Log In Sign Up

Some Model Theory of Guarded Negation

by   Vince Bárány, et al.

The Guarded Negation Fragment (GNFO) is a fragment of first-order logic that contains all positive existential formulas, can express the first-order translations of basic modal logic and of many description logics, along with many sentences that arise in databases. It has been shown that the syntax of GNFO is restrictive enough so that computational problems such as validity and satisfiability are still decidable. This suggests that, in spite of its expressive power, GNFO formulas are amenable to novel optimizations. In this paper we study the model theory of GNFO formulas. Our results include effective preservation theorems for GNFO, effective Craig Interpolation and Beth Definability results, and the ability to express the certain answers of queries with respect to a large class of GNFO sentences within very restricted logics. This version of the paper contains streamlined and corrected versions of results concerning entailment of a conjunctive query from a set of ground facts and a theory consisting of GNFO sentences of a special form ("dependencies").


page 1

page 2

page 3

page 4


Two-variable logics with some betweenness relations: Expressiveness, satisfiability and membership

We study two extensions of FO2[<], first-order logic interpreted in fini...

Symmetries in Modal Logics

We generalize the notion of symmetries of propositional formulas in conj...

On the Relational Translation Method for Propositional Modal Logics

One way of proving theorems in modal logics is translating them into the...

Learning Formulas in Finite Variable Logics

We consider grammar-restricted exact learning of formulas and terms in f...

Adding the Power-Set to Description Logics

We explore the relationships between Description Logics and Set Theory. ...

Towards a Model Theory of Ordered Logics: Expressivity and Interpolation (Extended version)

We consider the family of guarded and unguarded ordered logics, that con...

Interpolable Formulas in Equilibrium Logic and Answer Set Programming

Interpolation is an important property of classical and many non-classic...

1 Introduction

The guarded negation fragment (GNFO) is a syntactic fragment of first-order logic, introduced in [BtCS11icalp] as an extension to the much-studied guarded fragment of first-order logic [AvBN98JPL, Gr99JSL]. Both fragments restrict the use of certain syntactic constructs by requiring the presence of guards, with the aim of taming the language from an algorithmic point of view, with an acceptable compromise on expressiveness. The guarded fragment is obtained by requiring all quantification to be guarded. This idea has its roots in modal logic and, accordingly, the model theory of the resulting fragment has a very similar flavour to that of modal logic. The guarded negation fragment is obtained instead by requiring all use of negation to be guarded. As it turns out, the latter use of guards is more general than the former. Formally, every sentence of the guarded fragment can be equivalently expressed in the guarded negation fragment [BtCS15jacm]. GNFO also properly contains the positive existential fragment of FO.

GFO constitutes a rich formalism that captures many of the integrity constraint languages and schema-mapping languages proposed in databases [dataint, FKMP05], and also many of the description logics [dl] proposed in knowledge representation. But GNFO is more suitable than GFO for expressing database queries; that is, mappings from structures to relations. Indeed, as noted above, GNFO properly contains all positive existential formulas. These are the most common SQL queries, built up using the basic SELECT FROM WHERE construct and UNION.

The defining characteristic of GNFO formulas is that a subformula with free variables can only be negated when used in conjunction with a positive literal , i.e. a relational atomic formula or an equality atom, containing all free variables of , as in

where order and repetition of variables is irrelevant. One says that the literal guards the negation. Unguarded negations of formulas with at most one free variable are also supported; this can be seen as a special case of guarded negation through the use of a vacuous equality guard .

It was shown in [BtCS15jacm] that GNFO possesses a number of desirable computational properties. For example, every satisfiable GNFO formula has a finite model (finite model property), as well as a, typically infinite, model of bounded tree-width (tree-like model property). It follows that satisfiability and entailment (hence, by the finite model property, satisfiability and entailment in the finite) of GNFO formulas are decidable.

In [bbo] the implications of GNFO for database theory are explored. For example, an SQL-based syntax for GNFO is defined, and an analogously constrained variant of stratified Datalog is also presented. Several computational problems concerning GNFO formulas (e.g. the “boundedness problem” for a fragment of the fixpoint extension of GNFO) are shown to be decidable.

In this work we investigate model-theoretic properties of GNFO. We first present results showing that GNFO formulas satisfying specific semantic properties can be rewritten into restricted syntactic forms. For example, we show that every GNFO formula that is preserved under extensions can be effectively rewritten as an existential GNFO formula. We give an analogous result for queries preserved under homomorphisms.

Next we consider GNFO sentences that can also be expressed as a kind of generalized Horn sentence known in the database community as a tuple-generating dependencies (TGD). We provide a syntactic characterization of the GNFO sentences that are equivalent to a finite set of TGDs and give a similar result for sentences in the guarded fragment.

We then turn to model theoretic results concerning explicit and implicit definability. The Projective Beth Definability theorem states that for any property that is implicitly defined by a first-order theory there is a first-order formula that explicitly defines the property. We show the analogous result with first-order replaced by GNFO. Following ideas of Marx [Marx07pods] we establish a Craig Interpolation Theorem for GNFO and from this conclude the Projective Beth Definability theorem for GNFO. This is in contrast with the situation for the Guarded Fragment, which does enjoy the simpler Beth definability property [HMO]. Contradicting claims made in earlier work [Marx07pods] we show that Projective Beth fails for the so-called Packed Fragment.

Finally, we study definability issues related to the “open world query answering” problem for GNFO. Open world query answering concerns determining which results of formulas are implied by partial information about the underlying structure, in the form of a subset of the interpretations of relations and a logical theory constraining the completion. More formally, the input to this problem is a set of GNFO sentences, a finite structure , and a positive existential formula . The goal is to determine the values of that hold in every structure extending the interpretations of relations in and satisfying . These values are sometimes referred to as “the certain answers to under ”. The complexity of open world query answering has already been identified for several GNFO-based languages in [bbo]. Here we show that GNFO sentences that are equivalent to a set of TGDs have additional attractive properties from the point of view of open world query answering. Specifically, we extend and correct results of Baget et. al. [bagetconf] by showing that the certain answers can always be determined by evaluating a sentence in a small fragment of (guarded negation) fixpoint logic, Guarded Negation Datalog, for which boundedness was shown decidable in [bbo]. From this we conclude that first-order definability of certain answers of GNFO TGDs is decidable.

