Gábor Alagi

Noran Azmy

Jasmin Christian Blanchette

Björn Borowski

Aymeric Bouzy

Martin Bromberger

Eugen Denerz

Alberto Fiori

Mathias Fleury

Florian Frohn

Willem Hagemann

Matthias Horbach

Maximilian Jaroschek

Marek Košta

Jennifer Müller

Anna Rossien

Anders Schlichtkrull

Renate Schmidt

Thomas Sturm

Martin Suda

Ching Hoo Tang

Andreas Teucke

Sophie Tourret

Hernán Vanzetto

Daniel Wand

Uwe Waldmann

Christoph Weidenbach

Matthias Baaz

Christel Baier

Michael Benedikt

Armin Biere

Maria Paola Bonacina

Uwe Egly

Berit Grußien

Andreas Herzig

Ullrich Hustadt

Yevgeny Kazakov

Manuel Kieroński

Laura Kovacs

Alexander Leitsch

Florian Lonsing

Martin Lück

Stephan Merz

Andreas Nonnengart

Martin Otto

Reinhard Pöschel

Ian Pratt-Hartmann

Karin Quaas

Abhisekh Sankaran

Nicole Schweikardt

Thomas Schwentick

Lidia Tendera

Martin Wirsing

Thomas Zeume

Erich Grädel

Marco Voigt

G F Gks

A F Fl

Fo

Keywords:

First-order logic has a long tradition and is one of the most prominent and most important formalisms in computer science and mathematics. It is well-known that the satisfiability problem for full first-order logic is not solvable algorithmically -we say that first-order logic is undecidable. This fact highlights a fundamental limitation of computing devices in general and of automated reasoning in particular. The classical decision problem, as it is understood today, is the quest for a delineation between the decidable and the undecidable parts of first-order logic based on elegant and computable syntactic criteria. Many researchers have contributed to this endeavor and till today numerous decidable and undecidable fragments of first-order logic have been identified. The present thesis sheds more light on the decidability boundary and aims to open new perspectives on the already known results.

In the first part of the present thesis we focus on the syntactic concept of separateness of variables and explore its applicability to the classical decision problem and beyond. Two disjoint sets of first-order variables are separated in a given formula if each atom in that formula contains variables from at most one of the two sets. This simple notion facilitates the definition of decidable extensions of many well-known decidable first-order fragments. We shall demonstrate that for several prefix fragments, several guarded fragments, the two-variable fragment, and for the fluted fragment. Altogether, we will investigate nine such extensions more closely. Interestingly, each of them contains the monadic first-order fragment without equality. Although the extensions exhibit the same expressive power as the respective originals, certain logical properties can be expressed much more succinctly. In at least two cases the succinctness gap cannot be bounded using any elementary function. This observation can be conceived as an indication for computationally hard satisfiability problems associated with the extended fragments. Indeed, we will derive nonelementary lower bounds for an extension of the Bernays-Schönfinkel-Ramsey fragment, called the separated fragment. Furthermore, we shall investigate the effect of separateness of variables at the semantic level, where it may lead to dependences between quantified variables that are weaker than such dependences are in general. Such weak dependences will be studied in the framework of model-checking games.

The focus of the second part of the present thesis is on linear arithmetic over the rationals with uninterpreted predicates. Two novel decidable fragments shall be presented, both based on the Bernays-Schönfinkel-Ramsey fragment. On the negative side, we will identify several small fragments of the language for which satisfiability is undecidable.

iii

List of Tables

1 Summary of the succinctness gaps that are explored in the present thesis . . . . . 5.1 Basic complexity classes and corresponding complete problems . . . . . . . . . . . 11.1 Encoding of two-counter-machine instructions using difference constraints. . . . . . 11.2 The degree of unsolvability regarding certain fragments of Presburger arithmetic with uninterpreted predicates . . . . . . .

Zusammenfassung

Untersuchungen der Logik erster Stufe blicken auf eine lange Tradition zurück. Es ist allgemein bekannt, dass das zugehörige Erfüllbarkeitsproblem im Allgemeinen nicht algorithmisch gelöst werden kann -man spricht daher von einer unentscheidbaren Logik. Diese Beobachtung wirft ein Schlaglicht auf die prinzipiellen Grenzen der Fähigkeiten von Computern im Allgemeinen aber auch des automatischen Schließens im Besonderen. Das Hilbertsche Entscheidungsproblem wird heute als die Erforschung der Grenze zwischen entscheidbaren und unentscheidbaren Teilen der Logik erster Stufe verstanden, wobei die untersuchten Fragmente der Logik mithilfe klar zu erfassender und berechenbarer syntaktischer Eigenschaften beschrieben werden. Viele Forscher haben bereits zu dieser Untersuchung beigetragen und zahlreiche entscheidbare und unentscheidbare Fragmente entdeckt und erforscht. Die vorliegende Dissertation setzt diese Tradition mit einer Reihe vornehmlich positiver Resultate fort und eröffnet neue Blickwinkel auf eine Reihe von Fragmenten, die im Laufe der letzten einhundert Jahre untersucht wurden.

Im ersten Teil der Arbeit steht das syntaktische Konzept der Separiertheit von Variablen im Mittelpunkt, und dessen Anwendbarkeit auf das Entscheidungsproblem und darüber hinaus wird erforscht. Zwei Mengen von Individuenvariablen gelten bezüglich einer gegebenen Formel als separiert, falls in jedem Atom der Formel die Variablen aus höchstens einer der beiden Mengen vorkommen. Mithilfe dieses leicht verständlichen Begriffs lassen sich viele wohlbekannte entscheidbare Fragmente der Logik erster Stufe zu größeren Klassen von Formeln erweitern, die dennoch entscheidbar sind. Dieser Ansatz wird für neun Fragmente im Detail dargelegt, darunter mehrere Präfix-Fragmente, das Zwei-Variablen-Fragment und sogenannte "guarded" und "fluted" Fragmente. Dabei stellt sich heraus, dass alle erweiterten Fragmente ebenfalls das monadische Fragment erster Stufe ohne Gleichheit enthalten. Obwohl die erweiterte Syntax in den betrachteten Fällen nicht mit einer erhöhten Ausdrucksstärke einhergeht, können bestimmte Zusammenhänge mithilfe der erweiterten Syntax deutlich kürzer formuliert werden. Zumindest in zwei Fällen ist diese Diskrepanz nicht durch eine elementare Funktion zu beschränken. Dies liefert einen ersten Hinweis darauf, dass die algorithmische Lösung des Erfüllbarkeitsproblems für die erweiterten Fragmente mit sehr hohem Rechenaufwand verbunden ist. Tatsächlich wird eine nicht-elementare untere Schranke für den entsprechenden Zeitbedarf beim sogenannten separierten Fragment, einer Erweiterung des bekannten Bernays-Schönfinkel-Ramsey-Fragments, abgeleitet. Darüber hinaus wird der Einfluss der Separiertheit von Individuenvariablen auf der semantischen Ebene untersucht, wo Abhängigkeiten zwischen quantifizierten Variablen durch deren Separiertheit stark abgeschwächt werden können. Für die genauere formale Betrachtung solcher als schwach bezeichneten Abhängigkeiten wird auf sogenannte Hintikka-Spiele zurückgegriffen.

Den Schwerpunkt des zweiten Teils der vorliegenden Arbeit bildet das Entscheidungsproblem für die lineare Arithmetik über den rationalen Zahlen in Verbindung mit uninterpretierten Prädikaten. Es werden zwei bislang unbekannte entscheidbare Fragmente dieser Sprache vorgestellt, die beide auf dem Bernays-Schönfinkel-Ramsey-Fragment aufbauen. Ferner werden neue negative Resultate entwickelt und mehrere unentscheidbare Fragmente vorgestellt, die lediglich einen sehr eingeschränkten Teil der Sprache benötigen.

Introduction

What kind of logical reasoning are computing devices capable of? This is one of the fundamental questions the present thesis ultimately revolves around. In order to provide rigorous answers, we need to be more precise. To this end, we need to, first and foremost, agree on a clear and convincing notion of the involved concepts, namely computing devices and logical reasoning.

There are two major reasons why human-constructed real-world computers and natural objects, such as the human brain, do usually not play much of a role in the study of computing. The first reason is their immense structural and operational complexity, which lies far beyond a reasonable and rigorous mathematical treatment. The second, even more important reason is the ambition of theoretical computer science to obtain results that give interesting insights and that are as broadly applicable as possible. To this end, the used models of computing devices should also capture as much as possible of the computational capabilities of future technology and of yet undiscovered natural phenomena. Therefore, the computing devices we shall take into account in the present thesis are abstract mathematical objects, such as Turing machines [START_REF] Mathison | On Computable Numbers, with an Application to the Entscheidungsproblem[END_REF] or Minsky machines [START_REF] Lee | Computation: finite and infinite machines[END_REF]. Although such abstract devices are granted access to potentially unbounded resources, such as running time and information storage capacity, they nevertheless adhere to finitary principles: every computation step can only process a fixed finite amount of information, and their behavior can be described by finite means, e.g. by a finite set of rules or by a program of finite length. Both models are characterized by neat and crisp mathematical definitions and they are considered to be universal models of computation in the sense that everything that is computable in an intuitive sense can in fact be computed using these abstract computing devices. This is known as the Church-Turing thesis. 1 Although it is impossible to prove this claim rigorously, it is widely accepted in contemporary theoretical computer science -similar to laws of nature that are widely accepted in contemporary physics. Indeed, there is strong evidence in favor of the Church-Turing thesis, as all currently known models of computation based on finitary principles turned out to have exactly the same computational power that Turing machines and Minsky machines have. The latter has been proved rigorously, see, e.g., [START_REF] Lee | Computation: finite and infinite machines[END_REF][START_REF] Hopcroft | Introduction to Automata Theory, Languages, and Computation[END_REF][START_REF] Rogers | Theory of recursive functions and effective computability[END_REF][START_REF] Cooper | Computability Theory[END_REF]. What in fact makes the Church-Turing thesis even more interesting is that we today also know that there are inherent limitations on what is computable with Turing machines and all the other equally powerful abstract computing devices. We shall come back to this fact shortly.

The other concept that we need to put on solid grounds is logical reasoning. It requires two components: a language in which we can unambiguously formulate the assumptions and propositions we wish to reason about and a finite (better: small) set of plausible rules of inference that describe clearly and unambiguously how conclusions may be drawn from finitely many given assumptions, possibly taking earlier-drawn conclusions into account. Since natural languages are far from being unambiguous, they do not qualify for such an endeavor. The combination of language plus inference rules chosen to be investigated in the present thesis is what is known today as classical first-order logic. 2 We will, however, occasionally even consider classical second-order logic.

INTRODUCTION

While Gottfried Wilhelm Leibniz (1646-1716) and David Hilbert (1862Hilbert ( -1943) ) promoted the idea that logical reasoning was more or less fully accessible to computing devices of one kind or another (cf. [START_REF] Cooper | Computability Theory[END_REF], Chapter 1), Church and Turing showed the contrary in 1936 [START_REF] Church | An Unsolvable Problem of Elementary Number Theory[END_REF][START_REF] Church | A Note on the Entscheidungsproblem[END_REF][START_REF] Church | Correction to A Note on the Entscheidungsproblem[END_REF][START_REF] Mathison | On Computable Numbers, with an Application to the Entscheidungsproblem[END_REF][START_REF] Mathison | On Computable Numbers, with an Application to the Entscheidungsproblem. A Correction[END_REF]: there are fundamental limits to what computing devices can compute, no matter whether they are abstract mathematical or real-world objects. In particular, it is beyond the capabilities of any abstract computing device, whose behavior is fully describable by a finite set of rules, to always compute the correct answer to the following question for arbitrary finite sets of assumptions S and an arbitrary proposition ϕ, both formulated in the language of first-order logic: Can we deduce ϕ from S using only the inference rules admitted in classical first-order logic? Alternatively, one could say that, assuming the Church-Turing thesis to be valid, there is no computing device that can solve the posed question in full generality. This is a limitation that is inherent to each and every model of computing devices that contemporary computer science has to offer.

Ever since the discovery of this fundamental insight in the 1930s, computer scientists have constantly put effort into exploring the boundaries between the realm of computable problems and the part that is inaccessible to computing devices. In the field of classical first-order logic, this exploration had even begun before the existence of such a boundary was known. In an attempt to find algorithmic ways for solving the outlined inference problems, several logicians described partial solutions. Instead of tackling the described problem for full first-order logic, they focused on certain parts of the underlying language, that is, on fragments of first-order logic, as we shall say, and devised specialized algorithms that are capable of solving instances of the inference problem formulated exclusively in such a language fragment. We shall call such a fragment decidable as a reference to Hilbert's "Entscheidungsproblem" (German for decision problem), which is an equivalent formulation of the inference problem outlined above. After the landmark results by Church and Turing, the exploration started on both sides of the computability boundary and has since then lead to a very large number of discoveries -see Chapter 3 for more details and references. In the present thesis we set out to contribute to this enterprise. The present thesis is divided into two parts. While Part I concentrates on classical first-order logic without any background theories, the focus of Part II is on classical first-order logic enhanced with the language of linear arithmetic plus the corresponding rules of reasoning.

In Part I we shall introduce a simple syntactic concept, namely separateness of variables, that facilitates elegant definitions of nontrivial extensions of well-known decidable fragments of first-order logic. The extended fragments have the remarkable property of being decidable as well. This aspect of separateness will be fleshed out in Chapter 3 and the novel decidable fragments presented therein constitute one of the main contributions of the present thesis. Figure 1 provides a schematic overview of the most important fragments we shall introduce. Roughly speaking, variables are separated in a first-order formula, if they never co-occur in the basic building blocks of the formula, called atoms. From a qualitative point of view, the extended fragments do not come with an increased expressiveness compared to the original fragments. That is, every property that can be expressed in such an extended language can also be expressed in the underlying original language. However, in some cases the respective logical formulas in the original fragment may have to be much longer. Indeed, we will show for several cases that there are significant gaps regarding the length of shortest formulas that express one and the same property, formulated in the extended language on the one hand, compared to the formulation in the original language on the other hand. For example, the succinctness gap between the well-known Bernays-Schönfinkel-Ramsey fragment and an extension of it, which we shall call the separated fragment, is as follows. For every positive natural number n we can find some property that can be expressed in the separated fragment with a formula of length k • n 2 for some positive natural number k, whereas expressing the very same property in the Bernays-Schönfinkel-Ramsey fragment requires a formula whose length is at least

2 2 . . . 2 2 height n .
Hence, from the perspective of formula length, the extended fragments we shall present enable Figure 1: Left-hand side: Schematic overview of well-known decidable fragments of first-order logic. Only the partial overlaps between MFO and the other fragments are depicted. We neglect any other partial overlaps. Moreover, the containment of AF in GKS and of GF in LGF is shown. Right-hand side: Schematic overview of the extended fragments (in green) that shall be presented in Chapter 3. Notice that MFO is properly contained in all extended fragments. The focus is again on the overlaps with MFO and on the proper containment relations. Other depicted overlaps might be unsubstantiated. us to describe certain properties much more succinctly and elegantly. Table 1 summarizes the succinctness gaps that we shall derive.

This boost in succinctness comes with a price tag attached concerning the computational complexity of logical inference in the extended fragments. That is, a worst-case analysis of the resources consumed by an abstract computing device that is actually doing logical reasoning in the separated fragment rather than in the Bernays-Schönfinkel-Ramsey fragment, for instance, reveals a similar gap regarding the required running time. It turns out that logical reasoning in the separated fragment is computationally as hard as logical reasoning is in any decidable first-order fragment that enjoys the so-called finite model property, if the size of smallest models is bounded by linearly growing towers of exponentials. This in fact means that logical reasoning for the separated fragment is at least as time consuming as it is for any other decidable first-order fragment enjoying the finite model property that is known today -at least as far as the author of the present thesis is aware of. We shall show this in two different ways: once in Chapter 3 (Theorem 3.3.11) -relative to the reasoning problem associated with other decidable first-order fragments -and once in Chapter 5 (Theorem 5.3.11) -relative to computationally hard problems from a different domain, so-called domino problems. FO 2 exponential Theorem 3.12.5

INTRODUCTION

Table 1: Summary of the succinctness gaps the are explored in the present thesis. The abbreviations for fragments are spelled out in Figure 1. The first row, for instance, summarizes the succinctness gap between the separated fragment and the Bernays-Schönfinkel-Ramsey fragment that we have described above. The gap between GAF and AF is conditional on ExpTime = NExpTime. All other gaps are unconditional.

Beyond the already described aspects, the concept of separateness of variables has further interesting facets on offer to be explored. A gentle introduction to the technical aspects of separateness and a detailed overview of the related topics treated in the present thesis can be found in Chapter 2. The syntactic notion of separateness induces the following semantic counterpart. Under certain circumstances, two first-order variables, one universally quantified and the other existentially quantified, that are separated in a given formula ϕ show a dependence pattern that is weaker than the dependence pattern one encounters in general in first-order logic. Hence, the term weak dependence suggests itself. In the general case, if a universally quantified variable x ranges over infinitely many values, an existentially quantified variable y that depends on x may have to range over infinitely many values as well. However, if y depends only weakly on x and the values assigned to all other involved variables are fixed, then the range of y can always be restricted to a finite set of values. This phenomenon and some consequences will be investigated in detail in Chapter 4. It will also play a role in Chapter 7, Section 7.2, where we shall suggest how Skolemization, an important technique in automated reasoning, could be enhanced so as to make it sensitive to weak dependences and yield better outcomes. Another interesting topic that is worth mentioning is interpolation. A first-order fragment is said to be closed under interpolation, if for every formula ϕ 1 from the fragment that logically entails another formula ϕ 2 from the fragment there is a third formula ψ from the same fragment, called the interpolant of ϕ 1 and ϕ 2 that "sits between" ϕ 1 and ϕ 2 in a syntactic and semantic sense. This means that (a) the vocabulary that is used in ψ is the common vocabulary of ϕ 1 and ϕ 2 , and (b) ϕ 1 logically entails ψ and ψ logically entails ϕ 2 . We shall derive interpolation theorems for several of our novel decidable first-order fragments: the separated fragment and the generalized Bernays-Schönfinkel-Ramsey fragment (Theorem 6.1.1), the generalized Ackermann fragment (Theorem 6.2.1), and the separated guarded negation fragment (Proposition 6.0.4).

In Part II of the present thesis, we turn our attention to a more specific part of classical first-order logic, which is concisely described as first-order arithmetic with uninterpreted predicate symbols. Logical reasoning in first-order arithmetic is not fully accessible to computing devices either. This changes, however, if we restrict multiplication. For instance, logical reasoning in the logic of the integers with addition, equality, and strict order -a fragment known as Presburger arithmetic -can be done by computing devices without human interaction, at least in principle. The picture changes again, as soon as we add so-called uninterpreted predicate symbols to the language. Allowing such predicate symbols, even if they have only one argument place, yields a logic fragment that is not decidable (cf. Chapter 11). Again, we need to restrict the admitted language, in order to obtain a decidable fragment.

Indeed, the main purpose of Part II is to explore the boundary between what parts of logical reasoning is accessible to computing devices in first-order arithmetic with uninterpreted predicate symbols and the parts that are inaccessible to computing devices. A detailed introduction and overview can be found in Chapter 8. In Chapter 10 we shall present two positive results, and in Chapter 11 several negative results will be derived. The two decidable fragments introduced in Chapter 10 are the Bernays-Schönfinkel-Ramsey fragment with simple linear rational constraints and the Bernays-Schönfinkel-Ramsey fragment with bounded difference constraints. Both fragments are suitable for applications in hardware and software verification. 3 For instance, we shall discuss in Section 10.5 how the latter fragment can be used to verify safety properties of real-time systems. In Chapter 11 the positive results shall be contrasted with an investigation of the syntactic threshold of the computationally inaccessible part of logical reasoning. We will concentrate on restricted fragments of Presburger arithmetic plus uninterpreted predicate symbols. Most of these results can be easily transfered to arithmetic over the rational numbers. In particular, we shall show in Section 11.4 how small relaxations of the syntactic requirements characterizing the Bernays-Schönfinkel-Ramsey fragment with bounded difference constraints will turn this decidable fragment into a fragment where logical reasoning is not fully accessible to computing devices anymore. Finally, in Section 11.5 we will sketch what the negative results found in Chapter 11 mean for certain formalisms used in the filed of verification, in particular concerning limitations that are revealed by our discoveries.

The following list summarizes the main contributions of the present thesis:

(1) The as yet unexplored concept of separateness of variables is fleshed out in several directions (Part I, an overview is given in Chapter 2).

(2) Nine novel decidable fragments of first-order logic are introduced that extend well-known decidable first-order fragments (Chapter 3). The major fragments that are being introduced are the separated fragment (SF), the generalized Bernays-Schönfinkel-Ramsey fragment (GBSR), the generalized Ackermann fragment (GAF), the generalized Gödel-Kalmár-Schütte fragment (GGKS), the separated guarded fragment (SGF), the separated loosely guarded fragment (SLGF), the separated guarded-negation fragment (SGNFO), the separated two-variable fragment (SFO 2 ), and the separated fluted fragment (SFL), cf. Figure 1. Moreover, it is proved that the qualitative expressiveness of the extended fragments compared to the respective original fragments stays the same.

(3) Significant gaps regarding succinctness are derived for several of the extended fragments: SF, GBSR, GAF, GGKS, SGF, SLGF, SFO 2 , cf. Table 1. This evidently shows that several of the extended fragments constitute a substantial quantitative improvement regarding expressiveness compared to the original fragments. Moreover, a succinctness gap is shown between SF sentences and shortest equivalent Gaifman-local sentences (Theorem 3.3.18).

(4) As a semantic counterpart to the mostly syntactically-minded investigation of separateness, the notion of weak dependence is introduced and it is investigated in the framework of model-checking games and satisfying strategies (also: winning strategies) in the spirit of Hintikka (Chapter 4). It is shown that every first-order sentence in which all dependences are weak is equivalent to some Bernays-Schönfinkel-Ramsey sentence (Theorem 4.2.1).

(5) Regarding the computational complexity of the satisfiability problem for SF (SF-Sat) and GBSR (GBSR-Sat), it is shown that both problems are non-elementary by deriving upper and lower bounds (Chapter 5). More precisely, it is shown that both problems are Towercomplete (cf. [START_REF] Schmitz | Complexity Hierarchies beyond Elementary[END_REF], see also Definition 5.0.2) and that for every positive integer k there are k-NExpTime-complete subproblems in both SF-Sat and GBSR-Sat (Theorem 5.0.3). Furthermore, a polynomial-time reduction is devised that facilitates reducing the satisfiability problem of any first-order fragment enjoying the finite model property to SF-Sat, provided that the former fragment comes with an elementary (or small non-elementary) bound regarding the size of smallest models (Theorem 3.3.11).

INTRODUCTION

(6) Craig-Lyndon-style interpolation theorems are proved for the Bernays-Schönfinkel-Ramsey fragment, SF, GBSR, the Ackermann fragment, and GAF, all without equality (Theorem 6.1.1, Lemma 6.1.9, Theorem 6.2.1, and Lemma 6.2.5).

(7) Several applications of separateness beyond the definition of decidable first-order fragments are proposed and first promising results derived: new Skolemization techniques sensitive to weak dependences (Section 7.2), a second-order variant of SF admitting the elimination of certain second-order quantifiers (Section 7.3), and an analysis of separateness in the context of interpreted logics, e.g. linear rational arithmetic (Section 7.1).

(8) Novel fragments of first-order linear rational arithmetic enhanced with uninterpreted predicate symbols are defined and proved to be decidable (Chapter 10): the Bernays-Schönfinkel-Ramsey fragment with simple linear rational constraints (BSR(SLR)) and the Bernays-Schönfinkel-Ramsey fragment with bounded difference constraints (BSR(BD)). It is shown that both fragments have a NExpTime-complete satisfiability problem (Corollaries 10.2.15 and 10.4.11). The decidability proof for BSR(SLR) can be restated in the framework of combinations of theories, which facilitates extensions, e.g. based on SF or GBSR rather than the Bernays-Schönfinkel-Ramsey fragment, and based on polynomials rather than linear arithmetic terms only (Section 10.3). A non-trivial application of BSR(BD) is elaborated upon, namely reachability analysis for formal models of real-time systems, in particular for timed automata (Section 10.5).

(9) Finally, several undecidable fragments of first-order arithmetic with uninterpreted predicate symbols are identified and discussed, mostly based on the universal fragment of Presburger arithmetic or the universal fragment of linear rational arithmetic (or restricted subfragments thereof) with a single uninterpreted predicate symbol of arity one (Chapter 11).

Part I

Separateness of First-Order Variables: A New Viewpoint on the Classical Decision Problem and Beyond

Chapter 1

Preliminaries

Syntax of First-Order Formulas

We mainly consider first-order logic formulas with equality. The following notions and notation are fairly standard and can be found in different composition in standard texts about first-order logic, for example, [START_REF] Herbert | A mathematical introduction to logic[END_REF][START_REF] Chung | Model Theory[END_REF][START_REF] Ebbinghaus | Mathematical Logic[END_REF][START_REF] Smullyan | First-Order Logic[END_REF][START_REF] Fitting | First-Order Logic and Automated Theorem Proving[END_REF][START_REF] Van Dalen | Logic and Structure[END_REF].

A vocabulary vocabulary Σ = Π, Ω Σ = Π, Ω (also: signature) comprises a countable set Π of predicate symbols and a countable set Ω of function symbols. If not explicitly stated otherwise, the vocabularies treated in the present thesis are finite. Every symbol in Σ is equipped with a nonnegative integer, its arity. For the distinguished equality predicate, whose semantics is fixed to be the identity relation, we use ≈. A function symbol of arity zero is called constant symbol. We call a vocabulary Σ = Π, Ω relational if Ω is empty.

Fix some vocabulary Σ = Π, Ω and fix some countably infinite supply Var Var of first-order variables. A Σ-term is a finite syntactic object: any constant symbol c ∈ Ω is a Σ-term; any variable v ∈ Var is a Σ-term; given any m-ary function symbol f ∈ Ω and m Σ-terms t 1 , . . . , t m the expression f (t 1 , . . . , t m ) is also a Σ-term. Atomic Σ-formulas (also: Σ-atoms) are either the logical constants true, false, or are equations s 1 ≈ s 2 , or are of the form P (s 1 , . . . , s m ) where the s i are Σ-terms, P stems from Π, and m is the arity of P . A Σ-formula is either a Σ-atom, a negated Σ-formula ¬ϕ, a conjunction ϕ ∧ ψ, a disjunction ϕ ∨ ψ, an implication ϕ → ψ, an equivalence ϕ ↔ ψ, or a quantified Σ-formula of the form ∀x. ϕ or ∃y. ϕ, where ϕ, ψ are Σ-formulas and x, y ∈ Var are first-order variables. For any Σ-terms s, t we use s ≈ t to abbreviate ¬ s ≈ t. Given a quantified Σ-formula Qv. ϕ, we call the subformula ϕ the scope of the quantifier Qv. Similarly, in a negated Σ-formula ¬ϕ the subformula ϕ is the scope of this occurrence of the negation sign. In order to save parentheses, we follow the convention that negation binds strongest, that conjunction binds stronger than disjunction, and that all of the aforementioned bind stronger than implication and equivalence. Equivalence, in turn, binds weaker than implication. The scope of quantifiers shall stretch as far to the right as admitted by parentheses. Given a set Φ of Σ-formulas, we call a Σ-formula ϕ a Boolean combination of formulas from Φ Boolean combination

, if ϕ consist of formulas from Φ, possibly connected via the Boolean connectives ¬, ∧, ∨, →, ↔. If we restrict the set of Boolean connectives even further to ∧, ∨, we speak of a ∧-∨-combination of formulas from Φ. Given some finite sequence of pairwise distinct variables v 1 , . . . , v n , the expression Qv 1 . . . v n . ϕ with Q ∈ {∀, ∃} abbreviates the formula Qv 1 .Qv 2 . . . . Qv n . ϕ. In addition, we often use the tuple notation Qv for the same purpose, where v stands for any finite tuple v 1 , . . . , v n with pairwise distinct first-order variables. For convenience, we often identify tuples v of variables with the set containing all the variables that occur in v. In most cases this abstraction from the exact order of quantifiers is justified by Proposition 1.0.1. A quantifier block is a maximal sequence Qv 1 .Qv 2 . . . . Qv n of quantifiers of the same kind occurring in a given formula. We occasionally use regular expressions to describe sequences of quantifiers. For example, for any positive integer k the expression ∃ * ∀ k ∃∃ stands for the set of all prefixes of the form ∃y 1 . . . y m ∀x 1 . . . x k ∃z 1 z 2 , where m ranges over all nonnegative integers; in particular, the leading existential quantifier block may be empty. Oftentimes the 10 CHAPTER 1. PRELIMINARIES vocabulary underlying our considerations shall not be mentioned explicitly. We just speak of terms, formulas, and atoms, when Σ is not important or clear from the current context. A formula is called relational relational formula , if the underlying vocabulary is relational, i.e. it does not contain any function symbols.

A variable v occurs freely in a formula ϕ if the formula contains an occurrence of v that is not in the scope of any quantifier Qv in ϕ. An occurrence of a variable v in a formula ϕ is bound , if it lies within the scope of some quantifier Qv in ϕ. In all formulas we tacitly assume, if not explicitly stated otherwise, that no variable occurs freely and bound at the same time and that all distinct occurrences of quantifiers bind distinct variables. We use ϕ(v 1 , . . . , v m ) ϕ(v 1 , . . . , v m ) to denote a formula ϕ whose free first-order variables form a subset of {v 1 , . . . , v m }. The variables v 1 , . . . , v m are assumed to be pairwise distinct. A formula is closed if it does not contain any free occurrences of variables. A closed formula is also called a ( Σ-)sentence. We call a term or a formula ground if it does not contain any occurrences of variables, neither free nor bound, and no quantifiers.

We denote substitution by ϕ v/s , where every free occurrence of v in ϕ is to be substituted by the term s. For simultaneous substitution of pairwise distinct variables v 1 , . . . , v n with s 1 , . . . , s n , respectively, we use the notation ϕ v 1 /s 1 , . . . , v n /s n ϕ v 1 /s 1 , . . . , v n /s n . For example, P (x, y) x/f (y), y/g(x) results in P (f (y), g(x)). Notice that this is different from the sequential application of substitution in P (x, y) x/f (y) y/g(x) = P f (g(x)), g(x) and P (x, y) y/g(x) x/f (y) = P f (y), g(f (y)) . We also write v/s to abbreviate v 1 /s 1 , . . . , v n /s n .

A formula is in prenex normal form normal forms

if it has the shape Q 1 v 1 . . . Q n v n . ψ with quantifier-free ψ and Q i ∈ {∀, ∃}, i.e. all quantifiers are lined up in front of the formula. The quantifier-free part is sometimes referred to as matrix . A formula is in negation normal form if it exclusively contains the connectives ∧, ∨, ¬ and every negation sign occurs immediately in front of an atom; quantifiers are of course admitted. A literal is an atom or a negated atom, and a clause is a disjunction of literals. A unit clause is a clause containing exactly one literal. We say that a formula is in conjunctive normal form (CNF) if it is a conjunction of clauses, possibly preceded by a quantifier prefix. 1 A formula in CNF is Horn if every clause contains at most one non-negated literal. It is Krom if every clause contains at most two literals. A formula is in disjunctive normal form (DNF) if it is a disjunction of conjunctions of literals, possibly preceded by a quantifier prefix. A sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ is said to be in standard form standard form if ψ is quantifier free and in negation normal form, in particular, the connectives → and ↔ are not admitted; all variables bound in the quantifier prefix are required to actually occur in ψ. The tuples x1 and ȳn may be empty, i.e. the quantifier prefix does not have to start with a universal quantifier, and it does not have to end with an existential quantifier.

For any formula ϕ we denote by vars(ϕ) vars(ϕ), consts(ϕ) the set of all variables occurring freely or bound in ϕ. Moreover, we write consts(ϕ) to address the set of all constant symbols that occur in ϕ. Similar notation is used for other syntactic objects.

Next, we define a measure of length of terms and formulas. length of terms and formulas

We set len(c) := 1 and len(v) := 1 for every constant symbol c and every variable v. For terms s 1 , . . . , s m we set len f (s 1 , . . . , s m ) := 1 + m i=1 len(s i ). The logical constants true and false are assigned length 1. The length of the other atoms is given by len P (s 1 , . . . , s m ) := 1 + m i=1 len(s i ), which includes the case where P is the equality predicate. For formulas ϕ, ψ we set len(¬ϕ) := 1 + len(ϕ), len(ϕ ∧ ψ) = len(ϕ ∨ ψ) := 1 + len(ϕ) + len(ψ), len(∀x. ψ) := 1 + |x| + len(ψ), and len(∃ȳ. ψ) := 1 + |ȳ| + len(ψ). Moreover, in the context of the length of formulas, we conceive implication and equivalence as abbreviations and set len(ϕ → ψ) := len(¬ϕ ∨ ψ) and len(ϕ ↔ ψ) := len (ϕ → ψ) ∧ (ψ → ϕ) . Notice that, in the presence of the connective ↔, len(ϕ) can be exponentially greater than the number of symbols needed to write ϕ down.

The quantifier rank quantifier rank of a formula is the depth of quantifier nestings in the formula. Every quantifier-free formula has quantifier rank zero. The quantifier rank of any formula Qv. ψ with Q ∈ {∀, ∃} is the quantifier rank of ψ plus one. For every formula ϕ • ψ with • ∈ {∧, ∨, →, ↔} the quantifier rank is the maximum of the quantifier ranks of ϕ and ψ. Every ¬ϕ has the same quantifier rank as ϕ has.

For every Σ-formula ϕ with Σ = Π, Ω we define ϕ to be the length of some fixed encoding of ϕ ϕ in a binary alphabet, e.g. suitable for the tape of some Turing machine. We assume the encoding to be reasonable, i.e. we assume that ϕ ∈ O len(ϕ) • log |Π| + |Ω| + |vars(ϕ)| if the underlying vocabulary Σ = Π, Ω is finite.

Semantics of First-Order Formulas

We mainly follow the Tarskian approach to semantics and interpret logic formulas with respect to given structures. Let Σ := Π, Ω be a vocabulary. A Σ-structure structure A consists of a nonempty set A, its domain (also: universe), and interpretations f A and P A of all function and predicate symbols in Σ. More precisely, A interprets any m-ary function symbol f ∈ Ω by a total mapping f A : A m → A that maps each and every m-tuple of elements from A to some element from A. Moreover, A interprets any m-ary predicate symbol P ∈ Π by a (possibly empty) set P A ⊆ A m of m-tuples over A's domain. Like for terms and formulas, we mostly omit the explicit reference to the underlying vocabulary Σ when speaking about structures.

Given any structure A, a variable assignment variable assignment (over A's domain) is a total mapping β : Var → A that assigns domain elements a ∈ A to variables v ∈ Var. When the domain A is clear from the context we often do not explicitly specify it, e.g. when a particular structure A is discussed, variable assignments are implicitly understood to assign elements from A, if not explicitly stated otherwise. We sometimes explicitly define a variable assignment by writing [v 1 →a 1 , . . . , v m →a m ] -or [v →ā] for short -when it is not important which elements are assigned to the variables in Var \ {v 1 , . . . , v m }. In such cases, we consider just some variable assignment β with β(v i ) = a i for i = 1, . . . , m. Given some variable assignment β, we define its update β[v 1 →a 1 , . . . , v m →a m ] β[v →ā] to be the variable assignment β with β (v i ) = a i for i = 1, . . . , m and β (v ) = β(v ) for every v ∈ Var \ {v 1 , . . . , v m }.

Given a Σ-term s, a Σ-structure A, and a variable assignment β over A's domain, we denote the evaluation of s under A and β A(β)(s) by A(β)(s). It is defined such that A(β)(v) := β(v) for variables v, A(β)(c) := c A for constant symbols c, and A(β) f (s 1 , . . . , s m ) := f A A(β)(s 1 ), . . . , A(β)(s m ) for complex terms. As for every ground term s the value of s under A is independent of any variable assignment, we occasionally drop the reference to any specific variable assignment and simply write A(s) when s is ground. Given a Σ-formula ϕ, a Σ-structure A, and a variable assignment β over A's domain, we say that ϕ is satisfied under A and β, written A, β |= ϕ A, β |= ϕ , if the following conditions are met: We always have A, β |= true but never A, β |= false. For more complicated formulas ϕ we define the following: We also use the symbol |= to denote semantic entailment of two formulas (over the same vocabulary). A formula ϕ semantically entails a formula ψ, written ϕ |= ψ, whenever for every structure A and every variable assignment β, A, β |= ϕ implies A, β |= ψ. The symbol |=| denotes semantic equivalence of formulas, i.e. ϕ |=| ψ ϕ |=| ψ holds whenever ϕ |= ψ and ψ |= ϕ. For convenience, we often drop the word "semantic" and just speak of entailment and equivalence.

A, β |= s ≈ t if
A logical Σ-theory is a set of Σ-sentences closed under semantic entailment, i.e. for every sentence ϕ with T |= ϕ we have ϕ ∈ T . Given a logical theory T , two formulas ϕ(x), ψ(x) are considered T -equivalent T -equivalence , if T |= ∀x. ϕ(x) ↔ ψ(x). For any Σ-structure A we write Th(A) to address the logical theory of all Σ-sentences that are satisfied by A. It is easy to check that Th(A) is closed under semantic entailment. For convenience, we sometimes use the term A-equivalence when we actually mean Th(A)-equivalence.

We shall often use the fact that quantifiers can be shifted in certain ways within formulas under preservation of the formula's semantics. The following proposition collects the basic equivalences that facilitate shifting of quantifiers.

Proposition 1.0.1 (Quantifier shifting). Let ϕ, ψ, χ be formulas, and assume that x and y do not occur freely in χ. We have the following equivalences, where • ∈ {∧, ∨}:

(i) ∃y. (ϕ ∨ ψ) |=| (∃y. ϕ) ∨ (∃y. ψ) (ii) ∀x. (ϕ ∧ ψ) |=| (∀x. ϕ) ∧ (∀x. ψ) (iii) ∃y. (ϕ • χ) |=| (∃y. ϕ) • χ (iv) ∀x. (ϕ • χ) |=| (∀x. ϕ) • χ (v) ∃y 1 ∃y 2 . ϕ |=| ∃y 2 ∃y 1 . ϕ (vi) ∀x 1 ∀x 2 . ϕ |=| ∀x 2 ∀x 1 . ϕ
Consequently, if x 1 ∈ vars(χ) and x 2 ∈ vars(ϕ) holds for two first-order formulas ϕ and χ, we get (∃x 1 . ϕ) ∧ (∃x 2 . χ) |=| ∃x 1 x 2 . (ϕ ∧ χ) and dually (∀x 1 . ϕ) ∨ (∀x 2 . χ) |=| ∀x 1 x 2 . (ϕ ∨ χ).

Consider any first-order sentence ϕ that contains an occurrence of a subformula ψ of the form ∃y. ψ and let Q 1 u 1 , . . . , Q n u n be the sequence of all quantifiers from ϕ in whose scope ψ lies. Let x be the tuple containing all the variables from the list v 1 , . . . , v n that are universally quantified in ϕ. The process of replacing the occurrence of ψ in ϕ with the formula ψ y/f y (x) for some fresh function symbol f y of appropriate arity is called (standard) Skolemization Skolemization2 of y (or of ∃y); the term f y (x) is called Skolem term and the function symbol f y Skolem function. In case of |x| = 0, we call f y Skolem constant. By exhaustive Skolemization of a given sentence ϕ we mean Skolemization of all the existential first-order quantifiers in ϕ one after the other (in any order).

Proposition 1.0.2. Let ϕ be some first-order Σ-sentence and let ϕ be the result of Skolemizing some of the existential quantifiers in ϕ. Then, we observe ϕ |= ϕ and any model A of ϕ can be turned into a model B of ϕ by extending A with appropriate interpretations of the introduced Skolem functions and Skolem constants. The rest of A remains unchanged, i.e. A and B coincide with respect to their domains and their interpretations of the symbols in Σ.

A structure A is a substructure substructure of a structure B (over the same vocabulary) if (1) A ⊆ B, (2) c A = c B for every constant symbol c, (3) P A = P B ∩ A m for every m-ary predicate symbol P , and (4) f A (ā) = f B (ā) for every m-ary function symbol f and every m-tuple ā ∈ A m . Given a structure A and some subset S of A's domain, the substructure of A induced by S is the unique substructure B of A with the domain B := S. The following is a standard lemma from model theory.

Lemma 1.0.3 (Substructure Lemma). Let ϕ be a first-order sentence without existential quantifiers and in which no universal quantifier lies within the scope of any negation sign -we treat any subformula ϕ 1 → ϕ 2 as abbreviation for ¬ϕ 1 ∨ ϕ 2 and any subformula ϕ 1 ↔ ϕ 2 as abbreviation for (¬ϕ 1 ∨ ϕ 2 ) ∧ (ϕ 1 ∨ ¬ϕ 2 ) to account for implicit negation signs as well. Moreover, let A be a substructure of B. If B |= ϕ, then A |= ϕ.

Proof (inspired by [START_REF] Ebbinghaus | Mathematical Logic[END_REF], proof of Lemma 5.7 in Chapter III). It is easy to prove by induction on a term s that ( * ) for every variable assignment β over A's domain we have A(β)(s) = B(β)(s). Now let ψ be any first-order formula. By induction on the structure of ψ, we show that for every variable assignment β over A's domain we have that B, β |= ψ entails A, β |= ψ. If ψ is atomic, the claim follows from ( * ). If ψ is of the form ¬χ, χ ∧ η, χ ∨ η, χ → η, or χ ↔ η, the claim follows easily from the inductive hypothesis. Suppose ψ is of the form ∀x. χ. Further assume that B, β[x →a] |= χ holds for every a ∈ B. Then, by induction, we have A, β[x →a] |= χ for every a ∈ A ⊆ B. In other words, we have A, β |= ∀x. χ.

This finishes the proof of the claim. The Substructure Lemma follows as a corollary.

A special kind of structures are Herbrand structures Herbrand structure

. 3 The domain of a Herbrand Σ-structure H -called Herbrand domain -is the set of all ground Σ-terms, where we assume that Σ contains at least one constant symbol. Moreover, every m-ary function symbol f ∈ Ω is interpreted by H such that for any sequence t 1 , . . . , t m ∈ H we have f H (t 1 , . . . , t m ) = f (t 1 , . . . , t m ). This means that H's domain and the interpretation of function symbols under H are entirely determined by the underlying vocabulary. Solely the interpretation of predicate symbols can (and must) be chosen. The following is a standard lemma which justifies that in certain contexts it suffices to exclusively consider Herbrand structures.

Lemma 1.0.4. Let ϕ be a sentence without equality and without existential quantifiers and in which no universal quantifier lies within the scope of any negation sign. If ϕ is satisfiable, then it has a model that is a Herbrand structure.

Proof. Let A be any model of ϕ and let Σ be the vocabulary underlying ϕ. Let A be the substructure of A that is induced by the domain A := a ∈ A | there is a ground Σ-term t such that a = A(t) .

By the Substructure Lemma, A is also a model of ϕ. We define the Herbrand structure H such that for every m-ary predicate symbol P ∈ Π and for all ground Σ-terms t 1 , . . . , t m we set t 1 , . . . , t m ∈ P H if and only if A (t 1 ), . . . , A (t m ) ∈ P A .

Let γ be any variable assignment over the Herbrand domain H and let β be the variable assignment defined such that β(v) := A(γ(v)) for every v. Then, we observe for every non-equational Σ-atom A that H, γ |= A if and only if A , β |= A. As ϕ contains only universal quantifiers that do not lie within the scope of any negation sign, this observation together with A |= ϕ entails H |= ϕ.

Given some Σ-sentence ϕ, a Herbrand Σ-model H |= ϕ is called minimal , if there is no Herbrand Σ-model H |= ϕ such that for every predicate symbol P in Σ we have P H ⊆ P H and one of these inclusions is strict. The following proposition is a standard result, see, e.g. Theorem 3.8 in Chapter XI of [START_REF] Ebbinghaus | Mathematical Logic[END_REF].

Proposition 1.0.5. Every satisfiable first-order Σ-sentence ϕ that is Horn has a unique minimal Herbrand model (sometimes also called the least Herbrand model). In other words, there is some Herbrand model H * |= ϕ such that for every Herbrand model H of ϕ we have P H * ⊆ P H for every predicate symbol P in Σ.

Syntax and Semantics of Second-Order Formulas

Occasionally, we shall also consider second-order formulas with equality. That is, we add secondorder quantification ∀P. ψ and ∃P. ψ to the inductive syntax definition of formulas, where ψ is a second-order formula and P is some predicate symbol that may occur in ψ but does not have to. Similarly, we add quantifiers ∀f. ψ and ∃f. ψ for any function symbol f . Like for first-order variables, we define free and bound occurrences of second-order variables for predicate and function symbols. Moreover, we also tacitly assume for second-order formulas that no variable occurs free and bound in the same formula and that distinct occurrences of quantifiers bind distinct variables, if not explicitly stated otherwise. For semantic satisfaction under a given structure A and a given variable assignment β we use the following rules in addition to the above first-order conditions:

A, β |= ∀P. ψ if and only if A , β |= ψ for every structure A that differs from A only in the interpretation of P , A, β |= ∃P. ψ if and only if A , β |= ψ for some structure A that differs from A only in the interpretation of P , A, β |= ∀f. ψ if and only if A , β |= ψ for every structure A that differs from A only in the interpretation of f , A, β |= ∃f. ψ if and only if A , β |= ψ for some structure A that differs from A only in the interpretation of f , where ψ is any second-order formula. The notions and notation for semantic entailment and semantic equivalence are extended to second-order formulas in the obvious way.

Additional Notation

We use the notation [k] [k] to abbreviate the set {1, . . . , k} for any positive integer k. The power set of a set S, i.e. the set of all subsets of S, is denoted by P(S). The iterated application of P P k S is given by P 0 (S) := S and P k+1 (S) := P k (P(S)) for k ≥ 0. For convenience, we mostly drop the parentheses and simply write P k S. Furthermore, we also define the tetration operation inductively by 2 ↑0 (m) 2 ↑k (m) := m and 2 ↑k+1 (m) := 2 (2 ↑k (m)) . Let S be any nonempty set. For any equivalence relation ∼ ⊆ S × S we write S/ ∼ S/ ∼ to address the set S ⊆ S S is a maximal nonempty set such that for all a, b ∈ S we have a ∼ b , which we shall call the quotient set (or simply quotient) induced by ∼ over S. The sets in S/ ∼ are the equivalence classes induced by ∼ over S. Given any element a ∈ S, we write [a] ∼ [a] ∼ to address the (unique) equivalence class containing a. Given any two equivalence relations ∼ 1 , ∼ 2 ⊆ S × S, we call ∼ 1 a refinement of ∼ 2 refinement if (a) for every set T ∈ S/ ∼1 there is some set T ∈ S/ ∼2 such that T ⊆ T , and (b) for every set T ∈ S/ ∼2 there is a finite collection of sets T 1 , . . . , T k ∈ S/ ∼1 such that T = T 1 ∪ . . . ∪ T k .

Chapter 2

Separateness of First-Order Variables

We now introduce a fairly simple concept that shall be the key theme in the entire Part I of the present thesis: separateness of first-order variables.

Definition 2.0.1 (Separateness of first-order variables). Let ϕ be any first-order formula and let X, Y be two disjoint sets of first-order variables. We say that X and Y are separated in ϕ if for every atom A occurring in ϕ we have vars(A) ∩ X = ∅ or vars(A) ∩ Y = ∅ or both. We say that X, Y are strictly separated in ϕ if X and Y are separated in ϕ and, in addition, for every subformula χ := (Qv. . . .) of ϕ we either have vars(χ) ∩ X = ∅ or vars(χ) ∩ Y = ∅.

Intuitively speaking, two sets X, Y of variables are separated in a formula, if there are no co-occurrences of variables x ∈ X and y ∈ Y in any atom. This simple syntactic notion is the key to a number of results that we shall develop in the subsequent chapters. Examples are novel decidable fragments of first-order logic (Chapter 3), computationally hard satisfiability problems in first-order logic (Chapter 5), and new insights regarding the dependences between universally and existentially quantified first-order variables belonging to separated sets, with an application to Skolemization (Chapters 4 and 7). In the rest of the present chapter we give a more detailed overview of separateness and its applications.

Typically, one would expect that sets of first-order variables in "naturally occurring" formulas are either not separated or are separated in trivial ways. For example, consider a formula that stipulates that R is a strict ordering without endpoint:

ϕ := ∀x 1 y 1 z 1 . R(x 1 , y 1 ) ∧ R(y 1 , z 1 ) → R(x 1 , z 1 )
∧ ∀x 2 y 2 . R(x 2 , y 2 ) → ¬R(y 2 , x 2 ) ∧ ∀x 3 ∃y 3 . R(x 3 , y 3 ) .

In any of the three conjuncts all occurring variables co-occur in some atom. On the other hand, the three sets {x 1 , y 1 , z 1 }, {x 2 , y 2 }, {x 3 , y 3 } are pairwise separated in ϕ. This trivial kind of separation is due to the fact that ϕ is simply a conjunction of three closed formulas.

