equal to the limit on the model size; the maximal variable would be understood as the one havina a maximal, by inclusion, set of known facts.

The paper is structured as follows. Section 2 contains preliminaries and definitions necessary to understand the following sections and discusses basic facts about the small model property. Section 3 defines a quasiorder on variables capturing the notion of variable with more facts. Using this order we show that the size of the small countermodel defined in the small model property is also a limit on the number of maximal variables in Afrodite strategy. Section 4 shows a limit on the size of the set of eigenvariables of an Arcadian automaton, which depends on the size of the small model, number of subformulas in the original formula and the number of its variables.

2 Preliminaries

We work in intuitionistic first-order logic with no function symbols or constants. The logic is the same as in previous works on games [Urzyczyn2016] and automata [poprzedni]. There is a set of predicates and every predicate has a defined arity. First order variables are noted as , , …(with possible annotations) and form an infinite set . The formulas are understood as abstract syntax trees and the possible formulas are generated with the grammar

We define the set of free variables of a formula as

  • ,

  • where

  • where ,

  • .

We assume that there is an infinite set of proof term variables usually noted as …that can be used to form the following terms.

The free variables in terms are defined by structural recursion on the terms, i.e. . The inference rules for the logic are shown in Figure 1.

[(⊥E)] Γ⊢ _τM:τ Γ⊢M:⊥

Under the eigenvariable condition .

Figure 1: The rules of the intuitionistic first-order logic ([poprzedni])

2.1 Models

We follow the definition of Kripke model from the work of Sørensen and Urzyczyn [UrzyczynSorensen]: A Kripke model is a triple where is a set of states, is a partial order on and are structures such that if then and for all the relation holds. A valuation maps variables to elements of . The satisfaction relation is defined in the usual way:

[completeness, Theorem 8.6.7 of of [UrzyczynSorensen]] The Kripke models as defined above are complete for the intuitionistic predicate logic, i.e. iff .

2.2 The finite model property and the small model property

We focus on classes of formulas that have finite model property. Our definitions closely follow that of Börger et al. [Borger97]: [finite model property]A class of formulas has the finite model property when, for all formulas , if is satisfiable, there exists a finite model such that . Since all classical theories can be easily expressed as intuitionistic theories by explicitly including the law of excluded middle, so there are many interesting classes that have finite model property.

Although the finite model property in the book by Börger et al. [Borger97] is strongly attached to decidability of a particular fragment of logic, this is not a property that implies this computational feature. The following property is what actually takes place in the fragment considered in the book. [small model property]A class has the small model property when there exists a computable function such that for all formulas , if is satisfiable, there exists a finite model of size such that . This definition was used in the book [Borger97] in the context of classical logic. It can also be used for intuitionistic first order logic, but the finiteness concerns a different but relevant notion of size. We say that a model is finite when is finite and is finite for all . The number is the size of the model . For all formulas from a class that has the finite model property either or there exists a finite model and a state such that . If or is true the proof follows by the completeness theorem and by definition. Otherwise there exists a model of class such that , and a state such that (if , and do not exist either or would be valid in the model). Note that it does not necessarily mean that a proof for exists. But, since Kripke models are monotonous, and we have a model of in the class : the part of the original model starting in . [effective class] We say that a model is a model of a class of formulas when for each it holds that .

A class of formulas is effective iff, it is decidable that given a final model whether is a model of the class . For example every class that has a finite number of axioms or axiom schemes, as well as prefix classes from the book of Börger et al [Borger97] is effective. An effective class has finite model property iff it has small model property. The implication from right to left is trivial. For the other one: we show how to compute . Given we run two processess in parallel: one generates finite models and checks whether they are models of X and then if is satisfied in them, and another one generates proof and checks if one of them proves . If the first process succeeds, we return the size of the model found, and if the second suceeds we return 1. Lemma 2.2 shows that one of the processess succeeds. This function is correct as it returns the size of a finite model if it exists, and otherwise the formula is not satisfiable, so the return value does not matter. In the proof above we can also make the function return the smallest finite model by enumerating the models ordered by size, but it is not needed in this paper.