An extended abstract of the present paper appeared in [mfcs14] and a journal version in [jsl]. This article contains revised versions of the proofs in Section 5. Related work both prior to and subsequent to [mfcs14] is discussed in Section 6.

Organization: Section 2 contains preliminaries. Section 3 looks at rewriting for restricted fragments of GNFO, while Section 4 looks at rewriting of queries with respect to views, via results on Craig interpolation and Beth definability. Section 5 presents our results on rewriting the certain answers of conjunctive queries with respect to GNFO TGDs. Section 6 covers conclusions and related work.

2 Definitions and Preliminaries

We work with fragments of first-order logic (FO) with equality and with its usual semantics, restricting attention to finite signatures consisting of relation symbols and constant symbols and no function symbols.

We assume familiarity with basic notions from model theory, such as a reduct of a structure (restricting the signature), an expansion of a structure, and a type (a satisfiable set of formulas in a collection of variables, possibly with parameters from a structure); and will only rely on material that can be found in the first few chapters of a standard model theory textbook, such as Chang and Keisler [ChangKeisler]. For example, we will make use of the Compactness Theorem and work with saturated elementary extensions. We briefly review the notion of saturation that we need in this work. A structure is an elementary extension of a structure , denoted , if is an extension of and every FO sentence with parameters from that is true in is also true in . A structure is -saturated if for every set of formulas (where ) containing finitely many parameters from , if every finite subset of is realized by some -tuple in , then the entire set is realized by an -tuple in . The conclusion means that there is a tuple of elements of the domain of such that for all . A first-order structure is recursively saturated if the conclusion above holds when the collection is further required to be recursive (or, in other words, decidable). A basic result in model theory is that every structure has an -saturated elementary extension, and every countable structure (in a countable signature) has a countable recursively-saturated elementary extension.

A homomorphism between structures and is a map from the domain of to the domain of that preserves the relations (i.e., implies ) as well as the interpretation of all constant symbols (i.e., ).

The primary focus of this paper is on finite structures. Finite model theory is concerned with logical semantics restricted to finite structures. When working with both classical and finite model semantics additional care must be taken to make it clear in each instance which semantics is meant. Crucially, both GFO and GNFO possess the finite model property (every satisfiable sentence has a finite model), which for most purposes voids the distinction between the two semantics and allows us to employ classical tools in the service of finite model theory. But at times, when working with different formalisms, we will need to be more specific as to which semantics is meant. We shall use the shorthand “(Both classically and in the finite.)” in formal assertions to signify that the statement holds equally true when semantic entailment is unrestricted and when it is restricted to finite structures.

Database query languages and constraint languages. One motivation for this work is to explore how well GNFO is suited for database applications. Accordingly, we will work with several logics and that are common in database theory, introduced below.

  • Existential FO, comprises formulas , where is quantifier-free.

  • Conjunctive queries (CQ), are the subset of existential FO where the quantifier-free kernel above does not contain disjunction or negation. Equivalently, these are the first-order formulas in prenex normal form built up using only and . A boolean conjunctive query is a CQ without free variables, that is, expressed as a FO sentence.

  • Acyclic conjunctive queries form an algorithmically well-behaved subclass of conjunctive queries [Yannakakis81, FFG02, GLS03]. The standard definition of acyclic CQ involves the notions of hypergraph acyclicity and hypergraph structure of a CQ [GLS03]. We will not need to directly use this definition, but only the following equivalent characterization, which generalizes one in  [GLS03] for boolean acyclic CQs. A formula is answer-guarded if it is of the form for some and relation symbol . Then we have the following alternative characterization of acyclic answer-guarded CQs:

    Fact 2.1

    An answer-guarded conjunctive query is acyclic iff it is equivalent to a positive existential GFO formula.

  • Tuple-generating dependencies (TGD) are sentences of the form

    where and are conjunctions of positive relational atoms (no equalities), and every variable from occurs in at least one conjunct of . is called the body of the TGD, while is referred to as the head.

In addition to the above fragments of FO, some of our arguments involve Datalog a language that extends positive-existential FO with a fixpoint mechanism. Datalog programs use a signature that is partitioned into “intensional relations”, representing the results of a fixpoint computation, and “extensional relations” that represent an input structure. In terms of second-order logic, intensional relations can be viewed as second-order variables, while extensional relations are part of the signature of the structure over which the program is being evaluated. A Datalog program consists of rules , where is an intensional relation and is a CQ over intensional and extensional relations, such that each variable occurs in at least one conjunct of . Associated to the program is an operator that takes as input a structure in the extended signature that includes both the extensional and intensional relations and returns a structure over the same extended signature. agrees with on all extensional relations. For each intensional relation , is the set of -tuples obtained by evaluating a rule of of the form (that is, evaluating in and projecting on variables ). This “immediate consequence” operator on structures is monotone, and thus has a unique least fixpoint. The result of evaluating a program on a structure is the least fixpoint (starting with all intensional relations empty). Given a distinguished intensional predicate (the goal predicate), the output of a Datalog program is the set of tuples belonging to the goal predicate in the least fixpoint. Datalog can be viewed as the positive-existential fragment of least-fixpoint logic.

Abiteboul, Hull, and Vianu [AHV] is a good reference for all of these languages.

One subtle but notable difference in the treatment of query languages in the database literature and the logic literature concerns the relationship between database instances and (finite) first-order structures. A database instance (or simply instance) for a signature , assigns to every relation symbol of arity a collection of -tuples, and to every constant symbol a value, called the interpretation of , and respectively of , in . A fact over a signature is an expression , where is a relation symbol and are values. An interpretation of a relation can be equivalently considered as a set of facts, namely the facts of the form where belongs to the interpretation of . The active domain of an instance or a structure is the set of values that participate in some fact, or, in other words, the union of the one-dimensional projections of the relations. We write for the active domain of . Note the difference between an instance and a relational structure: a relational structure is defined over an explicitly given domain, which can contain any number of “inactive” elements. Two structures can thus correspond to the same instance while having different domains. In database theory one is typically interested in domain-independent formulas, that is, formulas that do not distinguish between structures corresponding to the same instance. For example the sentence is domain-independent, while is not. Both CQs and Datalog are languages defining only domain-independent formulas. In parts of this work, we will deal with logical formulas that are domain-independent. For a domain-independent sentence we can talk about “being true on instance ”, and similarly give semantics to domain-independent formulas in terms of instances rather than structures. Thus if we are dealing with questions about domain-independent formulas, it will often be convenient to perform constructions that form instances from instances, rather than constructions that form structures from structures. A homomorphism between instances and is defined as with structures, but is now defined on the active domain of , and is required to preserve the interpretation of the relations as well as any constants occurring in the active domain of .

