Baumgartner, Peter

Waldmann, Uwe

English

The Australian National University

Hierarchic Superposition:Completeness without CompactnessPeter Baumgartner1 and Uwe Waldmann21 NICTA⋆ and Australian National University, Canberra, AustraliaPeter.Baumgartner@nicta.com.au2 MPI für Informatik, Saarbrücken, Germanyuwe@mpi-inf.mpg.deAbstract. Many applications of automated deduction and verification requirereasoning in combinations of theories, such as, on the one had (some fragmentof) first-order logic, and on, the other hand a background theory, such as someform of arithmetic. Unfortunately, due to the high expressivity of the full logic,complete reasoning is impossible in general. It is a realistic goal, however, todevise theorem provers that are “reasonably complete” in practice, and the hier-archic superposition calculus has been designed as a theoreical basis for that. Ina recent paper we introduced an extension of hierarchic superposition and provedits completeness for the fragment where every term of the background sort isground. In this paper, we extend this result and obtain completeness for a largerfragment that admits variables in certain places.1 Hierarchic SuperpositionMany applications of automated deduction and verification require reasoning incombi-nations of theories, such as, on the one hand (some fragment of) first-order logicand onthe other hand some form of arithmetic. In hierarchic superposition [2, 3] we considerthe following scenario:We assume that we have a background (“BG”) prover that accepts as input a setof clauses over aBG signatureΣB = (ΞB, ΩB), whereΞB is a set ofBG sortsandΩBis a set ofBG operators. Terms/clauses overΣB and BG-sorted variables are calledBG terms/clauses. For instance,ΞB might be {int, boolB} andΩB might contain theinteger numbers,+, −, <, ≤, true<, true≤, and additional parametersα, β, . . . that maybe interpreted freely over theint-domain. The BG prover decides the satisfiability ofΣB-clause sets w. r. t. aBG specification, say linear integer arithmetic (LIA).For technical reasons, we assume that equality is the only predicate symbol inour language and that any non-equational atomp(t1, . . . , tn) is encoded as an equationp(t1, . . . , tn) ≈ truep. We refer to the terms that result from this encoding of atomsasatom terms; all other terms are calledproper terms. When we simply write, say,x ≤ y,this should always be taken as a shorthand for an equation as above.⋆ NICTA is funded by the Australian Government through the Department of Communicationsand the Australian Research Council through the ICT Centre of Excellence Program.The foreground (“FG”) theorem prover accepts as inputs clauses over a signatureΣ = (Ξ,Ω), whereΞB ⊆ Ξ andΩB ⊆ Ω. The sorts inΞF = Ξ \ ΞB and the operatorsymbols inΩF = Ω\ΩB are calledFG sortsandFG operators. For instance,ΞF might be{list, boolF} andΩF might contain operatorscons: int × list → list, length: list → int,isempty: list → boolF, andtrueisempty:→ boolF, among others.Σ-terms that are not BGterms are called FG terms. Notice that FG terms such aslength(x) can have BG sorts.After abstracting out certain BG terms that occur as subterms of FG terms,3 the FGprover saturates the set ofΣ-clauses using the inference rules of hierarchic superposi-tion, such as, e. g.,Negative superpositionl ≈ r ∨C s[u] 0 t ∨ Dabstr((s[r] 0 t ∨C ∨ D)σ)if (i) neither l nor u is a BG term, (ii)u is not a variable, (iii)σ is a simplemgu of l andu, (iv) rσ  lσ, (v) (l ≈ r)σ is strictly maximal in (l ≈ r ∨ C)σ,(vi) the first premise does not have selected literals, (vii)tσ  sσ, and (viii)if the second premise has selected literals, thens 0 t is selected in the secondpremise, otherwise (s0 t)σ is maximal in (s0 t ∨ D)σ.These differ from the standard superposition inference rules [1] mainly in that only theFG parts of clauses are overlapped and that any BG clauses derived during the saturationare instead passed to the BG prover. The BG prover implementsan inference ruleCloseC1 · · · Cnif C1, . . . ,Cn