Non-trivial cases of separateness appear, for instance, in formulas where universal and existential quantifiers are nested and the variables they bind are separated. Consider the sentence ψ := ∀x∃y. P (x) ↔ Q(y) in which the singleton sets {x} and {y} are obviously separated. It expresses a certain symmetry in structures A. For every domain element a there is some element b such that a belongs to P A if and only if b belongs to Q A . It turns out that the same property can be expressed without any nesting of alternating quantifiers. Indeed, we can use the distributivity laws of Boolean algebra and quantifier shifting (cf. Proposition 1.0.1) to transform ψ into the equivalent CHAPTER 2. SEPARATENESS OF FIRST-ORDER VARIABLES sentence (∃x. P (x)) → (∃y 1 . Q(y 1 )) ∧ (∃x. ¬P (x)) → (∃y 2 . ¬Q(y 2 )) :

∀x∃y. P (x) ↔ Q(y)
|=| ∀x∃y. ¬P (x) ∨ Q(y) ∧ P (x) ∨ ¬Q(y) |=| ∀x. ¬P (x) ∧ (∃y 2 . ¬Q(y 2 )) ∨ (∃y 1 . Q(y 1 )) ∧ P (x) |=| (∀x. ¬P (x)) ∨ (∃y 1 . Q(y 1 )) ∧ (∃y 2 . ¬Q(y 2 )) ∨ (∀x. P (x))

|=| (∃x. P (x)) → (∃y 1 . Q(y 1 )) ∧ (∃x. ¬P (x)) → (∃y 2 . ¬Q(y 2 ))

We could even shift quantifiers outwards again and finally obtain an equivalent sentence with a ∃∃∀ quantifier prefix: ψ := ∃y 1 y 2 ∀x. P (x) → Q(y 1 ) ∧ ¬P (x) → ¬Q(y 2 ) . This example shows that we can not only transform nested quantification of separated variables into quantification that is not nested. In addition, we can replace ∀∃ alternations in exchange for ∃∀ alternations, or vice versa.

In the example we start from a ∀∃ sentence and obtain an ∃∃∀ sentence. The increase in the number of used quantifiers is not a coincidence. Much rather, it illustrates a key difference between the two representations. The sentence ψ can, using a ∀∃ alternation, represent the symmetry property of structures more succinctly than the sentence ψ can with an ∃∀ quantifier alternation.

The following examples illustrates this phenomenon in a more pronounced way. We shall see later that such succinctness gaps can become k-fold exponential, if we start from k nested ∀∃ alternations and seek an equivalent sentence with a single ∃∀ quantifier alternation. The proof of this result (cf. Theorem 3.2.7) is based on a general variant of ψ.

Example 2.0.2. Consider the sentence ϕ 1 := ∀x∃y. (P 1 (x) ↔ Q 1 (y)) ∧ . . . ∧ (P n (x) ↔ Q n (y)). Given any sequence b := b 1 . . . b n of n bits, we denote by χb(x) and ηb(y) the formulas χb(x) := 1≤i≤n bi=1

P i (x) ∧ 1≤j≤n bj =0
¬P j (x) and ηb(y) :=

1≤i≤n bi=1 Q i (y) ∧ 1≤j≤n bj =0
¬Q j (y) .

Then, ϕ 1 can be transformed into the equivalent sentence ∀x.

b∈{0,1} n χb(x) ∧ ∃y. ηb(y) ,

where we have managed to shift the existential quantifier ∃y inwards. We can do the same for the universal quantifier ∀x, if we beforehand transform the sentence into a conjunction of disjunctions.

To keep the sentence short, we do not just blindly apply the Boolean laws of distributivity, but we also remove redundant formula parts -we have already tacitly done so in the above transformation. This results in the sentence b∈{0,1} n ∀x. ¬χb(x) ∨ ∃y. ηb(y) |=| b∈{0,1} n ∃x. χb(x) → ∃y. ηb(y) .

We can now shift quantifiers outwards again, existential ones first. Since existential quantification does not distribute over conjunction, we have to rename bound existential variables. We thus obtain the equivalent sentence ϕ 1 := ∃ y 0...0 . . . y 1...1 2 n variables ∀x b∈{0,1} n χb(x) → ηb(yb) .

The sentence ϕ 1 is much more verbose that the original ϕ 1 . The original ϕ 1 refers to the universal variable x and stipulates the existence of a counterpart y that behaves with respect to Q like x behaves with respect to P . In contrast, the sentence ϕ 1 lists 2 n elements, including detailed descriptions of their potential behavior with respect to Q, and stipulates the existence of each and every single one of them, provided a counterpart exhibiting the respective behavior with respect to P is contained in the domain. Indeed, no equivalent sentence in prenex form with the quantifier prefix ∃ * ∀ * could do significantly better (cf. Theorem 3.2.7). Now consider the case with additional quantifier alternations:

ϕ 2 := ∀u∃v∀x∃y. (P 1 (u, x) ↔ Q 1 (v, y)) ∧ . . . ∧ (P n (u, x) ↔ Q n (v, y)) .

We extend the notation χb(x) from above to χb(u, x) by replacing every P i (x) with P i (u, x) and every ¬P j (x) with ¬P j (v, y). In the same spirit the notation ηb(y) is extended to ηb(v, y). When we apply the transformations from above to the new formula in one step, we obtain ∀u∃v.

b∈{0,1} n ∀x. ¬χb(u, x) ∨ ∃y. ηb(v, y) .

We next transform the scope of ∃v into a disjunction of conjunctions and, while doing so, treat the subformulas ∀x. ¬χb(u, x) and ∃y. ηb(v, y) as indivisible units. Shifting the quantifier ∃v inwards then yields ∀u.

S⊆{0,1} n b∈{0,1 n }\S ∀x. ¬χb(u, x) ∧ ∃v.

b∈S ∃y. ηb(v, y) .

Next, we use the distributivity laws to transform the scope of ∀u into a conjunction of disjunctions, in order to be able to shift the quantifier inwards: where S 1 , . . . , S m is an enumeration of all subsets of {0, 1} n , i.e. m = 2 2 n ; each ȳSi is a tuple of |S i | variables y Si, b with b ∈ S i ; and x is a tuple of 2 n variables xb with b ∈ {0, 1} n . Again, the sentence ϕ 2 is much more verbose than the original ϕ 2 . This time the gap in succinctness grows even doubly exponential with growing n. And, once more, no equivalent ∃ * ∀ *sentence could, asymptotically speaking, do much better.

The examples we have seen so far illustrate a general property of nested quantification of variables that are separated. Namely, nesting of quantifiers is not essential but may facilitate a more succinct representation of properties. The formula transformations in Example 2.0.2 illustrate how such succinct representations can be unfolded. We can use the same approach to prove the following technical lemma.

Lemma 2.0.3. Let x, ȳ, x , ȳ , z be pairwise disjoint tuples of first-order variables and let ψ(x, x , ȳ, ȳ , z) be a formula in which x∪x and ȳ∪ȳ are strictly separated. We can transform ∀x∃ȳ. ψ(x, x , ȳ, ȳ , z) into an equivalent formula ψ (x , ȳ , z) that satisfies the following conditions. • either χ entirely stems from ψ(x, x , ȳ, ȳ , z) (modulo renaming of bound variables),

• or (Q v. . . .) stems from ψ(x, x , ȳ, ȳ , z) and the quantifier Qu stems from the prefix ∀x∃ȳ (modulo renaming of bound variables).

Proof. A basic formula basic formulas is any atom and any subformula (Qv. . . .) in ψ that does not lie within the scope of any quantifier in ψ.

We first transform ψ into an equivalent disjunction of conjunctions of negated or non-negated basic formulas. This is always possible. Since the sets x ∪ x and ȳ ∪ ȳ are strictly separated in ψ, none of the basic formulas contains variables from both sets. Hence, the constituents of every conjunction can be grouped into three parts: ψ i (x, x , z), containing none of the variables from ȳ ∪ ȳ ; χ i (ȳ, ȳ , z), containing none of the variables from x ∪ x ; η i (x , ȳ , z), containing neither variables from x nor from ȳ. Hence, ∀x∃ȳ. ψ(x, x , ȳ, ȳ , z) is equivalent to a formula of the form ∀x∃ȳ.

i ψ i (x, x , z) ∧ χ i (ȳ, ȳ , z) ∧ η i (x , ȳ , z) ,
where the ψ i , χ i , and η i are conjunctions of negated or non-negated basic formulas. We now shift the existential quantifier block ∃ȳ inwards so that it only binds the (sub-)conjunctions χ i (ȳ, ȳ , z). The emerging subformulas ∃ȳ. χ i (ȳ, ȳ , z) are treated as basic formulas in the further process (replacing the ones that now occur as their proper subformulas). Notice that the sets x ∪ x and ȳ ∪ ȳ are still strictly separated in the scope of the leading ∀x quantifier block.

Next, we transform the formula into a conjunction of disjunctions of negated and non-negated basic formulas, group the constituents of disjunctions into two groups ψ j (x, x , z) and χ j (x , ȳ , z), and shift the universal quantifier block ∀x inwards so that it only binds the (sub-)disjunctions ψ j (x, x , z). The resulting formula is the sought ψ in which the sets x ∪ x and ȳ ∪ ȳ are still strictly separated.

We shall apply variants of Lemma 2.0.3 and the general methods used in its proof in several places, mostly for resolving ∀∃ quantifier alternations. But the underlying idea is much more general. If certain separateness conditions are satisfied by a formula, succinct representations of properties can be unfolded into more verbose ones that require a lower quantifier rank or even use fewer quantifier alternations. To this end, notice that the prefix ∀x∃ȳ in Lemma 2.0.3 could be replaced with a ∃ * ∀ * prefix or any other prefix over the variables in x and ȳ. It is straightforward to adapt the proof to the new situation. We only need to reorder the steps of the quantifier shifting scheme and/or more iterations.

The following result can easily be proven using Lemma 2.0.3.

Lemma 2.0.4. Let ϕ(x 1 , . . . , xn , ȳ1 , . . . , ȳn , z) be a quantifier-free formula in which the sets x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn are separated. There exists a quantifier-free formula ϕ (ū, v, z) such that ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ϕ(x 1 , . . . , xn , ȳ1 , . . . , ȳn , z) and ∃ū∀v. ϕ (ū, v, z) are equivalent.

Proof. For quantifier-free formulas separateness and strict separateness coincide. Hence, we can apply Lemma 2.0.3 to the formula ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ϕ(x 1 , . . . , xn , ȳ1 , . . . , ȳn , z) in an iterated fashion to obtain some equivalent formula ψ in which the sets x and ȳ are strictly separated. As none of the alternations in the quantifier prefix ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n is present in ψ, for any of its subformulas Qu. . . . (Q v. . . .) . . . with Q, Q ∈ {∀, ∃} we observe Q = Q . In other words, ψ does not contain any quantifier alternations at all. Therefore, we can shift all quantifiers outwardsexistential quantifiers first, renaming bound variables as necessary -, and thus obtain an equivalent formula of the form ∃ū∀ȳ. ϕ (ū, v, z) with quantifier-free ϕ .

As already pointed out, unfolding formulas in the spirit of Lemma 2.0.3 inevitably incurs immense blowups in the worst case. We will derive upper and lower bounds on the increase in length in subsequent sections (cf. Lemma 3.2.5 and Theorems 3.2.7, 3.5.3, 3.9.9, 3.10.8, and 3.12.5). In particular, we will see that the transformation described in Lemma 2.0.4 leads to formulas that are asymptotically n-fold-exponentially longer than the original.

Another interesting point is that Lemma 2.0.4 holds for first-order formulas irrespective of whether they contain function symbols of arbitrary arity. However, the presence of second-order quantifiers would require additional separateness conditions, similar to the ones strict separateness poses towards quantified subformulas.

In spite of the generality of the result, we will mostly concentrate on relational first-order formulas in the rest of Part I.

Novel Decidable Fragments of Relational First-Order Logic

Separateness of variables will be the prime concept that we use in Chapter 3 to extend well-known fragments of first-order logic that are known to possess a decidable satisfiability problem. The first extended fragment in this family is the separated fragment1 , which consists of relational first-order sentences ∃z∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ϕ(x 1 , . . . , xn , ȳ1 , . . . , ȳn , z) in which the sets x1 ∪ . . . ∪ xn and ȳ1 ∪ . . . ∪ ȳn are separated. Lemma 2.0.4 in fact shows that every SF sentence is equivalent to some ∃ * ∀ * prenex sentence. The class of all relational ∃ * ∀ * -sentences with equality is called the Bernays-Schönfinkel-Ramsey fragment (BSR) and is well known to have a decidable satisfiability problem. A more detailed discussion can be found in Chapter 3. Before we fully embark on the endeavour of finding new decidable first-order fragments, we outline a few other applications of separateness.

Skolemization and Weak and Strong Dependences Between Quantified Variables

In general, nested first-order quantification leads to dependences between existentially and universally quantified variables. Consider the first-order sentence ϕ := ∀xz∃y. P (x) ↔ Q(x) ↔ R(y, z) . Standard Skolemization removes the quantifier ∃y from ϕ and replaces every occurrence of the variable y with the term f (x, z) for some fresh Skolem function f . The result is the equivalent second-order sentence ϕ Sk := ∃f. ∀xz. P (x) ↔ Q(x) ↔ R(f (x, z), z) . The Skolem term f (x, z) makes the dependence of y on the variables x and z explicit. Using the laws of Boolean algebra and quantifier shifting, the original ϕ can be transformed into the equivalent sentence ϕ := ∃x 1 . P (x 1 ) ∧ Q(x 1 ) → ∀z 1 ∃y 1 . R(y 1 , z 1 ) ∧ ∃x 2 . P (x 2 ) ∧ ¬Q(x 2 ) → ∀z 2 ∃y 2 . ¬R(y 2 , z 2 ) ∧ ∃x 3 . ¬P (x 3 ) ∧ Q(x 3 ) → ∀z 3 ∃y 3 . ¬R(y 3 , z 3 ) ∧ ∃x 4 . ¬P (x 4 ) ∧ ¬Q(x 4 ) → ∀z 4 ∃y 4 . R(y 4 , z 4 ) with a lower quantifier rank. Applying Standard Skolemization to the latter formula replaces every occurrence of y i with the Skolem term g i (z i ). This time, we have several Skolem functions g 1 , . . . , g 4 , each of which has arity one instead of arity two. We will investigate this phenomenon on a semantic level in Chapter 4 and Section 7.2. We shall distinguish two kinds of dependences that occur between existentially quantified variables and universally quantified variables. The dependence of y on x in the original formula ϕ is a weak dependence. A formal definition of weak dependences is given in Definition 4.0.1 on page 111. One characteristic of weak dependences is that they may vanish if ∀∃ quantifier alternations are unfolded in the spirit of Lemma 2.0.3. This is what happens when ϕ is transformed into ϕ . In contrast, the dependence of y on z is considered to be strong. Since the two variables co-occur in an atom, the quantifier alternation ∀z∃y cannot be removed by equivalence-preserving transformations. It turns out that an analysis of separateness in ϕ can predict a-priori that y only weakly depends on x and that four unary Skolem functions could be used instead of a single binary Skolem function. This leads to a non-standard Skolemization technique that is sensitive to the difference between weak and strong dependences. When we apply it to ϕ, we obtain the equivalent second-order sentence ϕ Sk := ∃g 1 . . . g 4 . ∀xz.

4 i=1 P (x) ↔ Q(x) ↔ R(g i (z), z) .
In Section 7.2 we shall elaborate on this form of dependence-sensitive Skolemization.

In the field of proof complexity it is known that using different forms of Skolemization can have dramatic effects on the length of shortest refutation proofs [START_REF] Baaz | On Skolemization and Proof Complexity[END_REF][START_REF] Egly | On the Value of Antiprenexing[END_REF]. Hence, the proposed form of Skolemization might be an interesting object of study in that context. Since Skolemization also plays an important role in first-order theorem proving, cf. [START_REF] Nonnengart | Computing Small Clause Normal Forms[END_REF][START_REF] Baaz | Normal Form Transformations[END_REF], analyzing weakness of dependences might lead to significant improvements in this field. Additional inspiration might be drawn from dependency analysis techniques that have been successfully applied in QBF solving (see Remark 7.2.1 on page 191 for references).

So far, we have concentrated on the syntactic side of separateness of variables. There is also a semantic side of this property which we shall study in Chapter 4. We have already mentioned a central idea above, the distinction between weak and strong dependences. Yet another way of applying dependence-sensitive Skolemization is given in the sentence ϕ Sk := ∃f g 1 . . . g 4 . ∀xz. P (x) ↔ Q(x) ↔ R(f (x, z), z) ∧ ∀xz.

4 i=1 f (x, z) ≈ g i (z) .
This sentence consists of two components. The first component is the result of Standard Skolemization ϕ Sk where the binary Skolem function f is introduced. The second component is a formula that restricts the range of f (x, z) under any model in such a way that for any fixed domain element b in the second argument position, the range of f (x, b) is limited to at most four different values, namely g 1 (b), g 2 (b), g 3 (b), g 4 (b). Again, this indicates the weakness of the dependence between y and x. The interpretation of Skolem functions under any model A of ϕ is strongly related to satisfying strategies (more suggestively: winning strategies) in the model-checking game associated with the pair ϕ, A . This link will become obvious in Chapter 4, where we shall elaborate on such strategies and what weakness of dependences means in the context of model-checking games. If we consider sentences in which all existentially quantified variables are separated from all universally quantified variables, all occurring dependences of existential variables on universal variables are weak. As a consequence, the range of any introduced Skolem functions can be restricted to a finite set. Similarly, there exist satisfying strategies that have a finite image. As the sentence ϕ contains at least one strong dependence, not every model of A admits such satisfying strategies with finite images. However, we shall see in Section 4.3 how to construct models accompanied by such a satisfying strategy in certain special cases.

Quantifier Elimination

Another area in which separateness of variables might be worth investigating is quantifier elimination quantifier elimination . For certain logical theories T over a vocabulary Σ, every first-order Σ-formula can be transformed into a T -equivalent quantifier-free Σ-formula. Two theories for which quantifier elimination-based decision procedures are well-known are Presburger arithmetic and linear arithmetic over the rational numbers (LRA). For the former a first decision procedure based on quantifier elimination has been devised by Presburger [START_REF] Presburger | Über die Vollständigkeit eines gewissen Systems der Arithmetik ganzer Zahlen, in welchem die Addition als einzige Operation hervortritt[END_REF], see also [START_REF] Herbert | A mathematical introduction to logic[END_REF], Section 3.2. A quantifier elimination-based decision procedure for the theory of linear rational arithmetic is the so-called Fourier-Motzkin elimination method . It has been (re-)discovered and published several times, e.g. by Fourier in 1826 [START_REF] Baptiste | Solution d'une Question Particulière du Calcul des Inégalités[END_REF], by Dines in 1919 [START_REF] Dines | Systems of Linear Inequalities[END_REF], and by Motzkin in 1936 [START_REF] Motzkin | Beiträge zur Theorie der Linearen Ungleichungen[END_REF]. For more modern accounts, see [START_REF] Dantzig | Fourier-Motzkin Elimination and Its Dual[END_REF][START_REF] Williams | Fourier's Method of Linear Programming and Its Dual[END_REF] and [START_REF] Schrijver | Theory of linear and integer programming[END_REF], Section 12.2. Historical remarks concerning the (re-)discovery of the method can be found in [START_REF] Williams | Fourier's Method of Linear Programming and Its Dual[END_REF], page 693. For real arithmetic over polynomials Tarski [START_REF] Tarski | A Decision Method for Elementary Algebra and Geometry[END_REF] devised a procedure for quantifier elimination. A more modern method based on virtual substitution is due to Loos and Weispfenning [START_REF] Loos | Applying Linear Quantifier Elimination[END_REF][START_REF] Volker | Quantifier Elimination for Real Algebra -the Quadratic Case and Beyond[END_REF], see below, who were inspired by methods due to Cooper [START_REF] Cooper | Theorem Proving in Arithmetic without Multiplication[END_REF] and Ferrante and Rackoff [START_REF] Ferrante | A Decision Procedure for the First Order Theory of Real Addition with Order[END_REF][START_REF] Ferrante | The computational complexity of logical theories[END_REF]. These methods work also in the LRA setting. 2 Comprehensive accounts and recent results regarding quantifier elimination using the virtual substitution method can be found in the survey articles [START_REF] Sturm | A Survey of Some Methods for Real Quantifier Elimination, Decision, and Satisfiability and Their Applications[END_REF][START_REF] Sturm | Thirty Years of Virtual Substitution: Foundations, Techniques, Applications[END_REF] and in the dissertations by Košta [Koš16] and Dolzmann [START_REF] Dolzmann | Algorithmic strategies for applicable real quantifier elimination[END_REF]. Given a quantifier-free formula ψ(x, y) over the language of LRA, one can extract a so-called elimination set E consisting of pairs γ, t of quantifier-free guards γ and testpoints t such that Q |= ∀x. ∃y. ψ(x, y) ←→ γ,t ∈E γ(x) ∧ ψ(x, y) y/ /t , (2.1)

where ψ(x, y) y/ /t denotes a quantifier-free formula which results from virtually substituting y with t and whose free variables belong to x. Consult Section 7.1 for further details, in particular the discussion preceding Proposition 7.1.3. The virtual substitution operation y/ /t maps atoms to quantifier-free formulas and behaves like ordinary substitution on compound formulas. It is worth noting that the extraction of elimination sets for y in ψ is solely based on the atoms in ψ that contain y and their respective polarity. Let us for the moment regard formulas of the form ϕ 1 → ϕ 2 as abbreviation for ¬ϕ 1 ∨ ϕ 2 and ϕ 1 ↔ ϕ 2 as abbreviation for (¬ϕ 1 ∨ ϕ 2 ) ∧ (ϕ 1 ∨ ¬ϕ 2 ).

Then, an occurrence of an atom has positive polarity, if it lies within the scopes of an even number of negation signs. If the number is odd, the occurrence has negative polarity. Also notice that eliminating a universal quantifier ∀x in a formula ∀x. χ amounts to eliminating ∃x in ¬∃x. ¬χ. Typically, elimination of quantifiers proceeds quantifier by quantifier from innermost to outermost. The reason is simply that often a principle like (2.1) is used to define the elimination procedure in an iterative fashion, where a single quantifier in front of a quantifier-free matrix is eliminated. Of course, it might be beneficial to shift quantifiers beforehand.

Example 2.0.5. Suppose we intend to eliminate the quantifier ∃u in the formula ϕ := ∃u∃y∀x∃z. y < u ∧ u + 2z = 0 ∧ (z > 0 ∧ x + y = 0 → x > 0) , using the above principle directly means that we have to eliminate ∃z, ∀x, and ∃y first. When we inspect the co-occurrences of variables in the occurring atoms, we find that the sets {u, z} and {x} are separated. Hence, after swapping ∃u and ∃y, we deal with a sentence of the form ∃y∃u∀x∃z. χ(y, u, x, z) with the mentioned separateness pattern. We transform ϕ into the equivalent formula ϕ := ∃y. ∃u. y < u ∧ ∃z. u + 2z = 0 ∧ z ≤ 0 ∨ ∃u. y < u ∧ ∃z. u + 2z = 0 ∧ (∀x. x + y = 0 ∨ x > 0) .

After swapping quantifiers ∃u and ∃z in the two subformulas (∃u. . . .), we have to deal with the subformulas ϕ 1 := ∃u. y < u ∧ u + 2z = 0 ∧ z ≤ 0 and ϕ 2 := ∃u. y < u ∧ u + 2z = 0 when we intend to eliminate two occurrences of the quantifier ∃u. For ∃u in ϕ 1 , we obtain the elimination set E 1 := true, -∞ , true, y + ε , true, -2z . Coincidentally, we get the same elimination set for ∃u in ϕ 2 . Regarding the atoms occurring in ϕ 1 , the virtual substitution operator u/ /t is defined such that (y < u) u/ / -∞ = false , (u + 2z = 0) u/ / -∞ = false , (y < u) u/ /y + ε = true , (u + 2z = 0) u/ /y + ε = false , (y < u) u/ / -2z = y < -2z , (u + 2z = 0) u/ / -2z = -2z + 2z = 0 .

Hence, applying the equivalence principle (2.1) yields that ϕ 1 is Q-equivalent to

γ,t ∈E1 y < u ∧ u + 2z = 0 ∧ z ≤ 0) u/ /t = false ∧ false ∧ z ≤ 0 ∨ true ∧ false ∧ z ≤ 0 ∨ y < -2z ∧ -2z + 2z = 0 ∧ z ≤ 0 |=| y < -2z ∧ z ≤ 0 .
We set ϕ 1 := y < -2z ∧ z ≤ 0. Analogously, elimination of ∃u in ϕ 2 yields the formula ϕ 2 := y < -2z. Put together, we observe that ϕ is Q-equivalent to ∃y∃z∀x. y < -2z ∧ z ≤ 0 ∨ y < -2z ∧ (x + y = 0 ∨ x > 0)

|=| ∃y∃z∀x. y < -2z ∧ z ≤ 0 ∨ x + y = 0 ∨ x > 0 |=| ∃y∃z∀x. y < -2z ∧ z > 0 ∧ x + y = 0 → x > 0 .

Let us call the sentence in the last line ϕ . When we compare this result to the original ϕ and take into account that the extraction of an elimination set E for u in ϕ is solely based on the atoms in ϕ that contain u and their respective polarity, we find that ϕ can be considered the result of directly eliminating ∃u from ϕ, after swapping ∃u and ∃y, by means of the elimination set E := true, -∞ , true, y + ε , true, -2z :

∃y. γ,t ∈E ∀x∃z. y < u ∧ u + 2z = 0 ∧ (z > 0 ∧ x + y = 0 → x > 0) u/ /t = ∃y. ∀x∃z. false ∧ false ∧ (z > 0 ∧ x + y = 0 → x > 0) ∨ ∀x∃z. true ∧ false ∧ (z > 0 ∧ x + y = 0 → x > 0) ∨ ∀x∃z. y < -2z ∧ -2z + 2z = 0 ∧ (z > 0 ∧ x + y = 0 → x > 0) |=| ∃y∀x∃z. y < -2z ∧ (z > 0 ∧ x + y = 0 → x > 0) = ϕ .
This example illustrates that separateness of variables can facilitate quantifier elimination techniques that break with the from-innermost-to-outermost paradigm. The following proposition is a first step in this direction. 3 It can be proved using a dual, slightly refined variant of Lemma 2.0.3. Proposition 2.0.6. Consider a quantifier-free formula ϕ(x, ȳ, z) over the language of linear rational arithmetic, where x and ȳ are separated in ϕ. Let E be an elimination set for y 1 in ϕ.

Then

Q |= ∃y 1 . . . ∃y p ∀x. ϕ ←→ γ,t ∈E ∃y 2 . . . ∃y n ∀x. γ ∧ ϕ y 1 / /t .

Quantifier elimination techniques are not limited to first-order quantifiers. It is a classical result that any second-order quantifier in relational monadic sentences -sentences containing only unary predicate symbols and equality -can be eliminated. This was discovered by Löwenheim [START_REF] Löwenheim | Über Möglichkeiten im Relativkalkül[END_REF], Skolem [START_REF] Skolem | Untersuchungen über die Axiome des Klassenkalküls und über Produktations-und Summationsprobleme welche gewisse Klassen von Aussagen betreffen[END_REF], and Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF]. In relational monadic sentences without equality every atom contains at most one first-order variable. Hence, in sentences of the latter kind any first-order variable is trivially separated from all other first-order variables. This high degree of separateness is one of the properties that enable the elimination of second-order quantifiers in Behmann's approach, for instance. We have already mentioned the separated fragment above. It is easy to see that this class of sentences contains every relational monadic first-order sentence. In other words, we are dealing with a syntactic generalization of the class of relational monadic first-order sentences without equality. It is a natural question to ask to what extent a second-order variant of the separated fragment admits elimination of second-order quantifiers. An example given by Ackermann in 1935 [START_REF] Ackermann | Untersuchungen über das Eliminationsproblem der mathematischen Logik[END_REF] already shows severe limitations. Nevertheless, we shall identify a previously unknown class of non-monadic sentences in Section 7.3, from which certain second-order quantifiers can be eliminated.

Chapter 3

Novel First-Order Fragments with a Decidable Satisfiability Problem

In the early twentieth century David Hilbert initiated his famous program striving for a formalization of the foundations of mathematics.1 At its core lay the classical decision problem the classical decision problem of first-order logic: Find an algorithm that determines the validity of any given first-order sentence. Following early pioneering work by Löwenheim [START_REF] Löwenheim | Über Möglichkeiten im Relativkalkül[END_REF], Skolem [START_REF] Skolem | Untersuchungen über die Axiome des Klassenkalküls und über Produktations-und Summationsprobleme welche gewisse Klassen von Aussagen betreffen[END_REF], and Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF], the late 1920's and the early 1930's saw first successes in the form of partial solutions by Bernays and Schönfinkel [START_REF] Bernays | Zum Entscheidungsproblem der mathematischen Logik[END_REF], Ackermann [START_REF] Ackermann | Über die Erfüllbarkeit gewisser Zählausdrücke[END_REF], Herbrand [START_REF] Herbrand | Recherches sur la théorie de la démonstration[END_REF], Ramsey [START_REF] Plumpton | On a Problem of Formal Logic[END_REF], Gödel [START_REF] Gödel | Ein Spezialfall des Entscheidungsproblems der theoretischen Logik[END_REF], Kalmár [START_REF] Kalmár | Über die Erfüllbarkeit derjenigen Zählausdrücke, welche in der Normalform zwei benachbarte Allzeichen enthalten[END_REF], and Schütte [START_REF] Schütte | Über die Erfüllbarkeit einer Klasse von logischen Formeln[END_REF]. All of them have identified classes of first-order sentences for which a decision procedure can be formulated. A turning point was reached when Church [START_REF] Church | An Unsolvable Problem of Elementary Number Theory[END_REF] and Turing [START_REF] Mathison | On Computable Numbers, with an Application to the Entscheidungsproblem[END_REF] discovered that the validity problem and, equivalently, the satisfiability problem of first-order logic cannot be solved algorithmically in full generality. It became clear that partial solutions are the best we can hope for. From that point on, the classical decision problem has been understood as the problem of classifying first-order logic into fragments with a decidable or undecidable satisfiability problem. This quest has produced a wealth of positive and also negative results, see [Ack54, Sur59, DG79, Lew79, FLTZ93, BGG97, Hus99, FLHT01] for references. The classification in terms of prefix classes has been solved completely and is comprehensively presented in [START_REF] Börger | The Classical Decision Problem[END_REF].

In what follows, we review certain classes of first-order sentences that are known to have a decidable satisfiability problem. For convenience, we shall be less precise every now and then and speak of decidable fragments decidable fragments of first-order logic or decidable classes in such cases. The following list is intended to give an overview over the fragments that are relevant for the present thesis in one way or another. It is -necessarily -incomplete with respect to all the decidable cases of the classical decision problem that have been studied in the literature over the years. The majority of the listed fragments enjoys the finite model property, i.e. every satisfiable sentence in such a fragment has a finite model. This is a sufficient condition for decidability of the associated satisfiability problem. If we can derive a computable upper bound regarding the size of smallest models, we speak of a small model property.

The monadic first-order fragment (MFO) comprises all relational first-order sentences without equality that contain only unary predicate symbols. When we refer to the monadic first-order fragment with equality, we use the abbreviation MFO ≈ .

In the landmark paper by Löwenheim [START_REF] Löwenheim | Über Möglichkeiten im Relativkalkül[END_REF] not only the well-known Löwenheim-Skolem theorem was formulated and proved, but also the satisfiability problem for MFO ≈ was shown to be decidable. Hence, MFO ≈ is often referred to as the Löwenheim fragment. Skolem [START_REF] Skolem | Untersuchungen über die Axiome des Klassenkalküls und über Produktations-und Summationsprobleme welche gewisse Klassen von Aussagen betreffen[END_REF] and Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF] proved decidability for the monadic second-order fragment with equality. Several decades later, Löb [START_REF] Löb | Decidability of the monadic predicate calculus with unary function symbols[END_REF] and Gurevich [START_REF] Gurevich | The Decision Problem for the Logic of Predicates and Operations[END_REF] extended the positive result for MFO to CHAPTER 3. NOVEL DECIDABLE FIRST-ORDER FRAGMENTS monadic first-order sentences with unary function symbols but without equality, the Löb-Gurevich fragment. Moreover, as pointed out by Gurevich [START_REF] Gurevich | The Decision Problem for Standard Classes[END_REF], the famous decidability result for the monadic theory of infinite binary trees S2S by Rabin [START_REF] Michael | Decidability of Second-Order Theories and Automata on Infinite Trees[END_REF] implies that the satisfiability problem for the class of monadic first-order sentences with equality and a single unary function symbol -the Rabin fragment -is decidable. This class is known for containing infinity axioms, i.e. satisfiable sentences without a finite model. There are also decision procedures for MFO based on resolution [Joy76, FLTZ93, Lei99, FLHT01] and for MFO ≈ based on superposition [START_REF] Bachmair | Superposition with Simplification as a Desision Procedure for the Monadic Class with Equality[END_REF]. Results concerning the computational complexity of monadic first-order fragments have been obtained by Meyer [Mey74], Rackoff [START_REF] Rackoff | The complexity of theories of the monadic predicate calculus[END_REF], Lewis [START_REF] Harry | Complexity of Solvable Cases of the Decision Problem for the Predicate Calculus[END_REF][START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF], Fürer [START_REF] Fürer | Alternation and the Ackermann Case of the Decision Problem[END_REF], Denenberg and Lewis [START_REF] Denenberg | The Complexity of the Satisfiability Problem for Krom Formulas[END_REF], Compton and Henson [START_REF] Compton | A Uniform Method for Proving Lower Bounds on the Computational Complexity of Logical Theories[END_REF], and Grädel [START_REF] Börger | The Classical Decision Problem[END_REF]. Satisfiability for MFO and MFO ≈ is NExpTime-complete.

The Bernays-Schönfinkel-Ramsey fragment (BSR) comprises all relational first-order sentences in prenex normal form with an ∃ * ∀ * quantifier prefix and with equality.

Bernays and Schönfinkel [START_REF] Bernays | Zum Entscheidungsproblem der mathematischen Logik[END_REF] showed that satisfiability for the relational ∃ * ∀ * prefix class without equality is decidable. Today, this class is known as the Bernays-Schönfinkel fragment (BS). Following up, Ramsey [START_REF] Plumpton | On a Problem of Formal Logic[END_REF] added equality to this fragment and also obtained a positive decidability result. This extended class is called Bernays-Schönfinkel-Ramsey fragment (BSR) and it is known to posses the finite model property, see [START_REF] Börger | The Classical Decision Problem[END_REF]. It is interesting to note that Ramsey's article is not so much famous for its contribution to the classical decision problem, but rather for laying the foundation for Ramsey theory. Computational complexity results regarding the satisfiability problem for BSR have been obtained by Lewis [START_REF] Harry | Complexity of Solvable Cases of the Decision Problem for the Predicate Calculus[END_REF][START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF], Plaisted [START_REF] Plaisted | Complete Problems in the First-Order Predicate Calculus[END_REF], and Denenberg and Lewis [START_REF] Denenberg | The Complexity of the Satisfiability Problem for Krom Formulas[END_REF]. The problem is complete for NExpTime. Resolution-based decision procedures are described in [START_REF] Leitsch | Deciding Clause Classes by Semantic Clash Resolution[END_REF][START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF]. More recent decision procedures aimed at practical applications include [START_REF] Antonio | Proof Systems for Effectively Propositional Logic[END_REF][START_REF] Piskac | Deciding Effectively Propositional Logic Using DPLL and Substitution Sets[END_REF][START_REF] Alagi | NRCL -A Model Building Approach to the Bernays-Schönfinkel Fragment[END_REF]. The fragments BS and BSR have been extended (directly or indirectly) with function symbols in various ways, e.g. by Abadi, Rabinovich, and Sagiv [ARS07, ARS10], Nelson, Dougherty, Fisler, and Krishnamurthi [NDFK12], Korovin [START_REF] Korovin | Non-cyclic Sorts for First-Order Satisfiability[END_REF], and Ge and de Moura [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF]. All of these extensions are carefully formulated so that the finite model property is retained.

The Ackermann fragment (AF) comprises all relational first-order sentences in prenex normal form with an ∃ * ∀∃ * quantifier prefix and without equality.

The satisfiability problem of ∃ * ∀∃ * -sentences without equality was shown to be decidable by Ackermann [START_REF] Ackermann | Über die Erfüllbarkeit gewisser Zählausdrücke[END_REF]. In his original proof Ackermann derived the finite model property for AF. The proof published later in [START_REF] Ackermann | Solvable Cases of the Decision Problem[END_REF] proceeds via a reduction to the satisfiability problem for MFO. In [START_REF] Dreben | The Decision Problem: Solvable Classes of Quantificational Formulas[END_REF] the finite model property of AF with equality is derived. Resolution-based decision procedures have been devised for AF as well [START_REF] William | Resolution Strategies as Decision Procedures[END_REF][START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Leitsch | Resolution and the Decision Problem[END_REF]. Moreover, a paramodulationbased decision procedure for AF with equality is also known [START_REF] Fermüller | Ordered Paramodulation and Resolution as Decision Procedure[END_REF]. Gurevich [START_REF] Gurevich | Formulas with one ∀. In Selected Questions in Algebra and Logic; in memory of A. Malcev[END_REF] and Maslov and Orevkov [START_REF] Yu | Decidable classes reducing to a one-quantifier class[END_REF] studied Ackermann sentences with arbitrary function symbols (but without equality). Accordingly, this fragment is called the Gurevich-Maslov-Orevkov fragment. While Gurevich proved the finite model property for this fragment, Orevkov and Maslov took a prooftheoretic route based on the inverse method. Another extension of AF is the Shelah fragment: ∃ * ∀∃ * -sentences with equality and a single unary function symbol [START_REF] Shelah | Decidability of a portion of the predicate calculus[END_REF]. This class contains infinity axioms and, hence, does not possess the finite model property. A more detailed version of Shelah's proof can be found in Section 7.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. Results regarding the computational complexity of the satisfiability problem for the Ackermann fragment and its extensions are due to Lewis [START_REF] Harry | Complexity of Solvable Cases of the Decision Problem for the Predicate Calculus[END_REF][START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF], Fürer [START_REF] Fürer | Alternation and the Ackermann Case of the Decision Problem[END_REF], Grädel [START_REF] Grädel | Satisfiability of Formulae with One ∀ is Decidable in Exponential Time[END_REF], and Kolaitis and Vardi [START_REF] Phokion | 0-1 Laws and Decision Problems for Fragments of Second-Order Logic[END_REF]. The satisfiability problem for AF is ExpTime-complete.

The Gödel-Kalmár-Schütte fragment (GKS) comprises all relational first-order sentences in prenex normal form with an ∃ * ∀∀∃ * quantifier prefix and without equality.

Gödel [START_REF] Gödel | Ein Spezialfall des Entscheidungsproblems der theoretischen Logik[END_REF][START_REF] Gödel | Zum Entscheidungsproblem des logischen Funktionenkalküls[END_REF], Kalmár [START_REF] Kalmár | Über die Erfüllbarkeit derjenigen Zählausdrücke, welche in der Normalform zwei benachbarte Allzeichen enthalten[END_REF], and Schütte [START_REF] Schütte | Über die Erfüllbarkeit einer Klasse von logischen Formeln[END_REF][START_REF] Schütte | Untersuchungen zum Entscheidungsproblem der mathematischen Logik[END_REF] independently showed that the satisfiability problem for GKS is decidable. Gödel and Kalmár established the finite model property. A probabilistic proof was later given by Gurevich and Shelah [START_REF] Gurevich | Random Models and the Gödel Case of the Decision Problem[END_REF], see also Section 6.2.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. Although Gödel claimed that his proof methods could also be applied for GKS sentences with equality, Goldfarb refuted this claim [START_REF] Goldfarb | The Unsolvability of the Godel Class with Identity[END_REF]. However, decidable subclasses are known, e.g. the syntactic subfragments described in [START_REF] Goldfarb | A Decidable Subclass of the Minimal Gödel Class with Identity[END_REF] and in [START_REF] Wirsing | Das Entscheidungsproblem der Prädikatenlogik 1. Stufe mit Identität und Funktionszeichen in Herbrandformeln[END_REF], Section 12. A decidable subclass described in semantic terms is mentioned in Section 6.2.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. Computational complexity results have been obtained by Lewis [START_REF] Harry | Complexity of Solvable Cases of the Decision Problem for the Predicate Calculus[END_REF][START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF], and Fürer [START_REF] Fürer | Alternation and the Ackermann Case of the Decision Problem[END_REF][START_REF] Fürer | The computational complexity of the unconstrained limited domino problem (with implications for logical decision problems)[END_REF]. Satisfiability for GKS is NExpTime-complete.

The Skolem fragment comprises the class of relational ∃ * ∀ * ∃ * prenex sentences without equality that satisfy the following properties. Let ∃z 1 . . . z k ∀x 1 . . . x m ∃y 1 . . . y n . ψ be such a sentence with quantifier-free ψ. Every atom A in ψ is required to contain either (a) at least one of the y j , or (b) at most one of the x i , or (c) all x 1 , . . . , x m . It is easy to see that GKS is a proper subfragment. Decidability of a slightly more restricted variant of the Skolem fragment was shown in [START_REF] Skolem | Ein Satz über Zählausdrücke[END_REF]. A resolution-based decision procedure of (an extended variant of) the Skolem fragment is given in [START_REF] William | Resolution Strategies as Decision Procedures[END_REF][START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF].

The two-variable fragment (FO2 ) comprises all relational first-order sentences with equality that are build up using at most two variables, which may be reused in distinct occurrences of quantifiers.

Scott gave a reduction of the satisfiability problem associated with FO 2 to the satisfiability problem for GKS [START_REF] Scott | A decision method for validity of sentences in two variables[END_REF]. This reduction works only for sentences without equality. In 1975 Moritmer [START_REF] Mortimer | On Languages with Two Variables[END_REF] proved that FO 2 with equality possesses the finite model property. The computational complexity of the satisfiability problem for FO 2 has been determined by Grädel, Kolaitis, and Vardi [START_REF] Grädel | On the decision problem for two-variable first-order logic[END_REF]: it is NExpTime-complete. A resolution-based decision procedure for FO 2 can be found in [START_REF] Hustadt | Maslov's Class K Revisited[END_REF]; a tableau-based method is described in [START_REF] Schmidt | A General Tableau Method for Deciding Description Logics, Modal Logics and Related First-Order Fragments[END_REF]. A superposition-based decision procedures for FO 2 with equality is devised in [START_REF] De | A Resolution-Based Decision Procedure for the Two-Variable Fragment with Equality[END_REF]. A very recent survey of FO 2 and various extensions is [START_REF] Kieroński | Two-variable logics with counting and semantic constraints[END_REF].

Maslov's fragment K comprises all relational first-order sentences without equality that satisfy the following properties (we use the definition from [START_REF] Hustadt | Maslov's Class K Revisited[END_REF]). Let ϕ be any relational sentence in negation normal form and let ψ(u 1 , . . . , u m ) be any subformula of ϕ. We assume that u 1 , . . . , u m are exactly the variables occurring freely in ψ and that they are pairwise distinct. The ϕ-prefix of ψ is the sequence Q 1 v 1 . . . Q m v m of quantifiers in ϕ (read from left to right) that bind the free variables of ψ, in particular, we have {v

1 , . . . , v m } = {u 1 , . . . , u m }. The terminal ϕ-prefix of ψ is the longest contiguous suffix of Q 1 v 1 . . . Q m v m starting with a universal quantifier. Put differently, if Q 1 v 1 . . . Q m v m is of the form ∃v 1 . . . v k ∀v k+1 Q k+2 v k+2 . . . Q m v m , then the terminal ϕ-prefix of ψ is ∀v k+1 Q k+2 v k+2 . . . Q m v m .
Notice that the terminal prefix may be empty. The sentence ϕ belongs to Maslov's fragment K if there are k ≥ 0 universal quantifiers ∀x 1 , . . . , ∀x k in ϕ that are not interspersed with existential quantifiers such that for every atom A in ϕ the terminal ϕ-prefix of A either (a) is at most of length one, or (b) ends with an existential quantifier, or (c) is of the form ∀x 1 . . . ∀x k .

Maslov introduced K in [Mas68] and devised a decision procedure based on Maslov's inverse method 2 [START_REF] Yu | An Inverse Method of Establishing Deducibilities in the Classical Predicate Calculus[END_REF]. Zamov gave a modern account of Maslov's fragment K and Maslov's decision procedure in a self-contained article [START_REF] Zamov | On a Connection Between the Resolution Method and the Inverse Method[END_REF]. Resolution-based decision procedures are presented in [START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Hustadt | Maslov's Class K Revisited[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF], see also Chapter 3 in [START_REF] Hustadt | Resolution-Based Decision Procedures for Subclasses of First-Order Logic[END_REF]. To the best knowledge of the author of the present thesis, the computational complexity of the satisfiability problem for Maslov's fragment K is yet unknown. Since K syntactically extends MFO, AF, GKS, and the Skolem fragment (all without equality), the problem must be at least NExpTime-hard.

Maslov's fragment K must not be confused with the Maslov fragment, the class of relational Krom sentences without equality in prenex normal form with the quantifier prefix ∃ * ∀ * ∃ * . The Maslov fragment is also known to have a decidable satisfiability problem, see Section 8.3.3 in [START_REF] Börger | The Classical Decision Problem[END_REF] for more details and references. In particular, Aanderaa and Goldfarb derived the finite model property for this class [START_REF] Aanderaa | The Finite Controllability of the Maslov Case[END_REF].

The fluted fragment (FL) comprises all relational first-order sentences without equality that satisfy the following properties. Let x 1 , x 2 , x 3 , . . . be a fixed ordered sequence of pairwise distinct variables. For every nonnegative integer k we define the set FL (k) inductively as follows. Any atom P (x , . . . , x k ) belongs to FL (k) -notice that x , . . . , x k is asserted to be a gap-free subsequence of x 1 , x 2 , x 3 , . . .. The set FL (k) is closed under Boolean combinations, i.e. if ϕ and ψ belong to FL (k) , then so do ¬ϕ, ϕ ∧ ψ, ϕ ∨ ψ, ϕ → ψ, ϕ ↔ ψ. Given any FL (k+1) formula ϕ(x 1 , . . . , x k+1 ), then ∀x k+1 . ϕ and ∃x k+1 . ϕ belong to FL (k) . The fluted fragment (FL) is the set FL (0) , which contains exclusively sentences. Notice that every sentence ϕ from FL (k) can be turned into an equivalent FL (0) sentence ∀x 1 . . . x k . ϕ.

The fluted fragment was introduced by Quine in two steps [START_REF] Van Orman Quine | On the Limits of Decision[END_REF][START_REF] Van Orman Quine | The Variable[END_REF]. In an attempt to extrapolate an extension of MFO from Herbrand's treatment of the fragment in [START_REF] Herbrand | Recherches sur la théorie de la démonstration[END_REF], Quine [START_REF] Van Orman Quine | On the Limits of Decision[END_REF] considered so-called homogeneous k-adic sentences, i.e. FL sentences in which all predicate symbols have arity k. Decidability of the associated satisfiability problem was shown via an extension of Herbrand's proof for MFO [START_REF] Herbrand | Recherches sur la théorie de la démonstration[END_REF]. Later on, namely at the very end of [START_REF] Van Orman Quine | The Variable[END_REF], Quine claimed that the same proof would work for full FL. However, in 1980 Noah pointed out [Noa80] that Quine's decision procedure is only applicable to the subfragment of homogeneous FL sentences. Hence, decidability of the full fragment was considered open again. In a series of articles [Pur96b, Pur96a, Pur99, Pur02] Purdy investigated the fluted fragment and argued that it possesses the finite model property (also in the presence of equality). However, several flaws have been detected in Purdy's work [START_REF] Pratt-Hartmann | Quine's Fluted Fragment is Non-Elementary[END_REF]. For instance, the satisfiability problem associated with FL was believed to be in NExpTime [START_REF] William | Complexity and Nicety of Fluted Logic[END_REF], until it was proved to be non-elementary in 2016 [START_REF] Pratt-Hartmann | Quine's Fluted Fragment is Non-Elementary[END_REF]. A decision procedure for FL based on resolution was devised in [START_REF] Schmidt | A Resolution Decision Procedure for Fluted Logic[END_REF].

Herzig [START_REF] Herzig | A new decidable fragment of first order logic[END_REF] considered a class of relational first-order sentences that is very similar to the fluted fragment. Herzig's ordered fragment consists of all relational first-order sentences without equality in which every atom P (v 1 , . . . , v m ) satisfies the following property. For every i, 1 ≤ i ≤ m, the (unique) quantifier Qv i binding v i lies within the scope of any quantifier Q u if and only if Q u binds one of the v j with j < i, i.e. u ∈ {v 1 , . . . , v i-1 }. Notice that the definition implies that the v 1 , . . . , v m are pairwise distinct. While atoms in fluted formulas ϕ ∈ FL (k) need to contain a contiguous suffix of the variable sequence x 1 , . . . , x k , any atom A in Herzig's ordered formulas must contain a contiguous prefix of the variables bound by the quantifier sequence governing A. Using the techniques from the proof of Lemma 2.0.3 in an iterated fashion, every sentence from Herzig's ordered fragment can be transformed into an equivalent fluted sentence. This observation is also a corollary of the result we shall develop in Section 3.13 (cf. Lemma 3.13.4 and Proposition 3.13.3).

The guarded fragment (GF) comprises all relational first-order sentences with equality that satisfy the following properties. An atomic guard γ(ū, v) is an atom A such that all u ∈ ū ∪ v occur in A. We define the guarded fragment (GF) inductively: (i) every relational atom is a GF formula (equality is allowed); (ii) every Boolean combination of GF formulas is a GF formula; (iii) for all tuples ū, v, every atomic guard γ(ū, v), and every GF formula ψ(ū, v) the following formulas belong to GF:

∀ū. γ(ū, v) → ψ(ū, v) -abbreviated by ∀ū. γ(ū, v) ψ(ū, v) -and ∃ū. γ(ū, v) ∧ ψ(ū, v) -abbreviated by ∃ū. γ(ū, v) ψ(ū, v)
. Notice that we assume in any GF formula Qū. γ(ū, v) ψ(ū, v) that all variables that occur freely in ψ also occur in γ.