Given two structures over the same signature , we write if the two structures agree on the interpretation of the constant symbols, and, for every relation , . This can be thought of as a weak version of the usual substructure relation, where we do not require the substructure to be induced by taking a subset of the domain. Since the definition does not refer to the domains of the structures , it is clearly also applicable to instances.

To every CQ of signature one can associate the -instance , the canonical instance associated to : the active domain of consists of the set of variables and constants occurring in and the facts are the literals . Evaluation of a CQ can be restated in terms of homomorphisms from : for every -ary CQ and every -tuple a of an instance we have that iff there exists a homomorphism  [CM77].

The Guarded-Negation Fragment. The Guarded Negation Fragment (GNFO) is a syntactic fragment of first-order logic, from which it inherits the usual semantics. The formulas of GNFO are built up inductively according to the grammar111In practice, the parentheses are often omitted and parsing ambiguity is resolved with the help of the standard order of precedence of logical connectives. ϕ::= R(t_1, …, t_n) —   t_1=t_2   —   ∃x (ϕ)   —   (ϕϕ)  —   (ϕϕ)   —   (α∧¬ϕ) where is a relation symbol, each is a variable or a constant symbol, and, in the last clause, is an atomic formula (possibly an equality) in which all free variables of the negated formula occur. That is, each use of negation must occur conjoined with an atomic formula that contains all the free variables of the negated formula. The atomic formula that witnesses this is called a guard for . Since we allow equalities as guards, every formula with at most one free variable can be trivially guarded, and we often write instead of , when has no free variables besides (possibly) . For a signature consisting of constant symbols and relation symbols, denotes the GNFO formulas in signature .

GNFO should be compared to the Guarded Fragment (GFO) of first-order logic [AvBN98JPL, Gr99JSL] typically defined via the grammar ϕ::= R(t_1, …, t_n)   —   t_1 = t_2   —   ∃x (αϕ)  —   (ϕϕ)   —   (ϕϕ)   —   ¬ϕ where, in the third clause, is again an atomic formula in which all free variables of occur (and may be a sequence of variables). Note that, in GFO formulas, all quantification must occur in conjunction with a guard, while there is no restriction on the use of negation.

Since GNFO is closed under conjunction and existential quantifications, every conjunctive query is expressible in GNFO. It is not much more difficult to verify that every GFO sentence can also be equivalently expressed in GNFO [BtCS15jacm]. Turning to fragments of first-order logic that are common in database theory, consider guarded tuple-generating dependencies: that is, sentences of the form

By simply writing out such a sentence using , one sees that it is convertible to a GNFO sentence. In particular, every inclusion dependency (i.e. every formula , where the atomic formulas and have no constants and no repeated variables) is expressible in GNFO. As mentioned in the introduction, many of the common dependencies used to describe relationships between schemas (e.g.  see  [dataint, FKMP05]) are expressible in GNFO. In addition, many of the common description logic languages used in the semantic web (e.g.  and  [dl]) are known to admit translations into GFO and hence into GNFO.

We will frequently make use of the key result from [BtCS15jacm] showing that GNFO is decidable and has the finite model property:

Theorem 2.2

A GNFO formula is satisfiable over all structures iff it is satisfiable over finite structures. Satisfiability and validity of GNFO is decidable (and 2ExpTime-complete).

It was shown in [bbo] that GNFO can be equivalently restated as a fragment of Codd’s relational algebra, and of the standard database query language SQL. More specifically, in [bbo], a fragment of relational algebra, called Guarded-Negation Relation Algebra (GN-RA) is introduced, and is shown to capture domain-independent GNFO. It is worth noting also that we can actually decide whether a given GNFO formula is domain-independent (and hence whether it can be converted to GN-RA). This is in contrast to the well-known fact that domain-independence is undecidable for first-order logic [AHV]. To see the decidability, we simply note that the statement expressing that a GNFO formula is domain-independent can be expressed as the validity of a GNFO sentence: the sentence is formed by introducing relations for the two domains, and relativizing quantification to those domains. We can then apply Theorem 2.2 to this sentence.

Note that if we have two GNFO open formulas and , the sentence stating that they are equivalent, or that one implies the other, is not necessarily a GNFO sentence. This does hold, however, if and are answer-guarded. We will need to require answer-guardedness in some of our results involving open formulas.222Note, however, that the equivalence problem and the entailment problem are decidable in 2ExpTime even for non-answer-guarded GNFO formulas (as follows from a easy reduction in which free variables are replaced by constant symbols). See, for example, Corollary 5.9. Most results about GNFO sentences trivially generalize to answer-guarded GNFO formulas. For instance, the observation from [BtCS15jacm] that every GFO sentence can be equivalently transcribed into GNFO extends to answer-guarded GFO formulas.

Guarded sets and tuples. Let be a structure and be the interpretation of all constants in the signature of . A subset of the domain of is guarded if there is a fact (in some relation) in which all members of occur together. We will sometimes apply the same notion to tuples: a tuple of values from the domain of a structure is guarded (in the structure), if the set of all elements of the tuple is guarded. Note that an answer-guarded query can only be satisfied by guarded tuples.

Tree-like model property. Satisfiable GFO formulas always have models that are “tree-like”: this is the tree-like model property of GFO [AvBN98JPL, Gr99JSL]. For any relational structure with constants, and any guarded tuple there is a guarded unravelling  [AvBN98JPL] of at , a structure and tuple such that:

  • is tree like in the sense that it has a tree decomposition with guarded bags [GO14survey];

  • if and only if for all .

We conclude this section by recalling an important result about approximating arbitrary answer-guarded conjunctive queries by conjunctive queries that are in GFO, which is proven using the unravellings above.

Paraphrasing [BGO14lmcs] we define the treeification of an answer-guarded CQ as the collection of minimal acyclic CQ that imply . From [BGO14lmcs] we know that is finite if the signature is finite. We will thus sometimes identify the treeification with the (answer-guarded) UCQ .