are BG clauses and{C1, . . . ,Cn} is unsatisfiable w. r. t. the BGspecification.As soon as one of the two provers detects a contradiction, theinput clause set has beenshown to be inconsistent w. r. t.conservative extensions of the BG specification.2 Refutational CompletenessThere are two requirements for the refutational completeness of hierarchic superposi-tion. The first one is a variant ofsufficient completeness: We must be able to prove thatevery ground BG-sorted FG term is equal to some BG term. Sufficient completenessof a set ofΣ-clauses is a property that is not even recursively enumerable. For certainclasses ofΣ-clause sets, however, it is possible to establish sufficient completeness au-tomatically [5, 3]: If all BG-sorted FG terms are ground, it suffices to add adefinitionαt ≈ t for every BG-sorted FG termt occurring in a clauseC[t], whereαt is a newparameter (BG constant); afterwardsC[t] can be replaced byC[αt].3 Abstracting outa termt that occurs in a clauseC[t] means replacingC[t] by x 0 t ∨C[x] fora new variablex. The reverse operation is calledunabstraction.2Since we can only passfinite clause sets to a BG prover, there is a second require-ment for refutational completeness, namely thecompactnessof the BG specification. Aspecification is called compact, if every set of formulas that is unsatisfiable w. r. t. thespecification has a finite unsatisfiable subset.It is well-known that first-order logic is compact. So, if we assume that the BGprover checks satisfiability w. r. t., say, the first-order theory of LIA4 the compactnessrequirement is automatically satisfied. Unfortunately, assoon as the BG signature con-tains parameters, satisfiability w. r. t. the first-order theory of LIA differs from satisfi-ability w. r. t. LIA over Z. Consider the following example: Suppose that the BG sig-nature contains the parameterα in addition to the integer numbers and the operatorsymbols of LIA, and that we have a unary FG predicate symbolp and theΣ-clausesp(0),¬p(x)∨ x < α, and¬p(x)∨ x+1 < y∨ p(y). Starting with these clauses, hierarchicsuperposition produces a setN1 of BG clauses0 < α,0+ 1 < y1 ∨ y1 < α,0+ 1 < y1 ∨ y1 + 1 < y2 ∨ y2 < α,0+ 1 < y1 ∨ y1 + 1 < y2 ∨ y2 + 1 < y3 ∨ y3 < α,. . .which, after removing the universally quantified variablesby quantifier elimination,turns out to be equivalent to{0 < α, 1 < α, 2 < α, 3 < α, . . .}. Each finite subset ofN1 is satisfiable inZ, and hence in the first-order theory of LIA. By compactness offirst-order logic,N1 itself is also satisfiable in the first-order theory of LIA, for in-stance in the non-standard modelQ × Z with 0 := (0, 0), 1 := (0, 1), α := (1, 0),(x, y) + (x′, y′) := (x+ x′, y+ y′), and a lexicographic ordering. On the other hand, thesetN1 is clearly unsatisfiable inZ. This leaves us two undesirable choices: If we as-sume that the BG specification is given by LIA overZ, hierarchic superposition is notrefutationally complete – there is a contradiction, but we will never detect it. If we as-sume that the BG specification is the first-order theory of LIA, hierarchic superpositionis refutationally complete, but we get non-standard models, that we would prefer toexclude in most applications.3 Completeness without CompactnessAre there classes ofΣ-clause sets for which we can guarantee that hierarchic superpo-sition is refutationally complete even if we restrict ourselves to the standard models oflinear integer or rational arithmetic? A first answer in thisdirection was given in [3]: Ifall BG-sorted terms in a clause set are ground, clauses are app opriately preprocessed,and some reasonable restrictions on simplifications are obsrved, then the hierarchicsuperposition calculus can produce only finitely many different BG clauses (up to un-abstraction and duplication of literals). Refutational completeness follows immediately.In the current paper, we extend this result significantly by permitting also BG-sortedvariables and, in certain positions, even variables with offsets.4 That is, the set