The guarded fragment was introduced by Andréka, Németi, and van Benthem [START_REF] Andréka | Modal Languages and Bounded Fragments of Predicate Logic[END_REF] as one characterization of the fragment of first-order logic in which propositional modal logic can be embedded via the so-called standard translation (cf. Section 2.4 in [START_REF] Blackburn | Modal Logic[END_REF]). Van Benthem [vB97] also proposed a more liberal form of guards, loose guards. A loose guard γ(ū, v) is a nonempty conjunction of atoms γ(ū, v) := A 1 (ū, v) ∧ . . . ∧ A k (ū, v) such that all u, v with u ∈ ū and v ∈ ū ∪ v co-occur in at least one A j . The loosely guarded fragment (LGF) is then defined by liberalizing (iii) such that loose guards are used instead of atomic guards. In particular, we assume in any LGF formula Qū. γ(ū, v) ψ(ū, v) that (a) all variables that occur freely in ψ also occur in γ and (b) every variable that is bound by Qū co-occurs with every free variable from ψ in some atom in γ. Grädel [START_REF] Grädel | On the Restraining Power of Guards[END_REF] derived the tree-like model property for GF and LGF and the finite model property for GF. Moreover, the computational complexity of the associated satisfiability problems is pinpointed in the same article: both are complete for deterministic doubly exponential time. A superposition-based decision procedure for GF with equality is due to Ganzinger and de Nivelle [START_REF] Ganzinger | A Superposition Decision Procedure for the Guarded Fragment with Equality[END_REF]. Resolution-based decision procedures for GF and LGF without equality are described in [START_REF] De | A Resolution Decision Procedure for the Guarded Fragment[END_REF][START_REF] Georgieva | Hyperresolution for Guarded Formulae[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF][START_REF] De | Deciding the guarded fragments by resolution[END_REF][START_REF] Georgieva | Hyperresolution for guarded formulae[END_REF]. More variants of guards and guarded quantification have been proposed, which lead to the definition of the clique-guarded fragment [START_REF] Grädel | Invited Talk: Decision procedures for guarded logics[END_REF] and the packed guarded fragment [START_REF] Marx | Tolerance Logic[END_REF], for instance. Hodkinson [START_REF] Hodkinson | Loosely Guarded Fragment of First-Order Logic has the Finite Model Property[END_REF] showed that also the loosely guarded fragment, the clique-guarded fragment, and the packed guarded fragment enjoy the finite model property.

Recently, Bárány, ten Cate, and Segoufin [START_REF] Bárány | Guarded negation[END_REF][START_REF] Bárány | Guarded Negation[END_REF] have discovered that guards can be shifted from quantification to negation, see also [START_REF] Segoufin | A survey on guarded negation[END_REF]. This leads to the guarded-negation first-order fragment (GNFO). GNFO comprises all relational first-order formula with equality over the Boolean connectives ¬, ∧, ∨ and existential quantification. Every occurrence of the negation sign is accompanied by a guard, i.e. negation may only occur in the form γ(ū, v) ∧ ¬ϕ(v), where γ is an atomic guard and ϕ is a GNFO formula. In terms of expressiveness, GNFO subsumes GF [START_REF] Bárány | Guarded Negation[END_REF]. Moreover, in the same article it is shown that GNFO enjoys the tree-like model property and the finite model property. The associated satisfiability problem is complete for deterministic doubly exponential time. Clique-guarded variants of GNFO have also been studied [START_REF] Bárány | Guarded Negation[END_REF].

The monadic shallow linear Horn fragment (MSLH) comprises all finite universally quantified conjunctions ∀x. i C i (x) of first-order Horn clauses C i (x) without equality satisfying the following properties.

Every C i is of the form ¬P 1 (s 1 ) ∨ . . . ∨ ¬P n (s n ) ∨ Q(t)
where n ≥ 0 and the s k and t are terms. The term t has to be shallow and linear , i.e. t is either a variable, a constant symbol, or of the form f (x 1 , . . . , x m ) with m ≥ 1 and pairwise distinct first-order variables x 1 , . . . , x m .

The MSLH clause fragment was introduced by Weidenbach [Wei99], motivated by applications in security, namely, the verification of key-exchange protocols. Driven by applications in program analysis, Nielson, Nielson, and Seidl independently [NNS02] identified a clause fragment, called H 1 , that has essentially the same expressive power. This was observed by Goubault-Larrecq [START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF]. More precisely, Goubault-Larrecq showed that every H 1 sentence ϕ can be transformed, in polynomial time, into an MSLH sentence ψ such that (i) ϕ and ψ are equisatisfiable, (ii) ψ |= ϕ, and (iii) if both sentences are satisfiable, then their least Herbrand models coincide on the interpretation of every predicate symbol occurring in ϕ. The analysis of the computational complexity of H 1 's satisfiability problem in [START_REF] Nielson | Normalizable Horn Clauses, Strongly Recognizable Relations, and Spi[END_REF] was sharpened in [START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF]: it is ExpTime-complete. The MSLH fragment was extended by Teucke and Weidenbach [START_REF] Teucke | Decidability of the Monadic Shallow Linear First-Order Fragment with Straight Dismatching Constraints[END_REF] to a non-Horn variant. The clause set H 1 was extended in various ways by Seidl and Reuß [START_REF] Seidl | Extending H 1 -clauses with disequalities[END_REF][START_REF] Seidl | Extending H 1 -Clauses with Path Disequalities[END_REF]. Other decidable first-order clause fragments that, like MSLH and H 1 , have a very strong connection to tree automata, are described in [Nie96, JMW98, JRV06, SV06, SV08]. Some of them have found applications in the verification of security protocols, see [START_REF] Seidl | Cryptographic Protocol Verification Using Tractable Classes of Horn Clauses[END_REF][START_REF] Seidl | Flat and one-variable clauses: Complexity of verifying cryptographic protocols with single blind copying[END_REF] and the references therein.

Other decidable fragments. There are several works that consider undecidable prefix classes, where additional restrictions on the co-occurrences of quantified variables in atoms lead to a decidable fragment [START_REF] Dreben | Solvable Surányi subclasses: an introduction to the Herbrand theory[END_REF][START_REF] Dreben | Classification of AEA Formulas by Letter Atoms[END_REF][START_REF] Goldberg | On the Solvability of a Subclass of the Suranyi Reduction Class[END_REF][START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF], see also Section 5.1 in [START_REF] Dreben | The Decision Problem: Solvable Classes of Quantificational Formulas[END_REF]. One example is Lewis' fragment T ([Lew80], Section 2A), which comprises first-order sentences of the form ∃z 1 . . . z k ∀x∃y 1 . . . y m ∀x . ψ without equality over a relational vocabulary with predicate symbols of arity two only. Moreover, ψ is quantifier-free and may not contain any atoms of the form P (x , x) or P (x , y j ), 1 ≤ j ≤ m; atoms of the form P (x, x ), P (x, y j ), or P (y j , x ) are allowed, though. This fragment contains infinity axioms, as witnessed by the sentence ∀x∃y∀z. P (y, x) ∧ P (x, z) → P (y, z) ∧ ¬P (x, x) provided in [START_REF] Harry | Complexity Results for Classes of Quantificational Formulas[END_REF]. Nevertheless, the class has a decidable satisfiability problem.

There is a wealth of works focusing on finite clause sets, i.e. ∀ * prenex sentences in conjunctive normal form after exhaustive Skolemization, rather than sentences. Usually, restrictions are imposed on the syntactic form of clauses, as in the case of the Maslov fragment (relational ∃ * ∀ * ∃ * Krom sentences without equality) or the Herbrand fragment (first-order sentences in CNF without equality in which every clause contains exactly one literal). More on decidable Krom clause classes can be found in Section 8.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. The satisfiability problem for Herbrand sentences is treated in Section 8.2.2 in [START_REF] Börger | The Classical Decision Problem[END_REF]; a resolution-based decision procedure was devised by Joyner in [START_REF] William | Resolution Strategies as Decision Procedures[END_REF]. Decidability of the class of Herbrand sentences with equality but only a single unary function symbol was proven by Wirsing in [START_REF] Wirsing | Das Entscheidungsproblem der Prädikatenlogik 1. Stufe mit Identität und Funktionszeichen in Herbrandformeln[END_REF], Sections 6-11, via a reduction to the Rabin fragment. Wirsing has also shown that satisfiability for the Herbrand fragment with equality is undecidable [START_REF] Wirsing | Das Entscheidungsproblem der Prädikatenlogik 1. Stufe mit Identität und Funktionszeichen in Herbrandformeln[END_REF][START_REF] Wirsing | Das Entscheidungsproblem der Klasse von Formeln, die höchstens zwei Primformeln enthalten[END_REF][START_REF] Wirsing | Kleine unentscheidbare Klassen der Prädikatenlogik mit Identität und Funktionszeichen[END_REF].

In later contributions, often a more flexible use of function symbols in clauses is allowed. For known results and references consult the books [START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Leitsch | The Resolution Calculus[END_REF], the PhD thesis of Hustadt [START_REF] Hustadt | Resolution-Based Decision Procedures for Subclasses of First-Order Logic[END_REF], the book chapters [START_REF] Leitsch | Resolution and the Decision Problem[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF], and, for instance, the articles [START_REF] Georgieva | A New Clausal Class Decidable by Hyperresolution[END_REF][START_REF] Lamotte | BDI: a new decidable clause class[END_REF]. Exemplary criteria in this direction of research are bounds on the depth at which variables may occur in terms, as witnessed by the positive variable dominated clause fragment (PVD), treated in [START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF]. The generalization of PVD presented in [START_REF] Lamotte | BDI: A New Decidable Firstorder Clause Class[END_REF][START_REF] Lamotte | BDI: a new decidable clause class[END_REF] illustrates that there is still room for improvement, and that such improvements may be inspired by real-world applications.

More recently discovered decidable fragments, again based on syntactical restrictions of sentences rather than clause sets, are the unary negation fragment [START_REF] Segoufin | Unary negation[END_REF], the uniform one-dimensional fragment [START_REF] Kieronski | Complexity and Expressivity of Uniform One-Dimensional Fragment with Equality[END_REF], and a family of fragments defined and proved decidable in [START_REF] Mogavero | Binding Forms in First-Order Logic[END_REF][START_REF] Bova | Herbrand property, finite quasi-Herbrand models, and a Chandra-Merlin theorem for quantified conjunctive queries[END_REF]. Although the unary negation fragment is not syntactically extended by GNFO, the former is subsumed by GNFO in terms of expressiveness [START_REF] Bárány | Guarded Negation[END_REF]. A close relative of the uniform onedimensional fragment is the one-free fragment introduced in [Tam91, Tam95], see also [START_REF] Fermüller | Resolution Methods for the Decision Problem[END_REF][START_REF] Fermüller | Resolution Decision Procedures[END_REF].

In the field of knowledge representation, Horn clause sets and equivalent formalisms play a key role. Over the last decade, so-called existential rules have attracted a lot of attention, see, e.g., [GHK + 13]. Roughly speaking, an existential rule is a first-order implication ϕ → ψ where ϕ and ψ are conjunctions of relational atoms and ψ may contain existentially quantified variables. Viewed as a fragment of first-order logic, existential rules in their general form lead to an undecidable satisfiability problem. However, a number of expressive decidable fragments has been discovered. Recent results and further references can be found in [BLM10, CGP10a, CGP10b, BMRT11, KR11, Mug11, LMTV12, GHK + 13, BGMR14, BBMR15, ALM17] for example.

In the subsequent sections, we will define novel fragments of first-order logic that all extend some of the above fragments, in particular MFO, BSR, AF, GKS, FO 2 , FL, GF, LGF, and GNFO. In essence, the definitions of the new fragments are careful combinations of the concepts of the original definitions with the concept of (strict) separateness of quantified variables. All new fragments still have a decidable satisfiability problem. We will see two approaches to showing decidability of the fragments: an indirect, syntactic approach and a direct, model-theoretic approach. The easier approach shall be presented first for all the fragments. It amounts to devising equivalence-preserving translations -in the spirit of the unfolding techniques presented in Chapter 2 -into fragments that are already known to be decidable. The second approach sheds more light on the underlying semantic properties, in particular on the question which dependences of existentially quantified variables on universally quantified variables are weak and which are strong in the sense already mentioned in Chapter 2. We will present this approach for three of the new fragments in Section 4, namely for the separated fragment, the generalized Bernays-Schönfinkel-Ramsey fragment, and the generalized Ackermann fragment.

The Separated Fragment (SF)

We start our exhibition of novel first-order fragments with the simplest, namely the one that we have already briefly introduced in Chapter 2: the separated fragment, SF for short. Technically, it is defined as a class of prenex sentences, but this is not an essential property. The defining principle of SF sentences is simply that co-occurrences of universally and existentially quantified variables in atoms are forbidden. Existential variables quantified by leading existential quantifiers are exempt from this rule. We consider an existential quantifier leading if it does not lie within the scope of any universal quantifier. Definition 3.1.1 (Separated fragment (SF)). The separated fragment (SF) consists of all relational first-order sentences ϕ with equality that are of the form ∃z ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in which ψ is quantifier-free, and in which the sets x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn are separated. The tuples z and ȳn may be empty, i.e. the quantifier prefix does not have to start with an existential quantifier and it does not have to end with an existential quantifier either.

Recall that x and ȳ are separated in ϕ if and only if for every atom A occurring in ϕ we either have vars(A) ∩ x = ∅ or vars(A) ∩ ȳ = ∅. Moreover, notice that the variables in z are not subject to any restriction regarding their occurrences.

As already mentioned earlier, Lemma 2.0.4 entails that every SF sentence can be transformed into an equivalent BSR sentence. In order to do so, we just have to replace the subformula ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in an SF sentence ϕ with an equivalent formula of the form ∃ū∀v. ψ . Theorem 3.1.2. Every SF sentence is equivalent to some BSR sentence.

Since BSR enjoys the finite model property, even if constant symbols are allowed in the syntax, the separated fragment immediately inherits this property. Hence, we conclude that the satisfiability problem for SF (SF-Sat) SF-Sat is decidable, even if constant symbols are allowed to occur in SF sentences.

Corollary 3.1.3. SF enjoys the finite model property and, hence, satisfiability of sentences in SF is decidable. This also holds in the presence of constant symbols in SF sentences.

It is not hard to see that SF is a proper syntactic extension of BSR. Clearly, the quantified variables in every BSR sentence ϕ := ∃z∀x. ψ with quantifier-free ψ trivially satisfy the separateness conditions imposed by Definition 3.1.1, as no existential quantifier lies within the scope of any universal quantifier. Similarly, every monadic sentence without equality in prenex normal form trivially satisfies the conditions of Definition 3.1.1, because any monadic atom contains at most one first-order variable. Since any MFO sentence can easily be transformed into an equivalent sentence in prenex normal form, it is fair to say that SF also contains MFO. At the expense of a slightly more technical definition, we could easily modify the definition of the separated fragment so that it is not restricted to prenex sentences. Then, it would indeed contain MFO also in a technically strict sense. On the other hand, it is an easy task to find sentences that belong to SF but neither to BSR nor to MFO. In fact, an interesting example is the sentence ϕ 2 from Example 2.0.2. Proposition 3.1.4. SF properly contains BSR and MFO.

Another interesting question is whether MFO ≈ is subsumed by SF. Obviously, the sentence ∀x∃y. x ≈ y is in MFO ≈ but violates the separateness conditions of SF. Therefore, from the syntactic point of view, there are monadic first-order sentences with equality whose variables are not sufficiently separated for SF. However, the sentence ∀x∃y. x ≈ y is equivalent to ∀x. x ≈ x, which certainly belongs to SF and even to BSR. Similarly, we have the MFO ≈ sentence ∀x∃y. x ≈ y, which is not in SF but equivalent to the BSR sentence ∃y 1 y 2 . y 1 ≈ y 2 . The following theorem witnesses that this is by no means a coincidence. As one consequence, speaking in terms of expressiveness, MFO ≈ is subsumed by BSR and, hence, also by SF.

Theorem 3.1.5. For every MFO ≈ sentence there is an equivalent BSR sentence.

The proof of this result is based on techniques described by Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF] in the context of second-order quantifier elimination for the monadic second-order fragment. A modern account of these techniques is given in [START_REF] Heinrich | Behmann's Contributions to Second-Order Quantifier Elimination from the View of Computational Logic[END_REF], Section 13.2. For the sake of simplicity, we consider exclusively relational formulas here. However, all arguments can be reused in cases where, in addition, constant symbols are allowed.

CHAPTER 3. NOVEL DECIDABLE FIRST-ORDER FRAGMENTS

Proof sketch. For any positive integer and any formula χ(u) we use the abbreviation ∃ ≥ u. χ(u) to denote the formula ∃u 1 . . . u . i<j u i ≈ u j ∧ i χ(u i ), where the variables u 1 , . . . , u are pairwise distinct and do not occur in χ(u). Moreover, we use the abbreviation ∃ < u. χ(u) to denote the formula ∀u 1 . . . u . i<j u i ≈ u j ∨ 1≤i≤ ¬χ(u i ), where the pairwise distinct u 1 , . . . , u do not occur in χ(u).

We start with two auxiliary results that are dual to one another:

Claim I: Let χ(u) be a quantifier-free relational monadic formula in which u is the only variable. Let V be a nonempty set of variables, all distinct from u.

(a) The formula ∃u. χ(u) ∧ v∈V u ≈ v is equivalent to

ψ := ∃ ≥|V |+1 u. χ(u) ∨ 1≤k≤|V | ∃ ≥k u. χ(u) ∧ V ⊆V |V |=k v∈V ¬χ(v) ∨ v,v ∈V v =v v ≈ v . (b) The formula ∀u. χ(u) ∨ v∈V u ≈ v is equivalent to ψ := ∃ <|V |+1 u. ¬χ(u) ∧ 1≤k≤|V | ∃ <k u. ¬χ(u) ∨ V ⊆V |V |=k v∈V ¬χ(v)∧ v,v ∈V v =v v ≈ v .
In both (a) and (b) we observe that every atom A in ψ either exclusively contains free variables or all the variables in A are bound in ψ. ♦

Consider any formula of the form

ψ := ∃y. i1 L i1 (y) ∧ i2 y ≈ z i2 ∧ i3 y ≈ z i3
, where the L i1 are literals over unary predicate symbols and the z i2 and z i3 are all pairwise distinct and different from y. If the subformula i2 y ≈ z i2 is nonempty, and thus contains at least one equation y ≈ z, then the quantifier ∃y can be eliminated and the whole formula ψ is equivalent to

i1 L i1 (z) ∧ i2 z ≈ z i2 ∧ i3 z ≈ z i3 .
Otherwise, Claim I(a) suggests that we can transform ψ into an equivalent formula in which no atom contains a free variable and a bound variable at the same time.

A dual observation holds for any formula ψ

:= ∀x. j1 K j1 (x) ∨ j2 x ≈ z j2 ∨ j3 x ≈ z j3 . If ψ contains at least one disequation x ≈ z, then ψ is equivalent to j1 K j1 (z)∨ j2 z ≈ z j2 ∨ j3 z ≈ z j3 .
Otherwise, Claim I(b) entails that we can transform ψ into an equivalent formula in which no atom contains a free variable and a bound variable at the same time.

Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be an MFO ≈ sentence in standard form with quantifier-free ψ. In all the transformations described below, we tacitly assume that formulas are simplified so that they contain neither trivially tautologous nor trivially unsatisfiable subformulas. First, we transform the matrix ψ into a disjunction k η k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 )∧χ k (x 1 , . . . , xn , ȳ1 , . . . , ȳn ) in which all η k and χ k are conjunctions of literals and where each atom in every χ k contains at least one variable from ȳn . Hence, ϕ is equivalent to ∀x 1 ∃ȳ 1 . . . ∀x n . k η k ∧ ∃ȳ n . χ k . As we have described above, proceeding variable by variable from ȳn , every subformula ∃ȳ n . χ k can be successively transformed into an equivalent formula χ k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 ) in which no atom contains a free variable and a bound variable at the same time. Therefore, ϕ is equivalent to ∀x 1 ∃ȳ 1 . . . ∀x n . k η k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 ) ∧ χ k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 ). In what follows we treat every subformula ∃y. (. . .) in the χ k as indivisible unit.

Next, we transform k η k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 ) ∧ χ k (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 ) into a conjunction of disjunctions and treat the quantifier block ∀x n analogously to how we have treated ∃ȳ n . Notice that afterwards there is no quantifier ∃y with y ∈ ȳn that lies within the scope of any ∀x with x ∈ xn . Proceeding this way with all the quantifier blocks one after another, we eventually obtain a formula ϕ in which, after having been transformed into negation normal form, for every atom A exactly one of three cases applies: (a) A contains only one variable, (b) A contains two existentially quantified variables, or (c) A contains two universally quantified variables. Moreover, there is no nesting of universal and existential quantifiers, i.e. no subformulas of the form (∀x. . . . (∃y. . . .) . . .) or (∃y. . . . (∀x. . . .) . . .) occur. Consequently, by shifting quantifiers back outwards again -existential ones first -, we can transform the final result ϕ into a BSR sentence.

The unrestricted presence of function symbols in SF would lead to an undecidable satisfiability problem. Nevertheless, SF could easily be extended so far that it also subsumes the Löb-Gurevich fragment while retaining decidability. We elaborate on this in Section 3.14.

We emphasized in Chapter 2 that transformations based on Lemma 2.0.3, like the one from SF sentences to equivalent BSR sentences, possibly lead to large blowups regarding the length of the formulas. In general, the length of formulas has a significant effect on the size of smallest models. For the BSR case this relation is linear: every satisfiable BSR sentence ∃y 1 . . . y m ∀x. ψ with m > 0 has a model with at most m domain elements. Proposition 3.1.6 (cf. Proposition 6.2.17 in [START_REF] Börger | The Classical Decision Problem[END_REF]). Let ϕ := ∃z ∀x. ψ be a satisfiable BSR sentence with quantifier-free ψ, possibly containing constant symbols. There is a model

A |= ϕ such that |A| ≤ max |z| + |consts(ϕ)|, 1 .
It turns out that for satisfiable SF sentences ϕ the size of smallest models in terms of the length of ϕ cannot be bounded by any tower of exponents 2 . . .

len(ϕ)

of a fixed height -this is a consequence of Proposition 5.0.1 and Theorem 5.0.3, which we shall prove in Chapter 5. In other words, the asymptotic growth of the size of smallest models is non-elementary in the length of the regarded SF sentence.

Using Lemma 2.0.4 to prove Theorem 3.1.2 does not yield very accurate bounds on the increase in formula length that we incur when translating SF sentences into BSR sentences. We shall conduct a more detailed analysis in the following section, where we derive matching upper and lower bounds. In particular, the entailed upper bound on the size of smallest models for satisfiable SF sentences will have immediate implications with respect to the computational complexity of SF-Sat. The latter will be the subject of Section 5, where we shall also derive corresponding lower bounds and prove that SF-Sat is indeed k-NExpTime-hard for every positive k.

Translation of SF into BSR: Upper and Lower Bounds

One of the key learning points from the previous sections is Theorem 3.1.2, which says that every SF sentence is equivalent to some BSR sentence. We presented a constructive proof by outlining a procedure that translates any SF sentence given as input into an equivalent BSR sentence. In the present section, we analyze the translation process in more detail. Our goal is to derive upper and lower bounds regarding the length of the resulting BSR sentences. Traditionally, such bounds are formulated in terms of syntactic parameters such as the length of the original SF sentence, the number of predicates it contains, or the number of occurring quantifier alternations. In the case of SF, it turns out that, if we intend to derive accurate bounds that also explain the blowup for subfragments such as MFO, we better take separateness of variables into account. This time, however, we are not interested in existentially and universally quantified variables being separated. In the current context it would not make much sense to define a numerical measure for this kind of separateness, as any sentence which does not exhibit full separateness between these two kinds of variables does not belong to SF. What we can measure numerically, though, is the degree of separateness among existentially quantified variables that stem from distinct quantifier blocks.

For convenience, we define this measure in an inverse-proportional way: zero marks the highest possible degree of separateness, larger numbers stand for a lower degree of separateness. Our measure is called the degree of interaction of existential variables ∂ ∃ (ϕ) , denoted by ∂ ∃ (ϕ). Intuitively, an SF sentence ϕ exhibits a degree ∂ ∃ (ϕ) = k, if variables from k distinct existential quantifier blocks interact. We say that two variables x, y interact, if they co-occur in at least one atom or if there is a third variable z that interacts with both x and y, that is, the property is transitive. For instance, in the SF sentence

ϕ := ∀x 1 ∃y 1 v 1 ∀x 2 ∃y 2 v 2 ∀x 3 ∃y 3 v 3 . P (x 1 , x 2 , x 3 ) ∧ ¬Q(y 1 , y 3 ) ∨ P (y 2 , v 2 , v 3 ) ∨ ¬Q(y 3 , v 1 )
the sets {y 1 , y 3 , v 1 } and {y 2 , v 2 , v 3 } form the maximal sets of interacting existential variables. Since each of these sets contains variables from at most two distinct quantifier blocks, the formula exhibits a degree ∂ ∃ (ϕ) = 2. Definition 3.2.1 (Degree of interaction of existential variables). Consider any first-order sentence ϕ := ∃z ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in standard form in which ψ is quantifier free and in which the sets x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn are separated. In addition, we assume that x1 and ȳ1 are nonempty. The tuple z may be empty.

For any j, 1 ≤ j ≤ n, and any variable y ∈ ȳj we say that y has index j, denoted idx(y) = j idx(y) . For any nonempty set Y ⊆ ȳ of existentially quantified variables and any positive integer k we say that Y has degree

k in ϕ, denoted ∂ ∃ (Y, ϕ) = k ∂ ∃ (Y, ϕ)
, if k is the maximal number of distinct variables y 1 , . . . , y k ∈ Y with idx(y 1 ) < . . . < idx(y k ). We say that ϕ's degree of interaction of existential variables (short: degree) is k, denoted ∂ ∃ (ϕ) = k, if k is the smallest positive integer such that we can partition ȳ into m > 0 parts Y 1 , . . . , Y m that are all pairwise separated in ϕ and for which k = max k j ∂ ∃ (Y j , ϕ) = k j , 1 ≤ j ≤ m . Sentences ϕ := ∃z ∀x. ψ in standard form with quantifier-free ψ are said to have degree zero, i.e. ∂ ∃ (ϕ) = 0.

Any BSR sentence ∃z∀x. ψ exhibits a degree of zero. There are simply no existentially-quantified variables whose quantifiers lie within the scope of some universal quantifier. Hence, no such variables could interact with any other in atoms. In the context of analyzing the blowup when going from SF to BSR this makes sense. Any reasonable transformation of a BSR sentence into an equivalent BSR sentence does not lead to any blowup.

Consider again the sentences

ϕ 1 = ∀x∃y. (P 1 (x) ↔ Q 1 (y)) ∧ . . . ∧ (P n (x) ↔ Q n (y))
and

ϕ 2 = ∀u∃v∀x∃y. (P 1 (u, x) ↔ Q 1 (v, y)) ∧ . . . ∧ (P n (u, x) ↔ Q n (v, y))
from Example 2.0.2 (page 16). We observe that ∂ ∃ (ϕ 1 ) = 1 and ∂ ∃ (ϕ 2 ) = 2. In Example 2.0.2 we showed a transformation of ϕ 1 into a BSR sentence whose length was singly exponential in the length of ϕ 1 . Similarly, we showed that ϕ 2 has an equivalent BSR sentence with a length that is doubly exponential in ϕ 2 's length. This already indicates the connection between the degrees of ϕ 1 and ϕ 2 and the length of equivalent BSR sentences: a degree of k leads to a k-fold exponential blow up in the worst case. Indeed, we shall derive upper bounds (Lemma 3.2.5) and lower bounds (Theorem 3.2.7) on the blowup that reflect exactly this behavior. Such fine-grained bounds come in handy when one is also interested in the blowup for subfragments of SF. Recall that MFO is such a subfragment. Obviously, any MFO sentence has a degree of at most one. Hence, the translation of any MFO sentence into BSR incurs an at most singly exponential increase in formula length. In fact, this behavior is not unexpected, as it is well known that any satisfiable MFO sentence ϕ has a smallest model whose size is at most exponential in the length of ϕ. Proposition 3.2.2 (cf. Proposition 6.2.1 in [START_REF] Börger | The Classical Decision Problem[END_REF]). Let ϕ := ∃z ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be a satisfiable MFO sentence. Moreover, assume that ϕ contains k distinct predicate symbols. Then, there is a model

A |= ϕ such that |A| ≤ 2 k .
Notice that the shape of the quantifier prefix does not contribute to the upper bound. As we have already pointed out in Proposition 3.1.6, the analogous relationship for satisfiable BSR sentences is linear. Therefore, any translation procedure that maps MFO sentences ϕ to equivalent BSR sentences ψ having a length doubly exponential in the length of ϕ, say, must be highly inefficient.

In fact, BSR and MFO belong to the class of SF sentences that have degree at most one. We refer to this subfragment as the strongly separated fragment (SSF). Definition 3.2.3 (Strongly separated fragment (SSF)). Let ϕ := ∃z∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be an SF sentence with quantifier-free ψ. We say that ϕ belongs to the strongly separated fragment (SSF) if and only if the sets x := x1 ∪ . . . ∪ xn and ȳ1 , . . . , ȳn are all pairwise separated in ϕ.

It is easy to find sentences in SSF that are neither in BSR nor in MFO, i.e. SSF is a proper extension of both. Moreover, it is worth noticing that all SF sentences with the quantifier prefix ∃ * ∀ * ∃ * ∀ * belong to the strongly separated fragment. We will see in Chapter 5 that the satisfiability problem for SSF is computationally as hard as satisfiability for BSR and MFO -all three problems are complete for NExpTime.

Next, we conduct the promised analysis of the translation from SF into BSR. Here, we deviate slightly from the presentation in the proof of Lemmas 2.0.4 and 2.0.3. Roughly speaking, in the first phase of the translation process all quantifiers are shifted inwards as far as possible. In order to do so, we first transform the sentence in question into a formula in CNF. After that, we employ the well-known rules of quantifier shifting (cf. Lemma 1.0.1), supplemented with the following lemma.

Lemma 3.2.4. Let I and K i , i ∈ I, be sets that are finite, nonempty, and pairwise disjoint. The elements of these sets serve as indices. Let

ϕ := ∃ȳ. i∈I χ i (z) ∨ k∈Ki η k (ȳ, z)
be some first-order formula where the χ i and the η k denote arbitrary subformulas that we treat as indivisible units in what follows. We say that any mapping f : I → i∈I K i is a selection function if for every i ∈ I we have f (i) ∈ K i . We denote the set of all selection functions of this form by F F . Then, ϕ is equivalent to

ϕ := S⊆I S =∅ i∈S χ i (z) ∨ f ∈F ∃ȳ. i∈S η f (i) (ȳ, z) .
Proof. For the sake of readability we sometimes reuse variables in different occurrences of quantifiers in this proof. Using distributivity of ∧ over ∨, we transform ϕ into an equivalent disjunction of conjunctions:

∃ȳ.

T,f ∈ (PI)×F i∈T χ i (z) ∧ i∈I\T η f (i) (ȳ, z) .
Since the existential quantifier block distributes over the topmost disjunction, we can shift this block inwards and obtain the equivalent formula

T,f ∈ (PI)×F i∈T χ i (z) ∧ ∃ȳ. i∈I\T η f (i) (ȳ, z) . (3.1)
At this point, we employ distributivity of ∨ over ∧ to transform this result into an equivalent conjunction of disjunctions ϕ := j ψ j, in which for every index j and every pair T, f ∈ (PI)×F there is exactly one such that either ψ j, = χ i for some i ∈ T or ψ j, = ∃ȳ. i∈I\T η f (i) (ȳ, z).

In order to show that ϕ is semantically equivalent to ϕ , we prove the following claims.

Claim I: Every disjunction ψ j, in ϕ is subsumed by a disjunction of the form

ψ S := i∈S χ i (z) ∨ f ∈F ∃ȳ. i∈S η f (i) (ȳ, z)
for some nonempty S ⊆ I.

Proof: Fix some index j and consider ψ j, . We set S := i ∈ I ψ j, = χ i for some . Consider the set S := I \ S. By definition of S, we know that none of the χ i with i ∈ S is a constituent of ψ j, . For every selection function f ∈ F there is some disjunct

i∈S χ i (z) ∧ ∃ȳ. i∈I\S η f (i) (ȳ, z)
in (3.1) of which we know that none of the χ i in it has been picked as constituent of ψ j, when constructing ϕ . Hence, due to the definition of ϕ , there must be some * such that ψ j, * = ∃ȳ. i∈I\S η f (i) (ȳ, z), where I \ S = S.

Consequently,

ψ j, is subsumed by ψ S . ♦

Claim II: Each of the subsuming disjunctions ψ S in Claim I is indeed equivalent to some disjunction ψ j, in ϕ .

Proof: Fix any nonempty S * ⊆ I and consider ψ S * . We obtain the equivalent disjunction ψ * from the disjuncts in (3.1) as follows. For every T ⊆ I with nonempty T ∩ S * we pick one of the χ i with i ∈ T ∩ S * as constituent of ψ * . For every T ⊆ I for which T ∩ S * is empty and any f ∈ F we pick ∃ȳ. i∈I\T η f (i) (ȳ, z) as constituent of ψ * . Since S * is nonempty, T must be a proper subset of I and thus I \ T is also nonempty.

For every constituent of the form ∃ȳ. i∈T η f (i) (ȳ, z) that belongs to the disjunction ψ * we know that S * ⊆ T . Hence, ψ * is of the form

i∈S * χ i (z) ∨ j f ∈F ∃ȳ. i∈S * η f (i) (ȳ, z) ∧ i∈S j η f (i) (ȳ, z)
for certain sets S j ⊆ I \ S * . Among the S j is, in particular, the empty set, originating from T = I \ S * . In this case, we have

S j = I \ T \ S * = I \ (I \ S * ) \ S * = ∅. Hence, we can equivalently transform ψ * into i∈S * χ i (z) ∨ f ∈F j ∃ȳ. i∈S * η f (i) (ȳ, z) ∧ i∈S j η f (i) (ȳ, z) |=| i∈S * χ i (z) ∨ f ∈F ∃ȳ. j i∈S * η f (i) (ȳ, z) ∧ i∈S j η f (i) (ȳ, z) |=| i∈S * χ i (z) ∨ f ∈F ∃ȳ. i∈S * η f (i) (ȳ, z) ∨ j i∈S * η f (i) (ȳ, z) ∧ i∈S j S j =∅ η f (i) (ȳ, z) |=| i∈S * χ i (z) ∨ f ∈F ∃ȳ. i∈S * η f (i) (ȳ, z) ∨ i∈S * η f (i) (ȳ, z) ∧ j i∈S j S j =∅ η f (i) (ȳ, z) .
By the absorption axiom of Boolean algebra, we finally obtain the equivalent disjunction

i∈S * χ i (z) ∨ f ∈F ∃ȳ. i∈S * η f (i) (ȳ, z) .
Thus, the claimed equivalence holds.

We have not yet explicitly argued why the first subformula i∈S * χ i (z) of ψ * covers S * completely. But this is easy to see, when one takes the singleton sets T = {i} for every i ∈ S * into account, for which we pick the χ i as a constituent of ψ * . ♦

This completes the proof of the lemma.

With Lemma 3.2.4 we now have the right tool at hand to perform the transformations described in the proofs of Lemmas 2.0.4 and 2.0.3 in a way that does not introduce so much redundancy. This will facilitate a neat analysis of the incurred blowup. Lemma 3.2.5. Let ϕ := ∃z ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be an SF sentence of positive degree ∂ ∃ (ϕ) in standard form. Let L ϕ (ȳ) denote the set of all literals in ϕ that contain at least one variable y ∈ ȳ := ȳ1 ∪ . . . ∪ ȳn . There exists a sentence ϕ BSR = ∃z ∃ū ∀v. ψ BSR in standard form with quantifier-free ψ BSR that is equivalent to ϕ and contains at most |z|

+ |ȳ| 2 • ∂ ∃ (ϕ) • 2 ↑∂ ∃ (ϕ) (|L ϕ (ȳ)|) ∂ ∃ (ϕ) leading existential quantifiers.
Proof. For convenience, we pretend that z is empty. The argument works for nonempty z as well. Let x := x1 ∪ . . . ∪ xn . We transform ϕ into an equivalent CNF formula of the form

∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . i∈I χ i (x) ∨ k∈Ki L k (ȳ)
where I and the K i are finite, pairwise disjoint sets of indices, the subformulas χ i are disjunctions of literals, and the L k are literals. By Lemma 3.2.4, we can construct an equivalent formula of the form

ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n . S∈PI\∅ i∈S χ i (x) ∨ f ∈F ∃ȳ n . i∈S η f (i) (ȳ)
where F is the set of all selection functions over the index sets K i , i ∈ I. For the sake of readability we sometimes reuse variables in different occurrences of quantifiers in this proof. Applying ordinary quantifier shifting, we shift inward the universal quantifier block ∀x n and thus obtain

ϕ := ∀x 1 ∃ȳ 1 . . . ∃ȳ n-1 . S∈PI\∅ ∀x n . i∈S χ i (x) ∨ f ∈F ∃ȳ n . i∈S η f (i) (ȳ) .
We now iterate these two steps in an alternating fashion until all quantifier blocks have been shifted inwards in the described way. The constituents of the result ϕ (3) := q χ

(3) q ∨ p η

(3) qp of this process have the form

χ (3) q = ∀x 1 . 1 ∀x 2 . 2 . . . n-1 ∀x n . i∈S 1 ,..., n-1 χ i (x) . . . ,
where the S 1,..., n -1 are certain subsets of I, and

η (3) qp = ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 ∃ȳ n . k∈K 1 ,..., n-1 L k (ȳ) . . . ,
where the K 1 ,..., n-1 are certain subsets of i∈I K i . By definition of ∂ ∃ (ϕ), we may assume that there is some positive integer m and a partition of the set ȳ into m nonempty subsets Y 1 , . . . , Y m that are all pairwise separated in ϕ and such that for every j, 1 ≤ j ≤ m, we have ∂ ∃ (Y j , ϕ) ≤ ∂ ∃ (ϕ). Since the sets Y 1 , . . . , Y m are pairwise separated in ϕ, we may partition the set L ϕ (ȳ) into subsets L ϕ (Y 1 ), . . . , L ϕ (Y m ) such that each L ϕ (Y j ) contains exactly the literals in ϕ that contain at least one variable from Y j . This means, we can rewrite every η

(3) qp into the form

η (4) qp = ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 ∃ȳ n . j∈[m] k∈K j 1 ,..., n-1 L k (Y j ) . . . where the sets K 1 1 ,..., n-1 , . . . , K m 1 ,..., n-1
constitute a partition of K 1 ,..., n-1 -some of these parts may be empty. We then observe the following equivalences.

∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 ∃ȳ n . j∈[m] k∈K j 1 ... n-1 L k (Y j ) . . . |=| ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 j∈[m] ∃ ȳn ∩ Y j . k∈K j 1 ... n-1 L k (Y j ) . . . |=| ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . j∈[m] n-1 ∃ ȳn ∩ Y j . k∈K j 1 ... n-2 n-1 L k (Y j ) . . . . . . |=| j∈[m] ∃ ȳ1 ∩ Y j . 1 ∃ ȳ2 ∩ Y j . 2 . . . n-1 ∃ ȳn ∩ Y j . k∈K j 1 ... n-1 L k (Y j ) . . .

For every η

(4) qp we call the result of the above transformation η

(5) qp . In cases where the set ȳi ∩ Y j is empty, the existential quantifier block vanishes. For every j ∈ [m] there are at most ∂ ∃ (Y j , ϕ) nonempty sets ȳi ∩ Y j . Hence, every η (5) qp contains at most ∂ ∃ (ϕ) nested existential quantifier blocks that are separated by in-between conjunctive connectives in the syntax tree.

We obtain ϕ (5) from ϕ (3) by replacing every constituent η

(3)

qp with the corresponding η

(5)

qp after applying the idempotence axioms of Boolean Algebra exhaustively to remove redundant conjuncts.

Let

κ := max |L ϕ (Y j )| 1 ≤ j ≤ m .
Due to the idempotence axioms, the following upper bounds can be shown inductively for any positive integer d, starting from d = 1: Modulo idempotence, there are at most 2 ↑d (κ) formulas of the form

∃ ȳi1 ∩ Y j . 1 ∃ ȳi2 ∩ Y j . 2 . . . d-1 ∃ ȳi d ∩ Y j . k∈K j 1 ,..., d-1 L k (Y j ) . . . . For the sentence ϕ (5) = q χ (3) q ∨ p η (5) qp this means that it contains at most m • 2 ↑∂ ∃ (ϕ) (κ)
distinct subformulas (not occurrences thereof!) that are of the form ∃y. ψ and do not lie within the scope of any quantifier. We treat every such subformula ∃y. ψ and every subformula χ

∃ ȳi1 ∩ Y j . 1 ∃ ȳi2 ∩ Y j . 2 . . . d j -1 ∃ ȳi ∂ j ∩ Y j . k∈K j 1 ,..., d j -1 L k (Y j ) . . .
for some j and certain indices i 1 , . . . , i dj with 1 ≤ i 1 < . . . < i dj ≤ n, all depending on r 2 ; d j abbreviates the expression ∂ ∃ (Y j , ϕ).

Due to previous observations, we know that, modulo idempotence, r 2 ranges over at most m • 2 ↑∂ ∃ (ϕ) (κ) indices. Moreover, any k in any η (6) r2 ranges over at most 2 ↑∂ ∃ (ϕ)-k (κ) indices. Consequently, every constituent r2 η

(6) r2 in ϕ (6) contains at most m•max i,j |ȳ i ∩Y j |• ∂ ∃ (ϕ) k =1 ∂ ∃ (ϕ) d=k 2 ↑d (κ) occurrences of existential quantifiers.
Since these existential quantifiers distribute over the topmost disjunction when we shift them outwards to the front of the sentence ϕ (6) , and since the universal quantifiers in the χ (6) q may also be shifted back outwards, we have shown that ϕ is equivalent to some BSR sentence with at most

|ȳ| 2 • ∂ ∃ (ϕ) • 2 ↑∂ ∃ (ϕ) (κ) ∂ ∃ (ϕ) leading existential quantifiers.
Put together, Proposition 3.1.6 and Lemma 3.2.5 immediately entail the following small model property for SF. Theorem 3.2.6 (Small model property for SF). Every satisfiable SF sentence ϕ has a model whose domain contains at most len(ϕ) + len(ϕ)

2 • ∂ ∃ (ϕ) • 2 ↑∂ ∃ (ϕ) (len(ϕ)) ∂ ∃ (ϕ) domain elements.
In cases where ∂ ∃ (ϕ) = 1, the bound in Theorem 3.2.6 simplifies to len(ϕ) + len(ϕ)

2 • 2 len(ϕ) .
This leads to a small model property for SSF, and its subfragment MFO, that stipulates for satisfiable sentences the existence of a model of exponential size in the length of the formula. Concerning the asymptotic growth, this yields a reasonable upper bound on the size of small models of satisfiable MFO sentences that is not too far away from Proposition 3.2.2. This works in spite of the fact that MFO sentences may contain arbitrarily nested alternating quantifiers. Next, we complement the obtained upper bound on the length of the BSR sentences resulting from the translation of SF sentences with a corresponding non-elementary lower bound.

Theorem 3.2.7. There is a class of satisfiable SF sentences that are Horn and Krom such that for every positive integer n the class contains a sentence ϕ of degree ∂ ∃ (ϕ) = n and with a length polynomial in n for which any equivalent BSR sentence contains at least n k=1 2 ↑k (n) leading existential quantifiers.

Proof. Let n ≥ 1 be some positive integer. Consider the following first-order sentence in which the sets {x 1 , . . . , x n } and {y 1 , . . . , y n } are separated:

ϕ ϕ := ∀x n ∃y n . . . ∀x 1 ∃y 1 . 4n i=1 P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) .
Notice that we change the orientation of the indices in the quantifier prefix in this proof.

In order to construct a particular model of ϕ, we inductively define the following sets:

S k S 1 := S ⊆ [4n] |S| = 2n , S k+1 := S ∈ PS k |S| = 1 2 • |S k | for every k > 1.
Then, we observe that

|S 1 | = 4n 2n ≥ 4n 2n 2n = 2 2n , |S 2 | = |S1| |S1|/2 ≥ |S1| |S1|/2 |S1|/2 = 2 |S1|/2 ≥ 2 2 2n /2 = 2 2 2n-1 , . . . |S n | = |Sn-1| |Sn-1|/2 ≥ 2 |Sn-1|/2 ≥ 2 2 2 . . . 2 2n-1 -1 -1 ≥ 2 ↑n (2n -(n -1)) = 2 ↑n (n + 1),
where the inequality n k ≥ (n/k) k can be found in [START_REF] Thomas | Introduction to Algorithms[END_REF] (page 1097), for example. Having the sets S k , we now define the structure A as follows:

A

A := n k=1 a (k) S , b (k) S S ∈ S k , P A i := a (1) S1 , . . . , a (n)
Sn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . . , 4n, and

Q A i := b (1) S1 , . . . , b (n)
Sn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . . , 4n. Clearly, for any choice of S 1 , . . . , S n and every i, 1 ≤ i ≤ 4n, we have

A, x 1 →a (1) S1 , . . . , x n →a (n) Sn , y 1 →b (1) S1 , . . . , y n →b (n) Sn |= P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) .
For any other choice of tuples c 1 , . . . , c n , i.e. there do not exist sets S 1 ∈ S 1 , . . . , S n ∈ S n such that c 1 , . . . , c n equals a

(1) S1 , . . . , a (n) Sn or b (1) S1 , . . . , b (n) Sn , we observe A, [x 1 →c 1 , . . . , x n →c n ] |= P i (x 1 , . . . , x n ) and A, [y 1 →c 1 , . . . , y n →c n ] |= Q i (y 1 , . . . , y n ) for every i. Hence, A, [x 1 →c 1 , . . . , x n →c n , y 1 →c 1 , . . . , y n →c n ] |= 4n i=1 P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) .
Consequently, A is a model of ϕ.

Consider the following simple two-player game with Players A and B A, B where both players have complete and instantaneous knowledge about all moves that are made by either player. In the first round A moves first by picking some domain element a

(n) S A,n S A,j , a (j) S A,j
for some set S A,n ∈ S n . B knows about A's choice and answers by picking a domain element b

(n) S B,n S B,j , b (j) S B,j
for some set S B,n ∈ S n . The game continues for n -1 more rounds, where in every round Player A picks a domain element a

A, x 1 →a (1) S A,1 , . . . , x n →a (n) S A,n , y 1 →b (1) S B,1 , . . . , y n →b (n) S B,n |= P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n )
for some i ∈ [4n], and Player B wins if and only if

A, x 1 →a (1) S A,1 , . . . , x n →a (n) S A,n , y 1 →b (1) S B,1 , . . . , y n →b (n) S B,n |= P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) for every i ∈ [4n].
Since A is a model of ϕ, there must exist a winning strategy for B.

Claim I: There is exactly one winning strategy for B, namely, for every j = n, . . . , 1 Player B picks the element b (j)

S A,j in round nj + 1, i.e. for every j we have S B,j = S A,j .

Proof: It is easy to see that the described strategy is a winning strategy for B.

Assume B deviates from this strategy. This means there exists some j * , 1 ≤ j * ≤ n, such that B did not adhere to the described strategy in the (nj * + 1)st round, i.e. S B,j * = S A,j * .

We show by induction on j * that A has a winning strategy from this deviation point on.

For the base case j * = 1 we consider two distinct nonempty sets S A,1 , S B,1 ⊆ [4n]. There must be some index i * that belongs to one of the two sets but not to the other, i.e. i * ∈ The case where i * ∈ S B,1 \ S A,1 is symmetric and A also wins.

(S A,1 ∪ S B,1 ) \ (S A,1 ∩ S B,1 ). Suppose that i * ∈ S A,1 \ S B,
For the inductive case we fix some j * > 1. Since S A,j * and S B,j * are distinct but have the same number of elements, there is some set S ∈ S A,j * \ S B,j * . If A picks a (j * -1) S A,j * -1 := a (j * -1) S in the following round, we have S B,j * -1 = S A,j * -1 for any choice b (j * -1) S B,j * -1 that B could possibly make. By induction, A has a winning strategy starting from the next round of the game. Hence, there is a winning strategy starting from the current round. ♦

The just proved claim would still hold true if we allowed B to freely pick any element of the domain A at every round. The reason is that for any choice of elements a

(n) S A,n , . . . , a (1)
S A,1 made by A with S A,1 ∈ . . . ∈ S A,n ∈ S n we know that S A,1 is nonempty. Hence, we can always find some i * ∈ S A,1 such that a

(1)

S A,1 , . . . , a (n) S A,n ∈ P A i * .
On the other hand, for any sequence c n , . . . , c 1 picked by B that does not comply with the rules of the described game, we have c 1 , . . . , c n ∈ Q A i * . This result proves the following observation. Proof: The reason is simply that in this case player A can always prevent B from reaching a state of the game where B can apply the described winning strategy. ♦

We have already analyzed the size of the sets S k . Due to the observed lower bounds, we know that A contains at least

n k=1 2 ↑k (n) elements of the form b (k) S .
Next, we argue that any ∃ * ∀ * -sentence ϕ * that is semantically equivalent to ϕ must contain at least n k=1 2 ↑k (n) leading existential quantifiers. Let ϕ * := ∃y 1 . . . y m ∀x 1 . . . x . χ * with quantifier-free χ * be a sentence with minimal m that is semantically equivalent to ϕ. Since A is also a model of ϕ * , we know that there is a sequence of elements c 1 , . . . , c m taken from the domain A such that A, [y 1 →c 1 , . . . , y m →c m ] |= ∀x 1 . . .