The next fact is a simple consequence of the definition of treeification and of the properties of guarded unravellings. It was first observed in [BGO14lmcs] in the case of boolean CQs, but the same reasoning applies to answer-guarded CQs.

Fact 2.3 (Treeification)

For every answer-guarded CQ , every structure and guarded tuple of it holds that iff . Consequently, for every answer-guarded GFO formula and answer-guarded conjunctive query it holds that iff .

We note that guarded unravellings are typically infinite and that it takes considerably more work to show that the last claim remains valid when restricting attention to finite structures [BGO14lmcs]. This claim is what underpins the argument in [BtCS15jacm] establishing the finite model property of GNFO.

3 Characterization and Preservation theorems

Preservation theorems are results showing that every property definable within a certain logic and which additionally satisfies some important semantic invariance can be expressed by a formula in the logic whose syntactic form guarantees that invariance. One example from classical model theory is the Łoś-Tarski theorem, stating that a property of structures definable in first-order logic is definable by a universal formula if and only if it is preserved under taking substructures. A second example is the Homomorphism Preservation theorem, stating that a property of structures definable in first-order logic is expressible by an existential positive sentences if and only if it is preserved under homomorphism [ChangKeisler]. One can consider the “finite model theory analogs” of each of these statements: for example, the finite model theory analog of Łoś-Tarski would be that a property of finite structures definable in first-order logic that is preserved under taking substructures must be definable by a universal formula of first-order logic. This analog is known to fail [EF99]. Rossman [ross] has shown that the finite analog of the Homomorphism Preservation theorem does hold.

A well-known preservation theorem from modal logic is Van Benthem’s theorem, stating that basic modal logic can express precisely the properties expressible in first-order logic invariant under bisimulation [vdb]. Rosen [rosen] has shown that Van Benthem’s theorem also remains valid if one restricts attention to finite structures, cf. also [Otto04APAL]. Analogous results on arbitrary structures have been established for both GFO [AvBN98JPL] and GNFO [BtCS15jacm]. In the context of finite model theory, Otto [Otto12jacm, Otto13apal] provided Van Benthem-style characterizations of GFO and of the “-bounded fragment of GNFO” indexed by a number . Central to these results are the notions of guarded bisimulation and guarded negation bisimulation that play similar roles in the model theory of GFO, respectively, GNFO as does bisimulation in the model theory of modal logic. For a comprehensive survey the interested reader should turn to [GO14survey].

3.1 Characterizing Gnfo within FO

We first look at the question of characterizing GNFO as a fragment of first-order logic invariant under certain simulation relations. In [BtCS15jacm] guarded-negation bisimulations (GN-bisimulations) were introduced, and it was shown that GNFO expresses the first-order logic properties that are invariant under GN-bisimulations. A related characterization over finite structures for the -variable fragment of GNFO is given in [Otto13apal]. Here we will work over all structures, giving a characterization theorem for a simpler kind of simulation relation, which we call a strong GN-bisimulation. We will use this characterization as a basic tool throughout the paper: to show that a certain formula is equivalent to one in GNFO, to argue that two structures must agree on all GNFO formulas and to amalgamate structures that cannot be distinguished by GNFO sentences in a sub-signature. The many uses of strong GN-bisimulations suggest that it is really the right equivalence relation for GNFO.

Recall that a homomorphism from a structure to a structure is a map from the domain of to the domain of that preserves the relations as well as the interpretation of the constant symbols. Recall also that a set, or tuple, of elements from a structure is guarded in if there is a fact of that contains all elements within the fact except possibly those that are the interpretation of some constant symbol.

Definition 3.1 (Strong GN-bisimulations)

A strong GN-bisimulation between structures and is a non-empty collection of pairs of guarded tuples of elements of and of , respectively, such that for every :

  • there is a homomorphism such that and “ is compatible with ”, meaning that for every guarded tuple in .

  • there is a homomorphism such that and “ is compatible with ”, meaning that for every guarded tuple in .

We write if the map extends to a homomorphism from to that is compatible with some strong GN-bisimulation between and . Note that, here, a and b are not required to be guarded tuples. We write if, furthermore, a is a guarded tuple in (in which case we also have that ). These notations can also be indexed by a signature , in which case they are defined in terms of -reducts of the respective structures.

It is easy to see that if there exists a strong GN-bisimulation between two structures, then the respective substructures consisting of the elements designated by constant symbols must be isomorphic.

The key distinction between strong GN-bisimulation and the GN-bisimulation of [BtCS15jacm] is that the homomorphisms whose existence is postulated in the back-and-forth properties of GN-bisimulation are only required to be “local”, that is, defined on arbitrary finite neighbourhoods of the guarded tuple in question, while our definition above asks for a single “global” homomorphism that is defined on the entire domain of the respective structure, i.e. one that is uniformly appropriate for all neighbourhoods according to the requirements of GN-bisimulations of [BtCS11icalp]. This is a very significant strengthening of requirements, which makes strong GN-bisimulation more powerful as a tool in our proofs.

Another distinction between the notions is that while GN-bisimulations are only defined on guarded tuples, our notion of strong GN-bisimulation is meaningful on arbitrary tuples. It is an equivalence relation on guarded tuples, but is asymmetric on general tuples.

In [BtCS15jacm] it was shown that GNFO corresponds to the GN-bisimulation-invariant fragment of first-order logic. In light of our previous remark, it follows that GNFO formulas are also invariant under strong GN-bisimulations as far as guarded tuples are concerned. In fact, for arbitrary tuples one can verify via structural induction on the construction of formulas that all GNFO formulas are preserved by strong GN-bisimulations. That is, one can show that implies , where the notation

expresses that, for every GNFO formula , implies .

Strong GN-bisimulations will play a key role in our remaining results. Informally, when we want to show that a GNFO formula can be replaced by another simpler , we will often justify this by showing that an arbitrary model of can be replaced by a strongly bisimilar structure where holds (or vice versa).

Our first “expressive completeness” result characterizes GNFO as the fragment of first-order logic that is preserved by strong GN-bisimulations.

Theorem 3.2

A first-order formula is preserved by (over all structures) iff it is equivalent to a GNFO formula.

The proof of the of Theorem 3.2 relies on the following lemma. Further, in the remainder of the paper, we will make use of the lemma directly. For example, the second part of the lemma will be instrumental in our proof of Craig Interpolation for GNFO presented in Section 4.