of all first-order BG sentences that hold in LIA.3Theorem 1. Let N be a set of clauses over the signature of linear integer arithmetic(with parametersα, β, etc.), such that every proper term in these clauses is either(i) ground, or (ii) a variable, or (iii) a sum x+k of a variable x and a number k≥ 0 thatoccurs on the right-hand side of a positive literal s< x + k. If the set of ground termsoccurring in N is finite, then N is satisfiable in LIA overZ if and only if N is satisfiablew. r. t. the first-order theory of LIA.Proof. Let N be a set of clauses with the required properties, and letT be the finite setof ground terms occurring inN. We will show thatN is equivalent to somefiniteset ofclauses over the signature of linear integer arithmetic, which implies that it is satisfiablein the integer numbers if and only if it is satisfiable in the first-order theory of LIA.In a first step, we replace every negative ordering literal¬s < t or ¬s ≤ t by theequivalent positive ordering literalt ≤ s or t < s. All literals of clauses in the resultingsetN0 have the forms ≈ t, s 0 t, s < t, s ≤ t, or s < x + k, wheres andt are eithervariables or elements ofT andk ∈ N. Note that the number of variables in clauses inN0 may be unbounded.In order to handle the various inequality literals in a more uniform way, we introducenew binary relation symbols<k (for k ∈ N) that are defined bya <k b if and only ifa < b+k. Observe thats<k t entailss<n t wheneverk ≤ n. Obviously, we may replaceevery literals < t by s <0 t, every literals ≤ t by s <1 t, and every literals < x+ k bys<k x. Let N1 be the resulting clause set.We will now transformN1 into an equivalent setN2 of ground clauses. We startby eliminating all equality literals that contain variables by exhaustively applying thefollowing transformation rules:N ∪ {C ∨ x 0 x } → N ∪ {C }N ∪ {C ∨ x 0 t } → N ∪ {C[x 7→ t] } if t , xN ∪ {C ∨ x ≈ x } → NN ∪ {C ∨ x ≈ t } → N ∪ {C ∨ x <1 t, C ∨ t <1 x } if t , xAll variables in inequality literals are then eliminated ina Fourier-Motzkin-like mannerby exhaustively applying the transformation ruleN ∪ {C ∨∨i∈Ix <ki si ∨∨j∈Jt j <nj x } → N ∪ {C ∨∨i∈I∨j∈Jt j <ki+nj si }wherex does not occur inC and one of the index setsI andJ may be empty.The clauses inN2 are constructed over the finite setT of proper ground terms,but the length of the clauses inN2 is potentially unbounded. In the next step, we willtransform the clauses in such a way that any pair of termss, t from T is related by atmost one literal in any clause: We apply one of the following transformation rules aslong as two terms andt occur in more than one literal:N ∪ {C ∨ s<k t ∨ s≈ t } → N ∪ {C ∨ s<k t } if k ≥ 1N ∪ {C ∨ s<0 t ∨ s≈ t } → N ∪ {C ∨ s<1 t }N ∪ {C ∨ s<k t ∨ s0 t } → N if k ≥ 1N ∪ {C ∨ s<0 t ∨ s0 t } → N ∪ {C ∨ s0 t }4N ∪ {C ∨ s<k t ∨ s<n t } → N ∪ {C ∨ s<n t } if k ≤ nN ∪ {C ∨ s<k t ∨ t <n s} → N if k+ n ≥ 1N ∪ {C ∨ s<0 t ∨ t <0 s} → N ∪ {C ∨ s0 t }N ∪ {C ∨ L ∨ L } → N ∪ {C ∨ L } for any literalLN ∪ {C ∨ s≈ t ∨ s0 t } → NThe length of the clauses in the resulting setN3 is now bounded by12m(m+ 1), wherem is the cardinality ofT. Still, due to the indices of the relation symbols<k, N3 maybe infinite. We introduce an equivalence relation∼ on clauses inN3 as follows: DefineC ∼ C′ if for all s, t ∈ T (i) s≈ t ∈ C if and only if s≈ t ∈ C′, (ii) s0 t ∈ C if and onlyif s 0 t ∈ C′, and (iii) s<k t ∈ C for somek if and only if s<n t ∈ C′ for somen. Thisrelation splitsN3 into at most (12m(m+ 1))5 equivalence classes.5We will now show that each equivalence class is logically equivalent to a finitesubset of itself. LetM be some equivalence class. Since any two clauses fromM differat most in the indices of their<k-literals, we can write every clauseCi ∈ M in the formCi = C ∨∨1≤l≤nsl <kil tlwhereC and thesl andtl are the same for all clauses inM. As we have mentioned above,sl <kil tl entailssl <k jl tl wheneverkil ≤ k jl ; so a clauseCi ∈ M entailsC j ∈ M wheneverthen-tuple (ki1, . . . , kin) is pointwise smaller or equal to