:= A * \ {b (k) S }, P B i := P A * i ∩ B n = P A * i and Q B i := Q A * i ∩ B n
for every i, and c B j := c A * j for every j. But then B must also be a model of both ϕ * and ϕ, since every model of ϕ Sk is a model of ϕ * , and because we assumed ϕ * and ϕ to be equivalent. This contradicts Claim II, and thus we must have m ≥ n k=1 2 ↑k (n). Since every atom Q i (y 1 , . . . , y n ) contains n variables from existential quantifier blocks that are interspersed with universal quantifier blocks, the degree ∂ ∃ (ϕ) of ϕ is n. Moreover, ϕ can easily be transformed into a CNF that is Horn and Krom at the same time. Hence, the theorem holds. Theorem 3.2.7 entails that there is no elementary upper bound on the length of the BSR sentences that result from any equivalence-preserving transformation of SF sentences into BSR. On the other hand, by Lemma 3.2.5, there is an elementary upper bound, if we only consider SF sentences with a bounded degree of interaction of existential variables. A special case of Theorem 3.2.7 highlights the difference in succinctness between BSR and MFO. By Thereom 3.2.5, we already know that every MFO sentence is equivalent to some BSR sentence whose length is at most exponential in the length of the original MFO sentence. The following proposition entails that, in the worst case, this exponential blowup cannot be avoided. Proposition 3.2.8. There is a class of MFO sentences that are Horn and Krom such that for every positive integer n the class contains a sentence ϕ of a length polynomial in n for which any equivalent BSR sentence contains at least 2 n leading existential quantifiers.

One possible witness for the mentioned class of MFO sentences consists of all the sentences ∀x∃y.

2n i=1 P i (x) ↔ Q i (y) for n ≥ 1.

Expressiveness of SF

We have already seen that SF is a syntactic extension of MFO and BSR (Proposition 3.1.4) and that every MFO ≈ sentence is equivalent to some SF sentence (Theorem 3.1.5). Hence, SF is (at least) as expressive as these three fragments. Moreover, any sentence that is a Boolean combination of sentences from BSR and/or MFO ≈ is equivalent to some SF sentence. On the other hand, Theorem 3.2.7 shows that SF sentences can be considerably more succinct than their BSR equivalents.

Fundamental Properties of Relations

The separated fragment inherits some expressiveness from BSR that other decidable first-order fragments, such as FO 2 , FL, and GF, lack. For instance, SF sentences can naturally express fundamental properties of relations, such as reflexivity, irreflexivity, symmetry, antisymmetry, transitivity, and congruence with respect to other predicates. Hence, SF sentences can directly express the axioms of, e.g., equivalence relations, (strict) order relations, and congruence relations. These are fundamental and interesting properties of relations that have to be assumed at the meta-level when dealing with first-order fragments that are less expressive in this respect.

Basic Counting Quantifiers

Basic "there exist at least n" counting quantifiers ∃ ≥n y can be defined natively in SF and do not have to be introduced via special operators. For example, given some positive integer n, the formula ∃ ≥n y. ψ(y, z) stipulates the existence of n pairwise distinct domain elements a 1 , . . . , a n such that ψ is satisfied if any of the a i is assigned to y. There is a standard first-order expansion for such formulas, namely

∃y 1 . . . y n . n i=1 ψ(y i , z) ∧ i<j y i ≈ y j .
This kind of basic counting quantifiers fits in nicely with the separateness conditions of SF. That is, if all variables that are universally quantified in ψ are separated from all variables that are existentially quantified, including y, then this separateness is preserved in the expansion of ∃ ≥n y. ψ(y, z). The reason is simply that in the expansion the variable y is converted into multiple y i , each of which is existentially quantified and separated from the universally quantified variables. This would change with the slightly different, yet equivalent, alternative expansion

∀y 1 . . . y n-1 ∃y. ψ(y) ∧ n-1 i=1 y ≈ y i ,
where the existentially quantified y co-occurs with every (universally quantified) y i in a disequation.

The picture is different, however, for the case of "there exist at most n" counting quantifiers ∃ ≤n x with positive n. One possible expansion for any formula ∃ ≤n x. ψ(x, z) is

∀x 1 . . . x n+1 . 1≤i<j≤n+1 x i ≈ x j → n+1 i=1 ¬ψ(x i , z) .
As ∃ ≤n x is in a sense dual to ∃ ≥n , it is not very surprising that its expansion is based on universal quantification. Now consider the formula ∀u∃ ≤1 y∀v. ¬R(u, v) and its equivalent with the expanded counting quantification:

∀u∀x 1 x 2 . x 1 ≈ x 2 → 2 i=1 ¬∀v. ¬R(u, v) |=| ∃x 1 x 2 . x 1 ≈ x 2 → ∀u∃v. R(u, v) .
Although the original sentence looks rather innocent from the perspective of separateness, its expansion does not. Indeed, the latter can be used as a building block for an infinity axiom:

ϕ inf := ∀x. ¬R(x, x) ∧ ∀x 1 x 2 x 3 . R(x 1 , x 2 ) ∧ R(x 2 , x 3 ) → R(x 1 , x 2 ) ∧ ∃y 1 y 2 . y 1 ≈ y 2 ∧ ∃x 1 x 2 . x 1 ≈ x 2 → ∀u∃v. R(u, v) .
Obviously, the hidden negation in any formula ∃ ≤n x. ψ(x, z) makes it a bit tricky to formulate suitable separateness conditions that would allow to integrate such expressions into SF without losing the finite model property (and decidability of SF-Sat). We shall not investigate the counting abilities of SF any further in the present thesis and leave it for future work.

One can use a sentence similar to ϕ inf and combine it with a formalization of domino problems in SF to obtain a formalization of unconstrained domino problems, which are, in general, undecidable -see Section 3.1.1 in [START_REF] Börger | The Classical Decision Problem[END_REF] for a discussion. In the remainder of this subsection, we shall present such a formalization in SF. It follows that enhancing SF with the described form of "there are at least n" quantifiers renders the associated satisfiability problem undecidable. Definition 3.3.1 (Unconstrained domino systems, cf. Definition 3.1.2 in [START_REF] Börger | The Classical Decision Problem[END_REF]). A domino system D := D, H, V is a triple where D is a finite set of tiles and H, V ⊆ D × D are binary relations determining the allowed horizontal and vertical neighbors of tiles, respectively. Consider the space N × N. We say that D tiles the space N × N if and only if there exists a mapping τ : N × N → D, called a D-tiling, such that for every x, y ∈ N × N the following conditions hold. Proposition 3.3.2 (Berger [START_REF] Berger | The undecidability of the domino problem[END_REF]). The set of domino systems that tile the space N × N forms an undecidable problem.

In order to formalize a given unconstrained domino problem D = D, H, V , we introduce the following constant and predicate symbols:

Succ(x, x )
x is the successor of x, R(x, x ) R constitutes a strict total order: x is strictly smaller than x , H(x, y, x , y )

x , y is the horizontal neighbor of x, y , i.e. x is successor of x and y = y, V (x, y, x , y )

x , y is the vertical neighbor of x, y , i.e. x = x and y is successor of y, D(x, y)

x, y is tiled with D ∈ D.

First, we stipulate the axioms of the successor relation Succ and of the strict total order R, in which the successor relation is embedded:

χ 1 := ∃z∀x. ¬Succ(x, z) , χ 2 := ∀x∃x . Succ(x, x ) , χ 3 := ∀xx x . Succ(x, x ) ∧ Succ(x, x ) → x ≈ x ∧ Succ(x , x) ∧ Succ(x , x) → x ≈ x , χ 4 := ∀xx . Succ(x, x ) → R(x, x ) , χ 5 := ∀x. ¬R(x, x) , χ 6 := ∀xx x . R(x, x ) ∧ R(x , x ) → R(x, x ) , χ 7 := ∀xx . R(x, x ) ∨ R(x , x) .
The following sentences encode a given domino system D := D, H, V :

η 1 := ∀xyx y . H(x, y, x , y ) ↔ Succ(x, x ) ∧ y ≈ y , η 2 := ∀xyx y . V (x, y, x , y ) ↔ x ≈ x ∧ Succ(y, y ) , η 3 := ∀xx y. H(x, y, x , y) → D,D ∈H D(x, y) ∧ D (x , y) , η 4 := ∀xyy . V (x, y, x, y ) → D,D ∈V D(x, y) ∧ D (x, y ) , η 5 := D,D ∈D D =D ∀xy. D(x, y) → ¬D (x, y) .
Proposition 3.3.3. Assume that D, H, and V are nonempty and let A be a model of the sentence

χ 1 ∧ . . . ∧ χ 7 ∧ η 1 ∧ . . . ∧ η 5 . A induces a tiling τ of N × N. Conversely, any D-tiling τ of the space N × N induces a model A |= χ 1 ∧ . . . ∧ χ 7 ∧ η 1 ∧ . . . ∧ η 5 .
All sentences in the above formalization, except for χ 2 , belong to BSR and thus also to SF. We have observed that χ 2 can be expressed with the sentence

(∃x 1 x 2 . x 1 ≈ x 2 ) ∧ ∀u∃ ≤1 y∀v. ¬Succ(u, v) |=| (∃x 1 x 2 . x 1 ≈ x 2 ) ∧ (∃x 1 x 2 . x 1 ≈ x 2 ) → ∀u∃v. Succ(u, v) .
Hence, if we were to admit quantifiers of the form ∃ ≤n in SF as described above, then we could reduce undecidable problems to the satisfiability problem of this extended language.

The sentence χ 2 in fact belongs to several of the known decidable fragments: AF, GKS, the Skolem fragment, FO 2 , FL, and Maslov's fragment K. Hence, Boolean combinations of BSR sentences with sentences from one of the mentioned other fragments lead to undecidable satisfiability problems, if no further restrictions are imposed. Consequently, it seems impossible that SF could be extended into a decidable fragment that contains BSR and any of the mentioned fragments without seriously restricting the possibility to combine sentences from the extended fragment with Boolean connectives.

Expressiveness with Respect to Models of Bounded Size

Whenever it is possible to restrict our attention to models with a bounded domain size -for some known bound -, then SF is as expressive as full (relational) first-order logic. This alone is not a very interesting result, as already the existential fragment of relational first-order logic, represented by the class of relational ∃ * prefix sentences, possesses this property (universal quantification can be replaced by finite conjunctions). What makes the case of SF special is that the incurred blowup in formula length is not linear in the bound but significantly lower.

In order to make this idea more precise, we consider the following formula over the unary predicate symbols Q 1 , . . . , Q m :

χ m χ m := ∀xx . m i=1 Q i (x) ↔ Q i (x ) -→ x ≈ x .
It is easy to see that any model of χ m contains at most 2 m domain elements. The length of χ m lies in O(m).

Proposition 3.3.4. For every positive integer m and any relational first-order sentence ϕ in which the predicate symbols Q 1 , . . . , Q m do not occur there is some SF sentence ϕ SF such that the sentences χ m ∧ ϕ and χ m ∧ ϕ SF are equivalent. Moreover, the length of ϕ SF lies in O m • len(ϕ) .

For the proof of this result, we use the abbreviation

s ≈m t := m i=1 Q i (s) ↔ Q i (t) s ≈m t
for any two terms s, t, and we employ the following simple observations. Lemma 3.3.5. Let A be any structure, let β be any variable assignment over A's domain, and let s, t be two terms. If A |= χ m holds, then we get A, β |= s ≈m t if and only if A, β |= s ≈ t.

This means, if we restrict our attention to domains with at most 2 m domain elements, we can use a separated form of equality. Proposition 3.3.6. Let ψ[t] be any formula (first-order or second-order) in which the term t occurs. Let x be some first-order variable that does not occur in ψ

[t]. Then, ψ[t] is semantically equivalent to ∀x. x ≈ t → ψ[x], where ψ[x] is derived from ψ[t]
by replacing every occurrence of t with the variable x.

Without loss of generality, we assume that ϕ in Proposition 3.3.4 is in negation normal form. We construct ϕ SF from ϕ by consecutively replacing each subformula of the form ∃y. ψ in ϕ with ∃y∀v. y ≈m v → ψ y/v , where we assume v to be fresh (one fresh variable for each replaced subformula). This can be done in such a way that any occurrence of existentially quantified variables lies within subformulas s ≈m t. The semantic equivalence of χ m ∧ ϕ and χ m ∧ ϕ SF follows from Lemma 3.3.5 and Proposition 3.3.6. This proves Proposition 3.3.4.

Notice that ϕ SF in fact belongs to the strongly separated fragment (SSF) (cf. Definition 3.2.3). The abbreviation s ≈m t used above is based on unary predicate symbols. It can only account for exponentially many domain elements in the length of the abbreviated formula, which is linear in the parameter m. This is typical for SSF.

We can replace this approach by a more sophisticated one that makes better use of the potential of SF and allows for more succinct representations. The main conceptual idea is that we use unary predicates L 1 , . . . , L n-1 to define sets L A 1 , . . . , L A n-1 accompanied with increasing upper bounds on their cardinality 2 m , 2 2 m , . . . , 2 ↑n-1 (m). To this end, for all positive m, n and every with 2 ≤ ≤ n -1 we recursively define the abbreviations

u ≈ m,n v u ≈1 m,1 v := m i=1 Q i (u) ↔ Q i (v)
and, for n ≥ 2 we set

u ≈1 m,n v := L 1 (u) ∧ L 1 (v) ∧ m i=1 Q i (u) ↔ Q i (v) and u ≈ m,n v := L (u) ∧ L (v) ∧ ∀x. L -1 (x) → ∃y. (x ≈ -1 m,n y) ∧ R (x, u) ↔ R (y, v) and u ≈n m,n v := ∀x. L n-1 (x) → ∃y. (x ≈n-1 m,n y) ∧ R n (x, u) ↔ R n (y, v) .
Notice that for every formula u ≈ m,n v, 1 ≤ ≤ n, we can partition vars(u ≈ m,n v) into two disjoint sets X, Y that are separated in the formula, and we have u ∈ X and v ∈ Y . Moreover, any variable that is universally quantified in u ≈ m,n v belongs to X, while Y contains all existentially quantified variables. Also note that no quantifier in the formula occurs within the scope of a negation sign or in the antecedent of an implication. Regarding formula length, we observe len u ≈1 m,n v ∈ O(m), and len u ≈ m,n v ∈ O( + m) for every with 2 ≤ ≤ n.

Based on these abbreviations for a separated variant of equality, we define the following sentences for all m ≥ 1 and n ≥ 2:

χ m,1 χ m,k := ∀xx . (x ≈1 m,1 x ) → x ≈ x and χ m,n := ∀xx . (x ≈1 m,n x ) → x ≈ x ∧ n-1 =2 ∀xx . L (x) ∧ L (x ) → ∃y∀y . L -1 (y) → (y ≈ -1 m,n y ) ∧ R (y , x) ↔ R (y , x ) → x ≈ x ∧ ∀xx ∃y∀y . L n-1 (y) → (y ≈n-1 m,n y ) ∧ R n (y , x) ↔ R n (y , x ) → x ≈ x .
Due to the syntactic properties of the formulas u ≈ m,n v regarding the separateness of variables, the sentences χ m,n belong to SF, if we transform them into prenex normal form by simply shifting all quantifiers to the front. The only obstacle is the implicit negation sign in front of (y ≈ -1 m,n y ) and similar formulas in the antecedent of implications. However, this neatly fits with the fact that y is existentially quantified and y universally. Regarding formula length, we observe len χ m,1 ∈ O(m), and len

χ m,n ∈ O(n 2 + n • m) for every n ≥ 2.
We can extend Lemma 3.3.5 also to the new separated equality ≈ m,n in the following way.

Lemma 3.3.7. Let A be any structure, let β be any variable assignment over A's domain. Suppose we have A |= χ m,n for two integers m, n ≥ 1. For every with 1 ≤ ≤ n -1 and all first-order variables u, v we get A,

β |= u ≈ m,n v if and only if A, β |= u ≈ v ∧ L (u) ∧ L (v). Moreover, we have A, β |= u ≈n m,n v if and only if A, β |= u ≈ v.
We next observe that the sentences χ n m,n restrict the size of domains.

Lemma 3.3.8. Let m, n ≥ 1 and let A be any model of χ m,n . For every k, 1 ≤ k ≤ n -1, the set L A k contains at most 2 ↑k (m) domain elements. Moreover, A's domain contains at most 2 ↑n (m) elements.

Proof. In case of A |= χ m,k with k = 1, any two elements a, b ∈ A that are not distinguishable by their membership in the sets Q A 1 , . . . , Q A m are identical. Hence, A cannot contain more than 2 m = 2 ↑1 (m) distinct elements.

In order to prove the first half of the lemma for n ≥ 2 under the assumption A |= χ m,n , we proceed by induction on k, starting with k = 1. The base case k = 1 is easy to settle, as any two elements a, b ∈ L A 1 that are not distinguishable by their membership in the sets Q A 1 , . . . , Q A m,n have to be identical in A. Hence, L A 1 cannot contain more than 2 m = 2 ↑1 (m) distinct elements. Consider any k with 1 < k ≤ n -1. By induction, the set L A k-1 contains at most 2 ↑k-1 (m) elements. The sentence χ m,n contains the following conjunct for every with 2 ≤ ≤ n -1:

∀xx . L (x) ∧ L (x ) → ∃y∀y . L -1 (y) → (y ≈ -1 m,n y ) ∧ R (y , x) ↔ R (y , x ) → x ≈ x .
The intended meaning of this sentence coincides with the following non-separated sentence:

ψ m, ψ m, := ∀xx . L (x) ∧ L (x ) → ∀y. L -1 (y) → R (y, x) ↔ R (y, x ) → x ≈ x |=| ∀xx . L (x) ∧ L (x ) → ∀y. L -1 (y) → ∃y . y ≈ y ∧ R (y , x) ↔ R (y , x ) → x ≈ x |=| ∀xx . L (x) ∧ L (x ) → ∃y∀y . L -1 (y) → y ≈ y ∧ R (y , x) ↔ R (y , x ) → x ≈ x ,
where we could take the last line and replace the equation y ≈ y with its separated variant y ≈ -1 m,n y to obtain the above conjunct. By virtue of (a slightly adapted variant of) Lemma 3.3.7, this replacement preserves semantics.

It is easy to see that A |= ψ m, entails that any two domain elements a, b

∈ L A are identical, if the two sets a, c ∈ R A c ∈ L A -1 and b, c ∈ R A c ∈ L A -1 coincide.
Recall that the inductive hypothesis says that the set L A -1 contains at most 2 ↑ -1 (m) elements. Hence, A |= ψ m, entails that the set L A contains at most 2 |L A -1 | ≤ 2 2 ↑ -1 (m) = 2 ↑ (m) domain elements. Finally, the conjunct

∀xx ∃y∀y . L n-1 (y) → (y ≈n-1 m,n y ) ∧ R n (y , x) ↔ R n (y , x ) → x ≈ x
in the sentence χ m,n has the following intended meaning:

∀xx . ∀y. L n-1 (y) → R n (y, x) ↔ R n (y, x ) → x ≈ x .
As we have already shown that A |= χ m,n entails |L A n-1 | ≤ 2 ↑n-1 (m), we conclude that A |= χ m,n also implies that A's domain A contains at most 2 ↑n (m) elements.

As a counterpart to the upper bound result in Lemma 3.3.8, we observe that χ m,n does not restrict the cardinality of models further than this. Lemma 3.3.9. Let A be any structure whose domain contains at most 2 ↑n (m) elements. There is a model A |= χ m,n over the same domain that differs from A only in its interpretation of the predicate symbols L 1 , . . . , L n-1 , R 2 , . . . , R n , Q 1 , . . . , Q m .

We use Lemmas 3.3.8 and 3.3.9 to derive a much stronger variant of Proposition 3.3.4. Abstractly speaking, it states that, when restricted to models of the size 2 ↑n (m), any first-order sentence can be translated into an equisatisfiable SF sentence whose length is polynomial in n, m, and the length of the original sentence.

Lemma 3.3.10. Let m, n be two positive integers with m ≥ 1 and n ≥ 2. There exists an effective translation T m,n T m,n mapping relational first-order sentences ϕ to SF sentences ϕ SF that satisfy the following properties. For every relational sentence ϕ, which does not contain the predicate symbols

L 1 , . . . , L n-1 , R 2 , . . . , R n , Q 1 , . . . , Q m , we have (a) χ m,n ∧ ϕ |=| χ m,n ∧ T m,n (ϕ), (b
) the formula length of T m,n (ϕ) is at most p(m, n) • len(ϕ) for some polynomial p(m, n), and (c) T m,n (ϕ) is computable in time q(m, n, len(ϕ)) for some polynomial q(m, n, k).

Proof. The translation T m,n is very similar to the one we have already sketched above. First, we transform ϕ into negation normal form. We construct ϕ SF from ϕ by consecutively replacing each subformula of the form ∃y. ψ in ϕ with ∃y∀v. y ≈n m,n v → ψ y/v , where we assume v to be fresh (one fresh variable for each replaced subformula). Finally, all quantifiers are shifted to the front of the sentence.

We have observed earlier that any variable set vars(y ≈n m,n v) can be partitioned into two sets X, Y that are separated in the subformula y ≈n m,n v, where all universally quantified variables are collected in X and all existentially quantified variables belong to Y . Since the introduced subformulas y ≈n m,n v always occur in the antecedent of implications and are, hence, subject to one implicit negation, the constructed sentence ϕ SF is indeed an SF sentence. The semantic equivalence of the formulas χ m,n ∧ ϕ and χ m,n ∧ ϕ SF follows from Proposition 3.3.6 and Lemma 3.3.7. Lemma 3.3.10 has interesting consequences. For instance, concerning the computational hardness of SF's satisfiability problem. The following theorem entails that SF-Sat is computationally at least as hard as the satisfiability problem for any first-order fragment that enjoys a small model property with an elementary upper bound on the size of small models. For instance, the fragments AF, GKS, FO 2 , and GF fall into this category. Even the satisfiability problem for first-order fragments enjoying a small model property with bounds 2 ↑ c•len(ϕ) ( d • len(ϕ) ) for constants c, d, such as FL, can be polynomially reduced to SF-Sat. Although this latter observation already yields a non-elementary lower bound regarding the computational complexity of SF-Sat, we shall derive a more accurate lower bound in Section 5.3 by encoding bounded domino problems.

Theorem 3.3.11. Consider any nonempty class C of relational first-order sentences for which we know two constants c, d ≥ 1 such that every satisfiable ϕ in C has a model whose domain contains at most 2 ↑ c•len(ϕ) ( d • len(ϕ) ) elements. The satisfiability problem for C is polynomial-time reducible to SF-Sat.

Proof. We use the translations T m,n from Lemma 3.3.10 for the reduction from C's satisfiability problem to SF-Sat. Given any sentence ϕ from C, we compute m := d • len(ϕ) and n := c • len(ϕ) . Without loss of generality, we assume that ϕ does not contain any of the predicate symbols L 1 , . . . , L n-1 , R 2 , . . . , R n , Q 1 , . . . , Q m . Next, we construct the sentence χ m,n ∧ T m,n (ϕ). By Lemma 3.3.10, this can be done in time that is polynomial in len(ϕ) and thus also polynomial in ϕ . By Lemma 3.3.9, any model A |= ϕ whose domain contains at most 2 ↑ c•len(ϕ) ( d • len(ϕ) ) elements can be extended to a model A |= χ m,n ∧ ϕ over the same domain. Hence, if ϕ is satisfiable, then there is some model

A |= χ m,n ∧ ϕ with |A | ≤ 2 ↑ c•len(ϕ) ( d • len(ϕ) )
. By Lemma 3.3.10, A is also a model of χ m,n ∧ T m,n (ϕ). On the other hand, any model of χ m,n ∧ T m,n (ϕ) yields a model of ϕ.

Remark 3.3.12. The restriction of Theorem 3.3.11 to classes over relational vocabularies is not essential. It is folklore knowledge that every first-order sentence containing function symbols can be converted into an equisatisfiable sentence over some relational vocabulary. The function symbols are replaced with predicate symbols that represent the respective function graph. This conversion causes a blowup that is only linear in the length of the original formula. For example, the sentence ∀x. P (f (x)) ∨ f (x) ≈ c with function symbols f and c is converted into the equisatisfiable sentence

∀xyz. Q c (z) ∧ Q f (x, y) → P (y) ∨ y ≈ z ∧ ∃z. Q c (z) ∧ ∀uv. Q c (u) ∧ Q c (v) → u ≈ v ∧ ∀u∃w. Q f (u, w) ∧ ∀uvw. Q f (u, v) ∧ Q c (u, w) → v ≈ w .
Employing the ideas underlying Lemma 3.3.10, one can also derive other lower bounds regarding the length of sentences that are equivalent to SF sentences but adhere to certain syntactic restrictions. We have already seen a result in this direction in Section 3.2, namely, Theorem 3.2.7, which described a non-elementary gap between the length of SF sentences and shortest equivalent BSR sentences. A classical result by Gaifman [START_REF] Gaifman | On Local and Non-Local Properties[END_REF] states that every first-order formula is equivalent to some formula that is local in a certain sense (see below). It has been shown later [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] that there is a non-elementary gap between the length of first-order sentences and their shortest equivalents in Gaifman normal form. We intend to prove that this gap also applies to the separated fragment. But first we need some preliminary definitions, mainly taken over from [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] (see also the textbooks [START_REF] Ebbinghaus | Finite model theory[END_REF][START_REF] Libkin | Elements of Finite Model Theory[END_REF]).

Fix any relational vocabulary Σ and let A be any Σ-structure. The Gaifman graph of A is the undirected, loop-free graph G A G A over the vertex set A and the edge set E that satisfies the following property. The set E contains an edge a, b if and only if there is some m-ary predicate symbol P in Σ, some tuple c 1 , . . . , c m ∈ P A , and two distinct indices i, j with a = c i and b = c j . The distance between two domain elements

a, b ∈ A in A is denoted by dist A (a, b) dist A (a, b)
and is defined to be the length of the shortest path from a to b in G A -the length of a path is the number of edges on the path. For every nonnegative integer r and every domain element a ∈ A the r-neighborhood of a in A is the set {b ∈ A | dist A (a, b) ≤ r}. The substructure of A induced by this set is denoted by N r A (a) N r A (a) . For every nonnegative integer r let dist >r (x, y) be a first-order formula stipulating that the distance between x and y is at least r + 1. A first-order formula ψ(x) is r-local if for every structure A and every a ∈ A we have A |= ψ(a) if and only if N r A (a) |= ψ(a). A basic local sentence basic local sentence is a sentence of the form

∃x 1 . . . x k . 1≤i<j≤k dist >2r (x i , x j ) ∧ 1≤i≤k ψ(x i ) ,
where ψ(x) is r-local. A first-order sentence ϕ is said to be in Gaifman normal form Gaifman normal form if it is a Boolean combination of basic local sentences.

Proposition 3.3.13 (Gaifman [Gai82]). Every relational first-order sentence is equivalent to some first-order sentence in Gaifman normal form.

Dawar et al. [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] present a class of first-order sentences ϕ that are non-elementarily more succinct than the shortest equivalent sentences ϕ in Gaifman normal form. The main tool for the proof is an encoding of nonnegative integers by trees, introduced in Section 10.3 of [START_REF] Flum | Parameterized Complexity Theory[END_REF], and succinct first-order formulas for handling these trees. Definition 3.3.14 (Encoding integers by trees (adapted from [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF], Definition 1)). For nonnegative integers i, n we write bit(i, n) bit(i, n)

to denote the i-th bit in the binary representation of n; the least significant bit is bit(0, n). We define the tree representation T (n) T (i)

for any integer n inductively as follows. T (0) is the tree consisting only of the root node. For n > 0 the tree T (n) is obtained by creating a new root node and attaching to it all trees T (i) for which bit(i, n) = 1.

In Figure 3.1 the tree encoding is illustrated. Notice that the number of sons of the root node equals the number 1-bits in the binary representation of the encoded integer. Further examples can be found in [START_REF] Flum | Parameterized Complexity Theory[END_REF], page 251.

The height of a tree T (n) and the number n represented by it are related as follows.

Proposition 3.3.15 ([FG06], Lemma 10.20). For every tree T let height(T ) be the number of edges along the longest path from the root of T to any leaf in T . Then, for all nonnegative integers h, n we have height(T (n)) ≤ h if and only if n < 2 ↑h (1).

In addition, we establish the following upper bound regarding the total number of nodes in any tree T (n).

Lemma 3.3.16. For every nonnegative n let h(n

) := height(T (n)) h(n)
. The number of nodes in a tree T (n) is at most 2 ↑h(n)+1 (1). Proof. Whenever we refer to trees in this proof, we mean trees that encode integers in the sense of Definition 3.3.14. Fix any nonnegative integer n. Let h := h(n). We proceed by induction on h.

Base cases h = 0 and h = 1. The only tree with height 0 is T (0), which contains 1 ≤ 2 = 2 ↑1 (1) nodes. Moreover, there is only one tree of height 1, namely T (1). This tree contains 2 ≤ 4 = 2 ↑2 (1) nodes.

Inductive case h > 1. For every h ≥ 0 let trees(h ) denote the number of distinct trees of height h and let nodes(h ) denote the maximal number of nodes in any tree of height h . We observe the following:

nodes(h) ≤ 1 + h-1 i=0 trees(i) • nodes(i) ≤ 1 + nodes(h -1) IH ≤ 2 ↑h (1) • h-1 i=0 trees(i) = 2 ↑h-1 (1) ≤ 1 + 2 ↑h (1) • 2 ↑h-1 (1) ≤ 2 2•2 ↑h-1 (1)
≤ 2 2 ↑h (1) = 2 ↑h+1 (1)

One of the main results in [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] is the following lower bound regarding the length of sentences in Gaifman normal form. Proposition 3.3.17 ([DGKS07a], Theorem 2). Let Σ := {E}, ∅ be a vocabulary where E is a binary predicate symbol. For every h ≥ 1 there is a first-order Σ-sentence ϕ h of length O(h 4 ) such that every first-order Σ-sentence in Gaifman normal form that is equivalent to ϕ h on the class F ≤h F ≤h of finite forests (of pairwise distinct trees) of height at most h has length at least 2 ↑h (1).

Although there does not seem to be an obvious way to transfer this result to the realm of SF by straightforward application of Lemma 3.3.10, the underlying ideas facilitate the derivation of a similar lower bound for SF.

Theorem 3.3.18. There is some vocabulary Σ and some polynomial p(h) such that for every h ≥ 0 there is an SF Σ-sentence ϕ SF,h of length p(h) satisfying the following property. Every first-order Σ-sentence ψ in Gaifman normal form that is equivalent to ϕ SF,h has length at least 2 ↑h (1).

Proof sketch. Let Σ := Π, ∅ be the vocabulary where Π contains the unary predicate symbols Red, Blue, 2 ↑n for any positive integer n. Given some Σ-structure A, a domain element a ∈ A is considered to be red if a ∈ Red A ; it is considered blue if a ∈ Blue A ; and it is considered black if it is neither red nor blue. We call any given subset of A's domain red, blue, or black, if all of its elements have the respective color. The predicate symbol E serves as the edge relation for directed graphs, in particular forests of rooted trees.

Q r 1 , Q b 1 , Q r 2 , Q b 2 , . . . and L r 1 , L b 1 , L r 2 ,
For every positive integer h let CF h CF h be the set of Σ-structures F h,k which we define as follows. For all nonnegative integers h, k with h ≥ 1 and k ≥ 0, we define the structure F h,k F h,k to contain the trees T (0), . . . , T (2 ↑h+2 -1), each colored entirely red or blue; none of the nodes in any tree in F h,k is red and blue at the same time. Every tree in F h,k , except for T (k), is colored blue; T (k) is red. Every tree occurs at most once, no matter its color, e.g. if there is a red tree T ( ), then there is neither another red tree T ( ) nor a blue T ( ) in F h,k . In addition to the trees, there are two disjoint sets, each consisting of 2 ↑h+3 pairwise distinct black domain elements a 1 , . . . , a 2 ↑h+3 ∈ F h,k and b 1 , . . . , b 2 ↑h+3 ∈ F h,k , none of which occurs in any edge in F h,k 's edge relation E F h,k . We do not consider these a i , b j as trees T (0). Figure 3.2 illustrates the exemplary structure F 0,1 .

Across all the structures in the class CF h we fix some interpretation of the predicate symbols

L b i , L r i , Q b i , Q r i , R b i
, and R r i and make sure that the following restrictions are obeyed. These predicates will be used in the same manner as we have already used them previously -the L b i , Q b i , R b i will be used to enforce an upper bound regarding the size of the blue part of F h,k and for identifying blue elements in a separated fashion, and the L r i , Q r i , R r i will serve the same purpose in the red part of F h,k . For every F h,k ∈ CF h we assume the following properties.

• For every , 1 ≤ ≤ h + 3, we have a 1 , . . . ,

a 2 ↑ ∈ L b F h,k and b 1 , . . . , b 2 ↑ ∈ L r F h,k . • For all distinct a i , a i ∈ L b 1 F h,k there is some Q b j with a i ∈ Q b j F h,k and a i ∈ Q b j F h,k or vice versa. The analogous property shall hold for distinct b i , b i ∈ L r 1 F h,k and the sets Q r j F h,k .
• For every , 2 ≤ ≤ h + 3, and all distinct a i ,

a i ∈ L b F h,k there is some element a ∈ L b -1 F h,k with a , a i ∈ R b F h,k and a , a i ∈ R b F h,k or vice versa. The analogous property shall hold for distinct b i , b i ∈ L r F h,k , some element b ∈ L r -1
F h,k , and the set R r F h,k .

• For any two distinct tree nodes c, d ∈ Blue F h,k there is some • If = k, then for every i,

a i ∈ L b h+2 F h,k with a i , c ∈ R b F h,k and a i , d ∈ R b F h,
1 ≤ i ≤ 2 ↑h+3 , we have F h,k |= R r h+4 (b i , c) if and only if F h,k |= R b h+4 (a i , d). • If = k , then for every i, 1 ≤ i ≤ 2 ↑h+3 , we have F h,k |= R b h+4 (a i , c) if and only if F h,k |= R r h+4 (b i , d). • If = k, k , then for every i, 1 ≤ i ≤ 2 ↑h+3 , we have F h,k |= R b h+4 (a i , c) if and only if F h,k |= R b h+4 (a i , d). T (0) T (1) T (2) T (3) a 1 a 2 a 3 a 4 L b 1 L b 2 b 1 b 2 b 3 b 4 L r 1 L r 2 Figure 3
.2: Illustration of the structure F 0,1 .

We now start constructing the sentences ϕ SF,h for any h ≥ 0. First, we create two variants of the abbreviations u ≈ m,n v, namely a red variant u ≈r, m,n v and a blue variant u ≈b,

m,n v u ≈r, m,n v, u ≈b, m,n v
, where all

Q i , L i , R i are replaced by Q r i , L r i , R r i and Q b i , L b i , R b i
, respectively, and the recursive reference to x ≈ m,n is replaced by x ≈r, m,n y and x ≈b, m,n y, respectively. This replacement does not significantly change the length of the formulas, i.e. len u ≈b, m,n v and len u ≈r, m,n v are polynomial in m and . Based on these new formulas, we define variants of the sentences χ m,n with n ≥ 2 as follows:

χ r m,n , χ b m,n χ r m,n := ∀xx . (x ≈r,1 m,n x ) → x ≈ x ∧ n-1 =2 ∀xx . L r (x) ∧ L r (x ) → ∃y∀y . L r -1 (y) → (y ≈r, -1 m,n y ) ∧ R r (y , x) ↔ R r (y , x ) → x ≈ x ∧ ∀xx . Red(x) ∧ Red(x ) → ∃y∀y . L r n-1 (y) → (y ≈r,n-1 m,n y ) ∧ R r n (y , x) ↔ R r n (y , x ) → x ≈ x and χ b m,n := ∀xx . (x ≈b,1 m,n x ) → x ≈ x ∧ n-1 =2 ∀xx . L b (x) ∧ L b (x ) → ∃y∀y . L b -1 (y) → (y ≈b, -1 m,n y ) ∧ R b (y , x) ↔ R b (y , x ) → x ≈ x ∧ ∀xx . Blue(x) ∧ Blue(x ) → ∃y∀y . L b n-1 (y) → (y ≈b,n-1 m,n y ) ∧ R b n (y , x) ↔ R b n (y , x ) → x ≈ x .
Compared to the original χ m,n , the changes are basically the same as the changes made in the abbreviations u ≈r, m,n v and u ≈b, m,n v. Moreover, in the third conjunct of χ r m,n and χ b m,n the antecedents Red(x) ∧ Red(x ) and Blue(x) ∧ Blue(x ) are added. The result is that χ r m,n does not restrict the whole domain of any model A |= χ r m,n to a certain cardinality, but only the number of domain elements that belong to the set Red A . A similar effect applies to the sentence χ b m,n with respect to the set Blue A . Regarding formula length, we observe that both len χ b m,n and len χ r m,n lie in O(n 2 + n • m) for every n ≥ 2. We borrow the following formulas from [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF], the full version of [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF], listed with their intended meaning: eq h (x, y) the subtrees with roots x and y, respectively, represent the same tree T (m) for some m < 2 ↑h , encoding h (x) the element x is indeed the root of a subtree T (m) for some m < 2 ↑h , less h (x, y) the subtree with root x represents a tree T (m) for some m < 2 ↑h and the subtree with root y represents a tree T (m ) for some m with m < m < 2 ↑h , min(x) the subtree with root x represents the tree T (0), max h (x) the subtree with root x represents the tree T 2 ↑h -1 , succ h (x, y) for the two subtrees T x , T y with root x, y, respectively, we have that if T x represents the tree T (m) with m < 2 ↑h -1, then T y represents the tree T (m + 1).

The following formula definitions are taken over from [START_REF] Flum | Parameterized Complexity Theory[END_REF], Section 10.3 (eq 0 (x, y) and eq h (x, y)), and from [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] (encoding h (x), less h (x, y), min(x), max h (x), and succ h (x, y)). The definitions containing the parameter h are meant for positive h. eq 0 (x, y) := true eq h (x, y) := ∃u. E(x, u) ↔ ∃v. E(y, v)

∧ ∀w. E(x, w) → ∃z. E(y, z) ∧ ∀z . E(y, z ) → ∃w . E(x, w ) ∧ ∀uv. u ≈ w ∧ v ≈ z ∨ u ≈ w ∧ v ≈ z → eq h-1 (u, v) encoding 0 (x) := ∀x . ¬E(x, x ) encoding h (x) := ∀x . E(x, x ) → encoding h-1 (x ) ∧ ∀x x . E(x, x ) ∧ E(x, x ) ∧ x ≈ x → ¬eq h-1 (x , x ) less 0 (x, y) := false less h (x, y) := ∃y . E(y, y ) ∧ ∀x . E(x, x ) → ¬eq h-1 (x , y )
∧ ∀x . E(x, x ) ∧ less h-1 (y , x ) → ∃y . E(y, y ) ∧ eq h-1 (x , y ) min(x) := ∀x . ¬E(x, x ) succ 0 (x, y) := false succ h (x, y) := ∃y . E(y, y )

∧ ∀y . E(y, y ) ∧ y ≈ y → less h-1 (y , y ) ∧ ∀x . E(x, x ) → ¬eq h-1 (x , y ) ∧ ∀y . E(y, y ) ∧ less h-1 (y , y ) → ∃x . E(x, x ) ∧ eq h-1 (x , y ) ∧ ∀x . E(x, x ) ∧ less h-1 (y , x ) → ∃y . E(y, y ) ∧ eq h-1 (y , x ) ∧ ¬min(y ) → ∃x . E(x, x ) ∧ min(x ) ∧ ∀x . E(x, x ) ∧ less h-1 (x , y ) → ∃z. succ h-1 (x , z) ∧ z ≈ y ∨ E(x, z) max 0 (x) := ∀x . ¬E(x, x ) max h (x) := ∃y. E(x, y) ∧ min(y) ∧ ∀x . E(x, x ) → max h-1 (x ) ∨ ∃y. E(x, y) ∧ succ h-1 (x , y) max 0 (x) := ∀x . ¬E(x, x ) max h (x) := encoding h (x) ∧ max h (x)
All of these formulas are based on the vocabulary {E}, ∅ and have a length that is polynomial in h. In addition to the formulas defined so far, we use the abbreviation root(x) := Red(x) ∨ Blue(x) ∧ ∀x . ¬E(x , x) . This brings us one step closer to the definition of the sentences ϕ SF,h . In order to illustrate the general ideas, we first construct intermediate sentences. For every h ≥ 0 we define the sentence ϕ h ϕ h as follows, where we draw some inspiration from the proof of Theorem 2 in [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF] (Theorem 4.3 in [START_REF] Dawar | Model Theory Makes Formulas Large[END_REF]):

ϕ h := χ r 1,h+4 ∧ χ b 1,h+4 ∧ ∀xx . Red(x) ∧ E(x, x ) → Red(x ) ∧ ∀xx . Blue(x) ∧ E(x, x ) → Blue(x ) ∧ ∀x. Red(x) → ¬Blue(x) ∧ ∀x. ¬Red(x) ∧ ¬Blue(x) ↔ h+3 i=1 L r i (x) ∨ L b i (x)
∧ ∃y. root(y) ∧ min(y)

∧ ∀x. root(x) → max h+2 (x) ∨ ∃y. root(y) ∧ succ h+2 (x, y) .

By virtue of Lemma 3.3.16, we conclude that F h,k |= χ r 1,h+4 ∧ χ b 1,h+4 holds for every F h,k ∈ CF h . Hence, the definition of the class CF h entails that every

F h,k ∈ CF h is a model of ϕ h .
Obviously, the sentence ϕ h is not in SF. The problematic parts are the two last conjuncts. In order to fix this, we need to find separated variants of the formulas eq h (x), encoding h (x), less h (x, y), min(x), max h (x), succ h (x), and root(x). To this end, we define the following colorguarded variants of these formulas: eq b h (x), eq r h (x), encoding b h (x), encoding r h (x), less b,b h (x, y), less b,r h (x, y), less r,b h (x, y), less r,r h (x, y), root b (x), root r (x), and so on. For the two-argument formulas the superscript r,b and similar ones indicate the expected color of the first and second argument, respectively. We exemplary show only the definition of some of these variants, the others are constructed in an analogous way. The definitions are tentative in the sense that we still need to transform the formulas so that they can ultimately be used to construct an SF sentence. eq b,r 0 (x, y) := Blue(x) ∧ Red(y) eq b,r h (x, y) := Blue(x) ∧ Red(y) ∧ ∃u. Blue(u) ∧ E(x, u) ↔ ∃v. Red(v) ∧ E(y, v)

∧ ∀w. Blue(w) ∧ E(x, w) → ∃z. Red(z) ∧ E(y, z) ∧ ∀z . Red(z ) ∧ E(y, z ) → ∃w . Blue(w ) ∧ E(x, w ) ∧ ∀u. Blue(u) → ∀v. Red(v) → u ≈ w ∧ v ≈ z ∨ u ≈ w ∧ v ≈ z → eq b,r h-1 (u, v) encoding b 0 (x) := Blue(x) ∧ ∀x . Blue(x ) → ¬E(x, x ) encoding b h (x) := Blue(x) ∧ ∀x . Blue(x ) ∧ E(x, x ) → encoding b h-1 (x ) ∧ ∀x x . Blue(x ) ∧ Blue(x ) ∧ E(x, x ) ∧ E(x, x ) ∧ x ≈ x → ¬eq b,b h-1 (x , x ) less b,r 0 (x, y) := false less b,r h (x, y) := Blue(x) ∧ Red(y) ∧ ∃y . Red(y ) ∧ E(y, y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) → ¬eq b,r h-1 (x , y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) ∧ less r,b h-1 (y , x ) → ∃y . Red(y ) ∧ E(y, y ) ∧ eq b,r h-1 (x , y ) min b (x) := Blue(x) ∧ ∀x . Blue(x ) → ¬E(x, x ) succ b,b 0 (x, y) := false succ b,b h (x, y) := Blue(x) ∧ Blue(y) ∧ ∃y . Blue(y ) ∧ E(y, y ) ∧ ∀y . Blue(y ) ∧ E(y, y ) ∧ y ≈ y → less b,b h-1 (y , y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) → ¬eq b,b h-1 (x , y ) ∧ ∀y . Blue(y ) ∧ E(y, y ) ∧ less b,b h-1 (y , y ) → ∃x . Blue(x ) ∧ E(x, x ) ∧ eq b,b h-1 (x , y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) ∧ less b,b h-1 (y , x ) → ∃y . Blue(y ) ∧ E(y, y ) ∧ eq b,b h-1 (y , x ) ∧ ¬min b (y ) → ∃x . Blue(x ) ∧ E(x, x ) ∧ min b (x ) ∧ ∀x . Blue(x ) ∧ E(x, x ) ∧ less b,b h-1 (x , y ) → ∃z. Blue(z) ∧ succ b,b h-1 (x , z) ∧ z ≈ y ∨ E(x, z) succ b,r 0 (x, y) := false succ b,r h (x, y) := Blue(x) ∧ Red(y) ∧ ∃y . Red(y ) ∧ E(y, y ) ∧ ∀y . Red(y ) ∧ E(y, y ) ∧ y ≈ y → less r,r h-1 (y , y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) → ¬eq b,r h-1 (x , y ) ∧ ∀y . Red(y ) ∧ E(y, y ) ∧ less r,r h-1 (y , y ) → ∃x . Blue(x ) ∧ E(x, x ) ∧ eq b,r h-1 (x , y ) ∧ ∀x . Blue(x ) ∧ E(x, x ) ∧ less r,b h-1 (y , x ) → ∃y . Red(y ) ∧ E(y, y ) ∧ eq r,b h-1 (y , x ) ∧ ¬min r (y ) → ∃x . Blue(x ) ∧ E(x, x ) ∧ min b (x ) ∧ ∀x . Blue(x ) ∧ E(x, x ) ∧ less b,r h-1 (x , y ) → ∃z. Blue(z) ∧ succ b,b h-1 (x , z) ∧ E(x, z) ∨ ∃z. Red(z) ∧ succ b,r h-1 (x , z) ∧ z ≈ y max 0 b (x) := Blue(x) ∧ ∀x . Blue(x ) → ¬E(x, x ) max h b (x) := Blue(x) ∧ ∃y. Blue(y) ∧ E(x, y) ∧ min b (y) ∧ ∀x . Blue(x ) ∧ E(x, x ) → max b h-1 (x ) ∨ ∃y. Blue(y) ∧ E(x, y) ∧ succ b,b h-1 (x , y) max b 0 (x) := Blue(x) ∧ ∀x . Blue(x ) → ¬E(x, x ) max b h (x) := Blue(x) ∧ encoding b h (x) ∧ max b h (x) root b (x) := Blue(x) ∧ ∀x . Blue(x ) → ¬E(x , x)
Notice that all quantifiers in the above formulas are guarded by color guards such that every subformula of the form ∀x. η for any variable x and any formula η is either equivalent to ∀x. Blue(x) → η or to ∀x. Red(x) → η for some η . Similarly, every subformula of the form ∃y. η for any variable y and any η is either equivalent to ∃y. Blue(y) ∧ η or to ∃y. Red(y) ∧ η for some η . Regarding the length of formulas, it is easy to check that the length is polynomial in h for most of the formulas. For succ b,b h (x, y) this also holds true, as there is only one recursive reference to succ b,b h-1 (x , z). For succ b,r h (x, y) the matter is slightly more complicated. We have one recursive reference to succ b,b h-1 (x , z) and one to succ b,r h-1 (x , z). But we have already discussed that succ b,b h-1 (x , z) is a formula of polynomial length in h. Hence, the overall length of succ b,r h (x, y) is also polynomial in h. Notice that the slightly optimized definition of succ b,b h (x, y) -and, by analogy, also of succ r,r h (x, y) -is necessary to avoid an exponential length of the formulas succ b,r h (x, y) and succ r,b h (x, y). For the rest of the present proof we use the abbreviations u ≈b h+4 v and u ≈r h+4 v u ≈b h+4 v, u ≈r h+4 v instead of u ≈b,h+4

1,h+4 v and u ≈r,h+4 1,h+4 v, respectively. We finalize the definition of the above formulas in two steps. In the first step, we push negation signs into the scope of quantifiers so that no quantifier lies within the scope of any negation sign. In the second step, we successively replace every subformula of the form ∃y. Blue(y) ∧ η with ∃y. Blue(y) ∧ ∀v. Blue(v) ∧ y ≈b h+4 v → η y/v , where we assume v to be fresh (one fresh variable for every replaced subformula). We proceed analogously for every subformula of the form ∃y. Red(y) ∧ η. The outlined transformations lead to formulas whose length is still polynomial in h.

With these tools at hand, we can now define the sentence ϕ SF,h ϕ SF,h as follows:

ϕ SF,h := χ r 1,h+4 ∧ χ b 1,h+4 ∧ ∀xx . Red(x) ∧ E(x, x ) → Red(x ) ∧ ∀xx . Blue(x) ∧ E(x, x ) → Blue(x ) ∧ ∀x. Red(x) → ¬Blue(x) ∧ ∀x. ¬Red(x) ∧ ¬Blue(x) ↔ h+3 i=1 L r i (x) ∨ L b i (x) ∧ ∃y. Blue(y) ∧ root b (y) ∧ min b (y) ∨ ∃y. Red(y) ∧ root r (y) ∧ min r (y) ∧ ∀x. Blue(x) ∧ root b (x) → max b h+2 (x)
∨ ∃y. Blue(y) ∧ ∀y . Blue(y ) ∧ y ≈b h+4 y → root b (y ) ∧ succ b,b h+2 (x, y ) ∨ ∃y. Red(y) ∧ ∀y . Red(y ) ∧ y ≈r h+4 y → root r (y ) ∧ succ b,r h+2 (x, y )

∧ ∀x. Red(x) ∧ root r (x) → max r h+2 (x)
∨ ∃y. Blue(y) ∧ ∀y . Blue(y ) ∧ y ≈b h+4 y → root b (y ) ∧ succ r,b h+2 (x, y ) ∨ ∃y. Red(y) ∧ ∀y . Red(y ) ∧ y ≈r h+4 y → root r (y ) ∧ succ r,r h+2 (x, y ) .