The first part of the lemma will be used in the “easy direction” of Theorem  3.2: it formalizes the notion that strong bisimulation preserves GNFO formulas. The second part of the lemma will be used in the harder direction of Theorem  3.2. It asserts that can always be lifted to by passing from a pair of structures to suitable elementary extensions. The second part will be established using the technique of recursively saturated models [ChangKeisler].

Lemma 3.3
  1. If then .

  2. If and both structures are countable, then there are countable elementary extensions and , respectively, such that .

The first part can be proved by a straightforward formula induction. For the second part, we will use countable recursively saturated structures.

Consider the pair of countable structures viewed as a single structure over an extended signature with additional unary predicates and to denote the domain of and of , respectively. Let be any countable recursively saturated elementary extension of . Let be the collection of all pairs of guarded tuples of and that are GNFO-indistinguishable. To establish the lemma, we need to show that is a strong GN-bisimulation, and that the partial map extends to a homomorphism that is compatible with . Both follow directly from the following claim.

  • Claim. Every finite partial map from to , or vice versa, that preserves truth of all GNFO-formulas, can be extended to a homomorphism compatible with .

  • Proof of claim. We assume that is a finite partial map from to ; the other direction is symmetric. Fix an enumeration of the (countably many) elements of the domain of that are not in the domain of . We will define a sequence of finite partial maps such that , and such that each preserves truth of all GNFO formulas. It then follows that is a homomorphism extending and compatible with .

    It remains only to show how to construct from . Here, we use the fact that is recursively saturated. Let c be an enumeration of the domain of , and d an enumeration of the range of , corresponding to the enumeration of c, and let be the set of all first-order formulas of the form

    where is a GNFO formula with parameters c and , and is obtained by replacing each parameter in c by its -image, and replacing by . In the above definition of we only consider formulas that belong to GNFO even when the parameters are treated as free variables (thereby excluding formulas such as ).

    The set is clearly a recursive set. From the fact that preserves truth of GNFO formulas it follows that every finite subset of is realized in . Note that in the argument above we are only relying on the closure of GNFO under conjunction and existential quantification.

    By compactness, therefore, is consistent and, by virtue of recursive saturation, it is realized by some element . It follows from the construction that the partial map preserves truth of all GNFO formulas.

This concludes the proof of the lemma.

Proof of Theorem 3.2. We prove only the harder direction, following the template often used in preservation theorems in classical model theory. Let be preserved by , and let be the set of all GNFO formulas it entails. Thanks to compactness, it is enough to show that .

Let , and let be the set of all negations of GNFO formulas false of in . We claim that is consistent. Suppose it were not consistent. Then by the Compactness Theorem we would have that implies , where is the negation of some finite conjunction of formulas from . It follows from the construction of that is (up to logical equivalence) a GNFO formula, which therefore must belong to . This yields a contradiction because we have that and .

Thus there is and a such that . By construction, every GNFO formula true of in is also true of in . Note that we may assume that both and are countable. Using Lemma 3.3, we can find elementary equivalent extensions completing the following diagram.

By virtue of being invariant under elementary equivalence and being preserved by strong GN-bisimulations, we can chase it around the diagram starting from and concluding . Given that was arbitrary, this shows that and so the theorem follows.

Note that our proof makes use of infinite structures in a fundamental way. We do not claim the analogous result for preservation over finite structures.

We now look at characterizing the intersection of GNFO with smaller fragments of first-order logic. We will start with tuple-generating dependencies.

3.2 Tuple-generating dependencies within Gnfo

Recall that a tuple-generating dependency (TGD) is a sentence of the form:

where and are conjunctions of relational atomic formulas (not equalities). TGDs arise in databases, as a way of specifying natural restrictions on data and as a way of capturing relationships between different datasources. They also arise in ontological reasoning. Static analysis and query answering problems have motivated research to identify expressive yet computationally well-behaved classes of TGDs. A guarded TGD (GTGD) is one in which includes an atomic formula containing all the variables occurring in . Guarded TGDs constitute an important class of TGDs at the heart of the Datalog framework [CGL09pods, BGO14lmcs] for which many computational problems are decidable. More recently, Baget, Leclère, and Mugnier [baget2010] introduced frontier-guarded TGDs (FGTGDs), defined like guarded TGDs, but where only the variables occurring both in and in (the exported variables) must be guarded by an atomic formula in . Every FGTGD is equivalent to a GNFO sentence, obtained just by writing it out using existential quantification, negation, and conjunction. Theorem 3.7 below shows that these are exactly the TGDs that GNFO can express.

We need two lemmas: one about GNFO and one about TGDs. For two structures , let us denote by the structure obtained from by removing all facts containing only values from the active domain of . We say that is a squid-extension of if

  1. every set of elements from the active domain of that is guarded in is already guarded in ; and

  2. is a union of structures such that: for two distinct and their active domains overlap only in , and each is guarded in , where is the set of elements of named by a constant symbol.

Intuitively, we can think of as a squid, where each is one of its tentacles. We refer to the as the tentacles, and the partition into as a squid decomposition of .

We extend the notation to instances in the obvious way (since it does not depend on the domain of or ). The following lemma allows one to turn an arbitrary extension of a structure into a squid-extension of , modulo strong GN-bisimulation.

Lemma 3.4

For every pair of structures with , there is a squid-extension of and a homomorphism whose restriction to is the identity function, such that via a strong GN-bisimulation that is compatible with . Moreover, we can choose to be finite if is.

We will make use of Lemma 3.4 as a tool for bringing certain conjunctive queries into a restricted syntactic form, by exploiting the fact that, whenever a tuple from satisfies a conjunctive query in a squid-extension of , then we can partition the atomic formulas of the query into independent subsets that are mapped into different tentacles of .

For every set of elements that is guarded in , we create a structure that is a fresh isomorphic copy of in which only the elements of are kept constant (i.e., mapped to themselves by the isomorphism), where is the set of all elements named by a constant symbol. We define to be the union of all such . Clearly, is a squid-extension of , and the natural projection is a homomorphism. Furthermore, we claim that via a strong GN-bisimulation that is compatible with . The claimed strong GN-bisimulation consists of all pairs where is a guarded tuple of .