3 Small model size and small Afrodite strategies

In this section we show that from a finite countermodel of a given size we can construct a small Afrodite strategy. First we introduce games, strategies and introduce tools to replace some variables in a strategy. Then we use these tools to show a limit on the set of eigenvariables in the game depending on the size of the small model, proving the Theorem 2.

3.1 Better variables


We define substitutions applied to a formula: is the formula with all free occurrences of replaced by in a capture-avoiding fashion. The disjuncts of a formula are and , and for a formula that is not a disjunction the whole formula is called a disjunct. We understand the formula to mean , but understanding it as a disjunction of three disjuncts would also be possible with minor technical changes.


We show how the small model property can be expressed in terms associated with the notion of intuitionistic games for first-order logic as defined in Section 5 of the work by Sørensen and Urzczyn [Urzyczyn2016]. The game describes a search for a proof and has two players: Eros, tryig to prove the judgement and Afrodite, showing that it can’t be proven. We write to state that the positions and are connected with a turn. A game is a sequence of positions connected by turns, i.e. a sequence such that for each . Possible moves are shown in Fig. 2. We omit the subscript “move” when it is not needed or clear from the context. A game starts in a position and begins with Eros’ move, followed by Afrodite’s move which determines the next turn. If Eros reaches a final position he wins, otherwise the game is infinite and Afrodite wins. We call the precedent and the antecedent of the move. Some turns have players associated with them: if Afrodite makes a choice in a move we call the precedent an Afrodite’s position, and if Eros makes a choice we call it an Eros position. A disjunct of is an aim. In order to avoid confusion with classical provability we write to denote that is provable from in first-order intuitionistic logic. If the exact proof is important we use the notation .


A strategy is a tree of nodes labeled by positions linked by edges labeled by turns, which we call moves. In each position either one or none of the players makes a choice. In a position with no choice the next position is determined by game rules (see Figure 2) and the corresponding turn must appear in the strategy. For Afrodite strategy the tree consists of non-final positions and all paths are infinite as well as the tree has at least one move in each Afrodite’s position and all the possible moves (up to renaming of fresh and bound variables) in Eros positions. A final position is a position in which or . For Eros strategy all paths end at a final position and the tree has at least one move in each Eros’ position and all the possible moves (up to renaming of fresh and bound variables) in Afrodite positions. It should be obvious that if Eros cannot make a move that introduces something new to the game, he is forced to replay one of the previous moves and Afrodite wins.

Ordering of variables.

Intuitively speaking we would like to capture the fact that one variable is “better” than the other if all the information that was known about the “worse” variable is kept and possibly extended with new facts. More formally we say when for every formula

if then .

The relations and are defined in the following way:

In cases when is clear we omit it for brevity. For any , the relation is a quasiorder, but not a partial order. The relation is trivially reflexive and transitivity follows immediately from definition with help of an observation that , so it is a quasiorder.

If we choose two distinct fresh variables and , i.e. not in , we have and , but , so is not a partial order. This leads to the conclusion that the only important variables are those that are maximal in the relation, as we can replace all the other variables with their maximal counterparts. Let be a formula such that . If , then , where, for all , . We apply the definition of for each in turn.

If Eros or Afrodite has a strategy in position and if at some position and all subsequent positions in that strategy we have , …, then we can replace all occurrences of variables with at and the same player still has strategy in position . The replacement is done while looking at the whole game tree and with maximum knowledge (i.e. trueness of predicates through the whole game tree) about variables, which is not a problem since our aim is to construct the strategy for Afrodite, which implies knowledge of all the possible turns.

Suppose Afrodite has a strategy in . Let us focus on a path in the tree of the strategy

Each of the moves may add something to , but nothing is removed and we can separate the newly added facts:

Another view of the new facts would be to separately keep track of those referring to the variables :

where has all the facts that reference the variables and the others. To make the notation concise we write as a shorthand for .

Instead of taking the original path we can take the following one

where , and . Or, viewed in the terms of s,

where .
To make this construction sound we need to show that and that the move is possible. The first part follows directly from Proposition 3.1. For the second part we show how to adapt the original move . The possible moves are listed in Fig. 2. Only two of them have direct interaction with non-fresh variables: in (a4) and (b5) Eros is free to choose any variable and the replacement variables are already available, so would not lead him to winning the game, otherwise he could have played this move in the original strategy.