The sentence ϕ SF,h is not yet in SF. What still causes trouble are the two subformulas root b (x) and root r (x) that occur in the antecedents of implications (all other abbreviated subformulasexcept for y ≈r h+4 y and y ≈b h+4 y -in implications occur exclusively in the respective succedent). Recall that root b (x) abbreviates Blue(x) ∧ ∀x . Blue(x ) → ¬E(x, x ). We define an alternative variant

root b (x) := Blue(x) ∧ ∀x . Blue(x ) → ∃y . Blue(y ) ∧ x ≈b h+4 y ∧ ¬E(y , x) .
Then, a prenex form of any sentence of the form ∀x. Blue(x) ∧ root b (x) → η belongs to SF, if η satisfies the necessary separateness conditions. Shifting the quantifiers from the antecedent of the implication to the front yields

∀x∃x ∀y . Blue(x) ∧ Blue(x) ∧ Blue(x ) → Blue(y ) ∧ x ≈b h+4 y ∧ ¬E(y , x) → η ,
where we can easily check that the separateness conditions are satisfied for the antecedent of the implication. The formula root r (x) is defined in analogy to root b (x). We now replace the subformulas root b (x) and root r (x) in ϕ SF,h that occur in the antecedents of implications with the alternatives root b (x) and root r (x). The result is almost an SF sentence, but technically only a variant of ϕ SF,h is in SF in which all quantifiers are shifted to the front. Shifting quantifiers can be done in a straightforward fashion. This finishes the construction of the sentences ϕ SF,h , each of which has a length polynomial in h. Like for the sentences ϕ h before, it is not hard to check that every F h,k ∈ CF h is a model of ϕ SF,h .

For the rest of this proof we fix some nonnegative integer h ≥ 0. Consider the sentence ϕ SF,h and suppose there is some equivalent sentence ψ ψ in Gaifman normal that has a length of at most 2 ↑h -1. Let η 1 , . . . , η L η , L be a list of all the basic local sentences that occur in ψ. Each η has the form ∃y 1 . . . y j .

1≤i<j≤j dist >2r (y i , y j ) ∧ 1≤i≤j ψ (y i ) . Let K := 1≤ ≤L j K
. By virtue of our assumption regarding the length of ψ, we know that

L ≤ K < 2 ↑h .
The

, . . . , c k, j c k, i such that F h,k |= ψ (c k, i ) holds for every i. Let D k := 1≤ ≤L {c k, 1 , . . . , c k, j } D k
. We distinguish the following two cases, where the set

F r k := Red F h,k ∪ 1≤j≤h-2 L r j F h,k F r k denotes the red part of F h,k :
If there is any k for which none of the domain elements c k, i belongs to F r k , then none of the neighborhoods N r F h,k (c k, i ) contains any elements from F r k . Hence, the substructure F F of F h,k induced by the domain F h,k \ F r k still satisfies any sentence η if and only if ∈ S. Consequently, we have F |= ϕ SF,h . But this contradicts the fact that ϕ SF,h stipulates the presence of all trees T (0), . . . , T (2 ↑h+2 -1) in F , in particular the tree T (k), which does not occur in F .

Otherwise, the red part F r k of each of the structures F h,k ∈ C S * contains at least one of the c k, i ∈ D k . Recall that there are at most L < 2 ↑h distinct r -local formulas in ψ, but at least

2 ↑h structures F h,k in C S * . Let F r h,k F r h,k
be the substructure of F h,k induced by its red part F r k . Then, because of L < 2 ↑h ≤ |C S * |, there must be some k * such that for every ψ with ∈ S * and every

d ∈ F r k * with d = c k * , i
for some i there is some

k d = k * k d such that F r h,k d |= ψ (e) for some e ∈ {c k d , 1 , . . . , c k d , j }. We create a new structure A A
that is the disjoint union of the following structures:

• the substructure F b h,k * F b h,k of F h,k * induced by the blue part of F h,k * , i.e. by the set Blue F h,k * ∪ 1≤j≤h-2 L b j F h,k * ,
• the substructures F r h,k d for every ∈ S * and every d ∈ F r k * with d = c k * , i for some i.

First of all, we notice that A does not contain a representation of the tree T (k * ). Hence, As both cases lead to a contradiction, the sentence ψ cannot exist.

A
One of the interesting aspects of the proof of Theorem 3.3.18 is that -in contrast to the proof of Theorem 3.3.11 -we do not restrict the whole domain to a finite set. Instead, we only restrict subdomains whose elements are affected by non-separated quantification. In Section 5.3.1 we will show related techniques with which we can enforce large-sized subdomains in models for SF sentences.

The results in the present section evidently show that the transformation outlined in Lemma 3.3.10 is a useful tool for proving lower bounds. On the one hand, we have derived lower bounds regarding the computational hardness of SF-Sat. On the other hand, we have shown that for every positive k SF sentences can be k-fold exponentially more succinct than equivalent BSR sentences or equivalent sentences in Gaifman normal form. Unfortunately, the presented translation methodology does not help in the quest for new decidable first-order fragments. The reason is simply that we already need arguments leading to a small model property before we can start the translation process, as we need information about the size of the models that have to be considered.

The Generalized Bernays-Schönfinkel-Ramsey Fragment (GBSR)

In this section we extend the separated fragment even further. Recall that SF contains relational sentences ∃z∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in which the sets x1 ∪ . . . ∪ xn and ȳ1 ∪ . . . ∪ ȳn are separated. The exemption of the leading existential quantifier block from the separateness conditions may lead to certain co-occurrences of existentially and universally quantified variables in atoms. Such co-occurrences are in some sense benign, as they do not pose an obstacle to the construction of algorithms that decide the satisfiability problem. For the moment it is not clear whether the leading existential quantifier block is the only possible source for such nicely behaving co-occurrences with universal variables. Indeed, we shall see shortly that the benign co-occurrences in SF are only the first sign of a more general notion. Exploring this emerging pattern leads to the definition of another decidable fragment of first-order logic, the generalized Bernays-Schönfinkel-Ramsey fragment -GBSR for short. Although the formal definition of GBSR subsumes all SF sentences, it can be considered a natural generalization of the original Bernays-Schönfinkel-Ramsey fragment; hence the name. Intuitively speaking, a GBSR sentence ϕ has the form ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifier-free ψ that may contain equality and possesses the following properties. Each atom in ϕ only contains variables from a subsequence of ϕ's quantifier prefix of the form ∃ * ∀ * . If two atoms share a universally quantified variable, the same quantifier subsequence is used for both atoms. 3 Notice that the idea of restricting subsequences of nested quantifiers (instead of prefixes of sentences in prenex normal form) has also been used for other fragments, e.g. Maslov's fragment K (cf. page 25). Definition 3.4.1 (Generalized Bernays-Schönfinkel-Ramsey fragment (GBSR)). Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be any relational first-order sentence with equality and quantifier-free ψ. Let At be the set of all atoms occurring in ϕ and let x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn . The sentence ϕ belongs to the generalized Bernays-Schönfinkel-Ramsey fragment (GBSR) if and only if we can partition At into sets At 0 , At 1 , . . . , At n such that (i) for every i, 0 ≤ i ≤ n, we have vars(At i ) ⊆ ȳ1 ∪ . . . ∪ ȳi ∪ xi+1 ∪ . . . ∪ xn , and (ii) for all distinct i, j, 0 ≤ i < j ≤ n, we have vars(At i ) ∩ vars(At j ) ∩ x = ∅.

Clearly, the main difference between SF and GBSR lies in the concession policy regarding benign co-occurrences of existential and universal variables. The following example gives a first impression of GBSR sentences and how they can be translated into BSR.

Example 3.4.2. Consider the first-order sentence ϕ := ∃u∀x∃y∀z. P (u, z) ∧ Q(u, x) ∨ P (y, z) ∧ Q(u, y) . It belongs to GBSR, as witnessed by the following partition of its atoms:

At 0 = ∅, At 1 = {Q(u, x)}, At 2 = {P (u, z), P (y, z), Q(u, y)}, At 3 = ∅.
Obviously, ϕ neither belongs to BSR nor to SF. As universal quantification does not distribute over disjunction, the quantifier ∀z cannot be shifted inwards with the standard quantifier shifting rules from Lemma 1.0.1 alone. However, it turns out that the transformation methods that we have first met in Section 2 and which we applied to transform SF sentences into equivalent BSR sentences also facilitate a translations of GBSR sentences into BSR sentences. We shall elaborate on this in Section 3.5. For ϕ we get the equivalent BSR sentence ϕ := ∃uy∀xzv. P (u, x) ∨ P (y, x) ∧ P (u, x) ∧ Q(u, x)

∨ P (u, z) ∨ P (y, z) ∧ Q(u, y) ∧ Q(u, z) ∨ P (u, v) ∨ P (y, v) ∧ Q(u, y) ∧ P (y, v) .
In contrast to SF, it is not immediately clear whether membership in GBSR can be tested efficiently. However, we can easily show that this is indeed the case.

Theorem 3.4.3. Deciding membership of first-order sentences in GBSR can be done deterministically in time that is polynomial in the length of any reasonable encoding of the input sentence.

Proof sketch. Suppose we are given a first-order sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifierfree ψ. Let x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn . We define the undirected graph G ϕ := V, E G ϕ by setting V := x and E := { x, x | there is an atom in ϕ containing both x and x }. A connected component in G ϕ is a maximal subset C ⊆ V such that for all distinct variables x, x ∈ C the transitive closure of E contains the pair x, x . The set of all connected components in G ϕ forms a partition of V . For every connected component C in G ϕ we denote by at(C) at(C) the set of all atoms in ϕ which contain at least one variable from C. For every index k, 1 ≤ k ≤ n, we denote by at k at k the smallest set of atoms such that at k contains all atoms taken from ϕ in which variables from ȳk occur and for every connected component C in G ϕ containing a variable x ∈ vars(at k ) we have at(C) ⊆ at k . We partition the set of all atoms in ϕ into parts at 0 , at 1 , . . . , at n at k

, where at k := at k \ >k at and at 0 collects all atoms in ϕ that do not belong to any at k with k > 0. For every k, 0 ≤ k ≤ n, we write X k X k to address the set vars( at k ) ∩ x.

Claim I:

(i) For all distinct indices k, we have X k ∩ X = ∅.

(ii) For every k we have vars( at k ) ∩ ȳ ⊆ 1≤ ≤k ȳ .

(iii) If we have vars(at k ) ∩ x = ∅ for all k, with 1 ≤ ≤ k ≤ n, then we have for every k ,

1 ≤ k ≤ n, that X k ⊆ k < ≤n x .
Proof: Ad (i): Suppose there are distinct indices k, , k < , and a variable x ∈ X k ∩ X . Then, there must be atoms Claim II yields a criterion to decide whether ϕ belongs to GBSR or not. It remains to convince ourselves that this criterion can be checked deterministically in polynomial time. Given ϕ, the graph G ϕ = V, E can be constructed in time that is quadratic in ϕ . We observe |V | = |x| ≤ |len(ϕ)| and |E| ≤ |x| 2 ≤ len(ϕ) 2 . Using efficient disjoint-set data structures, the connected components of G ϕ and the sets at k can be computed in time that is polynomial in ϕ . The sum of the lengths of the atoms in at 1 , . . . , at n is at most n • len(ϕ) ≤ len(ϕ) 2 . Finally, the test whether we have vars(at k ) ∩ x = ∅ for all k, with 1 ≤ ≤ k ≤ n can be done in time that is polynomial in ϕ .

A k ∈ at k ⊆
GBSR has been advertised as an extension of SF, which in turn contains BSR and MFO. Indeed, given an SF sentence χ := ∃z∀ū 1 ∃v 1 . . . ∀ū n ∃v n . χ , we can partition the set of χ's atoms into two nonempty sets At 1 , At n such that vars(At 1 ) ⊆ z ∪ ū1 ∪ . . . ∪ ūn and vars(At n ) ⊆ z ∪ v1 ∪ . . . ∪ vn . This partition obviously satisfies the requirements of Definition 3.4.1. On the other hand, the sentence ϕ from Example 3.4.2 belongs to GBSR but not to SF. Hence, GBSR is a proper extension of SF. Proposition 3.4.4. GBSR properly contains SF and, hence, BSR and MFO.

By Theorem 3.1.5, GBSR in addition semantically subsumes MFO ≈ , like SF does. We shall discuss two ways of showing that the satisfiability problem for GBSR sentences (GBSR-Sat) GBSR-Sat is decidable. The first approach is of a syntactic nature, based on an effective translation from GBSR into BSR. We elaborate on this in the next section. The second approach uses model-theoretic techniques to directly establish a small model property. In Section 4.2 we will consider model-checking games for GBSR sentences and prove the existence of a special kind of winning strategies that induce finite models for satisfiable GBSR sentences. Both approaches in the end lead to upper bounds on the computational complexity of GBSR-Sat. We shall pick up on this topic in Chapter 5.

Translation of GBSR into BSR

Like for SF there is an effective equivalence-preserving translation from GBSR into BSR. It essentially follows the same lines as the SF-BSR translation and is also mainly based on the standard laws of Boolean algebra and quantifier shifting. However, the additional benign cooccurrences of universally and existentially quantified variables in GBSR sentences require a bit more attention. Roughly speaking, we iteratively (re-)transform a given GBSR sentence into particular syntactic shapes and apply quantifier shifting so that we eventually obtain a formula in which no existential quantifier occurs within the scope of any universal quantifier. We then shift all quantifiers outwards again -existential quantifiers first -, renaming bound variables as necessary. The final result is a BSR sentence. Since GBSR contains SF, Theorem 3.2.7 entails that there is no elementary upper bound on the blowup that we incur in any equivalence-preserving translation from GBSR into BSR. On the other hand, the blowup for GBSR-BSR translations will not be significantly worse than in the case of SF-BSR translations. It seems that in this sense GBSR does not offer much more succintness compared to BSR when describing first-order properties than SF does.

The accuracy of our analysis of the translation from SF into BSR benefited from measuring the degree of separateness between existentially quantified variables that stem from distinct quantifier blocks. Any attempt to a similar analysis for the translation from GBSR into BSR requires a similar, yet more sophisticated measure. The key difference is that we have to deal with the additional benign co-occurrences of universally and existentially quantified variables. An appropriate measure for GBSR sentences is the following Definition 3.5.1 (Degree of interaction for GBSR sentences). Consider any GBSR sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in which ψ is quantifier free. In analogy to Definition 3.2.1, we say that any variable y ∈ ȳj has index j, denoted idx(y) = j idx(y)

. For any nonempty set V ⊆ vars(ϕ) and any positive integer k we say that V has degree k in ϕ, denoted ∂(V, ϕ) = k, if k is the maximal number of distinct variables v 1 , . . . , v k ∈ V with idx(v 1 ) < . . . < idx(v k ). We say that the GBSR sentence ϕ has degree k, denoted

∂ ∃∀ (ϕ) = k ∂ ∃∀ (ϕ)
, if k is the smallest positive integer such that we can partition vars(ϕ) into m > 0 parts V 1 , . . . , V m that are all pairwise separated in ϕ and for which

k = max k j ∂(V j , ϕ) = k j , 1 ≤ j ≤ m .
The analysis of the incurred blowup when translating GBSR into BSR will be significantly more accurate when we base it on the degree of interaction of variables from distinct quantifier blocks rather than on the number of occurring ∀∃-alternations, for instance. Even this difference in the outcome of the analysis cannot be elementarily bounded in the worst case. Lemma 3.5.2. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be any GBSR sentence with quantifier-free ψ. There exists a quantifier-free first-order formula ψ (ū, v) such that ϕ := ∃ū∀v. ψ (ū, v) is in standard form and equivalent to ϕ, and all literals in ϕ also occur in ϕ (modulo variable renaming). Moreover, ū

contains at most |ȳ| 2 • ∂ ∃∀ (ϕ) • 2 ↑∂ ∃∀ (ϕ) (2 • len(ϕ)) ∂ ∃∀ (ϕ) leading existential quantifiers.
Proof sketch. Without losing generality, we assume that ϕ is in standard form. Let At, x, and ȳ be defined as in Definition 3.4.1 and let At 0 , At 1 , . . . , At n At i , L i , X i be some partition in accordance with Definition 3.4.1. Let L 0 , L 1 , . . . , L n be the corresponding partition of the set of literals occurring in ϕ, i.e. every At i is exactly the set of atoms occurring in L i . Furthermore, let X i := vars(L i ) ∩ x. By Definition 3.4.1, we observe the following:

(I) For all distinct indices k, we have X k ∩ X = ∅.

(II) For every k we have vars

(L k ) ⊆ ȳ1 ∪ . . . ∪ ȳk ∪ xk+1 ∪ . . . ∪ xn .
We transform ϕ into an equivalent formula in CNF of the form

∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . i∈I χ (1) i,0 (x 1 , . . . , xn ) ∨ χ (1) i,1 (ȳ 1 , x2 , . . . , xn ) ∨ . . . ∨ χ (1) i,n-1 (ȳ 1 , . . . , ȳn-1 , xn ) ∨ χ (1)
i,n (ȳ 1 , . . . , ȳn ) where (a) the set I is a finite set of indices, (b) the χ (1) i,n (ȳ 1 , . . . , ȳn ) are disjunctions of literals k∈Ki L k (ȳ 1 , . . . , ȳn ) where the sets K i are finite, pairwise disjoint -also disjoint with I -sets of indices, (c) the χ (1) i,j (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) contain exclusively literals from L j . By virtue of Lemma 3.2.4, there is an equivalent formula of the form

ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n . S∈PI\∅ i∈S n-1 j=0 χ (1) i,j (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) ∨ f ∈F ∃ȳ n . i∈S L f (i) (ȳ 1 , . . . , ȳn )
where F is the set of all selection functions over the family of index sets (K i ) i∈I . Applying ordinary quantifier shifting and exploiting the disjointness of the sets X j (cf. (I)), we shift the universal quantifier block ∀x n inwards and thus obtain

ϕ := ∀x 1 ∃ȳ 1 . . . ∃ȳ n-1 . S∈PI\∅ n-1 j=0 ∀(x n ∩ X j ). i∈S χ (1) i,j (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) ∨ ∀(x n ∩ X n ). f ∈F ∃ȳ n . i∈S L f (i) (ȳ 1 , . . . , ȳn ) .

Notice that any distinct χ

(1) i,j and χ

(1) i ,j that remain in the scope of any ∀(x n ∩ X j ) exclusively contain literals from L j . Although the universal quantification in the last conjunct is vacuous, we write it here for the sake of clarity. We regroup the disjuncts in ϕ as follows

ϕ = ∀x 1 ∃ȳ 1 . . . ∃ȳ n-1 . S∈PI\∅ n-1 j=0 ∀(x n ∩ X j ). i∈S χ (1) i,j (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) =: χ (2)
S,j (ȳ1,...,ȳj ,xj+1,...,xn-1)

∨ ∀(x n ∩ X n-1 ). i∈S χ (1) i,n-1 (ȳ 1 , . . . , ȳn-1 , xn ) ∨ f ∈F ∃ȳ n . i∈S L f (i) (ȳ 1 , . . . , ȳn ) =: χ (2)
S,≥n-1 (ȳ1,...,ȳn-1)

.

We now iterate these two steps in an alternating fashion until all quantifier blocks have been shifted inwards in the described way. The result ϕ (2n) has a tree-like shape with respect to the nesting of scopes of universal and existential quantifier blocks interspersed with conjunctions and disjunctions such that every atom A(ȳ 1 , . . . , ȳi , xi+1 , . . . , xn ) that belongs to the partition At i lies exactly in the scope of the quantifier blocks ∃ȳ 1 , . . . , ∃ȳ i , ∀(x i+1 ∩ X i ), . . . , ∀(x n ∩ X i ). Figure 3.3 illustrates the situation in a simplified way. We observe that every subformula ∀x. η of ϕ (2n) that is not in the scope of any other universal quantifier has the shape for some j where the sets K 1,..., n-1 are certain index sets. By a similar transformation as we have applied in the proof of Lemma 3.2.5 to transform the subformulas η

∀(x i ∩ X j ). 1 ∀(x i+1 ∩ X j ). 2 . . . n-1 ∀(x n ∩ X j ). k∈K 1 ,..., n-1 η k (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) . . . , ∀(x1 ∩ X0) ∃ȳ1 ∀(x2 ∩ X0) ∀(x2 ∩ X1) ∃ȳ2 ∀(x3 ∩ X0) ∀(x3 ∩ X1) ∀(x3 ∩ X2) ∃ȳ3
(3)

qp into η (5)
qp , we can exploit the pairwise separateness of the sets V 1 , . . . , V m in ϕ (2n) and transform the above subformula into

1≤h≤m ∀(x i ∩ X j ∩ V h ). 1 ∀(x i+1 ∩ X j ∩ V h ). 2 . . . n-1 ∀(x n ∩ X j ∩ V h ). k∈K (h) 1 ,..., n-1 η k (ȳ 1 , . . . , ȳj , xj+1 , . . . , xn ) . . . , where the K (1) 1 ,..., n-1 , . . . , K (m) 1 ,..., n-1
are certain pairwise disjoint index sets. The resulting structure of quantifier nestings is depicted in Figure 3.4. Afterwards, we do a similar transformation for 2n) after narrowing the scopes of universal quantifiers with respect to the sets V 1 , . . . , V m that are pairwise separated in ϕ (2n) . The sets U j,h denote the intersection X j ∩ V h .

∀(x1 ∩ U0,1) . . . ∀(x1 ∩ U0,m) ∃ȳ1 ∀(x2 ∩ U0,1) ∀(x2 ∩ U0,m) ∀(x2 ∩ U1,1) . . . ∀(x2 ∩ U1,m) ∃ȳ2 ∀(x3 ∩ U0,1) ∀(x3 ∩ U0,m) ∀(x3 ∩ U1,1) ∀(x3 ∩ U1,m) ∀(x3 ∩ U2,
the existential quantifier blocks in ϕ (2n) . Figure 3.5 depicts the resulting nesting structure of quantifiers. We denote the sentence resulting from ϕ (2n) after the described transformations by ϕ * .

From this point on we argue along the same lines as in the proof of Lemma 3.2.5 to obtain an upper bound on the subformulas in ϕ * that do not occur in the scope of any quantifiers. Let L ϕ (V h ) denote the number of literals occurring in ϕ that contain at least one variable from V h . Moreover, let κ be the least upper bound for all |L ϕ (V h )|. Since the nesting depth of quantifiers in ϕ * is bounded from above by ∂ ∃∀ (ϕ), adapting the arguments from the proof of Lemma 3.2.5 entails that there are no more than 2 ↑∂ ∃∀ (ϕ) (κ + n) different subformulas (not occurrences thereof!) of the mentioned kind. The term κ + n (in contrast to only κ in the original proof) accounts for the fact that the subformulas may contain a certain mixture of existential and universal quantifiers. different subformulas, and the former expression is bounded from above by 2 ↑∂ ∃∀ (ϕ) (κ + n).

∀(x1 ∩ U0,1) . . . ∀(x1 ∩ U0,m) ∃(ȳ1 ∩ V1) . . . ∃(ȳ1 ∩ Vm) ∀(x2 ∩ U0,1) ∀(x2 ∩ U0,m) ∀(x2 ∩ U1,1) ∃(ȳ2 ∩ V1) ∀(x2 ∩ U1,m) ∃(ȳ2 ∩ Vm) ∀(x3 ∩ U0,1) ∀(x3 ∩ U0,m) ∀(x3 ∩ U1,1) ∀(x3 ∩ U2,1) ∃(ȳ3 ∩ V1) ∀(x3 ∩ U1,m) ∀(x3 ∩ U2,m) ∃(ȳ3 ∩
After shifting all quantifiers in ϕ * outwards in an existential quantifiers-first manner, we obtain a BSR sentence that is equivalent to the original GBSR sentence ϕ and contains at most

|ȳ| 2 • ∂ ∃∀ (ϕ) • 2 ↑∂ ∃ (ϕ) (κ + n) ∂ ∃∀ (ϕ) leading existential quantifiers.
The just proven lemma can be reformulated into the following less technical theorem.

Theorem 3.5.3. Every GBSR sentence is equivalent to some BSR sentence whose length is ∂ ∃∀ (ϕ)-fold exponential in the length of the original.

The theorem also holds in the presence of constant symbols: every GBSR sentence ϕ with constant symbols is equivalent to some BSR sentence ϕ with the same constant symbols.

After transforming a satisfiable GBSR sentence into an equivalent BSR sentence, the number of leading existential quantifiers induces an upper bound on the size of small models -every satisfiable GBSR sentence has such a small model. By virtue of Theorem 3.5.3, the small model property of BSR (with or without constant symbols), spelled out in Proposition 3.1.6, can be transferred to GBSR. Corollary 3.5.4. Every satisfiable GBSR sentence ϕ has a model whose size is at most ∂ ∃∀ (ϕ)-fold exponential in the length of ϕ. Moreover, GBSR-Sat is decidable, even if we allow constant symbols to occur.

In Section 4.2 we present a different, a model-theoretic approach to GBSR-Sat which culminates in a direct construction of models. That approach facilitates deriving an upper bound on the size of small models as well. In order to formulate this bound accurately, we introduce a related, yet somewhat complementary notion of degree based on the interaction of universally quantified variables in atoms.

Regarding lower bounds, the result formulated in Theorem 3.2.7 immediately entails that there are GBSR sentences that inevitably lead to a non-elementary blowup when translating them into equivalent BSR sentences. Moreover, Theorem 3.3.18 is also relevant for GBSR. It means that for every natural number k there are GBSR sentences whose shortest equivalent in Gaifman normal form is k-fold exponentially longer than the original.

Taking Boolean Structure into Account

In this section we briefly look into the quest for gaining additional information from the Boolean structure of formulas. A trivial first observation in this context follows from Lemma 3.5.2 and the fact that every ∧-∨-combination of BSR sentences is equivalent to some BSR sentence of the same length.

Proposition 3.6.1. Every ∧-∨-combination of GBSR sentences is equivalent to some BSR sentence.

Next, we increase the level of difficulty slowly and consider two special cases of GBSR sentences in conjunctive normal form (CNF) and in disjunctive normal form (DNF) where the translation into BSR does not lead to any blowup regarding the length of formulas.

Proposition 3.6.2. Consider any GBSR sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . m i=1 ψ i where the ψ i are disjunctions of literals. Let ȳ := ȳ1 ∪ . . . ∪ ȳn . Suppose that for any two distinct indices j, j the sets vars(ψ j )∩ ȳ and vars(ψ j )∩ ȳ are disjoint. Then, ϕ is equivalent to ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . m i=1 ψ i .

Proof. By assumption, we can use quantifier shifting to transform ϕ into an equivalent sentence of the form m i=1 ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ i -for simplicity, some instances of vacuous quantifiers have been introduced, i.e. quantifiers Qv. χ where v does not occur in χ. The lemma follows immediately from the following auxiliary result.

Consider any GBSR sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in which ψ is a disjunction of literals. This means, we can rewrite ψ into a formula of the form

χ 0 (x 1 , . . . , xn ) ∨ χ 1 (ȳ 1 , x2 , . . . , xn ) ∨ . . . ∨ χ n-1 (ȳ 1 , . . . , ȳn-1 , xn ) ∨ χ n (ȳ 1 , . . . , ȳn ) ,
where none of the disjunctions χ i , χ j with i = j share variables from x := x1 ∪ . . . ∪ xn . For every i,

0 ≤ i ≤ n, let X i := vars(χ i ) ∩ x X i
. Then, ϕ is equivalent to As quantifier shifting is sufficient to transform the special kind of sentences treated in Proposition 3.6.2 into BSR sentences, the translation does not lead to a blowup in formula length. Hence, any satisfiable sentence ϕ of this kind has a model whose domain contains at most len(ϕ) elements.

∀X 0 . χ 0 (x 1 , . . . , xn ) ∨ ∃ȳ 1 ∀X 1 . χ 1 (ȳ 1 , x2 , . . . ,
Next, we briefly discuss the dual case of GBSR formulas in DNF where disjuncts do not share universally quantified variables.

Proposition 3.6.3. Consider any GBSR sentence of the form ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . m i=1 ψ i where the ψ i are conjunctions of literals. Let x := x1 ∪ . . . ∪ xn and suppose that for any two distinct indices j, j the sets vars(ψ j ) ∩ x and vars(ψ j ) ∩ x are disjoint. Then, ϕ is equivalent to ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . m i=1 ψ i .

Proof. Again, quantifier shifting and the introduction of vacuous quantifiers can be used to transform ϕ into an equivalent sentence of the form m i=1 ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ i . The lemma follows immediately from the following auxiliary result.

Consider any GBSR sentence ϕ = ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in which ψ is a conjunction of literals. Again, we can regroup the literals in this conjunction so that ψ has the form Both propositions refer to special cases of GBSR sentences where the translation into BSR requires very little effort, as only quantifiers need to be shifted. Moreover, the sentences are required to possess a very specific Boolean structure. The latter requirement can be weakened to some extent. As any quantifier-free formula can be converted into conjunctive or disjunctive normal form, one could simply extend Propositions 3.6.2 and 3.6.3 to formulas that can be transformed into formulas of the described shape. In other words, the original formula need not satisfy the requirements, but a certain normal form has to. But then, checking whether a given formula falls into the syntactic category in question may require exponential time, in the worst case, as the normal form transformation can cause an exponential blowup regarding formula length.

χ 0 (x 1 , . . . , xn ) ∧ χ 1 (ȳ 1 , x2 , . . . , xn ) ∧ . . . ∧ χ n-1 (ȳ 1 , . . . ,
Alternatively, we can use an approximation of the normal form that yields enough information to make an informed decision without requiring the expensive construction of conjunctive or disjunctive normal forms. 4 Suppose we are given a quantifier-free formula ψ in negation normal form. From its Boolean structure we can read off which literals will end up in a common conjunction when we transform ψ into DNF using exclusively the basic laws of Boolean algebra: associativity, commutativity, distributivity of ∧ over ∨ -the latter is only used in the direction from χ 1 ∧(χ 2 ∨χ 3 ) to (χ 1 ∧ χ 2 ) ∨ (χ 1 ∧ χ 3 ). Each application of these rules preserves the following property: we call two atoms A, B conjunctive companions in ψ conjunctive and disjunctive companions

, if ψ contains a subformula χ 1 ∧ χ 2 such that A occurs in χ 1 and B occurs in χ 2 or vice versa. There is also the dual notion of disjunctive companions in ψ, which applies to atoms A, B if ψ contains a subformula χ 1 ∨ χ 2 such that A occurs in χ 1 and B occurs in χ 2 or vice versa. Lemma 3.6.4 (Invariance of conjunctive and disjunctive companions). (iii) Let ψ := χ 1 ∧ (χ 2 ∨ χ 3 ) and ψ := (χ 1 ∧ χ 2 ) ∨ (χ 1 ∧ χ 3 ). Two atoms A and B are conjunctive companions in ψ if and only if they are conjunctive companions in ψ .

(i) Let ψ := (χ 1 • χ 2 ) • χ 3 and ψ := χ 1 • (χ 2 • χ 3 ) be
(iv) Let ψ := χ 1 ∨ (χ 2 ∧ χ 3 ) and ψ := (χ 1 ∨ χ 2 ) ∧ (χ 1 ∨ χ 3 ). Two atoms A and B are disjunctive companions in ψ if and only if they are disjunctive companions in ψ .

Proof Sketch. The proof is straightforward and proceeds by case distinction with respect to the subformulas in which A and B occur.

For every quantifier-free formula ψ in negation normal form Lemma 3.6.4 entails that two atoms are conjunctive companions in ψ if and only if they are conjunctive companions in an equivalent formula ψ in DNF, provided that ψ has been derived from ψ by applying exclusively the Boolean laws of associativity, commutativity, and distributivity of ∧ over ∨. Dually, two atoms are disjunctive companions in ψ if and only if they are disjunctive companions in an equivalent formula ψ in CNF, provided that ψ has been derived from ψ using exclusively the Boolean laws of associativity, commutativity, and distributivity of ∨ over ∧. This leads to the following observation.

Definition 3.6.5 (Conjunctively and Disjunctively Connected Sets of Variables and Atoms). Consider any two sets X, Y of first-order variables and any formula ψ in negation normal form. We say that X and Y are conjunctively (disjunctively) connected in ψ, if there is some x ∈ X ∩ Y that occurs in ψ, or if there are two atoms A and B that are conjunctive (disjunctive) companions in ψ such that A contains some x ∈ X and B contains some y ∈ Y . We say that two sets X, Y of variables are conjunctively (disjunctively) disconnected in ψ, if they are not conjunctively (disjunctively) connected in ψ.

We extend these notions to mixed pairs X, S of sets of first-order variables and of atoms, respectively: X and S are conjunctively (disjunctively) connected in ψ, if there exists some x ∈ X and some A ∈ S that occurs in ψ and contains x, or if there are two atoms A and B that are conjunctive (disjunctive) companions in ψ such that A contains some x ∈ X and B belongs to S. We say that X, S are conjunctively (disjunctively) disconnected in ψ, if they are not conjunctively (disjunctively) connected in ψ.

Lemma 3.6.6. Consider any first-order sentence of the form ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in negation normal form with quantifier-free ψ. If for every i, 1 ≤ i ≤ n, the sets x1 ∪ . . . ∪ xi and ȳi are disjunctively disconnected in ψ, then ϕ is equivalent to ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . ψ.

Proof. By Lemma 3.6.4, we can transform ψ into a formula ψ in CNF that is a conjunction of clauses none of which contains variables from two disjunctively disconnected sets. Hence, ψ can be rewritten into the form

i∈I0 χ i (x 1 , . . . , xn ) ∧ i∈I1 χ i (ȳ 1 , x2 , . . . , xn ) ∧ . . . ∧ i∈In χ i (ȳ 1 , . . . , ȳn ) ,
where the index sets I 0 , . . . , I n are finite and pairwise disjoint, and every χ i is a clause. Using quantifier shifting, we can transform ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ into the sentence The idea underlying Lemma 3.6.6 and the definition of GBSR can be blended to obtain a more liberal definition of GBSR. In particular, this helps liberalizing requirement (ii) of Definition 3.4.1 up to a certain degree. The following lemma illustrates a first approach to such a blend of separateness and disjunctive disconnectedness. Several refinements would be conceivable, but we shall confine ourselves to this rather simple variant. Lemma 3.6.7. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be any relational first-order sentence with equality. Let At be the set of all atoms occurring in ϕ and let x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn . Assume that there is a sequence of subsets At (0) , At (1) , . . . , At (n) ⊆ At At (k) such that for every i, 1 ≤ i ≤ n, the set ȳi is disjunctively disconnected from the set At (0) ∪ . . . ∪ At (i-1) in ψ. Moreover, assume that for every k, 0 ≤ k ≤ n, the set At (k) can be partitioned into parts At (ii) for all distinct i, j, 0 ≤ i < j ≤ k, we have vars(At

∀x 1 . . . xn . i∈I0 χ i (x 1 , . . . , xn ) ∧ ∃ȳ 1 . ∀x 2 . . . xn . i∈I1 χ i (ȳ 1 , x2 , . . . , xn ) ∧ ∃ȳ 2 . . . . ∧ ∃ȳ n-1 . ∀x n . i∈In-1 χ i (ȳ 1 , . . . , ȳn-1 , xn ) ∧ ∃ȳ n . i∈In χ i (ȳ 1 , . . . ,
(k) i ) ∩ vars(At (k) j ) ∩ x = ∅, and
(iii) for all distinct k, and all distinct i, j with 0 ≤ k < ≤ n and 0 ≤ i ≤ k and 0 ≤ j ≤ we have vars(At

(k) i ) ∩ vars(At ( ) j ) ∩ x1 ∪ . . . ∪ xk = ∅.
Then, ϕ is equivalent to some GBSR sentence.

Proof. By Lemma 3.6.4, we can transform ψ into a formula ψ in CNF that can be rewritten into the form

ψ := χ 0 (x 1 , . . . , xn ) ∧ χ 1 (x 1 , . . . ,
ϕ := ∀x (0) 1 . . . x(0) n . χ 0 (x (0) 1 , . . . , x(0) n ) ∧ ∀x 1 ∃ȳ 1 . ∀x (1) 2 . . . x(1) n . χ 1 (x 1 , x(1) 2 , . . . , x(1) n , ȳ1 ) ∧ ∀x 2 ∃ȳ 2 . ∀x (2) 3 . . . x(2) n . χ 2 (x 1 , x2 , x(2) 3 , . . . , x(2) n , ȳ1 , ȳ2 ) ∧ ∀x 3 ∃ȳ 3 . . . . ∧ ∀x n-1 ∃ȳ n-1 . ∀x (n-1) n . χ n-1 (x 1 , x2 , x3 , . . . , xn-1 , x(n-1) n , ȳ1
At (k)
to be the set of atoms occurring in the formula

χ k (x 1 , . . . , xk , x(k) k+1 , . . . , x(k) k , ȳ1 , . . . , ȳk ) .
In other words, At

(k)
is a subset of the atoms from At (k) after renaming variables like in ϕ . Due to our assumptions, every At

(k)
can be partitioned into sets At

(k) 0 , . . . , At (k) k At (k) i
such that (a) for every i, 0 ≤ i ≤ k, we have vars At

(k) i ⊆ ȳ1 ∪ . . . ∪ ȳi ∪ xi+1 ∪ . . . ∪ xk ∪ x(k) k+1 ∪ . . . ∪ x(k) n , (b)
for all distinct i, j, 0 ≤ i < j ≤ k, we have vars At

(k) i ∩ vars At (k) j ∩ x1 ∪ . . . ∪ xk ∪ x(k) k+1 ∪ . . . ∪ x(k) n = ∅, and
(c) for all distinct k, and all distinct i, j with 0 ≤ k < ≤ n and 0 ≤ i ≤ k and 0 ≤ j ≤ we have vars( At

(k) i ) ∩ vars( At ( ) j ) ∩ x1 ∪ . . . ∪ x ∪ k≤k ≤n x(k ) k +1 ∪ . . . ∪ x(k ) n = ∅.

Consider the sets At

i := i≤k≤n At (k) i At i for 0 ≤ i ≤ n.
Because of (a), we have

vars At i ⊆ ȳ1 ∪ . . . ∪ ȳi ∪ xi+1 ∪ . . . ∪ xn ∪ i≤k≤n x(k) k+1 ∪ . . . ∪ x(k) n . (3.2)
Together with (b) and (c), this entails

vars( At i ) ∩ vars( At j ) ∩ x1 ∪ . . . ∪ xn ∪ 1≤k≤n x(k) k+1 ∪ . . . ∪ x(k) n = ∅ (3.3)
for all i, j with 0 ≤ i < j ≤ n.

Let ϕ be the following formula that results from ϕ by shifting all quantifiers outward:

ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n ∀x (0) 1 . . . x(0) n x(1) 2 . . . x(1) n . . . x(n-2) n-1 x(n-2) n x(n-1) n . χ 0 (x (0) 1 , . . . , x(0) n ) ∧ χ 1 (x 1 , x(1) 2 , . . . , x(1) n , ȳ1 ) ∧ . . . ∧ χ n-1 (x 1 , . . . , xn-1 , x(n-1) n , ȳ1 , . . . , ȳn-1 ) ∧ χ n (x 1 , . . . , xn , ȳ1 , . . . , ȳn ) .
By virtue of (3.2) and (3.3), ϕ is the sought GBSR sentence equivalent to ϕ Notice that the maximal possible degree of interaction in the sentence ϕ in the proof of Lemma 3.6.7 is n + 1. However, we could do the shifting of quantifiers in the last step of ϕ 's construction in such a way that ∂ ∃∀ (ϕ ) ≤ n. Consequently, the blowup that we incur when transforming sentences that satisfy the conditions of Lemma 3.6.7 is at most (n+1)-fold exponential in the length of ϕ, since ϕ 's matrix might be exponentially longer than the original matrix of ϕ.

Example 3.6.8. Consider the sentence ϕ := ∀x 1 x 2 ∃y∀z 1 z 2 . P (x 1 , z 1 ) ∨ P (z 2 , x 2 ) ∧ P (y, z 1 ) ∨ P (x 2 , z 2 ) ∧ P (x 1 , x 2 ) , which satisfies the conditions of Lemma 3.6.7. To see this, we inspect the following witnessing subsets At (0) and At (1) with their respective partitions:

At (0) := P (x 1 , z 1 ), P (z 2 , x 2 ) =: At (0) 0 and
At (1) := P (y, z 1 )

=: At (1) 1 , P (x 2 , z 2 ), P (x 1 , x 2 ) =: At
(1) 0

.

Proceeding as described in the proof of Lemma 3.6.7, the sentence ϕ can be transformed into the equivalent sentence

∀x 1 x 2 z 1 z 2 . P (x 1 , z 1 ) ∨ P (z 2 , x 2 ) ∨ P (x 2 , z 2 ) ∧ P (x 1 , z 1 ) ∨ P (z 2 , x 2 ) ∨ P (x 1 , x 2 )
∧ ∀x 1 x 2 ∃y∀z 1 z 2 . P (y, z 1 ) ∨ P (x 2 , z 2 ) ∧ P (y, z 1 ) ∨ P (x 1 , x 2 ) .

Evidently, each of the two constituents of the topmost conjunction is a GBSR sentence.

The Generalized Ackermann Fragment (GAF)

Recall that the Ackermann fragment (AF) consists of all relational first-order sentences in prenex normal form with an ∃ * ∀∃ * quantifier prefix and without equality. In the beginning of Chapter 3, we have already outlined that the satisfiability problem for AF is decidable and that this decidability result has been stretched to several syntactic extensions of AF: AF with equality, the Gurevich-Maslov-Orevkov fragment -AF plus function symbols of arbitrary arity, and the Shelah fragment -AF with equality plus a single unary function symbol. Of course, constant symbols may also be allowed without jeopardizing decidability of the respective decidability problem. The Shelah fragment has the remarkable property of having a decidable satisfiability problem while allowing the formulation of infinity axioms. Hence, this class of sentences does not enjoy the finite model property.

In the present section, we generalize AF to the generalized Ackermann fragment (GAF) in the same spirit as we have generalizeed BSR to GBSR in Section 3.4. This means we shall devise an effective procedure that translates any given GAF sentence into an equivalent AF sentence. It will turn out that this procedure will be compatible with function symbols and equality. That is, our results will show that GAF with equality is equivalent to AF with equality, GAF with arbitrary function symbols but without equality is equivalent to the Gurevich-Maslov-Orevkov fragment, and GAF with equality and a single unary function symbol in equivalent to the Shelah fragment. Hence, all these extensions of GAF will be shown to possess a decidable satisfiability problem.

Intuitively speaking, a GAF sentence is of the form ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ with quantifier-free ψ and it satisfies the following properties. Each atom in ϕ contains only variables from some subsequence of ϕ's quantifier prefix of the form ∃ * ∀∃ * . If two atoms share a universally quantified variable or some variable from the trailing ∃ * -block of their respective quantifier subsequence, then they have the same ∃ * ∀∃ * -subsequence as source of all their variables. Definition 3.7.1 (Generalized Ackermann fragment (GAF)). Let ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ be a relational first-order sentence without equality. Let At be the set of all atoms occurring in ϕ and let x := x1 ∪ . . . ∪ xn , ȳ := ȳ1 ∪ . . . ∪ ȳn , and ū := ū1 ∪ . . . ∪ ūn . Moreover, we define the index of a variable v ∈ x ∪ ȳ ∪ ū by idx(v) := k idx(v) if and only if v ∈ xk ∪ ȳk ∪ ūk . The sentence ϕ belongs to the generalized Ackermann fragment (GAF) if and only if we can partition At into sets At 0 and At x , x ∈ x, such that the following conditions are satisfied: (a) vars(At 0 ) ⊆ ȳ (b) for every x ∈ x we have vars(At x ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x} ∪ ūidx(x) ∪ . . . ∪ ūn (c) for all distinct x, x ∈ x we have vars(At x ) ∩ vars(At x ) ∩ ū = ∅.

Notice that the tuples xi and ȳi , ūi in any GAF sentence ϕ may be empty. As one consequence, ϕ's quantifier prefix does not have to start with a universal quantifier and it does not have to end with an existential quantifier. Moreover, notice that every variable u ∈ ū that occurs in ϕ is associated with exactly one reference variable x ∈ x, determined by the set At x in which u occurs. Intuitively speaking, using suitable equivalence-preserving transformations, any quantifier ∃u with u ∈ ū can be shifted out of the scope of any universal quantifier but the one binding u's reference variable. This is the essence of the first step of the effective translation procedure from GAF into AF, which we shall assemble in the proof of Lemma 3.8.4. The following example gives a first impression of GAF sentences and how they can be translated into AF.

Example 3.7.2. Consider the first-order sentence

ϕ := ∃u∀x∃v∀z∃y 1 y 2 . ¬P (u, x) ∨ Q(x, v) ∧ R(u, z, y 1 ) ∧ P (u, x) ∨ ¬Q(x, v) ∧ ¬R(u, z, y 2 ) .
The partition of the set At := {P (u, x), Q(x, v), R(u, z, y 1 ), R(u, z, y 2 )} into At 0 := ∅, At x := {P (u, x), Q(x, v)}, and At z := {R(u, z, y 1 ), R(u, z, y 2 )} is a witness for the belonging of ϕ to GAF. Due to the Boolean structure of ϕ, the quantifiers ∃y 2 , ∃y 1 , and ∀z can be shifted inwards immediately but ∃v cannot. This yields the equivalent sentence ∃u∀x∃v. ¬P (u, x) ∨ Q(x, v) ∧ ∀z∃y 1 . R(u, z, y 1 )

∧ P (u, x) ∨ ¬Q(x, v) ∧ ∀z∃y 2 . ¬R(u, z, y 2 ) .
Because of the two universal quantifiers ∀x and ∀z, which are even interspersed with an existential one, ϕ does not belong to AF. Exhaustive Skolemization of ϕ leads to

∀xz. ¬P (c, x) ∨ Q x, f (x) ∧ R c, z, g(x, z) ∧ P (c, x) ∨ ¬Q x, f (x) ∧ ¬R c, z, h(x, z)
and thus explicitly fixes the dependence of y 1 on the universally quantified variables x and z, as y 1 is replaced with the term g(x, z). However, the shape of the original ϕ did not immediately indicate such a strong dependence of y 1 on x, since x and y 1 do not co-occur in any atom. Moreover, there are no other variables that depend on x and establish a connection between x and y 1 by means of co-occurrences in atoms. One may say that it is the Boolean structure of ϕ alone which causes a dependence of y 1 on x, and that such a form of dependence has only a finite character. These ideas will be made more precise in Chapter 4 and, for GAF sentences in particular, in Section 4.3. The described point of view is supported by the existence of an equivalent sentence ϕ , in which the dependence of y 1 on x has vanished. The price we have to pay, however, is an increase in the size of the formula.

ϕ := ∃u. ∀x. ¬P (u, x) ∨ ∃v. Q(x, v) ∧ ∀x. ¬P (u, x) ∨ ∀z∃y 1 . R(u, z, y 1 ) ∧ ∀x. ∃v. ¬Q(x, v) ∨ P (u, x) ∧ ∀x∃v. ¬Q(x, v) ∨ ∀z∃y 1 . R(u, z, y 1 ) ∧ ∀z∃y 2 . ¬R(u, z, y 2 ) ∨ ∀x. P (u, x) ∧ ∀z∃y 2 . ¬R(u, z, y 2 ) ∨ ∀x∃v. Q(x, v) ∧ ∀z∃y 2 . ¬R(u, z, y 2 ) ∨ ∀z∃y 1 . R(u, z, y 1 )
Transforming ϕ into ϕ requires only basic logical laws and is very similar to approaches we have seen before: first, we shift the quantifiers ∃y 2 , ∃y 1 , ∀z inwards as far as possible. Then, we construct a disjunction of conjunctions of certain subformulas using distributivity. This allows us to shift the quantifier ∃v inwards. Afterwards, we apply the laws of distributivity again to obtain a conjunction of disjunctions of certain subformulas. This step enables us to shift the universal quantifier ∀x inwards. In the resulting sentence every occurrence of an existential quantifier lies in the scope of at most one universal quantifier. Moreover, every atom in the original formula ϕ contains at most one universally quantified variable. Exhaustive Skolemization of ϕ leads to a sentence whose shape is quite close to the shape of an exhaustively Skolemized sentence from the Ackermann fragment. More precisely, every atom contains at most one variable, possibly with multiple occurrences. The only difference is that we get more than only one universally quantified variable in the sentence as a whole, but at most one in every atom.

Another example of a simple GAF sentence is the sentence ψ := ∃u∀x∃y∀z. P (u, z) ∧ Q(u, x) ∨ P (y, z) ∧ Q(u, y) which we have already treated in Example 3.4.2 as an example for GBSR sentences.

The sentence ψ from the above example belongs to GBSR and GAF at the same time, while it does not belong to the Ackermann fragment, SF, BSR, or the monadic fragment. Hence, even the intersection of GBSR and GAF contains sentences which do not fall into the syntactic categories offered by the standard fragments.

As a first result concerning GAF we show that membership in GAF is decidable in polynomial time.

Theorem 3.7.3. Deciding whether a given first-order sentence belongs to GAF can be done deterministically in time that is polynomial in the length of any reasonable encoding of the input sentence.

Proof sketch. Let ϕ := ∀x 1 ∃v 1 . . . ∀x n ∃v n . ψ be any relational first-order sentence in prenex normal form with quantifier-free ψ. Let x := x1 ∪ . . . ∪ xn and v := v1 ∪ . . . ∪ vn . For the moment we do not know a priori how the variables in each and every existential quantifier block ∃v k are to be partitioned into ȳk and ūk . This will be sorted out in due course.