The following lemma expresses a general property of TGDs that follows from the fact that TGDs are preserved under taking direct products of structures [Fagin82].

Lemma 3.5

(Both classically and in the finite.) Let be any set of TGDs and suppose that , where and the are conjunctions of atomic formulas. Then for some .

To simplify the presentation, we consider the case where . Let

and suppose for the sake of a contradiction that there are structures and such that . Let be the direct product , that is, the structure whose domain is the cartesian product of the domains of and and such that a tuple of pairs belong to a relation in if and only if the tuple of first-projections belongs to the corresponding relation in and the tuple of second-projections belongs to the corresponding relation in . If a constant symbol denotes in and in , it denotes the pair in . Since TGDs are closed under taking direct products, we have that . It also follows from the construction that

  1. the natural projections and are homomorphisms, and

  2. whenever is satisfied by tuples in and in , then the tuple of pairs whose first-projections are and whose second projections are also satisfies in .

Putting this together, we obtain that , which contradicts the fact that .

Because is finite if both and are, the above argument is equally valid over finite structures as over arbitrary structures.

We now return to describing our characterization of TGDs that are equivalent to some GNFO sentence. Consider a TGD . A specialization of is a TGD of the form obtained from by applying some substitution mapping the variables to constant symbols or to variables among and . Clearly, a specialization of a TGD entails . The following lemma states that as far as strong GN-bisimulation invariant TGDs are concerned, we can replace any TGD by specializations of it that are equivalent to frontier-guarded TGDs. Its proof relies heavily on the two lemmas above.

Lemma 3.6

[TGD specializations] (Both classically and in the finite.) Let be a set of TGDs that is strong GN-bisimulation invariant and let be a TGD such that . Then there exists a specialization of such that , and such that is logically equivalent to a conjunction of frontier-guarded TGDs.

First we introduce the notion of a quasi-frontier guarded TGD. By the graph of a TGD we mean the undirected graph whose nodes are the conjuncts of and where two conjuncts are connected by an edge if they share an existentially quantified variable. Observe that if the graph of is not connected, then can be decomposed into several TGDs, one for each connected component. We say that is quasi-frontier guarded if, for each connected component of its graph, the set of universally quantified variables occurring in atomic formulas belonging to that component is guarded by some atomic formula in the TGD body . This is equivalent to saying that the decomposition into TGDs just mentioned yields a set of frontier-guarded TGDs.

We will show that, if is a set of TGDs that is strong GN-bisimulation invariant and is a TGD such that , then there exists a specialisation of such that , and such that is quasi-frontier guarded.

Thus fix such that .

Consider any structure and homomorphism . Let be the image of . By Lemma 3.4, has a squid-extension such that via some strong GN-bisimulation that is compatible with a homomorphism whose restriction to is the identity function. Since is invariant for strong GN-bisimulations, . Therefore since , . In particular, can be extended to a homomorphism from to . We can extract from a substitution , namely the one that sends a variable to a constant symbol if is the interpretation of (if is the interpretation of several constant symbols we choose one arbitrarily), or else sends to an arbitrary for which if there is such , otherwise sends to . Applying to the conjunctive query yields another conjunctive query (where is a subset of . By construction we have that

is a specialization of such that the CQ is satisfied in , hence also in , under the assignment for the universally quantified variables . We first show that each is quasi-frontier-guarded. Consider the decomposition of

such that the graphs of enumerate the connected components of the graph of and let be arbitrary.

Note that, by construction, all existential variables are mapped by to elements that neither belong to nor interpret any constant symbol: if had mapped an existential variable to , then this variable would have been removed and replaced by a universal variable. Next note that the active domains of the tentacles of overlap only on elements of . Using connectivity of , we see that the existential variables must map to the active domain of a single tentacle. From connectedness of the graph of , we know there are two possibilities: if there are no existential variables in , then consists of a single atom. In this case the universal variables map into a guarded set of . If there is any existential variable in , then every universal variable lies in some atom with an existential variable. Since the existential variables do not map into , it follows that the image of under must be entirely contained in a single tentacle of . Now the subset of the universally-quantified variables occurring in is mapped into , since mapped into and extended . Thus the variables must be mapped by to the intersection of a tentacle and the active domain of , hence (by the properties of a squid decomposition) again we can conclude that maps to a guarded set of elements of . And since agrees with on these variables, the same statement holds with substituted for . Since was defined as the -image of , we can conclude that the universally-quantified variables occurring in are guarded in ; that is, is frontier-guarded. Since was arbitrary, this shows that is indeed quasi-frontier-guarded.

Now we need to show that one such is entailed by . What we have shown thus far is that any that is satisfied by satisfies one such . But there are only finitely many such , and thus by Lemma 3.5 we can conclude that entails one such .

Suppose we apply the lemma above to each TGD is . We get a finite set of frontier-guarded TGDs whose conjunction implies each TGD in . Further, each TGD in the set is implied by . Thus we have obtained our first main characterization:

Theorem 3.7

Every GNFO sentence that is equivalent to the conjunction of a finite set of TGDs on finite structures is equivalent to the same conjunction of a finite set of TGDs on arbitrary structures, and such a formula is equivalent (over all structures) to a finite set of FGTGDs.

In light of the above result, it may seem tempting to suppose that, similarly, guarded TGDs can express all that can be expressed both by TGDs and in GFO. This is, however, not the case: the TGD can be equivalently expressed in GFO, but not by means of a guarded TGD; and the guarded TGD is not expressible in GFO. Instead, we show that every property expressible both in GFO and by a finite set of TGDs is in fact expressible by a finite set of acyclic frontier-guarded TGDs.

Recall from Section 2 that a CQ is answer-guarded if its free variables co-occur in one of its atomic sub-formulas and that such a CQ is acyclic if it is equivalent to a positive-existential GFO formula. We say that a frontier-guarded TGD is acyclic if the answer-guarded CQ and the answer-guarded CQ are both acyclic. Note that both CQs are indeed answer-guarded, by virtue of being frontier-guarded.

Theorem 3.8

Every GFO sentence that is equivalent to a finite set of TGDs over finite structures is equivalent (over all structures) to a finite set of acyclic FGTGDs.

Let be any GFO sentence that is equivalent to a finite set of TGDs over finite structures. Then, by Theorem 3.7, is equivalent to a finite set of FGTGDs over arbitrary structures.