The other case is when Eros has a strategy in . The substitution is almost the same as in the previous case except some nonfinal positions might become final, as the set of facts known about is bigger or equal to those that were known about , as . Final positions remain final by Proposition 3.1. Nonfinal positions might become final, but it only makes Eros win faster.

3.2 Construction of the strategy

Small strategies of Afrodite.

With the aim of relating the size of the Afrodite strategy and the size of the small model we define a notion of a small strategy. Proposition 3.1 suggest the following definition. Since we know that using only the maximal variables is sufficient in the game, we define small strategy of Afrodite for a formula from class as a strategy that has at most -classes of abstraction of maximal variables. Given a small countermodel of a formula we aim to construct a small winning Afrodite strategy , i.e. one that gives at least one possible response for each possible Eros’ move. For a given turn we need to choose a response to Eros moves. We associate a state with each turn . Our strategy has the following invariant that holds at each turn:


and the sets of maximal variables corresponds to states of the small countermodel. The part of the invariant quantified with is called the existential part and the part quantified with is called the universal part.

Moves manipulating assumptions:

  • If is an assumption then Afrodite chooses between positions and .

  • If is an assumption then Afrodite chooses between positions and .

  • If is an assumption then the next position is .

  • If is an assumption then Eros chooses a variable and the next position is .

Moves manipulating the proof goal:

  • If is an assumption then the next position is where is a fresh variable.

  • If is an aim of the form the next position is .

  • If is an aim of the form then Afrodite chooses between positions and .

  • If the aim is an atom or a disjunction the next position is .

  • If is an aim of the form the next position is where is fresh.

  • If is an aim of the form then Eros chooses a variable and the next position is .

Figure 2: Table of moves in position for the intuitionistic game [Urzyczyn2016, fig. 11, p. 32]. In each move Eros chooses a formula - either an assumption or an aim, and the move is selected from this table according to the chosen.

Fig. 2 lists possible moves and the choices players make. We define a strategy for Afrodite and she makes a choice in cases marked with * in the figure. Afrodite should choose in the indicated moves:


We choose when .


We choose when .


We choose when .

In case of (b1) and (b4) the current model state might needs to be advanced to some subsequent state to keep the invariant.

We still need to show that each move preserves the invariant. At each position the invariant (1) holds. We assume the notation of Figure 2 and show that each move preserves the invariant (1).

  • We have two possibilities:

    • In case : we choose . The existential part of the invariant follows directly from the invariant of the previous step. For the universal part suppose the opposite, i.e , so for given we either have contradiction with from invariant of the previous step or , but then we would not choose this move for the strategy.

    • Otherwise and we choose . The existential part of the invariant remains true as does not change. For universal part suppose , but then , which is in contradiction with the invariant from the previous step.

  • Once again we have two possibilities:

    • In case : we choose . The existential part of the invariant follows directly from the invariant of the previous step. The universal part is the same as in the corresponding point of the move (a1).

    • Otherwise and the proof is the same as in the corresponding point of (a1).

  • The existential part is true because follows from . The universal part is proven by simply applying the definition of .

  • We can choose any value for . Existential part: from the invariant in the previous move we have , so we apply definition of to get . Universal part: suppose that and . But this means which implies have a contradiction with from the previous move.

  • Since we know that there exists such that . In the existential part we just need to take . Universal part: identical with the universal part of (a4).

  • Using the assumption we have a state such that but . We advance to . The existential part is trivially true. For the universal part: suppose and . This is in contradiction with .

  • We have the following cases:

    • : the set of assumptions does not change so the existential part is proven by applying the existential part from the previous move. For the universal part, is exactly the assumption of the case under investigation.

    • otherwise . We choose the position ; the existential part is the same as in the previous step. For the universal part suppose : then contradicts the invariant from the previous move.

  • The existential part is the same as in the previous move. The universal part is the same as in the second bullet of (b2).