Let G ϕ := V, E G ϕ be a directed graph such that V := v and E := v, v idx(v) ≤ idx(v ) and there is some atom A in ψ in which v and v co-occur . For any variable v ∈ v the upward closure

C ↑ v C ↑ v , at(C ↑ v ) is the smallest subset of v such that v ∈ C ↑ v and for every v ∈ C ↑ v the existence of an edge v , v in G ϕ entails v ∈ C ↑ v . Let at(C ↑ v )
denote the set of all atoms in ψ, in which a variable from C ↑ v occurs. For every x ∈ x let at x at x , at 0 be the smallest set of atoms such that (a) every atom in ϕ in which x occurs belongs to at x , and (b) for every v ∈ vars(at x ) ∩ v with idx(v) ≥ idx(x) we have at(C ↑ v ) ⊆ at x . By at 0 we denote the set of all atoms that occur in ϕ but in none of the at x with x ∈ x. Moreover, we use the notation

U x := vars(at x ) ∩ i≥idx(x) vi U x .
Claim I: If (A) every atom in ϕ contains at most one variable from x, and (B) for all distinct variables x, x ∈ x with idx(x) ≤ idx(x ) and any variable v ∈ i≥idx(x) vi we have v ∈ vars(at x ) ∩ vars(at x ), then we observe the following properties:

(i) For all distinct x, x ∈ x we have at x ∩ at x = ∅.

(ii) For every x ∈ x we have vars(at x ) ∩ x = {x}.

(iii) For every x ∈ x we have U x ∩ vars(at 0 ) = ∅.

(iv) For all distinct x, x ∈ x with idx(x) ≤ idx(x ) we have U x ∩ vars(at x ) = ∅.

Proof:

Ad (i): Suppose there are variables x, x ∈ x and there is some atom A ∈ at x ∩ at x . A must belong to at(C ↑ v ) for some variable v ∈ v with idx(v) ≥ idx(x) or idx(v) ≥ idx(x ), since otherwise we would have {x, x } ⊆ vars(A) which contradicts Condition (A). This in turn means that some variable v ∈ v occurs in A for which idx(v ) ≥ idx(v). Hence, v ∈ vars(A) ⊆ vars(at x ) ∩ vars(at x ) with idx(v ) ≥ idx(x) or idx(v ) ≥ idx(x ). This constitutes a contradiction to Condition (B).

Ad (ii): This is a direct consequence of (i) and the definition of at x . Ad (iii): Whenever v ∈ U x ⊆ i≥idx(x) vi we have that at(C ↑ v ) ⊆ at x . Suppose there is some v ∈ U x ∩ vars(at 0 ), i.e. there is some atom A ∈ at 0 with v ∈ vars(A). Since A ∈ at(C ↑ v ) ⊆ at x , the definition of at 0 entails that A cannot occur in at 0 . Ad (iv): Whenever v ∈ U x ⊆ i≥idx(x) vi , we observe that at(C ↑ v ) ⊆ at x . Suppose there is some v ∈ U x ∩ vars(at x ). Hence, there must be some atom A ∈ at x in which v occurs. But since A belongs to at(C ↑ v ), we know that A ∈ at x . This contradicts (i). ♦

Claim II: The sentence ϕ belongs to GAF if and only if it satisfies Conditions (A) and (B) from Claim I.

Proof: Regarding the if -direction, we set At 0 := at 0 and At x := at x for every x ∈ x. Moreover, every existential quantifier block ∃v k can be partitioned into Regarding the only if -direction we argue as follows. Condition (A) of Claim I is certainly satisfied, if Condition (b) of Definition 3.7.1 is met by ϕ. Consider any two variables x, x ∈ x with idx(x) ≤ idx(x ) and let u be some variable in U x . Because of idx(u) ≥ idx(x), Condition (b) of Definition 3.7.1 entails that u ∈ ū. By Condition (c) of Definition 3.7.1, u cannot occur in both At x and At x . Since U x ⊆ vars(at x ) = vars(At x ), u cannot occur in At x and, hence, not in at x either. This entails that Condition (B) of Claim I is satisfied. ♦ By Claim II, Conditions (A) and (B) from Claim I together yield a criterion to decide whether ϕ belongs to GAF or not. It remains to argue that this criterion can be checked deterministically in polynomial time. It is straightforward to check Condition (A) in polynomial time. Hence, we concentrate on Condition (B). Given ϕ, the graph

G ϕ = V, E can be constructed in time that is quadratic in ϕ . We observe |V | = |v| ≤ |len(ϕ)| and |E| ≤ |v| 2 ≤ len(ϕ)
2 . Using efficient data structures, the upward closures C ↑ v in G ϕ and the sets at(C ↑ v ) and at x can be computed in time that is polynomial in ϕ . The sum of the lengths of the atoms in all the at x taken together is at most |x| • len(ϕ) ≤ len(ϕ)

2 . Finally, the test whether we have

vars(at x ) ∩ vars(at x ) ∩ i≥idx(x) vi = ∅
for all distinct x, x with idx(x) ≤ idx(x ) can be done in time that is polynomial in ϕ .

The next proposition confirms that GAF indeed extends the Ackermann fragment. Moreover, MFO is a proper subfragment of GAF. Since the sentence ϕ from Example 3.7.2 belongs to GAF but lies in neither of the other two fragments, it is immediately clear that GAF constitutes a proper syntactical extension of both. Proposition 3.7.4. GAF properly contains AF and MFO.

Proof. Let ϕ := ∃z ∀x∃v. ψ be an AF sentence with quantifier-free ψ. Any atom in ϕ contains at most one universally quantified variable, namely x. Let At x be the set of all atoms occurring in ϕ. If we conceive the variables in v as "ū-variables", then Condition (b) of Definition 3.7.1 is satisfied by At x . The other two conditions, (a) and (c), are trivially satisfied. Consequently, ϕ belongs to GAF.

Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be an MFO sentence. For every x ∈ x1 ∪ . . . ∪ xn define At x to be the set containing exactly the atoms in ϕ that contain x. Let At 0 be the set of all atoms in ϕ that do not belong to any At x . Clearly, this partition of ϕ 's atoms meets all the conditions stated in Definition 3.7.1, if we conceive all the existentially quantified variables in ϕ as "ȳ-variables". Hence, ϕ belongs to GAF.

As for GBSR, we shall first discuss a syntactic route to decidability of the satisfiability for GAF (GAF-Sat) GAF-Sat that is based on an effective equivalence-preserving translation from GAF into AF. A semantically-flavored approach based on model-checking games and the analysis of dependences between existentially and universally quantified variables shall be developed in Section 4.3. Both approaches will lead to small model properties for GAF and, as one consequence, yield upper bounds on the computational complexity of deciding GAF-Sat.

Translation of GAF into the Ackermann Fragment

The equivalence-preserving translation from GAF into AF proceeds in two stages. The first stage resembles an exhaustive unfolding process in the spirit of Lemma 2.0.3. Nestings of quantifiers in a given GAF sentence that bind separated sets of variables vanish in the course of this stage. This results in a sentence in which every subformula lies within the scope of at most one universal quantifier. Such sentences can easily be converted into a special syntactic form, which we shall call GAF special form. Then, in the second stage of the translation process, a sentence in GAF special form is transformed into an equivalent AF sentence.

The next lemma focuses on the first stage of the translation process.

Lemma 3.8.1. Let ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ be any GAF sentence with quantifier-free ψ.

We can effectively transform ϕ into an equivalent sentence ϕ in standard form, in which every subformula lies within the scope of at most one universal quantifier. Moreover, all literals in ϕ also occur in ϕ (modulo variable renaming).

Proof. We assume that ϕ is in standard form. Let the sets At, x, ȳ, ū be defined as in Definition 3.7.1. Let At 0 , (At x ) x∈x At 0 , At x be the partition of the set At described in Definition 3.7.1. Recall that ϕ is assumed to be in negation normal form. Let L 0 , (L x ) x∈x L 0 , L x be the corresponding partition of the set of literals occurring in ϕ. Hence, every At x is exactly the set of atoms occurring in L x , and the same holds for At 0 and L 0 . Moreover, we use the notation

U x := vars(L x ) ∩ i≥idx(x) ūi U x .
Given any set V of variables, we write L(V ) L(V ) to address the set of all literals from ϕ that contain at least one variable from V . For every x ∈ x we refine the set

L x into subsets L x,0 , L x,idx(x) , L x,idx(x)+1 , . . . , L x,n : L x,k L x,n := L x ∩ L(ū n ), L x,k := L x ∩ L(ū k ) \ >k L x, for every k satisfying idx(x) ≤ k < n, and L x,0 := L x \ ≥idx(x) L x, . Similarly, we define U x,k := vars(L x,k ) ∩ U x U x,k for every k, idx(x) ≤ k ≤ n.
Then, we observe the following (cf. Claim I in the proof of Theorem 3.7.3):

(I) For all distinct x, x ∈ x we have L x ∩ L x = ∅. (II) For all distinct x, x ∈ x with idx(x) ≤ idx(x ) we have U x ∩ vars(L x ) = ∅. (III) For every k we have L x,k ⊆ L x . (IV) For all distinct k, we have L x,k ∩ L x, = ∅. (V) For every k ≥ idx(x) we have vars(L x,k ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x} ∪ ūidx(x) ∪ . . . ∪ ūk . (VI) We have vars(L x,0 ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x}.
After having fixed notation, we proceed along similar lines as in the proof of Lemma 3.5.2, i.e. we perform syntactic transformations based on the axioms of Boolean algebra and ordinary quantifier shifting (cf. Lemma 1.0.1). Once more, this will not change the set of literals occurring in the intermediate steps (modulo variable renaming), since we start from a formula in negation normal form restricted to the connectives ∧, ∨, ¬. Analogous to the proof of Lemma 3.5.2, we (re-)transform parts of ϕ repeatedly into a disjunction of conjunctions (or a conjunction of disjunctions) of subformulas which we treat as indivisible units. The literals and indivisible units in the respective conjunctions (disjunctions) will be grouped in accordance with the sets L 0 , L x and L x,idx(x) , . . . , L x,n , where needed. For this purpose, it is important to keep in mind that (I) and the definition of L 0 entail that L 0 together with the sets L x partition the set of all literals occurring in ϕ. Moreover, every L x is partitioned by the sets L x,0 , L x,idx(x) , . . . , L x,n , by virtue of (III), (IV), and the definition of L x,0 .

Let us elaborate on transformation process: we first describe it and then it is presented formally. At the beginning, we transform ψ into a disjunction of conjunctions of literals i ψ i . Then, we rewrite every

ψ i into χ (1) i,0 ∧ n k=1 x∈x k χ (1) i,x,0 ∧ n j=k χ (1) i,x,j , where χ (1)
i,0 and the χ (1) i,x,j are conjunctions of literals. χ

(1) i,0 comprises all literals in ψ i which belong to L 0 , while for every j the literals which belong to L x,j are grouped into χ

(1) i,x,j , respectively. By (V) and (VI), we know that vars(χ

(1) i,x,0 ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x} and vars(χ (1) i,x,j ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x} ∪ ūidx(x) ∪ . . . ∪ ūj for j > 0. Moreover, the definition of L 0 entails vars(χ (1) i,0 ) ⊆ ȳ.
At this point, we shift the existential quantifier block ∃ȳ n ūn inwards. By (VI), we have vars(L x,0 ) ∩ (ȳ n ∪ ūn ) = ∅. Therefore, the subformulas χ (1) i,x,0 contain neither variables from ȳn nor from ūn . Similarly, due to (V), the χ (1) i,x,j with 0 < j < n do not contain any variables from ȳn or from ūn . Consequently, one part of the quantifier block ∃ȳ n ūn , namely ∃ ȳn ∩ vars(χ

(1) i,0 ) , binds variables in χ (1)
i,0 (for convenience, we still write the full ∃ȳ n , which does not affect semantics), and another -disjoint -part, namely ∃ ūn ∩ U x,n , binds variables in χ

(1) i,x,n . In addition, (II) ensures that ū ∩ U x,n is disjoint from ū ∩ U x ,n for distinct x, x . The thus obtained sentence ϕ has the form

∀x 1 ∃ȳ 1 ū1 . . . ∀x n . i ∃ȳ n . χ (1) i,0 ∧ n k=1 x∈x k χ (1) i,x,0 ∧ n-1 j=k χ (1) i,x,j ∧ ∃(ū n ∩ U x,n ). χ (1) i,x,n .
In the rest of the transformation process we treat the subformulas ∃ȳ n . χ

(1) i,0 and ∃(ū n ∩ U x,n ). χ (1)
i,x,n as indivisible units. Next, we transform the big disjunction in ϕ into a conjunction of disjunctions i ψ i , rewrite the disjunctions ψ i into subformulas η

(1) i,0 ∨ n-1 k=1 x∈x k η (1) i,x ∨ x∈xn η (1)
i,x , similarly to what we have done above, but this time grouped in accordance with the more coarse-grained sets L 0 and L x . Having done the regrouping, we shift the universal quantifier block ∀x n inwards. The resulting formula has the shape ∀x 1 ∃ȳ 1 ū1 . . .

∀x n-1 ∃ȳ n-1 ūn-1 . i η (1) i,0 ∨ n-1 k=1 x∈x k η (1) i,x ∨ x∈xn ∀x. η (1) i,x .
From this point on we treat the subformulas ∀x. η

(1) i,x as indivisible units as well. Moreover, we shall group them under the conjunctions χ

( ) i,0 or η ( )
i,0 , ≥ 2, respectively, since they do not contain any free occurrences of universally quantified variables x ∈ x anymore. This is not only convenient but also necessary, because a subformula ∀x. η

(1) i,x may share free variables y ∈ ȳ1 ∪ . . . ∪ ȳidx(x)-1 with the subformula η

(1) i,0 . Hence, when some quantifier ∃y is shifted inwards later on, both ∀x. η

(1) i,x
and some literals in η

(1) i,0 might have to remain within the scope of ∃y. We reiterate the described process until all the quantifiers have been shifted inwards in the outlined way. There is one more peculiarity to mention. At later stages of the transformation subformulas of the form χ

( ) i,x,j ∧ . . . ∧ χ ( )
i,x,n may appear in which the constituents χ ( ) i,x,j may share variables u ∈ ūj , for instance. For the sake of readability, we abbreviate such subformulas by χ ( ) i,x,≥j and similar notations. Emerging subformulas ∃(ū ∩ U x, ). χ ( ) i,x,≥j will be treated as indivisible units.

∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . i χ (1) i,0 (ȳ 1 , . . . , ȳn ) ∧ n k=1 x∈x k χ (1) i,x,0 (ȳ 1 , . . . , ȳk-1 , x) ∧ n j=k χ (1) i,x,j (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūj ) |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n . i ∃ȳ n . χ (1) i,0 (ȳ 1 , . . . , ȳn ) ∧ n k=1 x∈x k χ (1) i,x,0 (ȳ 1 , . . . , ȳk-1 , x) ∧ n-1 j=k χ (1) i,x,j (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūj ) ∧ ∃(ū n ∩ U x,n ). χ (1) i,x,n (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn ) |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n . i η (1) i,0 (ȳ 1 , . . . , ȳn-1 ) ∨ n-1 k=1 x∈x k η (1) i,x (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn-1 ) ∨ x∈xn η (1) i,x (ȳ 1 , . . . , ȳn-1 , x) |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n-1 ∃ȳ n-1 ūn-1 . i η (1) i,0 (ȳ 1 , . . . , ȳn-1 ) ∨ n-1 k=1 x∈x k η (1) i,x (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn-1 ) ∨ x∈xn ∀x. η (1) i,x (ȳ 1 , . . . , ȳn-1 , x) |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n-1 ∃ȳ n-1 ūn-1 . i χ (2) i,0 (ȳ 1 , . . . , ȳn-1 ) ∧ n-1 k=1 x∈x k χ (2) i,x,0 (ȳ 1 , . . . , ȳk-1 , x) ∧ n-2 j=k χ (2) i,x,j (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūj ) ∧ χ (2) i,x,≥n-1 (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn-1 ) |=| ∀x 1 ∃ȳ 1 ū1 . . . ∀x n-1 . i ∃ȳ n-1 . χ (2) i,0 (ȳ 1 , . . . , ȳn-1 ) ∧ n-1 k=1 x∈x k χ (2) i,x,0 (ȳ 1 , . . . , ȳk-1 , x) ∧ n-2 j=k χ (2) i,x,j (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūj ) ∧ ∃(ū n-1 ∩ U x,n-1 ). χ (2)
i,x,≥n-1 (ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn-1 ) . . .

|=| ∀x 1 ∃ȳ 1 ū1 . i χ (n) i,0 (ȳ 1 ) ∧ x∈x1 χ (n) i,x,0 (x) ∧ χ (n) i,x,≥1 (x, ū1 ) |=| ∀x 1 . i ∃ȳ 1 . χ (n) i,0 (ȳ 1 ) ∧ x∈x1 χ (n) i,x,0 (x) ∧ ∃(ū 1 ∩ U x,1 ). χ (n) i,x,≥1 (x, ū1 ) |=| ∀x 1 . i η (n) i,0 () ∨ x∈x1 η (n) i,x (x) |=| i η (n) i,0 () ∨ x∈x1 ∀x. η (n) i,x (x)
The final result of this transformation is the sought ϕ . Every time a universal quantifier block ∀x j is shifted inwards at the -th stage, all the subformulas which contain universal quantifiers already are grouped into η ( ) i,0 . Due to the disjointness properties of the L x,k and the U x,k , it is guaranteed that no η ( ) i,0 contains a free occurrence of any x ∈ x (details have been elaborated above). Consequently, in the final result ϕ we do not have any nested occurrences of universal quantifiers.

We restore the property that no two quantifiers in ϕ bind the same variables by appropriately renaming bound variables in ϕ .

The sentence ϕ whose existence is stipulated in Lemma 3.8.1 can easily be further transformed into a particular shape to which we shall refer as GAF special form GAF special form :

∃z. i j ∀x i,j ∃ȳ i,j . χ i,j (z, x i,j , ȳi,j ) ∨ η i (z)
where the χ i,j and the η i are quantifier free.

Lemma 3.8.2 (GAF special form). If ϕ belongs to GAF, then we can effectively construct an equivalent sentence of the form ∃z. i j ∀x i,j ∃ȳ i,j . χ i,j (z, x i,j , ȳi,j ) ∨ η i (z), where the χ i,j and the η i are quantifier free.

Proof. By Lemma 3.8.1, we can effectively construct a sentence ϕ in standard form that is equivalent to ϕ and that does not contain any nested occurrences of universal quantifiers. We construct ϕ from ϕ as follows. First, we shift all existential quantifiers in ϕ that do not lie within the scope of any universal quantifier to the front of the formula. In the resulting sentence ∃z. ψ every existential quantifier in ψ lies within the scope of exactly one universal quantifier. We treat every subformula of the form ∀x. χ in ψ as indivisible unit while transforming ψ into an equivalent conjunction of disjunctions of literals and such indivisible units. The resulting formula can be brought into the desired shape by shifting existential quantifiers that lie in the scope of a universal quantifier outwards until they form an existential quantifier block directly right of the corresponding universal quantifier.

It is interesting to note that a sentence in GAF special form is not merely a Boolean combination of Ackermann sentences. The difference is that distinct subformulas ∀x∃ȳ. χ and ∀x ∃ȳ . χ may share existentially quantified variables. However, one can show that every such sentence is indeed equivalent to some Ackermann sentence. Therefore, every GAF sentence is equivalent to an Ackermann sentence. Before we make this claim precise (cf. Lemma 3.8.4), we develop an auxiliary result that we will reuse later.

Lemma 3.8.3. Let ψ be a first-order formula of the form ψ := j ∀x ∃ȳ. χ j (z, x, ȳ) with quantifierfree subformulas χ j (z, x, ȳ). Then, ψ is equivalent to some formula ψ of the form

ψ := ∃v 1 . . . vq ∃ȳ 1 . . . ȳq . j q k=1 χ j (z, vk , ȳk ) ∧ ∀x∃ȳ. q k=1 A∈At A(z, x, ȳ) ↔ A(z, vk , ȳk ) ,
where At denotes the set of all atoms occurring in ψ and q := 2 |At| . In addition, we have |v k | = |x| for every k and |ȳ | = |ȳ| for every .

Proof. We first prove ψ |= ψ . Let A be any structure, β any variable assignment, and j any index such that A, β |= ∀x ∃ȳ. χ j (z, x, ȳ). For every set S ⊆ At we define

D S D S := ā, c ∈ D |x|+|ȳ| for every atom A ∈ At we have A, β[x →ā, ȳ →c ] |= A(z, x, ȳ) if and only if A ∈ S .
We write S |= χ j (z, x, ȳ) if D S is nonempty and if we have A, β[x →ā, ȳ →c ] |= χ j (z, x, ȳ) for every tuple ā, c in D S . Let S 1 , . . . , S r be an enumeration of all the sets S k with S k |= χ j (z, x, ȳ). Notice that 1 ≤ r ≤ q. Let b1 , c1 , . . . , br , cr be some sequence with bk , ck ∈ D S k for every k. Then, for every k the assumption

S k |= χ j (z, x, ȳ) entails A, β[x → bk , ȳ →c k ] |= χ j (z, x, ȳ). Hence, A, β[v 1 → b1 , . . . , vr → br , vr+1 → b1 , . . . , vq → b1 ] |= ∃ȳ 1 . . . ∃ȳ q . q k=1 χ j (z, vk , ȳk ) .
(3.4)

Let ā ∈ D |x| be any tuple of length |x|. Because of A, β |= ∀x ∃ȳ. χ j (z, x, ȳ), there is some S k , 1 ≤ k ≤ r, and some tuple c ∈ D |ȳ| such that ā, c ∈ D S k and S k |= χ j (z, x, ȳ). Therefore, we get the following for bk , ck :

A, β[x →ā, vk →b k , ȳk →c k ] |= ∃ȳ. A∈At A(z, x, ȳ) ↔ A(z, vk , ȳk ) . (3.5)
Put together, (3.4) and (3.5) entail

A, β[v 1 → b1 , . . . , vr → br , vr+1 → b1 , . . . , vq → b1 ] |= ∃ȳ 1 . . . ∃ȳ q . j q k=1 χ j (z, vk , ȳk ) ∧ ∀x ∃ȳ. q k=1 A∈At A(z, x, ȳ) ↔ A(z, vk , ȳk ) . This proves A, β |= ψ . Hence, we have shown that A, β |= ψ implies A, β |= ψ .
Next, we show ψ |= ψ. Let A be a structure, let β be a variable assignment, and let b1 , . . . , bq , c1 , . . . , cq be tuples such that

A, β[v 1 → b1 , . . . , vq → bq , ȳ1 →c 1 , . . . , ȳq →c q ] |= j q k=1 χ j (z, vk , ȳk ) ∧ ∀x ∃ȳ. q k=1 A∈At A(z, x, ȳ) ↔ A(z, vk , ȳk ) . (3.6)
Then, there is some index j such that

A, β[v 1 → b1 , . . . , vq → bq , ȳ1 →c 1 , . . . , ȳq →c q ] |= q k=1 χ j (z, vk , ȳk ) .
Let D 1 , . . . , D q D k be sets defined such that

D k := ā ∈ D |x| | there is some tuple c ∈ D |ȳ| such that for every atom A ∈ At we have A, β[x →ā, ȳ →c ] |= A(z, x, ȳ) if and only if A, β[v k → bk , ȳk →c k ] |= A(z, vk , ȳk ) .
Note that the sets D k are all nonempty but not necessarily pairwise disjoint. Then, because of Assumption (3.6), for every ā ∈ D |x| there is some k, Lemma 3.8.3 is essential for the second stage in the transformation process between GAF and AF. With this tool at hand, the following lemma is now easy to prove. Lemma 3.8.4. For every GAF sentence ϕ we can effectively construct an equivalent sentence ϕ over the same vocabulary that has the shape ∃v∀x∃ w. ψ with quantifier-free ψ.

1 ≤ k ≤ q, such that ā ∈ D k . Because of A, β[v k → bk , ȳk →c k ] |= χ j (z, vk , ȳk ), we therefore have A, β[x →ā, ȳ →c ] |= χ j (z,
Proof sketch. By virtue of Lemma 3.8.2, we can transform ϕ into an equivalent sentence ϕ in GAF special form, i.e. ϕ = ∃z. i j ∀x i,j ∃ȳ i,j . χ i,j (z, x i,j , ȳi,j ) ∨ η i (z), where the χ i,j and the η i are quantifier free. Consider any subformula of the form ψ := j ∀x ∃ȳ. χ j (z, x, ȳ), possibly containing free variables from z. By virtue of Lemma 3.8.3, ψ is equivalent to some formula of the form ∃v ȳ . χ (z, v , ȳ ) ∧ ∀x∃ȳ. χ (z, x, ȳ, v , ȳ ) with quantifier-free χ , χ . Hence, ϕ is equivalent to some sentence that, after shifting some quantifiers outwards, is of the form ∃z. i ∃ū i ∀x i ∃ wi . ψ i (z, ūi , x i , wi ) ∨ η i (z), where the ψ i and the η i are quantifier free. A prenex version of this sentence yields the sought ϕ , since the universal quantifiers distribute over the topmost conjunction.

Notice that the proofs of Lemmas 3.8.1 to 3.8.4 still work in the presence of the equality predicate or function symbols. Therefore, we obtain the following result.

Theorem 3.8.5. Every GAF sentence ϕ is equivalent to some AF sentence ψ. Moreover, we get the following results for relaxed restrictions on the syntax.

(a) Every GAF sentence with equality is equivalent to some AF sentence with equality.

(b) Every GAF sentence with arbitrary function symbols and without equality is equivalent to some Gurevich-Maslov-Orevkov sentence ( ∃ * ∀∃ * -sentences with arbitrary function symbols, cf. page 24).

(c) Every GAF sentence with equality and with a single unary function symbol is equivalent to some Shelah sentence ( ∃ * ∀∃ * -sentences with equality and a single unary function symbol, cf. page 24).

In addition, constant symbols are admissible in all of the above cases.

Since AF possesses the finite model property, so does GAF, even in the first two syntactically extended cases mentioned in Theorem 3.8.5. On the other hand, it is known that the Shelah fragment contains infinity axioms. One example is the sentence ∀x∃y.

f (f (y)) ≈ f (x) ∧ f (y) ≈ x ([BGG97]
, proof of Proposition 6.5.5). Still, the satisfiability problem for the Shelah fragment is known to be decidable (cf. [BGG97], Section 7.3). Therefore, we get the following positive results regarding the decidability of GAF-Sat.

Corollary 3.8.6. GAF-Sat is decidable, even in the syntactically more liberal cases given in Theorem 3.8.5. The syntactic extensions of GAF described in items (a) and (b) of Theorem 3.8.5 enjoy the finite model property.

Remark 3.8.7. Every sentence from the Löb-Gurevich fragment (monadic first-order sentences with constant symbols and unary function symbols but without equality, cf. page 23) falls into the syntactic category of GAF when we in addition allow unary function symbols. By Lemma 3.8.4, every such sentence is equivalent to some ∃ * ∀∃ * -sentence over the same vocabulary. The latter kind of sentences constitutes a subclass of the Gurevich-Maslov-Orevkov fragment. Hence, Lemmas 3.8.1 to 3.8.4 establish a reduction of the satisfiability problem for sentences from the Löb-Gurevich fragment to the satisfiability problem for the Gurevich-Maslov-Orevkov fragment.

On the other hand, the presented methods do not establish a reduction from the Rabin fragment (monadic first-order sentences with equality and a single unary function symbol, cf. page 23) to the Shelah fragment. The problem is equations that do not adhere to the syntactic restrictions of GAF. It seems that these cannot be treated by the same methods we have employed to deal with equations in the monadic fragment in the proof of Theorem 3.1.5, where we devised an equivalence-preserving translation from MFO ≈ into BSR.

At this point we have settled the question concerning decidability of GAF-Sat, also under certain syntactic extensions. In fact, decidability of GAF-Sat without any syntactic extensions is already a corollary of the decidability of the satisfiability problem for Maslov's fragment K. The reaon is that the latter syntactically subsumes GAF. Proposition 3.8.8. GAF is contained in Maslov's fragment K.

Proof. Let ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ be any GAF sentence with quantifier-free ψ. Recall that ϕ is relational and does not contain equality. Let the sets At, x, ȳ, ū be defined as in Definition 3.7.1 and let At 0 , (At x ) x∈x be the partition of the set At described in Definition 3.7.1. Then, in the terminology of the definition of Maslov's fragment K (cf. page 25), the terminal ϕ-prefix of any atom A ∈ At x with x ∈ x is a subsequence of ∀x∃ū idx(x) . . . ūn . Therefore, the terminal ϕ-prefix of A either ends with an existential quantifier or it is of length one. Regarding the ϕ-prefix of any atom B ∈ At 0 , we get ∃ȳ 1 . . . ȳn . Hence, the terminal ϕ-prefix of B is empty. Consequently, ϕ satisfies the conditions of the definition of Maslov's fragment K.

Of course, Proposition 3.8.8 fails for any extensions of GAF with either equality or non-constant function symbols. We shall see in the next section, how GAF can be extended in such a way that we obtain a generalization of the Gödel-Kalmár-Schütte fragment. Although the latter is syntactically contained in Maslov's fragment K as well, its extension will not (cf. Proposition 3.9.4).

We have not yet given any lower bounds on the blowup that we incur when translating GAF sentences into equivalent Ackermann sentences. However, known bounds regarding the computational complexity of AF-Sat and MFO-Sat give some evidence that this blowup is at least exponential. On the one hand, it is known that the satisfiability problem for AF (without equality) is decidable in deterministic exponential time, even in the presence of arbitrary function symbols (see [START_REF] Börger | The Classical Decision Problem[END_REF], Theorem 6.3.26 for the former case and Theorem 6.3.1 for the latter). In other words, AF-Sat lies in ExpTime. On the other hand, NExpTime-hardness for MFO-Sat has been shown (cf. Theorem 6.2.13 in [START_REF] Börger | The Classical Decision Problem[END_REF]). Since MFO is a subfragment of GAF, this entails the following conditional lower bound.

Proposition 3.8.9. In the worst case, there is at least a super-polynomial blowup in formula length when translating GAF sentences into equivalent AF sentences in a uniform algorithmic way, unless ExpTime = NExpTime In Section 4.3, we present a model-theoretic approach including a direct construction of finite models for satisfiable GAF sentences. That approach facilitates deriving an upper bound on the size of small models, which in the end also leads to upper bounds on the computational complexity of GAF-Sat.

Remark 3.8.10. There is also a probabilistic proof for the decidability of the Gödel-Kalmár-Schütte fragment known [START_REF] Gurevich | Random Models and the Gödel Case of the Decision Problem[END_REF], see also Section 6.2.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. Since GKS is a syntactic extension of the Ackermann fragment, the proof shows decidability for the latter as well. Although the arguments are indirectly applicable to GAF, via the translation to Ackermann sentences, it might be worthwhile to check whether the probabilistic approach can be applied to GAF sentences directly. We may have to guess some parameters of the probabilistic construction or use upper bounds derivable from what we already know about satisfiable GAF sentences.

The Generalized Gödel-Kalmár-Schütte Fragment (GGKS)

It is only a tiny step from the Ackermann fragment to the Gödel-Kalmár-Schütte fragment: simply allow two consecutive universal quantifiers in the quantifier prefix instead of only one. We will see shortly, that, if one views the definition of the generalized Ackermann fragment from the right angle, it is a similarly small step to go from GAF to a generalization of the Gödel-Kalmár-Schütte fragment, which we shall call the generalized Gödel-Kalmár-Schütte fragment (GGKS). Intuitively speaking, a GGKS sentence is of the form ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ with quantifier-free ψ and satisfies the following properties. Each atom in ϕ contains only variables from some subsequence of ϕ's quantifier prefix of the form ∃ * ∀∀∃ * . We allow only fixed pairs of universally quantified variables to co-occur in atoms. Any two atoms that are associated with the same pair have the same ∃ * ∀∀∃ * -subsequence as source of all their variables. The same applies to any two atoms that share some variable from the trailing ∃ * -block of their respective quantifier subsequence. Definition 3.9.1 (Generalized Gödel-Kalmár-Schütte fragment (GGKS)). Let ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ be a relational first-order sentence without equality. Let At be the set of all atoms occurring in ϕ and let x := x1 ∪ . . . ∪ xn , ȳ := ȳ1 ∪ . . . ∪ ȳn , and ū := ū1 ∪ . . . ∪ ūn . Like in Definition 3.7.1, we define the index of a variable (i) There is some partition of the variables in x into a sequence X := {x 1 , x 1 } . . . {x m , x m } X of nonempty, pairwise disjoint sets with at most two variables each (x i = x i is allowed).

v ∈ x ∪ ȳ ∪ ū by idx(v) := k idx(v) if and only if v ∈ xk ∪ ȳk ∪ ūk
(ii) There is a partition of At into sets At ∅ and At x,x with {x, x } ∈ X , such that the following requirements are met:

(ii.a) vars(At ∅ ) ⊆ ȳ;

(ii.b) for every {x, x } ∈ X with idx(x) ≤ idx(x ) we have vars(At x,x ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x, x } ∪ ūidx(x ) ∪ . . . ∪ ūn ; (ii.c) for all distinct sets {x 1 , x 1 }, {x 2 , x 2 } ∈ X we have vars(At x1,x 1 ) ∩ vars(At x2,x 2 ) ∩ ū = ∅.
Since the tuples xi and ȳi , ūi in any GGKS sentence ϕ may be empty, ϕ's quantifier prefix does not have to start with a universal quantifier and it does not have to end with an existential quantifier. Moreover, notice that every variable u ∈ ū that occurs in ϕ is associated with exactly one set {x, x } ∈ X containing at least one and at most two reference variables x, x ∈ x, determined by the set At x,x in which u occurs. Intuitively speaking, like in the case of GAF, any quantifier ∃u with u ∈ ū can be shifted out of the scope of any universal quantifier that does not bind one of u's reference variables.

Deciding membership in GGKS for a given sentence can be done deterministically in polynomial time. The procedure is based on the concepts that we already used for deciding membership in GAF.

Theorem 3.9.2. Deciding whether a given first-order sentence belongs to GGKS can be done deterministically in time that is polynomial in the length of any reasonable encoding of the input sentence.

Proof sketch. We only slightly adapt the proof of Theorem 3.7.3. Let ϕ := ∀x 1 ∃v 1 . . . ∀x n ∃v n . ψ be any relational first-order sentence in prenex normal form with quantifier-free ψ. Let x := x1 ∪. . .∪x n and v := v1 ∪ . . . ∪ vn . For the moment we do neither know a priori how the variables in each existential quantifier block ∃v k are to be partitioned into ȳk and ūk , nor do we know the partition of x into the sequence

X = {x 1 , x 1 } . . . {x m , x m }. Let the graph G ϕ := V, E G ϕ , C ↑ v , at(C ↑ v ), at 0 , at x , U x
and the upward closure C ↑ v be defined like in the proof of Theorem 3.7.3. In addition, we take over the definitions of at(C ↑ v ) for v ∈ v and at x for x ∈ x and at 0 . Moreover, we reuse the notation U x := vars(at x ) ∩ i≥idx(x) vi .

Claim I: Assume that (A) for every x ∈ x there is at most one x ∈ x \ {x} such that at x ∩ at x is nonempty, and (B) for all distinct x, x ∈ x with idx(x) ≤ idx(x ) and nonempty at x ∩ at x we have v ∈ vars(at

x ∪ at x ) for every v ∈ idx(x )-1 i=idx(x) vi . Let X := {x 1 , x 1 }, . . . , {x m , x m } X
be a maximal sequence of nonempty, pairwise disjoint subsets of x, each containing exactly two distinct variables

x i , x i for which at xi ∩ at x i is nonempty. Let X := X {x m +1 } . . . {x m } X
be a maximal extension of X that constitutes a partition of x, i.e. every x ∈ x occur is exactly one set in X . We define the sets at x,x := at x ∪ at x at x,x , U x,x , at ∅ and U x,x := U x ∪ U x for every {x, x } ∈ X . Moreover, we set at ∅ := at 0 . Then, we observer the following properties:

(i) For all distinct {x 1 , x 1 }, {x 2 , x 2 } ∈ X we have at x1,x 1 ∩ at x2,x 2 = ∅. (ii) For every {x, x } ∈ X we have vars(at x,x ) ∩ x = {x, x }. (iii) For every {x, x } ∈ X we have U x,x ∩ vars(at ∅ ) = ∅. (iv) For all distinct {x 1 , x 1 }, {x 2 , x 2 } ∈ X with min idx(x 1 ), idx(x 1 ) ≤ min idx(x 2 ), idx(x 2 ) we have U x1,x 1 ∩ vars(at x2,x 2 ) = ∅.
Proof:

Ad (i): Suppose there are variables x 1 , x 2 stemming from distinct sets {x 1 , x 1 }, {x 2 , x 2 } ∈ X and there is some atom A ∈ at x1 ∩ at x2 . Then, x 1 = x 2 . Moreover, by maximality of X , we must have {x 1 , x 2 } as one element in X . Hence, {x 1 , x 2 }, {x 1 , x 1 }, and {x 2 , x 2 } are distinct, and Condition (A) entails x 1 = x 1 and x 2 = x 2 . But this contradicts the requirement that all sets in X are pairwise disjoint.

Ad (ii): This is a direct consequence of (i) and the definition of at x , at x , and at x,x .

Ad (iii): Whenever v ∈ U x,x ⊆ i≥min idx(x),idx(x ) vi we have that at(C ↑ v ) ⊆ at x,x . Suppose there is some v ∈ U x,x ∩ vars(at ∅ ), i.e. there is some A ∈ at ∅ = at 0 with v ∈ vars(A). Since A ∈ at(C ↑ v ) ⊆ at x,x
, by definition of at 0 , A cannot occur in at 0 and, hence, not in at ∅ .

Ad (iv): Whenever v ∈ U x1,x 1 ⊆ i≥min idx(x1),idx(x 1 ) vi , we observe that at(C ↑ v ) ⊆ at x1,x 1 . Suppose there is some v ∈ U x1,x 1 ∩ vars(at x2,x 2 ).
Hence, there must be some atom A ∈ at x2,x 2 in which v occurs. But since A belongs to at(C ↑ v ), we know that A ∈ at x1,x 1 . This contradicts (i).

♦

Claim II: The sentence ϕ belongs to GGKS if and only if it satisfies Conditions (A) and (B) from Claim I.

Proof: Regarding the if -direction, we construct the sequence X as described in the proof of Claim I, we set At ∅ := at ∅ At x,x , At ∅ and for every {x, x } ∈ X we set At x,x := at x,x . Moreover, we partition every existential quantifier block ∃v k into ∃ȳ k ∃ū k by setting ūk := vk ∩ {x,x }∈X U x,x and ȳk := vk \ ūk . Condition (i) of Definition 3.9.1 is certainly satisfied by X . Condition (ii.a) of Definition 3.9.1 is satisfied due to the following observations. By definition of at ∅ and the at x,x , we have vars(At ∅ ) ∩ x = ∅. By virtue of Claim I(iii) and the above partition of the vk into ȳk and ūk , we have ūk ∩ vars(At ∅ ) = ∅ for every k. Hence, vars(At ∅ ) ⊆ ȳ1 ∪ . . . ∪ ȳn . Condition (ii.b) of Definition 3.9.1 is a consequence of the way we partition the vk into ȳk , ūk . By Condition (B), any variable v ∈ v ∩ vars(At x,x ) with index idx(v) = k belongs to U x,x if and only if k ≥ max idx(x), idx(x ) . Hence, again by Condition (B), we have v ∈ ȳk if and only if k < min idx(x), idx(x ) , and we have v ∈ ūk otherwise. Moreover, Claim I(ii) states that x, x are the only variables from x that occur in At x,x . Condition (ii.c) of Definition 3.9.1 follows immediately from Claim I(iv) and the the fact that ū1 ∪ . . . ∪ ūn = {x,x }∈X U x,x .

Regarding the only if -direction we argue as follows. Condition (A) of Claim I is certainly satisfied, if Conditions (ii.b) and (ii.c) of Definition 3.9.1 are met by ϕ. Consider any pair of distinct variables x, x ∈ x with idx(x) ≤ idx(x ) and nonempty at x ∩ at x . By construction of at x and at x , a nonempty intersection of the two entails that the set at x ∪ at x cannot be partitioned into two parts at 1 , at 2 such that at 1 contains x, at 2 contains x , and at 1 and at 2 do not share any variables from {x, x } ∪ ūidx(x) ∪ . . . ∪ ūn . Hence, by Conditions (ii.b) and Conditions (ii.c) of Definition 3.9.1, we must have {x, x } ∈ X . But then, Condition (ii.b) of Definition 3.9.1 entails that vars(at x ∪ at x ) ∩ ūk = vars(At x,x ) ∩ ūk is empty for every k with idx(x) ≤ k < idx(x ). This entails that Condition (B) of Claim I is satisfied. ♦ By Claim II, Conditions (A) and (B) from Claim I together yield a criterion to decide whether ϕ belongs to GGKS or not. It remains to argue that this criterion can be checked deterministically in polynomial time. We have already argued in the proof of Theorem 3.7.3 that the graph G ϕ and the sets at x can be computed deterministically in time that is polynomial in ϕ . The sum of the lengths of the atoms in all the at x taken together is at most |x| • len(ϕ) ≤ len(ϕ)

2 . Therefore, checking whether at x ∩ at x for any x, x is empty and, hence, checking Conditions (A) and (B) can be done in time polynomial in ϕ .

GGKS obviously contains sentences that GAF does not, e.g. ∀x 1 x 2 . P (x 1 , x 2 ). It is also easy to see that GGKS is an extension of GAF: if we restrict the sequences X so that they contain only singleton sets, then we essentially obtain the definition of GAF. Hence, also AF and MFO are a subset of GGKS. Finally, consider any GKS sentence ∃ȳ∀x 1 x 2 ∃ū. ψ with quantifier-free ψ. We define the sequence X := {x 1 , x 2 } and let At x1,x2 be the set of all atoms occurring in ϕ. Then, X and At x1,x2 satisfy the conditions of Definition 3.9.1 and thus witness that ϕ belongs to GGKS. Proposition 3.9.3. GGKS properly contains GKS, GAF, AF, and MFO.

In the previous section we have seen that GAF is contained in Maslov's fragment K. We shall see now that we left the realm of the latter class with the step from GAF to GGKS. Proposition 3.9.4. GGKS and Maslov's fragment K are syntactically incomparable classes of sentences.

Proof. The following sentence witnesses that GGKS is not contained in Maslov's fragment K:

∀x 1 x 1 x 2 x 2 . P (x 1 , x 1 ) ∨ Q(x 2 , x 2 ) .
The sentence belongs to GGKS but not to Maslov's class K. On the other hand, it is easy to find sentences that belong to K but not to GGKS, e.g.

∀x 1 x 2 x 3 ∃y 1 y 2 . P (x 1 , x 2 , y 1 ) ∧ Q(x 3 , y 1 , y 2 ) ∧ R(x 1 , x 2 , x 3 ) .
Next, we sketch an equivalence-preserving translation from GGKS into GKS. The bulk of the work was already described in Section 3.8. Again, we proceed in two stages, first transforming a given GGKS sentence into GGKS special form and, afterwards, into an equivalent GKS sentence. Lemma 3.9.5. If ϕ belongs to GGKS, we can effectively construct an equivalent sentence ϕ in standard form, in which every subformula lies within the scope of at most two universal quantifiers, and the scope of every universal quantifier contains at most one more universal quantifier. Moreover, all literals in ϕ occur in ϕ (modulo variable renaming).

The transformation mentioned in the lemma is essentially a slight adaptation of the analogous transformation for the GAF case (cf. Lemma 3.8.1). The sentence ϕ can easily be further transformed into a particular shape to which we shall refer as GGKS special form GGKS special form

: ∃z. i j ∀x i,j x i,j ∃ȳ i,j . χ i,j (z, x i,j , x i,j , ȳi,j ) ∨ η i (z)
where the χ i,j and the η i are quantifier free. One can show that every such sentence is equivalent to some GKS sentence. Therefore, every GGKS sentence is equivalent to a GKS sentence.

Lemma 3.9.6. Every GGKS sentence ϕ in GGKS special form can be effectively transformed into an equivalent sentence ϕ that has the shape ∃z ∀xx ∃ȳ. ψ with quantifier-free ψ.

Proof. Since ϕ is in GGKS special form, it has the shape ϕ := ∃z. i j ∀x i,j x i,j ∃ȳ i,j . χ i,j (z, x i,j , x i,j , ȳi,j ) ∨ η i (z), where the χ i,j and the η i are quantifier free. Consider any subformula of the form ψ := j ∀xx ∃ȳ. χ j (z, x, x , ȳ), possibly containing free variables from z. By virtue of Lemma 3.8.3, ψ is equivalent to some formula of the form ∃v ȳ . χ (z, v , ȳ ) ∧ ∀xx ∃ȳ. χ (z, x, x , ȳ, v , ȳ ) with quantifier-free χ , χ . Hence, ϕ is equivalent to some sentence that, after shifting some quantifiers outwards, is of the form ∃z. i ∃ū i ∀x i x i ∃ wi . ψ i (z, ūi , x i , x i , wi ) ∨ η i (z), where the ψ i and the η i are quantifier free. A prenex version of this sentence yields the sought ϕ . Theorem 3.9.7. Every GGKS sentence is equivalent to some GKS sentence.

Since we know that GKS enjoys the finite model property and, hence, the decidability problem for GKS is decidable, this result immediately entails decidability of the satisfiability problem for GGKS (GGKS-Sat) GGKS-Sat .

Corollary 3.9.8. The satisfiability problem for GGKS is decidable, and GGKS enjoys the finite model property.

As we have already pointed out in Remark 3.8.10, Gurevich and Shelah [START_REF] Gurevich | Random Models and the Gödel Case of the Decision Problem[END_REF] gave a probabilistic proof for the decidability of GKS, see also Section 6.2.3 in [START_REF] Börger | The Classical Decision Problem[END_REF]. It would be interesting to approach decidability of GGKS-Sat using a probabilistic approach without relying on the translation from GGKS to GKS.

We finish the present section emphasizing that GGKS sentences can be substantially more succinct than equivalent GKS sentences. The following theorem formulates a lower bound regarding the incurred blowup that comes along with any equivalence-preserving translation from GGKS to GKS.

Theorem 3.9.9. There is a class of GGKS sentences and some positive integer n 0 such that for every integer n ≥ n 0 the class contains a sentence ϕ with a length linear in n for which any equivalent GKS sentence has a length that is at least exponential in n.

Proof sketch. Let n ≥ 1 be some positive integer. Consider the following first-order sentence in which the sets {x 1 , x 2 } and {y 1 , y 2 } are separated:

ϕ := ∀x 2 ∃y 2 ∀x 1 ∃y 1 . 8n i=1 P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) .
In analogy to the proof of Theorem 3.2.7, we construct the following model A for ϕ. The construction is based on the sets

S k S 1 := S ⊆ [8n] |S| = 2n and S 2 := S ⊆ S 1 |S| = 1 2 |S 1 | . We observe that |S 1 | = 8n 2n ≥ 8n 2n 2n = 2 4n and |S 2 | = |S 1 | |S 1 |/2 ≥ |S 1 | |S 1 |/2 |S1|/2 ≥ 2 2 4n-1 .
Having the sets S 1 , S 2 , we now define the structure A as follows:

A

A := a (1) S , b (1) S S ∈ S 1 ∪ a (2)
S , b

(2) S S ∈ S 2 ,

P A i := a (1) S1 , a (2)
S2 ∈ A 2 i ∈ S 1 ∈ S 2 for i = 1, . . .

, 8n, and

Q A i := b (1) S1 , b (2)
S2 ∈ A 2 i ∈ S 1 ∈ S 2 for i = 1, . . . , 8n.
Clearly, for any choice of S 1 , S 2 and every i, 1 ≤ i ≤ 8n, we have

A, x 1 →a (1) S1 , x 2 →a (2) S2 , y 1 →b (1) S1 , y 2 →b (2) S2 |= P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) .
For any other choice of pairs c 1 , c 2 , i.e. there do not exist sets

S 1 ∈ S 1 and S 2 ∈ S 2 such that c 1 , c 2 equals a (1) S1 , a (2) S2 or b (1) S1 , b (2)
S2 , we observe A, [x 1 →c 1 , x 2 →c 2 ] |= P i (x 1 , x 2 ) and A, [y 1 →c 1 , y 2 →c 2 ] |= Q i (y 1 , y 2 ) for every i. Hence, A, [x 1 →c 1 , x 2 →c 2 , y 1 →c 1 , y 2 →c 2 ] |= 8n i=1 P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) . Consequently, A is a model of ϕ.
For every S ∈ S 1 ∪ S 2 we define the structure A -S A -S as the substructure of A induced by the domain

A -S := A \ {b (k) S }, where k = 1 if S ∈ S 1 and k = 2 if S ∈ S 2 .
Like in the proof of Theorem 3.2.7 we can prove the following claim.

Claim I: For every S ∈ S 1 ∪ S 2 the substructure A -S of A does not satisfy ϕ. ♦ Let ϕ * := ∃z∀x 1 x 2 ∃ȳ. ψ * with quantifier-free ψ * be a shortest GKS sentence equivalent to ϕ. Suppose that the length of ϕ * is less than 2 n . Let ψ := i∈I χ i (z, x 1 , x 2 , ȳ) be a shortest disjunction of conjunctions of literals that is equivalent to ψ * . We observe that the index set I contains fewer than 2 2 n indices, for otherwise we could find a shorter formula satisfying our requirements. For the same reason every conjunction χ i contains at most 2 n literals.