Recall the notion of guarded unravelling of a structure and the notion of treeification of an answer-guarded CQ from Section 2. Note that for each TGD in , its left-hand side is answer-guarded by definition, and its right-hand side can be assumed answer-guarded as well. Consider the set of disjunctive GTGDs obtained by replacing the head and body of each TGD by its treeification, and expanding out the disjunction in the left-hand side.

We claim that is equivalent to . Note that since is in GFO, for any structure , . Similarly, since is in GFO, . Thus it is enough to show equivalence of and on guarded unravellings. But from Fact 2.3 we see that each formula is equivalent to its treeification on guarded unravellings, and so our claim is proven.

Now by Lemma 3.5, we obtain that each disjunctive TGD in is equivalent to one of the GTGDs obtained by replacing the disjunction in its head by one of the disjuncts. Since the head and body of each such TGD are acyclic, each such TGD is acyclic.

3.3 Existential and Positive-Existential Formulas

We turn to characterizing the existential formulas within GNFO, establishing an analog of the Łoś-Tarski theorem.

Theorem 3.9

Every GNFO formula that is preserved under extensions over finite structures has the same property over all structures, and such a formula is equivalent (over all structures) to an existential formula in GNFO. Furthermore, we can decide whether a formula has this property, and also find an equivalent existential GNFO formula effectively.

Let be a GNFO formula containing constants c and with free variables x. Let d be fresh constants, one for each variable in x. Then is preserved under extensions over finite structures iff the GNFO sentence is a validity over finite structures, where is the relativization of to a new unary predicate . Since is a GNFO formula, it is a validity over finite structures iff it is a validity over all structures. Also, the decidability of GNFO allows us to decide this validity.

As to the effective content of the claim, note that once an equivalent existential formula is known to exist in GNFO, we can find it by exhaustive search relying on the decidability of equivalence of GNFO formulas.

By the classical Łoś-Tarski theorem, if a first-order formula is preserved under extensions over all structures, it is equivalent to an existential formula . Thus, to complete the proof, it suffices to show that every GNFO formula that is equivalent to an existential formula is also equivalent to an existential GNFO formula . We can assume that is satisfiable, since otherwise it is clearly equivalent to a GNFO formula. We can convert into the form , where with each a possibly negated relational atom and where each is a conjunction of equalities an inequalities of a complete equality type on cxy. That is, is a maximal satisfiable set of equalities and inequalities involving the constants c and variables xy.

In general, some of the negated atomic formulas and inequalities in may not be guarded. Let be obtained from by removing all conjuncts that are unguarded negative atomic formulas or unguarded inequalities.

We claim that and are equivalent. One direction is obvious, since clearly implies . In the remainder of the proof, we show that implies .

Consider an arbitrary structure and tuple a such that . It is our task to show that . Our general approach will be to construct another structure and tuple b such that . In addition, we will show that . By Theorem 3.2, this will allow us to conclude as needed, since is logically equivalent to .

Let be a variable assignment from an appropriate to elements of , witnessing . In particular, is in general an incomplete equality type on cxy that only includes an equality or inequality of every pair of variables that co-occur in a positive relational atom in some . We need to show that . The main obstacles to overcome are:

  1. the possibility that maps two variables to the same element of while includes the (unguarded) inequality .

  2. the possibility that contains a fact that is the -image of an atomic formula occurring under an (unguarded) negation in .

Based on these considerations, our construction of and b will, intuitively, involve (i) making sure that only those equalities are satisfied that are either explicitly contained in or that follow (by transitivity) from guarded equalities true in at a and (ii) making sure that every fact satisfied in whose values are in the range of is guarded by a fact that is an -image of a positive atomic formula of .

The precise construction is as follows. Let be the set of constants and all variables occurring, free or bound, in . Further let be the equivalence relation on generated by all pairs of constants or variables such that contains the equality . Let be the natural map that sends each variable to its equivalence class. We define the structure with domain and, for each relation symbol , the relation consisting of tuples such that occurs as a positive atomic sub-formula in or, what is the same, in . Further let the -class of each constant interpret in the corresponding constant symbol and let . Note that depends on solely through the choice of the disjunct that is assumed to be satisfied at a in via the variable assignment .

  • Observation 1: there is a homomorphism such that and such that is injective on guarded subsets of . That is, maps distinct elements co-occurring in a fact of to distinct elements of .

  • Observation 2: assigns elements of to variables of in a manner witnessing .

Observation 1 follows from the definition of and of . Observation 2 follows from the construction of (for the equalities, inequalities, and positive atomic formulas) and from the previous observation (for the negative atomic formulas).

As a next step, we transform into as follows. For each fact of we make an isomorphic copy of denoted , where the isomorphism maps the elements belonging to the -image of to their, by Observation 1, unique -preimage and maps all other elements to distinct fresh elements. We define as the union , and let be the map that extends by mapping every newly-created element in some to the corresponding element of . Note that, by construction, is a homomorphism.

  • Observation 3: via the variable assignment .

  • Observation 4: .

Observation 3 follows from Observation 2, , and the observation that does not add any new facts on elements of . For Observation 4, it can be easily verified that the graph of is in fact a strong GN-bisimulation, which is compatible with the homomorphism and . From Observation 4 and Theorem 3.2 we get that as needed.

Note. This theorem can also be proven by refining the GNFO interpolation theorem of Section 4 to get a Lyndon-style interpolation theorem. The approach via interpolation is spelled out in the paper [csllics14].

Finally, we consider the situation for GNFO formulas that are positive existential (for short, ). Since GNFO contains all formulas, Rossman’s homomorphism preservation theorem [ross] implies that the formulas are exactly the formulas in GNFO preserved under homomorphism, over all structures or (equivalently, by the finite model property for GNFO) over finite structures. In addition, using the proof of Rossman’s theorem plus the decidability of GNFO we can effectively decide whether a GNFO formula can be rewritten in .

Theorem 3.10

There is an effective algorithm for testing whether a given GNFO formula is equivalent to a positive existential formula, and, if so, computing such a formula.

Rossman’s proof [ross] shows that if an arbitrary FO formula is equivalent to an formula, it is equivalent to one of the same quantifier rank as . If is in GNFO, we can test equivalence of a given formula with , using the decidability of GNFO. We can thus test all formulas with quantifier rank bounded by the quantifier rank of , giving an effective procedure.