  • We can choose any value for . The existential part is true since is the same as previously and the valuation of does not affect it. The universal part: suppose that . Then by definition , which is in contradiction with the invariant from the previous move.

  • The existential part is the same as in the previous move. For the universal part suppose . Then by definition of we have , which is a contradiction with the invariant of the previuos step.

The constructed strategy is small: elements of correspond to -classes and the valuation proves that all the variables fit in classes as the size of the model is . This proves the following: For all classes that have the small model property and all formulas , if a strategy of Afrodite exists for then a small strategy of Afrodite for also exists.

4 Small model size and the Arcadian automata

Here we show a limit on resources of Arcadian automata [poprzedni] checking derivability of a formula from an effectively axiomatized class that has the finite model property. Theorem 4.3 shows a limit on the size of the set of eigenvariables of the automaton in terms of the numbers of variables and subformulas in and the size of the small model. We reason only about automata that are translated from a formula as defined in Section 4 of [poprzedni]. In Section 4.1 we introduce Arcadian automata, show how to replace variables in their runs in Section 4.2, and limit the size of the set of eigenvariables in 4.3.

4.1 Arcadian automata


We already know that -maximal variables play a crucial role. Given a set of facts we denote by the set obtained from by selecting only those facts that do have only maximal variables in . An Arcadian automaton is a tuple , where is a finite tree, and are sets of states and instructions with mapping states to instructions, describes the binding of variables and and are the inital state and node. The function satisfies the condition that for all either is a leaf or where and is the usual predicate of being a successor. An instantaneous description is where and are the current state and node, is a set of eigenvariables, and are interpretations of bindings and is the store. For more details see [poprzedni].

4.2 Better variables in Arcadian automata

Equivalent positions

We say that the position and are equivalent when and .

Suppose where for some and such that and . If then where and are fresh variables, i.e. . Proof is by induction over the length of the proof of . We look at the last rule in the proof. In most of the cases the conclusion follows by simple application of the inductive hypothesis, but there are three rules that change the environment, namely (), ) and () and the proof is more subtle for them. Let us focus on the rule. If we do not need to change anything, in the other case we know that and we apply the induction hypothesis and use the assumption for the -abstraction. We can now remove the variable as it is not referenced in .

The induction base is the var rule, since the proof must begin with this rule, and the correctness of replacing with follows immediately from the definition of . If , and are variables in such that then and . If then there exists and such that and in each step of only maximal variables are mentioned in . Apply Proposition 4.2 sequentially to each nonmaximal variable.

4.3 Loquacious runs

Note that our logic has the subformula property ([poprzedni]). This means that there is only a limited number of possible targets . Let us review fragments of an automaton run . If and are equivalent, then a part of the run is removable, i.e. there exists a run of the same automaton where and are obtained from and by replacing some variables by their maximal counterparts. Otherwise that fragment is not removable, as new fact about the maximal variables are discovered, but the number of such non-removable runs is limited: there are at most maximal variables. Suppose is the number of variables in and is the number of subformulas in . The maximum size of an environment is . Each non-trivial step has to either add something to the environment or change the target as otherwise the previous state is repeated. We have at most possible targets, so after at most steps the target repeats and in the worst case each step introduces a new variable, so the maximum size of in the automaton is .

This proves the following: Let be a formula from an effective class that has the small model property. For a given accepting run of an Arcadian automaton for that formula there exists an accepting run of the same automaton with the same result that has the property , where is the working domain of the automaton and is the maximum size of the environment defined in the previous paragraph.

5 Conclusion

The small model size is directly related to important resources in games and automata for checking provability. In terms of games, the elements of models directly correspond to abstraction classes of maximal elements of a quasiorder on eigenvariables that captures the relation of having more information available about a variable.

For automata the number of such maximal elements can be directly related to the size of set of eigenvariables ; the dependency is exponential, caused by the necessity of representing the eigenvariables that correspond to non-maximal elements of the quasiorder.

These observations lead to an idea for implementing proof theory bases proves in a manner that would not be substantially less powerful than those based on model theory. More specifically we suggest that should not be represented syntactically but rather as an abstraction class of the quasiorder.