Let d be some tuple for which we have

A, [z → d] |= ∀x 1 x 2 ∃ȳ. i∈I χ i (z, x 1 , x 2 , ȳ) . Let D := {b (2) S | S ∈ S 2 and b (2) S ∈ d} D . Because of | d| ≤ |z| ≤ len(ϕ * ) ≤ 2 n and |S 2 | ≥ 2 2 4n-1 ≥ 2 2 3n , we have |D| ≥ 2 2 2n
for sufficiently large n. By Claim I, we observe

A -S , [z → d] |= ∀x 1 x 2 ∃ȳ. i∈I χ i (z, x 1 , x 2 , ȳ) for every S with b (2) S ∈ D. Hence, for every b (2) S ∈ D there is some pair c 1 , c 2 ∈ A \ {b (2) S }, some tuple b containing b (2) S and some index i S ∈ I such that A, [z → d, x 1 →c 1 , x 2 →c 2 , ȳ → b] |= χ i S (z, x 1 , x 2 , ȳ) and A -S , [z → d, x 1 →c 1 , x 2 →c 2 ] |= ∃ȳ. χ i S (z, x 1 , x 2 , ȳ) .
Because of |I| ≤ 2 2 n and |D| ≥ 2 2 2n , there must be some index i * that appears as i S for at least

|D| |I| ≥ 2 2 2n 2 2 n = 2 2 2n -2 n ≥ 2 (2 n ) 2 /2 n = 2 2 n elements b (2) S ∈ D,
S such that A, [z → d, x 1 →c 1 , x 2 →c 2 , ȳ → b] |= χ i * (z, x 1 , x 2 , ȳ) (3.7) and A -S , [z → d, x 1 →c 1 , x 2 →c 2 ] |= ∃ȳ. χ i * (z, x 1 , x 2 , ȳ) . (3.8)
Consider some b

(2) S ∈ D * with S ∈ S 2 and fix it. The only atoms in χ i * that could possibly contribute to the effect described in (3.7) and (3.8) for b

(2)

S have the form Q j (z, y ), Q j (y, y ), Q j (x 1 , y ), or Q j (x 2 , y ) for z ∈ z,
y, y ∈ ȳ, and 1 ≤ j ≤ 8n, and, moreover, the variables z, y, x 1 , x 2 need to be assigned values b

(1) T with T ∈ S 1 . Let S 1 be the set collecting all the T from S 1 that are assigned to such variables occurring in atoms of the mentioned kind. As

χ i * contains at most 2 n such variables, |S 1 | ≤ 2 n . Recall that S contains 1 2 |S 1 | ≥ 2 4n-1 sets of indices.
By construction of S 2 , there must be some some S ∈ S 2 such that for every T ∈ S 1 we have T ∈ S if and only if T ∈ S. Let b be the tuple that results from b by replacing every occurrence of b

(2) S in the tuple by b

(2)

S . Then, we get A -S , [z → d, x 1 →c 1 , x 2 →c 2 , ȳ → b ] |= χ i * (z, x 1 , x 2 , ȳ), which contradicts (3.8).
Consequently, the length of the sentence ϕ * cannot be less than 2 n .

Separateness and Guarded Quantification

In the beginning of Chapter 3 -more precisely, on page 26 -, we have briefly introduced the concept of guarded quantification. The idea is that a quantifier Qū is not only accompanied by its scope ψ(ū, v) but also by a guard γ(ū, v). A guard is a formula that contains all variables that occur freely in the scope ψ(ū, v) and satisfies additional syntactic restrictions. For instance, guards may be restricted to atomic formulas -which is characteristic for the guarded fragment -, and we then speak of atomic guards. Or guards γ(ū, v) may be restricted to nonempty conjunctions of atoms A 1 (ū, v) ∧ . . . ∧ A k (ū, v) such that every variable u ∈ v co-occurs with every v ∈ ū ∪ v in at least one A j . This kind of guards of called loose guards.

Given any such guard γ(ū, v), guarded quantification has two possible shapes: ∀ū. γ(ū, v) → ψ(ū, v) and ∃ū. γ(ū, v) ∧ ψ(ū, v), which are dual to one another. If we restrict our attention to first-order sentences in which all quantifiers are guarded in the described way by atomic guards or loose guards, then we are in the realm of the guarded fragment or the loosely guarded fragment.

Definition 3.10.1 (Guarded fragment (GF) and loosely guarded fragment (LGF)).

An atomic guard γ(ū, v) is an atom A(ū, v) such that all u ∈ ū ∪ v occur in A(ū, v). A loose guard γ(ū, v) is a nonempty conjunction of atoms γ(ū, v) := A 1 (ū, v) ∧ . . . ∧ A k (ū, v
) such that ū is nonempty, ū and v are disjoint, and all u, v with u ∈ ū and v ∈ ū ∪ v co-occur in at least one A j .

We define the set of loosely guarded formulas inductively:

(i) every relational atom is a loosely guarded formula, equality is admitted;

(ii) every Boolean combination of loosely guarded formulas is a loosely guarded formula;

(iii) for all tuples ū, v, every loose guard γ(ū, v), and every loosely guarded formula ψ(ū, v) the following formulas are loosely guarded formulas:

∀ū. γ(ū, v) → ψ(ū, v) -abbreviated by ∀ū. γ(ū, v) ψ(ū, v) -and ∃ū. γ(ū, v) ∧ ψ(ū, v) -abbreviated by ∃ū. γ(ū, v) ψ(ū, v).
Notice that we assume in any loosely guarded formula Qū. γ(ū, v) ψ(ū, v) that (a) all variables that occur freely in ψ also occur in γ and (b) every variable that is bound by Qū co-occurs with every free variable from ψ in some atom in γ.

The loosely guarded fragment (LGF) is the class of all loosely guarded sentences. The guarded fragment (GF) is defined in the same way, except that we require all guards to be atomic.

We shall occasionally use sloppy language and speak of LGF formulas when we mean loosely guarded formulas that are not necessarily closed. Formally, LGF exclusively contains sentences. The same applies to GF formulas.

At first glance it seems that guarded quantification and separateness of quantified variables are two opposite properties. In particular, any guard γ(ū, v) in a formula ∀ū. γ(ū, v) ϕ(ū, v) has to ensure that every u ∈ ū co-occurs with each v ∈ v in at least one atom in γ. Clearly, this destroys any separateness of variables from ū and v which might be separated in ϕ. However, it turns out that guardedness and separateness can be conceived as complementing concepts. Combining the two in a certain way can help extending the (loosely) guarded fragment of first-order logic in a way that preserves decidability of the satisfiability problem. Definition 3.10.2 (Separated loosely guarded fragment (SLGF)). Two tuples x, ȳ are guardseparated in a loosely guarded formula ψ if for every atom A in ψ we either have vars(A) ∩ x = ∅ or vars(A)∩ȳ = ∅; the same must hold for every guard γ in ψ: either vars(γ)∩x = ∅ or vars(γ)∩ȳ = ∅.

We define the set of separated loosely guarded formulas inductively as follows. (i) and (ii) are the same as for loosely guarded formulas (cf. Definition 3.10.1). Let ū, v, z be tuples of variables and let γ(ū, v) be any loose guard.

(iii) The following are separated loosely guarded formulas:

∀ū. γ(ū, v) → ψ(ū, v, z) and ∃ū. γ(ū, v) ∧ ψ(ū, v, z)
, where the sets ū and z are guard-separated in ψ.

The separated loosely guarded fragment (SLGF) is the class of all separated loosely guarded sentences. When we start from the set of guarded formulas instead of loosely guarded formulas, we obtain the separated guarded fragment (SGF).

As for GF and LGF, we shall occasionally use sloppy language and speak of SLGF formulas and SGF formulas when we mean separated (loosely) guarded formulas that are not necessarily closed.

Remark 3.10.3. Notice that any formula of the form ∀ūx. γ(ū, v) ∧ δ(x, ȳ) → ψ(ū, v, x, ȳ, z) where ū, x, and z are pairwise distinct and guard-separated in ψ is equivalent to the SLGF formula ∀ū. γ(ū, v) ∀x. δ(x, ȳ) ψ(ū, v, x, ȳ, z) . A dual observation can be made for existential quantification. This means that, under certain restrictions, we can mix variables that are subject to distinct guards in a single quantifier block. One could incorporate this idea into the definition of SLGF and, hence, obtain a syntactically slightly extended version. However, for the sake of simplicity, we adhere to the simpler definition given above.

It is easy to see that SLGF is indeed a proper syntactic extension of LGF, and that the same applies to SGF and GF. A simple sentence witnessing the strictness of these containment relations is the sentence ∀x. x ≈ x ∃y. y ≈ y P (y) ↔ ¬P (x) . It belongs neither to GF nor to LGF, but to both SGF and SLGF. Moreover, the sentence is a witness of the following observation: Every MFO sentence can be easily turned into an equivalent SGF sentence with a length linear in the original. We just need to add trivial equations v ≈ v as guards to subformulas Qv. χ. The result of this transformation lies in the intersection of SGF and MFO ≈ . Proposition 3.10.4. SGF properly contains GF and SLGF properly contains SGF, LGF, and GF. Moreover, every MFO sentence can be turned into an equivalent SGF sentence with a length linear in the original.

For MFO ≈ sentences the matter seems to be more complicated. The sentence ∀xy. x ≈ y, for instance, is not an SLGF sentence and cannot be directly transformed into an equivalent SLGF sentence in the described way.

Analogously to all the other novel first-order fragments we have defined, there exists an effective translation procedure that transforms SLGF sentences into equivalent LGF sentences. Lemma 3.10.5. Every SLGF formula is equivalent to some LGF formula.

Proof. We prove an auxiliary result from which the lemma follows easily: Consider any SLGF formula ϕ := Qū. γ(ū, v) ψ(ū, v, z) where ψ is any LGF formula, ū, v, z are pairwise disjoint, and ϕ's free variables are exactly the ones in v, z. Then, ϕ is equivalent to some LGF formula ϕ (v, z). Moreover, any two sets of variables that are guard-separated in ϕ are also guard-separated in ϕ .

Suppose Q is a universal quantifier (the case for existential quantification is dual). Recall that, by definition of SLGF, the tuples ū and z need to be guard-separated in ψ. Since ψ is an LGF formula and since we assume that no variable occurs freely and bound in ϕ at the same time, we know that in every subformula χ := Qx. δ(x, ȳ) η(x, ȳ) of ψ we either have vars(χ) ∩ ū = ∅ or vars(χ) ∩ z = ∅ (or both). Moreover, since ϕ is an SLGF formula, we have vars(A) ∩ ū = ∅ or vars(A) ∩ z = ∅ for every atom in ψ. Hence, ϕ is equivalent to some formula of the form ϕ

:= ∀ū. γ(ū, v) → i χ i (ū, v) ∨ η i (v, z)
, where the χ i and η i are disjunctions of atoms, negated atoms, or LGF formulas of the form Qx. δ(x, ȳ) η(x, ȳ). Applying distributivity and shifting the quantifier ∀ū in ϕ , it is easy to show equivalence to ϕ :

= i ∀ū. γ(ū, v) → χ i (ū, v) ∨ η i (v, z) . This is the sought LGF formula.
Notice that the proof works irrespectively of the structure of guards. Hence, we also observe that every SGF formula is equivalent to some GF formula.

In connection with the well-known fact that GF and LGF possess the finite model property [START_REF] Grädel | On the Restraining Power of Guards[END_REF][START_REF] Hodkinson | Loosely Guarded Fragment of First-Order Logic has the Finite Model Property[END_REF], the obvious consequence of Lemma 3.10.5 is that the satisfiability problems associated with SGF and SLGF (SGF-Sat and SLGF-Sat) SGF-Sat and SLGF-Sat are decidable.

Theorem 3.10.6. Both SGF and SLGF possess the finite model property. Moreover, the satisfiability problem for SGF sentences and SLGF sentences is decidable.

The following example illustrates the translation of SLGF sentences into LGF sentences, using the more liberal SLGF syntax outlined in Remark 3.10.3.

Example 3.10.7. Let ū, v, x, ȳ, z be five pairwise disjoint tuples of variables and let γ(ū, z), γ (v, z), δ(xu, z), δ (yv, z) be loose guards, where xu and yv denote the results of appending ū to x and v to ȳ, respectively. Consider the formula

∃ūv. γ(ū, z) ∧ γ (v, z) ∧ ∀xȳ. δ(xu, z) ∧ δ (yv, z) → ϕ(ū, v, x, ȳ, z)
where ϕ is quantifier free and the sets ū ∪ x and v ∪ ȳ are separated in ϕ. Clearly, this formula is not loosely guarded, as there are no guarding atoms in which the variables from ū and v co-occur, and the same holds for the variables from x and ȳ. Nevertheless, the formula is equivalent to some LGF formula, as witnessed by the following transformations, where the ψ i and χ i are certain disjunctions of literals and the ψ j and χ j are certain conjunctions of literals and basic formulas:

∃ūv. γ(ū, z) ∧ γ (v, z) ∧ ∀xȳ. δ(xu, z) ∧ δ (yv, z) → ϕ(ū, v, x, ȳ, z) |=| ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ ∀xȳ. δ(xu, z) ∧ δ (yv, z) → i ψ i (x, ū, z) ∨ χ i (ȳ, v, z) |=| ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ i ∀xȳ. δ(xu, z) ∧ δ (yv, z) → ψ i (x, ū, z) ∨ χ i (ȳ, v, z) |=| ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ i ∀xȳ. δ(xu, z) → ψ i (x, ū, z) ∨ δ (yv, z) → χ i (ȳ, v, z) |=| ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ i ∀x. δ(xu, z) → ψ i (x, ū, z) basic formula with free variables from ū, z ∨ ∀ȳ. δ (yv, z) → χ i (ȳ, v, z) basic formula with free variables from v, z |=| ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ j ψ j (ū, z) ∧ χ j (v, z) |=| j ∃ūv. γ(ū, z) ∧ γ (v, z) ∧ ψ j (ū, z) ∧ χ j (v, z) |=| j ∃ū. γ(ū, z) ∧ ψ j (ū, z) ∧ ∃v. γ (v, z) ∧ χ j (v, z) .
The final result belongs to LGF.

We conclude this section with an investigation of the succinctness gap between SLGF and LGF. The following theorem entails that there is no elementary upper bound on the length of the LGF sentences that result from any equivalence-preserving transformation of SLGF sentences into LGF.

Theorem 3.10.8. There is a class of SLGF sentences such that for every integer n ≥ 3 the class contains a sentence ϕ with n ∀∃ alternations and with a length polynomial in n for which any equivalent LGF sentence has at least (n -1)-fold exponential length in n.

Proof sketch. Let n ≥ 3. Consider the following SLGF sentence in which the sets {x 1 , . . . , x n } and {y 1 , . . . , y n } are separated:

ϕ := ∀x n . R n (x n ) ∃y n . T n (y n ) . . . ∀x 1 . R 1 (x 1 , . . . , x n ) ∃y 1 . T 1 (y 1 , . . . , y n ) . 4n i=1 P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) .
In order to construct a particular model of ϕ, we inductively define the following sets:

S k S 1 := S ⊆ [4n] |S| = 2n , S k+1 := S ∈ PS k |S| = 1 2 • |S k | for every k ≥ 1.
Hence, we observe that

|S 1 | = 4n 2n ≥ 4n 2n 2n = 2 2n , |S 2 | = |S1| |S1|/2 ≥ |S1| |S1|/2 |S1|/2 = 2 |S1|/2 ≥ 2 2 2n /2 = 2 2 2n-1 , . . . |S n | = |Sn-1| |Sn-1|/2 ≥ 2 |Sn-1|/2 ≥ 2 2 2 . . . 2 2n-1 -1 -1 ≥ 2 ↑n (2n -(n -1)) = 2 ↑n (n + 1),
where the inequality n k ≥ (n/k) k can be found in [START_REF] Thomas | Introduction to Algorithms[END_REF] (page 1097), for example. Having the sets S k , we now define the structure A as follows:

A A := n k=1 a (k) S , b (k) S S ∈ S k , P A i := a (1) S1 , . . . , a (n) Sn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . . , 4n, Q A i := b (1) S1 , . . . , b (n) Sn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . . , 4n, R A j := a (j) Sj , . . . , a (n)
Sn ∈ A n S j ∈ . . . ∈ S n for j = 1, . . . , n, and

T A j := b (j) Sj , . . . , b (n) Sn ∈ A n S j ∈ . . . ∈ S n for j = 1, . . . , n.
For any choice of S 1 , . . . , S n with S 1 ∈ . . . ∈ S n we observe

A, x 1 →a (1) S1 , . . . , x n →a (n) Sn |= n j=1 R j (x j , . . . , x n ) , A, y 1 →b (1) S1 , . . . , y n →b (n) Sn |= n j=1
T j (y j , . . . , y n ) , and

A, x 1 →a (1) S1 , . . . , x n →a (n) Sn , y 1 →b (1) S1 , . . . , y n →b (n) Sn |= 4n i=1 P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) .
For any tuple c j , . . . , c n for which there do not exist sets S j ∈ S j , . . . , S n ∈ S n such that S j ∈ . . . ∈ S n and c 1 , . . . , c n equals a

(j) Sj , . . . , a (n)
Sn , we observe A, [x j →c j , . . . , x n →c n ] |= R j (x j , . . . , x n ). Hence, for any variable assignment β we have

A, β[x j →c j , . . . , x n →c n ] |= R j (x j , . . . , x n ) → . . . . Consequently, A is a model of ϕ.
Consider the following simple two-player game with Players A and B A, B

where both players have complete and instantaneous knowledge about all moves that are made by either player. In the first round A moves first by picking some domain element a

(n) S A,n S A,j , a (j) S A,j
for some set S A,n ∈ S n . B knows about A's choice and answers by picking a domain element b

(n) S B,n S B,j , b (j) S B,j
for some set S B,n ∈ S n . The game continues for n -1 more rounds, where in every round Player A picks a domain element a

A, x 1 →a (1) S A,1 , . . . , x n →a (n) S A,n , y 1 →b (1) S B,1 , . . . , y n →b (n) S B,n |= P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n )
for some i ∈ [4n], and Player B wins if and only if

A, x 1 →a (1) S A,1 , . . . , x n →a (n) S A,n , y 1 →b (1) S B,1 , . . . , y n →b (n) S B,n |= P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) for every i ∈ [4n].
Since A is a model of ϕ, there must exist a winning strategy for B.

Claim I: There is exactly one winning strategy for B, namely, for every j = n, . . . , 1 Player B picks the element b (j)

S A,j in round nj + 1, i.e. for every j we have S B,j = S A,j . Proof: It is easy to see that the described strategy is a winning strategy for B.

Assume B deviates from this strategy. This means there exists some j * , 1 ≤ j * ≤ n, such that B did not adhere to the described strategy in the (nj * + 1)-st round, i.e. S B,j * = S A,j * .

We show by induction on j * that A has a winning strategy from this deviation point on.

For the base case j * = 1 we consider two distinct nonempty sets S A,1 , S B,1 ⊆ [4n]. There must be some index i * that belongs to one of the two sets but not to the other, i.e. i * ∈

(S A,1 ∪ S B,1 ) \ (S A,1 ∩ S B,1 ). Suppose that i * ∈ S A,1 \ S B,1 . Hence, we can construct the chain i * ∈ S A,1 ∈ . . . ∈ S A,n
, by definition of the allowed moves. This entails A, [x 1 →a

(1)

S A,1 , . . . , x n →a (n) S A,n ] |= P i * (x 1 , . . . , x n ).
On the other hand, we get A, [y 1 →b

(1)

S B,1 , . . . , y n →b (n) S B,n ] |= Q i * (y 1 , . . . , y n ), because of i * ∈ S B,1 .
Hence, A wins and the chosen strategy cannot be a winning strategy for B.

The case where i * ∈ S B,1 \ S A,1 is symmetric and A wins as well.

For the inductive case we fix some j * > 1. Since S A,j * and S B,j * are distinct but have the same number of elements, there is some set S ∈ S A,j * \ S B,j * . If A picks a

(j * -1) S A,j * -1 := a (j * -1) S
in the following round, we have S B,j * -1 = S A,j * -1 for any choice b (j * -1) S B,j * -1 that B could possibly make in accordance with the rules. By induction, A has a winning strategy starting from the next round of the game. Hence, there is a winning strategy for A starting from the current round. ♦

The described game corresponds to the model-checking game associated with the pair A, ϕ . Obviously, the given rules limit the moves of the involved players in such a way that all guards in ϕ are satisfied by the variable assignment both players construct move by move. Viewed in this light, the above claim proves the following observation. For every S ∈ S k , 1 ≤ k ≤ n, we define the structure A -S A -S as the substructure of A induced by the domain A -S := A \ {b

(k) S }.
Claim II: For every S ∈ S k , 1 ≤ k ≤ n, the substructure A -S of A does not satisfy ϕ.

Proof: The reason is simply that in this case player A can always prevent B from reaching a state of the game where B can apply the described winning strategy. ♦

We have already analyzed the size of the sets S k . Due to the observed lower bounds, we know that A contains at least

n k=1 2 ↑k (n) elements of the form b (k) S .
Let ϕ LGF be a shortest LGF sentence that is semantically equivalent to ϕ. Next, we argue that len(ϕ LGF ) is at least (n -1)-fold exponential in n. We start by introducing some additional notation. We divide the domain A into two disjoint parts A a := a

(k) S | 1 ≤ k ≤ n and S ∈ S k and A b := b (k) S | 1 ≤ k ≤ n and S ∈ S k A a , A b , A b,k . Moreover, we subdivide A b into parts A b,k := b (k) S | S ∈ S k with 1 ≤ k ≤ n. We define the following vocabularies Σ, Σ P R , Σ QT Σ := {P i , Q i | 1 ≤ i ≤ 4n} ∪ {R j , T j | 1 ≤ j ≤ n}, ∅ , Σ P R := {P i | 1 ≤ i ≤ 4n} ∪ {R j | 1 ≤ j ≤ n}, ∅ , and
Σ QT := {Q i | 1 ≤ i ≤ 4n} ∪ {T j | 1 ≤ j ≤ n}, ∅ .
Moreover, let Σ P R and Σ QT Σ P R , Σ QT be disjoint extensions of the vocabularies Σ P R and Σ QT , respectively, each extended by a countably infinite number of nullary predicate symbols.

Claim III-a: Consider any loose guard γ(ū, v) over the vocabulary Σ. Suppose we have A, β |= γ for some variable assignment β over A's domain, or A -S , β |= γ for some S and some variable assignment β over the domain of A -S . Then, either all atoms in γ are Σ P R -atoms or all atoms in γ are Σ QT -atoms.

Proof: We argue for the case where A, β |= γ. The argument for the cases A -S , β |= γ are the same. Consequently, γ must either be a conjunction of Σ P R -atoms or a conjunction of Σ QT -atoms, but cannot mix the two kinds. ♦

Let γ(ū, v) = A 1 (ū, v) ∧ . . . ∧ A m (ū, v). Suppose there are k, k such that A k is a Σ P R -atom and A k is a Σ QT -atom. Let V := vars(A k ) and V := vars(A k ). Because of A, β |= A k ∧ A k , we must have β(V ) ⊆ A a and β(V ) ⊆ A b . Since γ is
Claim III-b: Consider any loosely guarded Σ-formula χ(v) := Qū. γ(ū, v) η(ū, v) and let A(z) be some atom occurring in η(ū, v). Recall that we assume that none of the variables occurring freely in any subformula of χ occurs bound in the same subformula and that, moreover, no variable is bound by two distinct occurrences of quantifiers. Suppose that γ(ū, v) is a Σ P R -formula and that A(z) is a Σ QT -atom or vice versa. Further suppose that we have A, β |= γ(ū, v) for some variable assignment β over A's domain. Let Z be the set of variables occurring in A(z) that are free in η(ū, v). Either Z is empty, i.e. none of the variables in A(z) occurs freely in η(ū, v), or we have A, β |= A(z) for every variable assignment over A's domain that coincides with β on the variables in Z.

The same holds if we replace A by any A -S .

Proof: We treat the case where γ is a Σ P R -formula and A is a Σ QT -atom. The other case can be treated in a similar way. Consider some β with A, β |= γ(ū, v) and any β that coincides with β on Z and which satisfies A, β |= A(z). Then, we observe

β(ū ∪ v) ⊆ A a and β (Z) ⊆ A b . This entails Z ∩ (ū ∪ v) = ∅, as A a and A b are disjoint. ♦
Claim III-c: Consider any loosely guarded Σ-formula χ(v) := Qū. γ(ū, v) χ (ū, v) where χ (ū, v) contains a subformula η(z) of the form Q ȳ. δ(ȳ, z) η (ȳ, z). Moreover, we assume that the guard γ(ū, v) is a Σ P R -formula and the guard δ(ȳ, z) is a Σ QT -formula or vice versa.

Suppose we have A, β |= γ(ū, v) for some variable assignment β over A's domain. Let Z be the set variables occurring in η (ȳ, z) that occur freely in χ (ū, v), i.e. Z ⊆ z. Let β be any variable assignment that coincides with β on Z. Then, either Z is empty or A, β |= δ(ȳ, z).

The same holds if we replace A by any A -S .

Proof: By definition of LGF formulas, for every z ∈ z that occurs in η and is free in χ the guard δ(ȳ, z) must contain at least one atom with z as argument. Consequently, the claim follows from Claim III-b. ♦

Starting from ϕ LGF we construct the sentence ψ LGF which possesses the following properties.

(a) The sentence ψ LGF is a Boolean combination of loosely-guarded Σ P R -sentences and looselyguarded Σ QT -sentences. Moreover, ψ LGF is in negation normal form.

(b) The vocabulary underlying ψ LGF is that of ϕ LGF extended by fresh nullary predicate symbols.

(c) The structure A can be uniquely expanded to a model B B, B -S of ψ LGF over the same domain and conserving the interpretations of all predicate symbols occurring in ϕ LGF ; for every B -Swhich is defined to be the substructure of B induced by the domain B -S := B \ {b

(k) S } for any S ∈ S k -we have B -S |= ψ LGF . (d) len(ψ LGF ) ∈ O len(ϕ LGF ) .
The construction of ψ LGF starts from ϕ LGF . As a first step, we shift any negation signs in ϕ LGF inwards so that they occur directly in front of atoms. We do this in a way that preserves guarded quantification. The length of the resulting formula is linear in the length of ϕ LGF . Next, we perform the following steps.

(1) Remove any subformulas that have the form Qū. γ(ū, v) χ where γ is neither a Σ P R -formula nor a Σ QT -formula but mixes Σ P R -and Σ QT -atoms. Since, by Claim III-a, A, β |= γ(ū, v) and A -S , β |= γ(ū, v) for every β and every S, these subformulas can be replaced by true in case of Q = ∀ and by false if

Q = ∃.
All guards in the resulting formula are either Σ P R -formulas or Σ QT -formulas.

(2) Remove any subformulas η of the form Q ȳ. δ(ȳ, z) η (ȳ, z) that occur in subformulas χ := Qū. γ(ū, v) χ where γ is a Σ P R -guard and δ is a Σ QT -guard or vice versa, and where η (ȳ, z) contains variables that are free in χ . By Claim III-c, A, β |= γ(ū, v) entails A, β |= δ(ȳ, z) for every β and every β which coincides with β on all variables that occur freely in χ . Hence, in case of Q = ∀ we can replace η with true, and in case of Q = ∃ we can replace η with false.

(3) Remove any Σ QT -atom (Σ P R -atom) A(z) that lies in the scope χ of a Σ P R -guarded (Σ QTguarded) quantified subformula Qū. γ(ū, v) χ and in which a variable

z ∈ z ∩ (ū ∪ v) occurs. By Claim III-b, A, β |= γ(ū, v) entails A, β |= A(z)
for every β and every β which coincides with β on all variables that occur freely in χ. Hence, we can replace A(z) with false.

(4) Do the following steps iteratively and exhaustively. Replace every occurrence of a non-atomic Σ P R -sentence (Σ QT -sentence) χ in ϕ LGF which does not contain another non-atomic sentence as proper subformula with the atom M , where M is a fresh nullary predicate symbol, and conjoin the formula M ↔ χ. We take M from Σ P R if the smallest quantifier scope the replaced occurrence of χ belongs to is Σ P R -guarded. Otherwise, we take some nullary M from Σ QT . The resulting formula is

ϕ LGF [χ/M ] ∧ (M ↔ χ).
The final result of this process has a length that is linear in the length of the original. Due to the previous transformations, we obtain a sentence that is a Boolean combination of Σ P R -sentences and Σ QT -sentences and satisfies Properties (a) to (a). We shall call it ψ LGF from now on. Moreover, none of the constituent sentences of ψ LGF properly contains a non-atomic sentence.

We need some more notions and notation. An atom is called linear linear atoms if every variable in it occurs at most once. Any occurrence of a variable v in a non-equational Σ-atom A is called a column-koccurrence column-koccurrences , if v is the (nk + 1)-st argument from the right in A. For example, if we fix n to be 6, then v has a column-5-occurrence in each of the atoms

Q i (x 1 , x 2 , x 3 , x 4 , v, x 6 ), T 3 (x 3 , x 4 , v, x 6 ), T 5 (v, x 6 ), but v has no column-5-occurrence in the atoms T 6 (x 6 ) or Q i (v, v, v, v, x 5 , v).
Claim IV-a: Let A(v) be some non-equational Σ QT -atom. Consider any variable v that has a column-k-occurrence in A(v). Then, for every variable assignment β we observe that

B, β |= A(v) entails β(v) ∈ A b,k . Similarly, for every S we have that B -S , β |= A(v) entails β(v) ∈ A b,k .
The same holds if we replace B with B -S for any S.

Proof: This follows immediately from the definition of B. ♦

Claim IV-b: Consider any loose guard γ(ū, v) over the vocabulary Σ QT . If B, β |= γ(ū, v) or B -S , β |= γ(ū, v
) holds for some variable assignment β and any S, then for every variable v occurring in a non-equational atom in γ(ū, v) there is a unique k, 1 ≤ k ≤ n, such that every occurrence of v in a non-equational atom in γ(ū, v) is a column-k-occurrence.

The same holds if we replace B with B -S for any S.

Proof: Suppose v has a column-k-occurrence in γ(ū, v) and, at the same time, a column-koccurrence in γ(ū, v) with k = k . By Claim IV-a, we then have β(v) ∈ A b,k ∩ A b,k . But since this intersection is empty, we obtain a contradiction. ♦

Claim IV-c: Consider any loosely guarded Σ QT -formula χ(v) := Qū. γ(ū, v) η(ū, v) in which γ(ū, v) contains at least one non-equational atom. Suppose there is a maximal subset Z ⊆ ū∪v containing at least two distinct variables such that B, β |= γ(ū, v) → z,z ∈Z z ≈ z holds for every variable assignment β. Then, there is some variable z * ∈ Z that occurs in some non-equational atom A(z) in γ(ū, v). Moreover, χ(v) is equivalent to some loosely-guarded Σ QT -formula Qū . γ (ū , v ) η (ū , v ), where z 1 , . . . , z m is an enumeration of all the variables in Z, γ (ū , v ) is the result of removing any trivial equations from γ z 1 /z * , . . . , z m /z * , and

η := η z 1 /z * , . . . , z m /z * .
The same holds if we replace B with B -S for any S.

Proof: Suppose that none of the z ∈ Z occurs in any non-equational atom in γ(ū, v).

Consider some u ∈ ū that does not occur in any non-equational atom in γ(ū, v). Then, u must co-occur with every z ∈ Z in some equation in γ(ū, v). But then, we have B, β |= γ(ū, v) → u ≈ z for every z ∈ Z. Since Z is maximal, we get u ∈ Z. Moreover, every v that occurs in some non-equational atom in γ(ū, v) must co-occur with u in some equation in γ(ū, v). Again, this entails v ∈ Z and, hence, yields a contradiction.

Consider some u ∈ ū that occurs in some non-equational atom in γ(ū, v). Then, u must co-occur with every z ∈ Z in some equation in γ(ū, v). But then, we once more get u ∈ Z.

Consequently, there is some z * ∈ Z that occurs in some non-equational atom A(z) in γ(ū, v). The rest of the claim follows immediately. ♦

Claim IV-d: Consider any loosely guarded Σ QT -sentence χ := Qū. γ(ū, ∅) η(ū) in which γ(ū, ∅) contains exclusively equational atoms. Let u be some variable from ū and let u 1 , . . . , u m be an enumeration of all the variables occurring from ū. Then, χ is equivalent to the sentence Qu. u ≈ u η (u) where η := η u 1 /u, . . . , u m /u . Moreover, for any atom A(u) in η (u) that does not lie within the scope of any quantifier in η (u) we have that either A(u) is a trivial equation u ≈ u, or A(u) is of the form T n (u), or B, β |= A(u) for every variable assignment β.

The same holds if we replace B with B -S for any S.

Proof: Since every variable occurring in γ(ū) must co-occur with u in some equation in γ(ū), we have B, β |= γ(ū) → v∈ū u ≈ v for every variable assignment β. Hence, χ is equivalent to Qu. u ≈ u η (u). Since we assume n ≥ 3, every predicate symbol Q i has arity 3. Hence, any non-equational atom A(u) with any predicate symbol from Σ QT different from T n must contain more than one occurrence of u. But in such cases we get B, β |= A(u) for every variable assignment β. ♦

Claim IV-e: Consider any loosely guarded Σ QT -formula χ(v) := Qū. γ(ū, v) η(ū, v) in which γ(ū, v) contains exclusively equational atoms and v is not empty. Let v * be some variable from v and let z 1 , . . . , z m be an enumeration of all the variables occurring in ū ∪ v. Then,

χ(v) is equivalent to the formula v∈v∩vars(γ) v ≈ v * → η (v * ), if Q = ∀, and χ(v) is equivalent to the formula v∈v∩vars(γ) v ≈ v * ∧ η (v * ), if Q = ∃, where η := η z 1 /v * , .
. . , z m /v * . Moreover, for any atom A(v * ) in η (v * ) that does not lie within the scope of any quantifier in η (v * ) we have that either

A(v * ) is a trivial equation v * ≈ v * , or A(v * ) is of the form T n (v * ), or B, β |= A(v * ) for every variable assignment β.
The same holds if we replace B with B -S for any S.

Proof: Pick some variable u * ∈ ū. Since every variable occurring in γ(ū, v) must co-occur with u * in some equation in γ(ū, v), we have B,

β |= γ(ū, v) → z∈ū∪v u * ≈ z for every variable assignment β. Hence, χ(v) is equivalent to the formula v∈v∩vars(γ) v ≈ v * → η (v * ), if Q = ∀, and χ(v) is equivalent to the formula v∈v∩vars(γ) v ≈ v * ∧ η (v * ), if Q = ∃.
Since we assume n ≥ 3, every predicate symbol Q i has arity 3. Hence, any atom A(u) with any predicate symbol from Σ QT different from T n must contain more than one occurrence of u. But in such cases we get B, β |= A(u) for every variable assignment β. ♦

Claim IV-f: Consider any loosely guarded Σ QT -formula χ(v) := Qū. γ(ū, v) η(ū, v) and let A(z) be some non-equational Σ QT -atom occurring in η(ū, v). Suppose that there is some variable v with a column-k-occurrence in some non-equational atom in γ(ū, v) and with a columnk -occurrence in A(z) for distinct k, k . For every β we observe that B, β |= γ(ū, v) entails B, β |= A(z) for every variable assignment β over B's domain that coincides with β on the variables that occur freely in η(ū, v).

The same holds if we replace B with B -S for any S.

Proof: As above, A, β |= γ(ū, v) together with A, β |= A(z) entails β(v) = β (v) ∈ A b,k ∩ A b,
v = u with column-k-occurrences in γ, unless γ(ū, v) contains an equation u ≈ v.
The same holds if we replace B with B -S for any S.

Proof: For every variable v occurring in γ(ū, v) the guard γ(ū, v) must contain some atom A(ū, v) in which u and v co-occur. If A(ū, v) is not an equation, then, by Claim IV-b, the occurrence of u in A(ū, v) is a column-k-occurrence. Hence, the (unique) occurrence of v in A(ū, v) is a column-k -occurrence for some k = k. By Claim IV-b, all occurrences of v in any non-equational atom in γ(ū, v) are column-k -occurrences. ♦

Claim IV-h: Consider any loosely guarded Σ QT -formula χ(v) := Qū. γ(ū, v) η(ū, v). Let u ∈ ū be a variable that has a column-k-occurrence in γ(ū, v). Suppose that we have B, β |= γ(ū, v) for some variable assignment β over B's domain. Further suppose that η(ū, v) contains a non-equational Σ QT -atom A(z) in which some variable v has a column-k-occurrence. If v occurs freely in η(ū, v), then we either have v = u or γ(ū, v) contains the equation u ≈ v or B, β |= A(z) for every variable assignment β over B's domain that coincides with β on the variables that occur freely in η(ū, v).

The same holds if we replace B with B -S for any S.

Proof: Suppose v = u and that γ(ū, v) does not contain the equation u ≈ v. Since v occurs freely in η(ū, v), it must also occur in some non-equational atom in γ(ū, v). By Claims IV-g and IV-b, v has only column-k -occurrences in γ(ū, v) with k = k. Hence, Claim IV-f entails B, β |= A(z) for every variable assignment β over B's domain that coincides with β on the variables that occur freely in η(ū, v). ♦

Due to Claims IV-c to IV-e, we can reduce the equations occurring in guards in Σ QT -subformulas of ψ LGF to a minimum without losing properties (a) -(d). The only equations in guards that cannot be removed in this way are part of purely equational guards that belong to top-most quantifiers in Σ QT -sentences. These guards consist of exactly one trivial equation.

Due to Claims IV-f and IV-h, we can modify ψ LGF as follows while retaining properties (a)-(d). Let Qū. γ(ū, v) η(ū, v) be any Σ QT -guarded subformula of ψ LGF . For any variable v that has a column-k-occurrence in γ(ū, v) we can replace any atom A(z) in η(ū, v) in which v has a column-koccurrence with k = k by false. If this occurrence of A(z) is part of a guard δ(x, ȳ) of a subformula Qx. δ(x, ȳ) η (x, ȳ), then we replace the whole subformula with true if Q = ∀, and we replace the whole subformula with false if Q = ∃. We proceed analogously for atoms A(z) containing column-k-occurrences of variables v with v = v. In the resulting formula, every non-equational Σ QT -atom is linear and for every variable v occurring in any non-equational Σ QT -atom there is some k such that all occurrences of v in non-equational Σ QT -atoms are column-k-occurrences. Moreover, for every Σ QT -subformula χ all distinct variables v, v that occur freely in χ and have column-k-occurrences and column-k -occurrences in χ, respectively, we know that k = k . This observation also entails that any non-trivial equation can be replaced by false in Σ QT -subformulas of ψ LGF and any trivial equation (except for the ones that constitute the guard of a top-most quantification in a Σ QT -sentence) can be replaced by true.

Notice that, after the previous modifications, every Σ QT -subsentence that is part of ψ LGF is actually a variable-renamed version of a loosely guarded FO n sentence, see Section 3.12.

Suppose that ψ LGF has fewer than 2 ↑n-1 (n) subformulas. We observed earlier that B |= ψ LGF and B -S |= ψ LGF for every S ∈ S n . Hence, for every S ∈ S n there is some Σ QT -subformula ψ S ψ S , β S in ψ LGF of the form ∃ȳ. γ S (ȳ, z) χ S (ȳ, z) and some variable assignment β S such that the following properties hold. We have β S (y * ) = b

S with T 1 ∈ . . . ∈ T n-1 ∈ S. Fix any S * ∈ S n and consider the formula ψ S * (z). There is a nonempty set S * S * such that ψ S * (z) coincides with every ψ S (z) with S ∈ S * . For any distinct S, S ∈ S * the sequences cS := β S (z) and cS := β S (z) must differ, for otherwise ( * ) would be violated. As there are at most

n-1 k=1 2 ↑k (n) distinct sequences cS , S * can contain at most n-1 k=1 2 ↑k (n) < 2 ↑n-1 (n)
n sets. Recall that there are fewer than 2 ↑n-1 (n) subformulas in ψ LGF . We have just inferred that each of these can only serve as ψ S for at most 2 ↑n-1 (n) n sets S ∈ S n . Hence, only

2 ↑n-1 (n) n • 2 ↑n-1 (n) = 2 (n+1)•2 ↑n-2 (n) < 2 2 ↑n-1 (n) = 2 ↑n (n)
sets S have a corresponding subformula ψ S . But this means that there are S ∈ S n such that B -S |= ψ LGF , which contradicts our assumptions. Consequently, ψ LGF must have more than 2 ↑n-1 (n) subformulas.

Separateness and Guarded Negation

We have already briefly visited the concept of guarded negation in the beginning Chapter 3 (page 26). The used guards γ(ū) are atoms in which every variable from ū occurs at least once. An occurrence of negation ¬ψ(ū) is guarded , if it is part of a formula γ(ū) ∧ ¬ψ(ū) with an atomic guard γ(ū). The guarded-negation fragment comprises first-order sentences in which all quantifiers are existential and every occurrence of negation is guarded by an atomic guard. Under these restrictions, universal quantification can only be expressed in a guarded fashion, simulated by existential quantification. For example, the sentence ∀x. P (x) → ψ(x) is equivalent to ∃y. y ≈ y ∧ ¬ ∃x. P (x) ∧ ¬ψ(x) .5

Definition 3.11.1 (Guarded-negation fragment (GNFO)). We define the set of guarded-negation formulas inductively:

(i) every relational atom is a guarded-negation formula, equality is admitted;

(ii) every ∧-∨-combination of guarded-negation formulas is a guarded-negation formula;

(iii) for every tuple ū and every guarded-negation formula ψ(ū) the formula ∃ū. ψ(ū) is a guardednegation formula;

(iv) for every tuple ū, every atomic guard γ(ū) (i.e. γ(ū) is an atom in which every u ∈ ū occurs at least once), and every guarded-negation formula ψ(ū) the formula γ(ū) ∧ ¬ψ(ū) is a guarded-negation formula.

The guarded-negation fragment (GNFO) is the class of all first-order guarded-negation sentences.

Barany, ten Cate, and Segoufin have shown that GNFO sentences have the same expressive power as GF sentences have (see [START_REF] Bárány | Guarded Negation[END_REF], Proposition 2.2). Moreover, there are GNFO sentences for which there is no GF equivalent, i.e. GNFO is strictly more expressive than GF. One such example is the sentence ∃xy. E(x, y)

∧ ¬ ∃uvw. E(x, u) ∧ E(u, v) ∧ E(v, w) ∧ E(w, y) ([BtCS15], Example 2.3).
Similar to guarded quantification, guarded negation can be made compatible with separateness of variables in a way that allows us to syntactically extend GNFO while retaining its expressive power and the decidability of the associated satisfiability problem (GNFO-Sat GNFO-Sat ).

Definition 3.11.2 (Separated guarded-negation fragment (SGNFO)). Given any sequence ū1 , . . . , ūn , v of pairwise-disjoint tuples of first-order variables, a separated negation guard γ(ū 1 , . . . , ūn , v) is a conjunction of n atoms A 1 (ū 1 , v) ∧ . . . ∧ A n (ū n , v) (possibly equations) such that for every i, 1 ≤ i ≤ n, all variables from ūi occur at least once in A i (ū i , v).

We define the set of separated guarded-negation formulas inductively:

(i) every relational atom is a separated guarded-negation formula, equality is admitted;

(ii) every ∧-∨-combination of separated guarded-negation formulas is a separated guarded-negation formula;

(iii) for every tuple ȳ and every separated guarded-negation formula ψ(ȳ) the formula ∃ȳ. ψ(ȳ) is a separated guarded-negation formula;

(iv) for every separated negation guard γ(ū 1 , . . . , ūn , v), and every separated guarded-negation formula ψ(ū 1 , . . . , ūn ) the formula γ(ū 1 , . . . , ūn , v) ∧ ¬ψ(ū 1 , . . . , ūn ) is a separated guardednegation formula if the following conditions are met. Let Z be the set of variables that are quantified in ψ(ū 1 , . . . , ūn ). We require that Z can be divided into pairwise disjoint, possibly empty subsets Z 1 , . . . , Z n such that the sets Z 1 ∪ ū1 , . . . , Z n ∪ ūn are all pairwise separated in ψ(ū 1 , . . . , ūn ).

The separated guarded-negation fragment (SGNFO) is the set of all first-order separated guardednegation sentences.

We shall occasionally use sloppy language and speak of GNFO and SGNFO formulas when we mean (separated) negation-guarded formulas that are not necessarily closed.

It is obvious that GNFO is contained in SGNFO and that there are SGNFO sentences that do not belong to GNFO. Moreover, every MFO sentence ϕ can be easily turned into an equivalent SGNFO sentence with a length linear in the original. We first transform ϕ into negation normal form and add trivial equations v ≈ v as guards to negated atomic subformulas ¬P (v). The result lies in the intersection of SGNFO and MFO ≈ . For MFO ≈ sentences the matter seems to be more complicated. The sentence ∃xy. x ≈ y, for instance, is not an SGNFO sentence and does not seem to have an SGNFO equivalent.

Proposition 3.11.3. SGNFO properly contains GNFO. Moreover, every MFO sentence can be turned into an equivalent SGNFO sentence with a formula length that is linear in the length of the original.

After we have seen the results obtained for the other novel first-order fragments, it should not come as a surprise that there is an effective translation from SGNFO to GNFO. Lemma 3.11.4. Every SGNFO formula is equivalent to some GNFO formula.

Proof. First, we recall the notion of strict separateness from Lemma 2.0.3. Let ψ be any first-order formula. Two disjoint sets of first-order variables X, Y are strictly separated in ψ if X and Y are separated in ψ and, in addition, for every subformula ψ := (Qv. . . .) of ψ we either have vars(ψ ) ∩ X = ∅ or vars(ψ ) ∩ Y = ∅.

We infer with two auxiliary results from which the lemma follows:

Claim I: Consider any SGNFO formula ϕ(ū 1 , . . . , ūn , v) := γ(ū 1 , . . . , ūn , v)∧¬ψ(ū 1 , . . . , ūn ) where ψ(ū 1 , . . . , ūn ) is any GNFO formula, and the ū1 , . . . , ūn are pairwise strictly separated in ψ(ū 1 , . . . , ūn ). Then, ϕ(ū 1 , . . . , ūn , v) is equivalent to some GNFO formula ϕ (ū 1 , . . . , ūn , v) in which ū1 , . . . , ūn are pairwise strictly separated.

Proof: Let basic formulas basic formulas in ψ(ū 1 , . . . , ūn ) be subformulas that do not lie in the scope of any quantifier or negation sign in ψ(ū 1 , . . . , ūn ) and that are either guarded negation formulas δ(x 1 , . . . , xk , ȳ) ∧ ¬χ(x 1 , . . . , xk ), quantified formulas ∃ȳ. χ(ȳ, x), or atoms. Transform ψ(ū 1 , . . . , ūn ) into a conjunction ψ := i∈I η i (ū 1 , . . . , ūn ) of disjunctions η i (ū 1 , . . . , ūn ) of basic formulas. Since we assumed ψ(ū 1 , . . . , ūn ) to be a GNFO formula and that the ū1 , . . . , ūn are pairwise strictly separated in ψ(ū 1 , . . . , ūn ), we conclude that every basic formula χ(x) in ψ(ū 1 , . . . , ūn ) satisfies x ∩ ū = ∅ for at most one , 1 ≤ ≤ n. Hence, the disjuncts η i (ū 1 , . . . , ūn ) in ψ (ū 1 , . . . , ūn ) can be regrouped such that

ψ = i∈I η i,1 (ū 1 ) ∨ . . . ∨ η i,n (ū n ) .
Therefore, γ(ū 1 , . . . , ūn , v) ∧ ¬ψ(ū 1 , . . . , ūn ) is equivalent to the following sentence, where

A 1 (ū 1 , v), . . . , A n (ū n , v) is the list of atoms that γ(ū 1 , . . . , ūn , v) comprises: A 1 (ū 1 , v) ∧ . . . ∧ A n (ū n , v) ∧ ¬ψ (ū 1 , . . . , ūn ) |=| A 1 (ū 1 , v) ∧ . . . ∧ A n (ū n , v) ∧ ¬ i∈I η i,1 (ū 1 ) ∨ . . . ∨ η i,n (ū n ) |=| A 1 (ū 1 , v) ∧ . . . ∧ A n (ū n , v) ∧ i∈I ¬η i,1 (ū 1 ) ∧ . . . ∧ ¬η i,n (ū n ) |=| i∈I A 1 (ū 1 , v) ∧ ¬η i,1 (ū 1 ) ∧ . . . ∧ A n (ū n , v) ∧ ¬η i,n (ū n )
This is the sought GNFO formula. ♦

Claim II: Consider any SGNFO formula ϕ(x, v) := ∃ȳ. ψ(ȳ, x, v) where ψ(ȳ, x, v) is any GNFO formula in which the sets ȳ ∪ x and v are strictly separated. Then, ϕ(x, v) is equivalent to some GNFO formula ϕ(x, v) in which ȳ ∪ x and v are strictly separated.

Proof: Let basic formulas basic formulas in ψ(ȳ, x, v) be defined like in the proof of Claim I. Transform ψ(ȳ, x, v) into a disjunction ψ := i∈I η i (ȳ, x, v) of conjunctions η i (ȳ, x, v) of basic formulas. Since we assumed ψ(ȳ, x, v) to be a GNFO formula and that the sets ȳ ∪ x and v are strictly separated in ψ(ȳ, x, v), every basic formula

χ(ū) in ψ(ȳ, x, v) satisfies ū ∩ (ȳ ∪ x) = ∅ or ū ∩ v = ∅. Hence, the conjuncts η i (ȳ, x, v) in ψ (ȳ, x, v) can be regrouped such that ψ = i∈I η i,1 (ȳ, x) ∧ η i,2 (v) . Therefore, ∃ȳ. ψ(ȳ, x, v) is equivalent to the sentence ∃ȳ. i∈I η i,1 (ȳ, x) ∨ η i,2 (v) |=| i∈I ∃ȳ. η i,1 (ȳ, x) ∧ η i,2 (v) .