then-tuple (k j1, . . . , k jn) (thatis, kil ≤ k jl for all 1 ≤ l ≤ n).Let Q be the set ofn-tuples of natural numbers corresponding to the clauses inM.By Dickson’s lemma [4], for every set of tuples inNn the subset of minimal tuples(w. r. t. the pointwise extension of≤ to tuples) is finite. LetQ′ be the subset of minimaltuples inQ, and letM′ be the set of clauses inM that correspond to the tuples inQ′.Since for every tuple inQ \Q′ there is a smaller tuple inQ′, we know that every clausein M \ M′ is entailed by some clause inM′. So the equivalence classM is logicallyequivalent to its finite subsetM′. Since the number of equivalence classes is also finiteand all transformation rules are sound, this proves our claim. ⊓⊔Corollary 2. The hierarchic superposition calculus is refutationally complete w. r. t. LIAover Z for finite sets ofΣ-clauses in which every proper BG-sorted term is either(i) ground, or (ii) a variable, or (iii) a sum x+ k of a variable x and a number k≥ 0that occurs on the right-hand side of a positive literal s< x+ k.6Proof. Let N be a finite set ofΣ-clauses with the required properties. By introducingdefinitionsαt ≈ t as described above and weak abstraction we obtain a sufficientlycomplete finite setN0 of abstracted clauses.Now we run the hierarchic superposition calculus onN0 (with the same restrictionson simplifications as in [3]). LetN1 be the (possibly infinite) set of BG clauses gener-ated during the run. By unabstracting these clauses, we obtain an equivalent setN2 of5 Any pair of termss, t is related in all clauses of an equivalence class by either a liter l s≈ t, ors0 t, or s<n t for somen, or t <n s for somen, or no literal at all, so there are five possibilitiesper unordered pair of terms.6 Note that in the counterexample abovex+1 occurs on theleft-handside of the literalx+1 < y.5clauses that satisfy the conditions of Thm. 1, soN2 is satisfiable in LIA overZ if andonly if N is satisfiable w. r. t. the first-order theory of LIA. Since thehi rarchic superpo-sition calculus is refutationally complete w. r. t. the first-order theory of LIA, the resultfollows. ⊓⊔Analogous results hold for linear rational arithmetic. Letn be the least commondivisor of all numerical constants in the original clause set; then we definea <2i b bya < b+ in anda <2i+1 b by a ≤ b+in for i ∈ N and express every inequation literal interms of<k. The Fourier-Motzkin transformation rule is replaced byN ∪ {C ∨∨i∈Ix <ki si ∨∨j∈Jt j <nj x } → N ∪ {C ∨∨i∈I∨j∈Jt j <ki•nj si }wherex does not occur inC, one of the index setsI andJ may be empty, andk • n isdefined ask + n− 1 if both k andn are odd, andk + n otherwise. The rest of the proofproceeds in the same way as before.References1. L. Bachmair and H. Ganzinger. Rewrite-based equational theorem proving with selection andsimplification.Journal of Logic and Computation, 4(3):217–247, 1994.2. L. Bachmair, H. Ganzinger, and U. Waldmann. Refutationaltheorem proving for hierarchicfirst-order theories.Appl. Algebra Eng. Commun. Comput, 5:193–212, 1994.3. P. Baumgartner and U. Waldmann. Hierarchic superposition with weak abstraction. InM. P. Bonacina, ed.,24nd Int. Conf. on Automated Deduction, 2013, LNAI 7898, pp. 39–57. Full version: Research Report MPI-I-2013-RG1-002, Max-Planck-Institut für Infor-matik, Saarbrücken, Germany, June 2013,http://domino.mpi-inf.mpg.de/internet/reports.nsf/NumberView/2013-RG1-002.4. L. E. Dickson. Finiteness of the odd perfect and primitiveabundant numbers withn distinctprime factors.Amer. J. Math., 35(4):413–422, 1913.5. E. Kruglov and C. Weidenbach. Superposition decides the first-order logic fragment overground theories.Math. in Comp. Sci., pp. 1–30, 2012.6

Hierarchic Superposition: Completeness without Compactness

https://openresearch-repository.anu.edu.au/bitstream/1885/66302/2/01_Baumgartner_Hierarchic_Superposition:_2013.pdf

Hierarchic Superposition: Completeness without Compactness

Abstract

Similar works

Full text

Available Versions

The Australian National University