4 Interpolation and Beth definability for Gnfo

The Craig Interpolation theorem for first-order logic [craig57beth] can be stated as follows: given formulas such that , there is a formula such that

  1. , and

  2. all relations occurring in occur in both and

  3. all constants occurring in occur in both and

  4. all free variables of are free variables of both and .

The Craig Interpolation theorem has a number of important consequences, including the Projective Beth Definability theorem [beth]. Suppose that we have a sentence over a first-order signature of the form , where is an -ary predicate, and suppose is a subset of . A sentence implicitly defines predicate over if: for every -structure , every expansion to a -structure satisfying has the same restriction to .Informally, the structure and the sentence determine a unique value for . An -ary predicate is explicitly definable over for models of if there is another formula using only predicates from such that . It is easy to see that whenever is explicitly definable over for models of , then implicitly defines over . The Projective Beth Definability theorem states the converse: if implicitly defines over , then is explicitly definable over for models of . In the special case where , this is called simply the Beth Definability theorem.

A proof of the Craig Interpolation theorem can be found in any model theory textbook (e.g. [ChangKeisler]). The Projective Beth Definability theorem follows from the Craig Interpolation theorem. Both theorems fail when restricted to finite structures [EF99].

We say that a fragment of first-order logic has the Craig Interpolation Property (CIP) if for all in the fragment, the result above holds relative to the fragment. We similarly say that a fragment satisfies the Projective Beth Definability Property (PBDP) if the Projective Beth Definability theorem holds relativized to the fragment – that is, if in the hypothesis of the theorem lies in the fragment then there is a corresponding formula lying in the fragment as well. We talk about the Beth Definability Property (BDP) for a fragment in the same way. The argument for first-order logic applies to any fragment with reasonable closure properties [hooglandthesis] to show that CIP implies PBDP.

CIP and PBDP do not hold when implication is restricted to finite models [EF99]. However, the finite and unrestricted versions of these properties are equivalent when considering fragments of FO with some basic closure properties that have the finite model property, since there equivalence (resp. consequence) over finite structures can be replaced by equivalence (resp. consequence) over all structures. Thus it is particularly natural to look at CIP and PBDP for such fragments, such as GFO and GNFO. Hoogland, Marx, and Otto [HMO] showed that the Guarded Fragment satisfies BDP but lacks CIP. Marx [Marx07pods] went on to explore PBDP for the Guarded Fragment and its extensions. He argues that the PBDP holds for an extension of GFO called the Packed Fragment. The definition of the Packed Fragment is not important for this work, but at the end of this section we show that PBDP fails for GFO, and also (contrary to [Marx07pods]) for the Packed Fragment. But we will adapt ideas of Marx to show that CIP and PBDP do hold for GNFO.

The main technical result of this section is then:

Theorem 4.1 (Gnfo has Craig interpolation)

For each pair of GNFO-formulas such that , there is a GNFO-formula such that

  • , and ,

  • all relations occurring in occur in both and ,

  • all free variables of are free variables of both and .

Section 4.1 is dedicated to the proof of Theorem 4.1. In Section 4.2 we present further applications of the result, and in Section 4.3 we discuss failure of interpolation for the Guarded Fragment.

We first comment that item (iii) can be ensured by pre-processing and . We can assume that contains only free variables that are common to : if it has variables that are not, then we can existentially quantify them. We can also assume that has only free variables that are common to : if it has variables that are not, then we can universally quantify them, restricting the universal quantification to a new “dummy guard”. This new guard will not occur in the interpolant, since it is not common, so this does not impact the other items. quantifying any violating free variables of the interpolant. Thus it suffices to ensure (i) and (ii).

Also observe that in Theorem 4.1, the interpolant is allowed to contain constant symbols outside of the common language. Indeed, this must be so, for GNFO lacks the stronger version of interpolation where the interpolant can only contain constant symbols occurring both in the antecedent and in the consequent. Recall that, in GNFO, as well as GFO, constant symbols are allowed to occur freely in formulas, and that their occurrence is not governed by guardedness conditions. In particular, for example, the formula belongs to GFO (and is equivalent to a formula of GNFO), while the formula does not. Now, consider the valid entailment . It is not hard to show that any interpolant not containing the constants and must be equivalent to . This shows that there are valid GFO-implications for which interpolants cannot be found in GNFO, if the interpolants are required to contain only constant symbols occurring both in the antecedent and the consequent. In fact, in [tencate:JSL05] it was shown that, in a precise sense, every extension of GFO with this strong form of interpolation has full first-order expressive power and is undecidable for satisfiability.

4.1 Proof of Craig interpolation for Gnfo

To establish Theorem 4.1 we follow a common approach in modal logic (see, in particular, Hoogland, Marx, and Otto [HMO]). We make use of a result saying that we can take two structures over different signatures, behaving similarly in the common signature, and amalgamate them to get a structure that is simultaneously similar to both of them (in the respective signatures). The precise statement of the theorem will be in terms of the notion of strong GN-bisimulation introduced in Section 3, and the proof will make use of the results there. Our specific amalgamation construction is inspired by the zig-zag products introduced by Marx and Venema [MarxVenema]. In the lemma and claims below, a will range over tuples, not necessarily guarded.

Lemma 4.2 (Amalgamation)

Let and be signatures containing the same constant symbols but possibly different relation symbols. If , then there is a structure such that

Let be the strong GN-bisimulation between and witnessing the fact that . Below, for any partial map from to or vice versa, with a slight abuse of notation, we will write if can be extended to a homomorphism that is compatible with . In particular, we have . Note that, for individual elements and , if and only if . In addition, with some further abuse of notation, for any -tuple of elements of and for any -tuple of elements of , we will denote by the -tuple .

We define the amalgam as follows:

  • the domain of is ;

  • for every ;

  • for every ;

  • for every constant symbol ;

  • .

To see that is thus well defined, note that for , if and then also and , and vice versa.

  • Claim 1:

  • Proof of claim 1. Let be the collection of all pairs for and v guarded (by a -atomic formula) in . We will show that is a strong GN-bisimulation between and , and that .

    Consider any pair . By construction, we have that and hence, there is a homomorphism that is compatible with , and such that . Let for all . It can easily be verified that is a homomorphism from to that is compatible with , and that