This is the sought GNFO formula. ♦

Now consider any SGNFO formula ϕ that is not a GNFO formula. Let χ(ū 1 , . . . , ūn , v) := γ(ū 1 , . . . , ūn , v) ∧ ¬χ (ū 1 , . . . , ūn ) be a smallest subformula of ϕ that violates the conditions of guarded negation in GNFO. Hence, the set Z of variables quantified in χ (ū 1 , . . . , ūn ) can be divided into pairwise disjoint sets Z 1 , . . . , Z n such that Z 1 ∪ ū1 , . . . , Z n ∪ ūn are pairwise separated in χ (ū 1 , . . . , ūn ). Further suppose that in χ (ū 1 , . . . , ūn ) the sets Z 1 ∪ ū1 , . . . , Z n ∪ ūn are not strictly separated. Let η(x) := ∃ȳ. η (ȳ, x) be a smallest subformula of χ (ū 1 , . . . , ūn ) that violates this strict-separateness condition. Hence, we can subdivide ȳ into pairwise disjoint parts ȳ1 , . . . , ȳn such that ȳi ⊆ Z i for every i. Moreover, we can subdivide x into pairwise disjoint parts x1 , . . . , xn such that xi ⊆ Z i ∪ ūi for every i. Then, η(x) can be rewritten into ∃ȳ 1 ∃ȳ 2 . . . ∃ȳ n . η (ȳ 1 , x1 , . . . , ȳn , xn ). Since we assume η(x) to be minimal, the sets ȳ1 ∪ x1 , . . . , ȳn ∪ xn are pairwise strictly separated in η (ȳ 1 , x1 , . . . , ȳn , xn ). By Claim II, η(x) is equivalent to some η (x) in which the Z 1 ∪ ū1 , . . . , Z n ∪ ūn are pairwise strictly separated. Therefore, the formula χ (ū 1 , . . . , ūn ) can be transformed into an equivalent formula χ (ū 1 , . . . , ūn ) in which Z 1 ∪ ū1 , . . . , Z n ∪ ūn are pairwise strictly separated. By Claim I, γ(ū 1 , . . . , ūn , v) ∧ ¬χ (ū 1 , . . . , ūn ) can be transformed into an equivalent formula that belongs to GNFO and in which the sets ū1 , . . . , ūn are pairwise strictly separated.

By iterative and exhaustive application of the outlined transformation, we can derive a GNFO formula that is equivalent to the SGNFO formula ϕ.

Since GNFO is known to possess the finite model property [START_REF] Bárány | Guarded Negation[END_REF], Lemma 3.11.4 entails the same for SGNFO. Of course, this also means that the satisfiability problem associated with SGNFO (SGNFO-Sat SGNFO-Sat ) is decidable.

Theorem 3.11.5. SGNFO possesses the finite model property and, hence, the satisfiability problem for SGNFO sentences is decidable.

Separateness and Finite-Variable First-Order Logic

The class of first-order formulas over a fixed finite set of variables yields an interesting object of study (see, e.g., [Ott97, Gro98, Daw99, GO99, KPHT18] and also the textbooks [START_REF] Libkin | Elements of Finite Model Theory[END_REF], Section 11, and [GKL + 07], Sections 1.1.3, 2.7, and 2.8). The special case where only two variables are admitted gives rise to the two-variable fragment of first-order logic, FO 2 , that we have already briefly discussed on page 25. It is important to understand that this restriction allows reusing variable names in nested quantifiers. Therefore, in the formulas in the present section we explicitly allow variables to occur free and bound in a formula, and to reappear in distinct occurrences of quantifiers in the same formula. For example, the sentence ∀x∃y. E(x, y) ∧ ∃x. E(y, x) ∧ ∃y. E(x, y) belongs to FO 2 . It stipulates the existence of a path of length at least three, starting from any node in a directed graph.

We shall see in this section that also in the context of finite-variable logics separateness can give us more syntactic freedom and the ability to express certain properties in a substantially more succinct way, on the one hand. On the other hand, the overall expressive power is retained, if restrictions are formulated in the right way. Definition 3.12.1 (Separated finite-variable formulas). For any positive integer k we define FO k FO k to be the set of all relational first-order formulas in which all variables are taken from a finite sequence x 1 , . . . , x k .

For every k ≥ 1 we define the class SFO k of relational first-order formulas as follows. Let V 1 , V 2 , V 3 , . . . be a sequence of pairwise disjoint sets V i ⊆ Var of first-order variables, each containing exactly k pairwise distinct variables. For every m ≥ 1 we define the set SFO k,m to be the set of all relational first-order formulas ϕ in which all variables are taken from V 1 ∪ . . . ∪ V m and in which all sets V 1 , . . . , V m are pairwise separated. The class SFO k is the union m≥1 SFO k,m .

It is easy to see that FO k is a special case of SFO k . Moreover, MFO is a proper subset of SFO k for k = 1. In contrast, for every positive integer k the MFO ≈ sentence ∀x 1 . . . x k ∃y. k y ≈ x k does not belong to SFO k . Proposition 3.12.2. For every positive k, SFO k contains FO k and MFO.

In the following lemma we establish the equivalence between SFO k and FO k for every positive k by devising an equivalence-preserving translation procedure between the two sets.

Lemma 3.12.3. Every SFO k sentence is equivalent to some FO k sentence.

Proof. Let m be any positive integer and consider any sentence ϕ from SFO k,m . Then, vars(ϕ) ⊆ V 1 ∪ . . . ∪ V m and all V 1 , . . . , V m are pairwise separated in ϕ. Without loss of generality, we assume that ϕ is in negation normal form.

We prove an auxiliary result from which the lemma follows.

Claim I: Consider any subformula ψ = Qv. χ of ϕ with v ⊆ V i for some i. If the sets V 1 , . . . , V m are pairwise strictly separated in χ, then we can construct a formula ψ that is equivalent to ψ and in which all sets V 1 , . . . , V m are pairwise strictly separated.

Proof: The proof proceeds along the same lines as the proof of Lemma 2.0.3.

A basic formula basic formulas is any atom and any subformula (Q v. . . .) in χ that does not lie within the scope of any quantifier in χ. Suppose Q is an existential quantifier. (The case of Q = ∀ can be treated in an analogous way.) Let z be the tuple collecting all variables that occur freely in ψ. We first transform χ into an equivalent disjunction of conjunctions of negated or non-negated basic formulas. This is always possible. Since the sets V 1 , . . . , V m are pairwise strictly separated in χ, the constituents of the j-th conjunction can be grouped into m parts:

η j,1 V 1 ∩ (v ∪ z) , . . . , η j,m V m ∩ (v ∪ z)
with vars(η j, ) ⊆ V . This is possible because of our assumption that the sets V 1 , . . . , V m are all pairwise strictly separated in χ. Hence, since v ⊆ V i , ψ is equivalent to a formula of the form ∃v.

j η j,i V i ∩ (v ∪ z) ∧ 1≤ ≤m =i η j, (V ∩ z) .
We shift the existential quantifier block ∃v inwards so that it only binds the (sub-)conjunctions

η j,i V i ∩ (v ∪ z) . The resulting formula j ∃v. η j,i V i ∩ (v ∪ z) ∧ 1≤ ≤m =i η j, (V ∩ z)
is the sought ψ in which the sets V 1 , . . . , V m are all pairwise strictly separated. ♦

Clearly, the sets V 1 , . . . , V m are pairwise strictly separated in any quantifier-free subformula of ϕ. Hence, applying Claim I iteratively, we can transform ϕ into an equivalent sentence ϕ in which the sets V 1 , . . . , V m are pairwise strictly separated. Since ϕ is a sentence, the strict separateness condition leads to the observation that for every subformula Qv. χ in ϕ there is some j such that vars(Qv. χ) ⊆ V j . As each of the V i contains exactly k variables, we can rename the bound variables in ϕ such that ϕ is an ∧-∨-combination of FO k sentences. Since FO k is closed under Boolean combinations, ϕ is an FO k sentence.

Since the satisfiability problem for FO 2 sentences is known to be decidable -in fact, the class of FO 2 sentences is known to possess the finite model property [Mor75, GKV97] -, Lemma 3.12.3 entails the same for the class of SFO 2 sentences and the associated satisfiability problem SFO 2 -Sat SFO 2 -Sat .

Theorem 3.12.4. The class of SFO 2 sentences possesses the finite model property and, hence, the satisfiability problem for SFO 2 sentences is decidable.

Having established the equivalence between FO k and SFO k regarding expressiveness, it remains to investigate the succinctness gap between the two fragments. We shall do this in particular for the class of SFO 2 sentences compared to the class of FO 2 sentences. Theorem 3.12.5. There is a class of SFO 2 sentences and some positive integer n 0 such that for every integer n ≥ n 0 the class contains a sentence ϕ with a length linear in n for which any equivalent FO 2 sentence has a length that is at least exponential in n.

Proof. Let n ≥ 1 be some positive integer. Consider the following first-order sentence in which the sets {x 1 , x 2 } and {y 1 , y 2 } are separated:

ϕ := ∀x 2 ∃y 2 ∀x 1 ∃y 1 . 2(n+1) i=1 P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) .
In analogy to the proof of Theorem 3.2.7, we construct the following model A for ϕ. The construction is based on the sets

S k S 1 := S ⊆ [2(n + 1)] |S| = n + 1 and S 2 := S ⊆ S 1 |S| = 1 2 |S 1 | . We observe |S 1 | = 2(n + 1) n + 1 ≥ 2(n + 1) n + 1 n+1 = 2 n+1
and

|S 2 | = |S 1 | |S 1 |/2 ≥ |S 1 | |S 1 |/2 |S1|/2 ≥ 2 2 n ,
in analogy to the proof of Theorem 3.2.7.

Claim I: Let S be any subset of S 2 such that for every S ∈ S there is some T ∈ S ⊆ S 1 which does not belong to any S ∈ S \ {S}. Then, S contains at most |S 1 | ≤ 2 2(n+1) sets as elements.

Proof: Obvious. ♦

Let A A be the structure with

A := a (1) S , b (1) S S ∈ S 1 ∪ a (2) S , b (2) S S ∈ S 2 , P A i := a (1) S1 , a (2)
S2 ∈ A × A i ∈ S 1 ∈ S 2 for i = 1, .
. . , 2(n + 1), and

Q A i := b (1) S1 , b (2)
S2 ∈ A × A i ∈ S 1 ∈ S 2 for i = 1, .
. . , 2(n + 1). Then, for any choice of S 1 , S 2 and every i, 1 ≤ i ≤ 2(n + 1), we have

A, x 1 →a (1) S1 , x 2 →a (2) S2 , y 1 →b (1) S1 , y 2 →b (2) S2 |= P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) .
For any other choice of pairs c 1 , c 2 , i.e. there do not exist sets

S 1 ∈ S 1 , S 2 ∈ S 2 such that c 1 , c 2 equals a (1) S1 , a (2) S2 or b (1) S1 , b (2) S2 , we observe A, [x 1 →c 1 , x 2 →c 2 ] |= P i (x 1 , x 2 ) and A, [y 1 →c 1 , y 2 →c 2 ] |= Q i (y 1 , y 2 ) for every i. Hence, A, [x 1 →c 1 , x 2 →c 2 , y 1 →c 1 , y 2 →c 2 ] |= 2(n+1) i=1 P i (x 1 , x 2 ) ↔ Q i (y 1 , y 2 ) . Consequently, A is a model of ϕ.
In analogy to the proof of Theorem 3.2.7, we can prove the following observation.

Claim II: For every S ∈ S 2 the substructure

A -S A -S of A induced by A -S := A \ b (2) S
does not satisfy ϕ. ♦ Let ϕ FO 2 be a shortest FO 2 sentence that is semantically equivalent to ϕ. Next, we argue that len(ϕ FO 2 ) is at least exponential in n. In [START_REF] Scott | A decision method for validity of sentences in two variables[END_REF] a normal form for FO 2 sentences was introduced, which is sometimes referred to as Scott normal form Scott normal form in the literature, e.g. in [START_REF] Grädel | On Logics with Two Variables[END_REF]. Accordingly, Lemma 8.1.2 in [START_REF] Börger | The Classical Decision Problem[END_REF] states that there is some relational FO 2 sentence ψ FO 2 that has the following properties:

(a) ψ FO 2 is of the form ∀uv. χ(u, v) ∧ m i=1 ∀x∃y. η i (x,
≤ k ≤ κ we have b ∈ R B k if and only if b ∈ R B k .
Claim III: Let n be sufficiently large. If κ is polynomial in n, then there is some S * ∈ S such that b

(2) S * ∈ D and for every T ∈ S * there is some S ∈ S \ {S * } that also contains T and we have b

(2) (2) S * . By Claim II (extended to B), there is some maximal nonempty set J ⊆ [m] such that for every j ∈ J we have B -S * |= ∀x∃y. η j (x, y). Consequently, for every j ∈ J there is some domain element c ∈ B * such that B, [x →c, y →b Notice that η j is quantifier free and, hence, exclusively contains atoms over the variables x, y. Moreover, for every binary atom A of the form P i (x, y), P i (y, x), Q i (x, y), or Q i (y, x) we have B, [x →c, y →d] |= A for every d ∈ {b S ] |= η j (x, y), which entails B -S * , [x →c] |= ∃y. η j (x, y). This leads to a contradiction and there, hence, cannot be a pair j, c as described.

S ∈ D. Proof: Clearly, D contains at least 2 2 n /2 κ = 2 2 n -κ domain elements. Hence, | S| ≥ 2 2 n -κ . Moreover, we observe 2 2 n -κ > 2 2(n+1) for sufficiently large n, if κ is polynomial in n. By Claim I,
Consider any j ∈ J and any c ∈ {b

(1)

S | S ∈ S 1 } for which B, [x →c, y →d] |= η j (x, y) for every d ∈ B * . Hence, there is some set T ∈ S 1 c, T such that c = b (1)
T . Suppose T ∈ S * . Then, for every binary atom A(x, y) of the form P i (x, y), P i (y, x), Q i (x, y), Q i (y, x), or x ≈ y we have

B |= A(c, b (2) S * ) but also B |= A(c, b (2)
S ) for every S ∈ S 1 \ {T }. Like in the above case we conclude B -S * , [x →c] |= ∃y. η j (x, y), which yields a contradiction. Suppose T ∈ S * . By Claim III, there is some S ∈ S \ {S * } such that T ∈ S and b

(2)

S ∈ D \ {b (2) S * } ⊆ B * . Then, we have B, [x →b (1) T , y →b (2) S * ] |= Q i (x, y) if and only if i ∈ T and B, [x →b (1)
T , y →b

S ] |= Q i (x, y) if and only if i ∈ T . For every other binary atom A of the form Q i (y, x), P i (x, y), P i (y, x), or x ≈ y we have B, [x →b T ] |= ∃y. η j (x, y), which constitutes a contradiction. This means, the number κ of unary predicate symbols occurring in ψ FO 2 cannot be polynomial in n, for otherwise we get B -S * |= ψ FO 2 and A -S * |= ϕ FO 2 . Since κ ∈ O len(ϕ FO 2 ) , it follows that len(ϕ FO 2 ) cannot be polynomial in n but must be at least exponential, in order to satisfy 2 2 n ≤ 2 2(n+1)+κ for growing n.

Separateness and Fluted Formulas

The main characteristic of fluted formulas can be crisply described as follows: "the order of quantification of variables coincides with the order in which those variables appear as arguments of predicates" ([PST16], page 1). The sentences in Herzig's ordered fragment can in fact be described in the same intuitive way. Herzig has put it like this: "the ordering of the quantifiers must be that of the variables in the predicates they govern" ([Her90], page 1). Nonetheless, the two fragments differ syntactically, as the details of their respective definition differ.

Example 3.13.1. The following FL sentence constitutes a definition of the concept married couples all whose children are marriedmwmc(x 1 , x 2 ):

∀x 1 x 2 . mwmc(x 1 , x 2 ) ↔ married(x 1 , x 2 ) ∧ ∀x 3 . haveChild(x 1 , x 2 , x 3 ) → ∃x 4 . married(x 3 , x 4 ) .
This exemplary sentence is taken from [START_REF] Hustadt | A survey of decidable firstorder fragments and description logics[END_REF]. It belongs to FL but not to Herzig's ordered fragment. The reason is that the atom married(x 3 , x 4 ) contains the variables x 3 , x 4 whose quantifiers lie within the scope of ∀x 1 and ∀x 2 , but neither x 1 nor x 2 occur (left of x 3 , x 4 ) in the atom married(x 3 , x 4 ).

The following sentence lies in the intersection of FL and Herzig's ordered fragment. It defines the concept of married couples that do not have any children togethermwoc(x 1 , x 2 ):

∀x 1 x 2 . mwoc(x 1 , x 2 ) ↔ married(x 1 , x 2 ) ∧ ¬∃x 3 . haveChild(x 1 , x 2 , x 3 ) .
A simple variation of this sentence, however, does not satisfy the syntactic restrictions of FL, while it still falls into Herzig's ordered fragment:

∀x 1 x 2 . mwoc(x 1 , x 2 ) ↔ ∀x 3 . married(x 1 , x 2 ) ∧ ¬haveChild(x 1 , x 2 , x 3 ) .
As the two fragments seem to be so similar, one could ask whether they are equivalent in expressiveness. Indeed, using the concept of separateness of variables, we can reconcile the two fragments while, at the same time, extending both of them to a common superclass, called the separated fluted fragment (SFL).

In the first-order formulas in this section we allow bound variables to reappear in distinct occurrences of quantifiers in the same formula. Before we formulate the definition of SFL, we adapt the following notation from the definition of Maslov's fragment K (cf. page 25). Let ψ(u 1 , . . . , u m ) be any subformula of a first-order sentence ϕ. We assume that u 1 , . . . , u m are exactly the variables occurring freely in ψ and that they are pairwise distinct. The ϕ-prefix of ψ is the sequence

Q 1 v 1 . . . Q m v m of
quantifiers in ϕ (read from left to right) that bind the free variables of ψ, in particular, we have {v 1 , . . . , v m } = {u 1 , . . . , u m }.

Definition 3.13.2 (Separated fluted fragment (SFL)). Let V 1 , V 2 , V 3 , . . . V i be disjoint ordered se- quences of pairwise distinct variables V i = x i 1 , x i 2 , x i 3 , . . ..
In what follows, we occasionally treat the sequences V i as sets.

The separated fluted fragment (SFL) comprises all relational first-order sentences ϕ without equality in which every atom A satisfies the following properties.

(a) A is of the form P (x i , . . . , x i k ) for some predicate symbol P and certain integers i, k, with i ≥ 1, k ≥ 0, and 1 ≤ ≤ k.

(b) The ϕ-prefix of A is of the form Q x i , . . . , Q k x i k with Q j ∈ {∃, ∀}.
Although separateness is not explicitly mentioned in the definition of SFL, it implicitly plays an important role. For every atom A in any SFL sentence ϕ, we find one sequence V i from which all variables in A stem, i.e. vars(A) ⊆ V i . Since the V 1 , V 2 , V 3 , . . . are pairwise disjoint, they are, hence, also pairwise separated in ϕ.

It is not hard to see that every FL sentence also belongs to SFL. The simple monadic sentence

∀x 1 1 ∃x 2 1 . P (x 1 1 ) ↔ Q(x 2 1
) is neither fluted nor does it belong to Herzig's fluted fragment. However, it belongs to SFL. Indeed, every MFO sentence can be turned into an SFL sentence by renaming bound variables. Consider any MFO sentence ϕ and suppose that all quantifiers in ϕ bind distinct variables. Let u 1 , . . . , u k be an enumeration of all the first-order variables occurring in ϕ. Let ϕ be the sentence that results from ϕ by renaming every u i into x i 1 . This sentence ϕ clearly belongs to SFL. Finally, consider any sentence ψ that belongs to Herzig's ordered fragment. Let P (u 1 , . . . , u m ) and Q(v 1 , . . . , v m ) be two atoms in ψ. Let j, j be any two indices with 1 ≤ j ≤ m and 1 ≤ j ≤ m such that u j and v j are bound by the same quantifier Q j u j = Q j v j in ψ. By definition of Herzig's ordered fragment, these quantifiers Q j u j and Q j v j are exactly in the scopes of

Q 1 u 1 , . . . , Q j-1 u j-1 and Q 1 v 1 , . . . , Q j -1 v j -1
, respectively, and no other quantifier scopes. As the quantifiers Q j u j and Q j v j coincide, the sets {u 1 , . . . , u j } and {v 1 , . . . , v j } must be equal. Applying this argument iteratively, we infer j = j and that the sequences u 1 , . . . , u j and v 1 , . . . , v j coincide. Suppose j * ≥ 1 is the maximal index such that u j * and v j * are bound by the same quantifier. For any indices , > j * we have that neither of the quantifiers Qu and Q v binding the variables u and v , respectively, lies in the scope of the other. For otherwise, assume that Qu were in the scope of Q v . Hence, < and there is some u with < such that u is also bound by the quantifier Q v . By the above argument, we have that = and that the sequences u 1 , . . . , u and v 1 , . . . , v must coincide. But since j * is maximal and j * < , we get a contradiction. Consequently, we can rename the bound variables in ψ in such a way that every atom A has the form P (x 1 1 , . . . , x 1 k ) for some k and the ψ-prefix of A is of the form Q 1 x 1 1 , . . . , Q k x 1 k . Proposition 3.13.3. SFL properly contains (modulo renaming of bound variables) FL, MFO, and Herzig's ordered fragment.

The following lemma stipulates that every SFL sentence has an equivalent in FL. As usual, this result is established by giving an effective equivalence-preserving translation from SFL into FL. Lemma 3.13.4. Every SFL sentence is equivalent to some FL sentence.

Proof. As a primer we adapt some notation from the definition of the fluted fragment (cf. page 26). For every nonnegative integer k and every positive integer i we define the set FL (k) (V i ) inductively as follows. Any atom P (x i , . . . ,

x i k ) with 1 ≤ ≤ k belongs to FL (k) (V i ). The set FL (k) (V i ) is closed under Boolean combinations, i.e. if ϕ and ψ belong to FL (k) (V i ), then so do ¬ϕ, ϕ ∧ ψ, ϕ ∨ ψ, ϕ → ψ, ϕ ↔ ψ. Given any FL (k+1) (V i ) formula ϕ(x i , . . . , x i k+1 ), then ∀x k+1 . ϕ and ∃x k+1 . ϕ belong to FL (k) (V i ).
Consider any SFL sentence ϕ and let m be the smallest integer such that vars(ϕ) ⊆ V 1 ∪. . .∪V m . Then, all V 1 , . . . , V m are pairwise separated in ϕ. Without loss of generality, we assume that ϕ is in negation normal form.

We prove an auxiliary result that is an adapted version of Claim I from the proof of Lemma 3.12.3.

Claim I: Consider any subformula ψ = Qx i k . χ of ϕ with Q ∈ {∀, ∃} that satisfies the following properties:

(a) χ is a Boolean combination of formulas from k ,i FL (k ) (V i ) -which we shall call basic formulas basic formulas in what follows;

(b) each of these basic formulas that contains

x i k is an FL (k) (V i ) formula; (c) every subformula of χ that is of the form Q x i k . χ is an FL (k-1) (V i ) formula. Then, we can construct a formula ψ such that (1) ψ is equivalent to ψ, (2) ψ is a Boolean combination of formulas from k ,i FL (k ) (V i ), and
(3) every subformula Qx i k . χ occurring in ψ belongs to FL (k-1) (V i ). Proof: We treat the case where Q is an existential quantifier; the case of Q = ∀ can be treated dually.

First, we transform χ into an equivalent disjunction of conjunctions of basic formulas that is of the form

j η j,i,k x i 1 , . . . , x i k ∧ 1≤i ≤m i =i k η j,i ,k (x i 1 , . . . , x i k ) ,
where we group the basic formulas in accordance with their belonging to the sets FL (k ) (V i ).

More precisely, the conjunctions η j,i,k contain exactly those basic formulas from the j-th disjunct in which the variable bound by Qx i k occurs freely. Moreover, any basic formula from FL (k ) (V i ) that occurs in the j-th disjunct and does not contain x i k as free variable is a conjunct of η j,i ,k . By assumption, each η j,i,k belongs to FL (k) (V i ), as we assumed that every basic formula in which x i k occurs is an FL (k) (V i ) formula. Hence, ψ is equivalent to a formula of the form

∃x i k . j η j,i,k x i 1 , . . . , x i k ∧ 1≤i ≤m i =i k η j,i ,k (x i 1 , . . . , x i k ) .
We shift the existential quantifier ∃x i k inwards so that it only binds the (sub-)conjunctions η j,i,k . The emerging subformula ∃x i k . η j,i,k belongs to FL (k-1) (V i ). The result

j ∃x i k . η j,i,k x i 1 , . . . , x i k ∧ 1≤i ≤m i =i k η j,i ,k (x i 1 , . . . , x i k )
is the sought ψ that is a Boolean combination of formulas from k ,i FL (k ) (V i ). ♦ By Definition 3.13.2, every atom in ϕ is an FL (k ) (V i ) formula for certain k , i . Hence, every subformula Qx i k . χ of ϕ with quantifier-free χ satisfies the conditions of Claim I. Consider any subformula ψ := Qx i k . χ of ϕ such that χ is a Boolean combination of atoms and of formulas ψ := Q x i k . χ that satisfy the preconditions of Claim I. By Claim I, we can transform all these ψ into equivalent formulas ψ in such a way that ψ, after all these transformations, satisfies the preconditions of Claim I. Due to this observation, we can iteratively apply Claim I to transform the sentence ϕ into an equivalent sentence ϕ that is a Boolean combination of sentences from

k ,i FL (k ) (V i ). Since every sentence χ ∈ FL (k ) (V i ) is equivalent to the sentence ∀x i 1 . . . x i k .
χ, we can transform ϕ into an equivalent sentence ϕ that is a Boolean combination of sentences from i FL (0) (V i ). In ϕ the sets V 1 , . . . , V m are pairwise strictly separated. Hence, we can rename bound variables in ϕ in such a way that the result ϕ is a Boolean combination of sentences from FL (0) (V 1 ). This sentence ϕ belongs to the fluted fragment.

Since FL enjoys the finite model property [START_REF] Pratt-Hartmann | Quine's Fluted Fragment is Non-Elementary[END_REF], Lemma 3.13.4 implies that the same holds true for SFL. Hence, the satisfiability problem associated with SFL (SFL-Sat SFL-Sat

) is decidable.

Theorem 3.13.5. SFL possesses the finite model property and, hence, the satisfiability problem for SFL sentences is decidable.

Decidable Fragments with Function Symbols

In the previous sections our focus was relational first-order formulas, and function symbols have only played a marginal role. In the present section, we shall briefly consider first-order fragments that admit function symbols under certain constraints but still have decidable satisfiability problems.

3. Proof. The proof is an adaptation of the proof of Proposition 6.2.7 from [START_REF] Börger | The Classical Decision Problem[END_REF].

Let f 1 , . . . , f k be an enumeration of all unary function symbols that occur in ϕ. We apply the following transformation iteratively. Assume ϕ contains the atom P (f i (t)) for some term t. We transform ϕ into ϕ P (f i (t)) R(t) ∧ ∀x. P (f i (x)) ↔ R(x), where the R is a fresh unary predicate symbol and ϕ P (f i (t)) R(t) is the formula we obtain from ϕ by replacing every occurrence of P (f i (t)) by R(t). Starting from ϕ, exhaustive application of this transformation yields a sentence ϕ of the form ψ ∧ k i=1 j ∀x. P j (f i (x)) ↔ R i,j (x) , where ψ does not contain any of the f i anymore. If we conceive the f i in ϕ as Skolem functions and revert the Skolemization, the f i vanish completely and we end up with the equisatisfiable sentence ϕ := ψ ∧ ∀x∃y 1 . . . y k . k i=1 j P j (y i ) ↔ R i,j (x) . Because of len(ψ) ≤ len(ϕ) and since for any occurrence of an f i in ϕ at most one new conjunct of a fixed length is introduced, we get len(ϕ ) ∈ O(len(ϕ)).

The construction used in the proof of Lemma 3.14.1 only requires that the unary function symbols exclusively occur in the arguments of unary predicate symbols. It is not required that all occurring predicate symbols are unary. If we were to consider, for instance, an SF sentence in which unary function symbols occur in the arguments of unary predicate symbols and nowhere else, then the sentence ψ ∧ ∀x∃y 1 . . . y k . k i=1 j P j (y i ) ↔ R i,j (x) belongs to SF as well (after shifting all quantifiers to the front).

Similarly, the construction can be applied to GBSR sentences with unary function symbols in monadic atoms. Although the final result is, technically, not in GBSR, it can easily be converted to GBSR by shifting quantifiers. The same holds true for GAF, GGKS, and SFO 2 . Even for the generalized guarded fragments SGF, SLGF, and SGNFO the construction is applicable, if we add trivial guards in the spirit of Propositions 3.10.4 and 3.11.3. For SFL only renaming bound variables is necessary to obtain an SFL sentence in the end. Hence, all of the mentioned fragments do not only (almost) contain MFO, but could be extended so that they (almost) become a proper superset of the Löb-Gurevich fragment.

SF and GBSR with Stratified Occurrences of Function Symbols

Decidable extensions of BSR with non-constant function symbols have been investigated mostly in the realm of sorted logic. Two examples are Abadi et al.'s stratified vocabularies [ARS07, ARS10] and Korovin's non-cyclic sorts [START_REF] Korovin | Non-cyclic Sorts for First-Order Satisfiability[END_REF]. A third approach is developed in [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF], where sorts are not the primary source of finiteness of the set of relevant terms. The cause for this limitation is rather the syntactic structure of the formula at hand. Technically, the same effect could be realized by extracting implicit sort information from the occurrences of function symbols in certain argument positions. In the end, it is not surprising that all three approaches (almost) lead to the same fragment: BSR with function symbols that occur only is a stratified fashion. Definition 3.14.2 (GBSR with stratified occurrences of function symbols). Consider any vocabulary Σ = Π, Ω and let ϕ be a Σ-sentence that adheres to the requirements of GBSR with the exception that we allow function symbols to occur. The sentence ϕ is considered to be a GBSR sentence with stratified occurrences of function symbols if there is a mapping lvl ϕ : (Π ∪ Ω) × N → N lvl ϕ that maps argument positions, i.e. pairs of the form P, k with P ∈ Π and 1 ≤ k ≤ arity(P ) or f, k with f ∈ Ω and 1 ≤ k ≤ arity(f ) + 1, to nonnegative integers such that the following conditions are satisfied.

(a) For every m-ary function symbol f ∈ Ω and every i with

1 ≤ i ≤ m we have lvl ϕ f, i > lvl ϕ f, m + 1 .
(b) For every (sub)term g(s 1 , . . . , s k-1 , f (t 1 , . . . , t m ), s k+1 , . . . , s m ) occurring in ϕ we have lvl ϕ f, m + 1 = lvl ϕ g, k . This includes the case where f is a constant symbol and m = 0. Moreover, this also includes the case where g is replaced with a predicate symbol P .

(c) For every equation f (s 1 , . . . , s m ) ≈ g(t 1 , . . . , t m ) occurring in ϕ we have lvl ϕ f, m + 1 = lvl ϕ g, m + 1 . This includes the cases where f or g or both are constant symbols (with m = 0 or m = 0 or both, respectively).

(d) Every variable v that occurs in ϕ is associated with a fixed nonnegative integer v v such that we have the following

• for every (sub)term f (s 1 , . . . , s k-1 , v, s k+1 , . . . , s m ) in ϕ we have lvl ϕ f, k = v ,
• for every atom P (s 1 , . . . , s k-1 , v, s k+1 , . . . , s m ) in ϕ we have lvl ϕ P, k = v ,

• for every equation v ≈ g(t 1 , . . . , t m ) in ϕ we have lvl ϕ g, m + 1 = v , and

• for every equation v ≈ v we have v = v .
Intuitively, the main characteristic of collections of terms in which function symbols only occur in a stratified fashion is that any function symbol f does never occur directly or indirectly in the arguments applied to f . An example for a direct occurrence is f (s 1 , g( t1 , f ( t ), t2 ), s2 ), in which f occurs in an argument in a term f (. . .). Indirect occurrences require, for instance, two terms f (s 1 , g( t), s2 ) and g(s 1 , f ( t ), s 2 ) where f does not occur in s1 , s2 , t, s 1 , s 2 , t .

Definition 3.14.2 resembles an a-posteriori variant of the definition of stratified vocabulary defined in [START_REF] Abadi | Decidable Fragments of Many-Sorted Logic[END_REF] for a sorted setting. Definition 3.14.3 (Stratified vocabulary -Definition 1 from [START_REF] Abadi | Decidable Fragments of Many-Sorted Logic[END_REF]). A vocabulary Σ for many-sorted logic is stratified if there is a mapping lvl Σ from sorts to nonnegative integers such that for every function symbol f :

ξ 1 × . . . × ξ m → ξ m+1 we have lvl Σ (ξ i ) > lvl Σ (ξ m+1 ) for every i ≤ m.
Stratified vocabularies are essentially the same objects as non-cyclic vocabularies, which are defined and investigated in [START_REF] Korovin | Non-cyclic Sorts for First-Order Satisfiability[END_REF]. A conceptually different approach, which yet leads to essentially the same first-order fragment is developed in [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF], Section 3. Instead of the mapping lvl, the authors use set constraints for the analysis of the syntactic structure. Proposition 3.14.4 ([ARS10, [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF][START_REF] Korovin | Non-cyclic Sorts for First-Order Satisfiability[END_REF]). The satisfiability problem for multi-sorted ∃ * ∀ *sentences over a stratified vocabulary is decidable.

The main argument for proving Proposition 3.14.4 is that any Herbrand domain over manysorted stratified vocabularies is finite. Exhaustive Skolemization of an ∃ * ∀ * -sentence ϕ over a stratified vocabulary only introduces constant symbols. As this again leads to a stratified vocabulary, Lemma 1.0.4 entails that any Skolemized version of ϕ has a finite Herbrand model, if ϕ is satisfiable. In other words, the class of many-sorted ∃ * ∀ * -sentences over a stratified vocabulary enjoys the finite model property.

Although Definition 3.14.2 does not rely on sort information, it ensures that a formula is constructed in accordance with Definition 3.14.3, based on implicit sort information that can be reconstructed a posteriori by an analysis of the occurrences of function symbols in terms.

Proposition 3.14.5. Consider any Σ-formula ϕ that satisfies Definition 3.14.2. Then, the singlesorted vocabulary Σ can be turned into a many-sorted vocabulary Σ such that (a) Σ and Σ contain the same function and predicate symbols, (b) Σ is stratified, and (c) ϕ is a Σ -formula obeying the sort restrictions of Σ .

We have already pointed out earlier that the translations from SF and GBSR into BSR that underly Lemmas 3.2.5 and 3.5.2 also works in the presence of function symbols. This also entails that every GBSR sentence with function symbols satisfying Definition 3.14.2 is equivalent to some BSR sentence that also satisfies this definition. Hence, Proposition 3.14.4 entails that the fragment described in Definition 3.14.2 has a decidable satisfiability problem Theorem 3.14.6. The satisfiability problem for GBSR sentences with stratified occurrences of function symbols is decidable.

Monadic Horn Sentences in which Positive Literals are Shallow and Linear

The monadic shallow linear Horn fragment (MSLH) (see page 27 for the exact definition) is quite different from the other fragments we have treated so far. It has strong connections to certain kinds of tree automata, see, e.g. [START_REF] Jacquemard | Unification in Extensions of Shallow Equational Theories[END_REF] and [START_REF] Weidenbach | Sorted Unification and Tree Automata[END_REF], Section 4. MSLH can be conceived as an extension of the class of Horn MFO sentences after exhaustive Skolemization. Given any Horn MFO sentence ∃z∀x 1 ∃y 1 . . . ∀x n ∃y n . i C i (x, ȳ), exhaustive Skolemization yields

∀x 1 . . . x n . i C i z/c, y 1 /f 1 (x 1 ), . . . , y n /f n (x 1 , . . . , x n ) ,
which belongs to MSLH, as every positive literal has one of three shapes: P (c), P (x i ), or P (f i (x 1 , . . . , x i )) with pairwise distinct x 1 , . . . , x i . On the other hand, it is easy to see that MSLH allows a much richer term syntax than Skolemized MFO. For instance, terms in negative literals may be arbitrarily complicated, including nested occurrences of non-constant function symbols. Moreover, the order of variables may vary in distinct literals, whereas in Skolemized MFO the arguments in Skolem terms adhere to a fixed order. Certain forms of symmetry can be expressed in MSLH, which cannot be expressed in MFO, for example ∀xy. P (f (x, y)) → P (f (y, x)).

The satisfiability problem for MSLH is known to be decidable in deterministic exponential time, in fact, it is ExpTime-complete [START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF]. This also entails that the satisfiability problem for Horn MFO sentences lies in ExpTime. Although it is already known that the satisfiability problem for Horn MFO sentences is also ExpTime-hard [START_REF] Denenberg | Logical Syntax and Computational Complexity[END_REF], it is instructive to show this by a reduction to a basic problem over tree automata. This will highlight the close connection between the two formalisms.

Proposition 3.14.7. The satisfiability problem for Horn-MFO is ExpTime-complete.

Proof sketch. To derive the upper bound, we recall that exhaustively Skolemized MFO sentences belong to the MSLH fragment for which a decision procedure is known that runs in deterministic exponential time [START_REF] Goubault-Larrecq | Deciding H 1 by resolution[END_REF], Theorem 6).

The lower bound can be derived by a reduction to the intersection non-emptiness problem for deterministic tree automata: Given a finite sequence of tree automata A 1 , . . . , A m , is there at least one tree that is accepted by all A i . This problem is known to be complete for ExpTime (see, e.g., [CDG + 08], Theorem 1.7.5). 6We stick to the basic definition from [START_REF] Veanes | Computational Complexity of Basic Decision Problems of Finite Tree Automata[END_REF]. A tree automaton A tree automaton A is a quadruple A = Q, Ω, R, F , where Q is a finite set of states; Ω a set of function symbols, each equipped with a fixed arity m f ≥ 0; we require m f = 0 for at least one f ∈ Ω;

R is the transition relation, containing transition rules of the form f (q 1 , . . . , q m f ) → q with f ∈ Ω and q 1 , . . . , q m f , q ∈ Q; and

F ⊆ Q is the set of final states.
We assume that the sets Q and Ω are disjoint. A tree automaton A = Q, Ω, R, F is deterministic if no rules in R have identical left-hand sides. Given A, the underlying tree language is the set of all syntax trees of ground terms over the function and constant symbols in Ω. The rules in R can be conceived a rewriting rules that turn (sub)trees into states. The starting point of this process are the leaves of a tree, which are represented by constant symbols from Ω. Given c ∈ Ω, a rewrite rule starting from c looks like c() → q -we usually drop the empty list of arguments () for convenience. A term t is accepted tree language accepted by A by A if repeated application of the rewrite rules from R eventually turns t into a final state q ∈ F . For example, consider the term t = g(c, f (c, d)) and suppose the rules c → q 1 ; d → q 2 ; f (q 1 , q 2 ) → q 1 ; g(q 1 , q 1 ) → q 2 belong to R. Then t is rewritten as follows g(c, f (c, d))

A -→ + g(q 1 , f (q 1 , q 2 )) A -→ g(q 1 , q 1 ) A -→ q 2 .
The term t is accepted by A if and only if q 2 ∈ F . Let A 1 , . . . , A n be a sequence of tree automata A i := Q i , Ω, R i , F i that share the underlying tree vocabulary. Without loss of generality we assume that the sets Q 1 , . . . , Q n are pairwise disjoint. Let ϕ 1 be the following sentence

ϕ 1 := f ∈Ω ∀x 1 . . . x m f . n i=1 f (q1,...qm f )→q ∈ Ri P q1 (x 1 ) ∧ . . . ∧ P qm f (x m f ) → P q (f (x 1 , . . . , x m f )) ,
which encodes all the rules from the transition relations of all tree automata A 1 , . . . , A n . Clearly, ϕ 1 can easily be converted into a Horn sentence. Since each of the clauses in that Horn sentence contains some positive literal, the sentence is satisfiable. Hence, by Proposition 1.0.5, ϕ 1 has a unique minimal Herbrand model H 1 . It is easy to verify that the language accepted by any A i is resembled by the set q∈Fi P H1 q . Put differently, for every ground term t that is accepted by A i we find some final state q ∈ F i such that H 1 |= P q (t). In addition, we notice that ϕ 1 is a Skolemized variant of an MFO sentence that is (almost) Horn.

Next, we define the sentence ϕ 2 that introduces the predicate symbols S 1 , . . . , S n :

ϕ 2 := n i=1 q∈Fi ∀x. P q (x) → S i (x) .
For each of the S i we observe that the unique minimal Herbrand model H 2 |= ϕ 1 ∧ ϕ 2 interprets the S i so that the set S H2 i captures the language accepted by A i . In order to also capture the intersection of the accepted languages in a single predicate, we define the sentence

ϕ 3 := ∀x. S 1 (x) ∧ . . . ∧ S n (x) → T (x) ∧ n i=1 T (x) → S i (x) .
Still, the conjunction ϕ 1 ∧ ϕ 2 ∧ ϕ 3 is satisfiable and, hence, has a unique minimal Herbrand model H 3 . Then, we observe that the set T H3 comprises exactly the terms that are in the intersection of the languages accepted by A 1 , . . . , A n .

Finally, consider the sentence ϕ := ϕ 1 ∧ ϕ 2 ∧ ϕ 3 ∧ ∀x. ¬T (x). It is equivalent to the Skolemized variant of a Horn-MFO sentence and, if ϕ is satisfiable, it has a unique minimal Herbrand model H * . Such a model exists if and only if the intersection of the tree languages accepted by A 1 , . . . , A n is empty. Consequently, ϕ is unsatisfiable if and only if the intersection of the languages accepted by A 1 , . . . , A n is not empty. In addition, the length of ϕ is linear in the sum of the lengths of any reasonable representation of the tree automata A 1 , . . . , A n .

It seems that treatments of the semantics of MSLH sentences, and their close relatives from the fragment H 1 (cf. page 27), mainly consider Herbrand structures and the correspondence to tree automata. This is the case in [Wei99, NNS02, Gou05, TW15, TW17, Teu17]. Obviously, Herbrand structures for MSLH sentences with non-constant function symbols have an infinite domain. Nevertheless, these structures might be representable by finite means. In the present section we shall see how to construct models with finite domains for satisfiable MSLH sentences. Hence, we show that this fragment enjoys the finite model property. More precisely, every satisfiable MSLH sentence containing k constant symbols, p predicate symbols, and function symbols of arity at most m has a model B whose domain contains at most k + (m + 1) • 2 p elements. The finite model B we shall construct can be conceived as a finite representation of the minimal Herbrand model H -every element in B's domain corresponds to an equivalence class over ground terms in H's domain. The underlying equivalence relation is determined by the interpretation of the unary predicate symbols under H.

Fix some vocabulary Σ = Π, Ω and consider a finite set N N , ϕ of pairwise variable-disjoint Σ-clauses for which the sentence ϕ := ∀x. C∈N C(x) is satisfiable and belongs to the MSLH fragment. The following is an immediate consequence of Lemma 4 from [START_REF] Weidenbach | Towards an Automatic Analysis of Security Protocols in First-Order Logic[END_REF].

Proposition 3.14.8. There is a finite set N * of pairwise variable-disjoint Σ-clauses such that N ⊆ N * and the sentence ϕ * := ∀x . C∈N * C(x ) belongs to MSLH and is logically entailed by ϕ. Moreover, there is some Herbrand model H |= ϕ * such that for every ground Σ-atom A of the form S f (s 1 , . . . , s m ) we have H |= A only if there is some clause C in N * and a variable assignment β that satisfy the following properties:

(a) C has the form ¬P 1 (x 1 )∨. . .∨¬P n (x n )∨S f (y 1 , . . . , y m ) where {x 1 , . . . , x n } ⊆ {y 1 , . . . , y m } and f (y 1 , . . . , y m ) is linear, i.e. the y 1 , . . . , y m are pairwise distinct; n = 0 or m = 0 is allowed;

(b) we have β(y i ) = s i for every i, 1 ≤ i ≤ m; and

(c) we have H, β |= P j (x j ) for every j, 1 ≤ j ≤ n.

Since ϕ * is Horn and satisfiable, Proposition 1.0.5 entails that it possesses a unique minimal Herbrand model H. The property described in Proposition 3.14.8 provides the key to construct a finite model for ϕ. The following example is intended to illustrate the underlying ideas.

Example 3.14.9. Consider the following set of clauses:

N := {P (a), Q(b), ¬P (u) ∨ ¬P (u ) ∨ P (f (u, u )), ¬Q(v) ∨ ¬Q(v ) ∨ Q(f (v, v )), ¬P (x) ∨ R(f (x, y)), ¬P (y) ∨ R(f (x, y)), ¬Q(x) ∨ R(f (x, y)), ¬Q(y) ∨ R(f (x, y)), ¬P (z) ∨ ¬Q(z) ∨ ¬R(z)}
where a and b are constant symbols. The sentence ϕ := ∀uu vv xyz. C∈N C(x, y, z) is satisfied by the Herbrand structure H with

P H = a, f (a, a), f a, f (a, a) , f f (a, a), a , f f (a, a), f (a, a) , f a, f a, f (a, a) , . . . , Q H = b, f (b, b), f b, f (b, b) , f f (b, b), b , f f (b, b), f (b, b) , f b, f b, f (b, b) , . . . , R H = f (s, t) s, t are any ground Σ-terms .
The model H is not minimal in the sense that the set R H is larger than necessary. When we fix the interpretations of P and Q under H, the clauses in N enforce only the terms f (s, t) with s ∈ P H and t ∈ Q H to occur in R's interpretation. In other words, the Herbrand structure H with

P H := P H , Q H := Q H , and
R H := f (s, t) s ∈ P H or t ∈ Q H is a model of ϕ whose interpretation of R is a proper subset of R H .
(u) ∨ ¬P (u ) ∨ P (f (u, u )) and ¬Q(v) ∨ ¬Q(v ) ∨ Q(f (v, v )).
These requirements towards the minimality of H provide us with a certain knowledge about distinct terms f (s, t) and f (s , t ). Suppose the terms s and s are indistinguishable with respect to their belonging to the predicates P H , Q H , R H . Further suppose that the same holds for the terms t and t . Then, f (s, t) and f (s , t ) are also indistinguishable with respect to their belonging to P H , Q H , and R H . A formal statement of this property is given in Lemma 3.14.10.

Based on this observation, we can use H as a blueprint for a finite model A, which is depicted in Figure 3 Recall that Π is the set of all predicate symbols occurring in N , and that Π contains only unary predicate symbols. Let P(Π) denote the power set of Π. We define the coloring ν : We define B's domain B to be the disjoint union of m * + 2 subdomains B 0 , B 1 , . . . , B m * +1 . Together with these subdomains we define a coloring λ : B → P(Π) λ as follows. B 0 contains exactly one element a c for every constant symbol c occurring in N , and we require λ(a c ) := ν(c). Moreover, we set c B := a c . This guarantees that c B = d B for all distinct constant symbols c, d occurring in N . Let im(ν) be the image of ν, i.e. im(ν) := {C ⊆ Π | there is some s ∈ H for which ν(s) = C}. For every color C ∈ im(ν) each B i , 1 ≤ i ≤ m * + 1, shall contain exactly one element a for which we set λ(a) := C.

H → P(Π) ν, ∼ ν such that ν(s) := {P ∈ Π | s ∈ P H }
] ∼ν = [s] ∼ν and ν(α ν(s) ) = ν(s). P \ R Q \ R P ∩ R Q ∩ R R \ (P ∪ Q)
We define the interpretation of each predicate symbol P ∈ Π under B such that for every a ∈ B we have a ∈ P B if and only if P ∈ λ(a). Regarding the non-constant function symbols f occurring in N , we proceed as follows. Let m be the arity of f . Consider any tuple a 1 , . . . ,

a m ∈ B m . Let C := ν(f (α λ(a1) , . . . , α λ(am) )). Pick some index j, 1 ≤ j ≤ m * + 1, such that none of the a 1 , . . . , a m belongs to B j ; then f B (a 1 , . . . , a m ) ∈ B j guarantees that f B (a 1 , . . . , a m ) = a for every , 1 ≤ ≤ m. Let b be the (unique) element in B j such that λ(b) = C. We set f B (a 1 , . . . , a m ) := b. This ensures λ f B (a 1 , . . . , a m ) = ν(f (α λ(a1) , . . . , α λ(am) )).
Notice that the number of elements in B's domain could potentially be reduced by taking only the elements that are generated via the functions f B starting from the elements in B 0 . Then, B would more closely correspond to the Herbrand domain H. Lemma 3.14.11. Let γ be any variable assignment over B's domain. Let β be the variable assignment over H's domain defined such that for every x we have β(x) := α λ(γ(x)) . Then, for every term t in N we have ν H(β)(t) = λ B(γ)(t) .

Proof. We proceed by induction on the structure of the term t. For the base case, assume that t is either a variable x or a constant symbol c. In the former case, we get ν H

(β)(x) = ν β(x) = ν α λ(γ(x)) = λ γ(x) = λ B(γ)(x) . In the latter case, we get ν H(β)(c) = ν c = λ(a c ) = λ c B = λ B(γ)(c) .
For the inductive case, assume that t is of the form f (t 1 , . . . , t m ). Let s i := H(β)(t i ) for every i. Moreover, let a i := B(γ)(t i ) for every i. By induction, we have ν(s i ) = λ(a i ) for every i. By virtue of Lemma 3.14.10, we thus get ν f (s 1 , . . . , s m ) L3.14.10

= ν f (α ν(s1) , . . . , α ν(sm) ) IH = ν f (α λ(a1) , . . . , α λ(am) ) . By definition of f B , we obtain ν f (α λ(a1) , . . . , α λ(am) ) = λ f B (a 1 , . . . , a m ) . Put together, this yields ν f (s 1 , . . . , s m ) = λ f B (a 1 , . . . , a m ) .
For the special case of ground terms, we can reformulate Lemma 3. [START_REF]IBI +[END_REF] Chapter 4

The Semantic Side: Weak Dependences and Model Checking Games

In the present chapter we aim to develop a better understanding of the semantic properties of GBSR and GAF sentences. The semantic counterpart of separateness is weak dependence. We have already pointed out in Chapter 2, pages 19 to 20, that existentially quantified variables can in general depend on universally quantified variables. Applying standard Skolemization to the existentially quantified y in the first-order sentence ϕ := ∀xz∃y. P (x) ↔ Q(x) ↔ R(y, z) , for example, leads to the replacement of every occurrence of y with the Skolem term f (x, z). The result is the sentence ϕ Sk := ∀xz. P (x) ↔ Q(x) ↔ R f (x, z), z in which the Skolem function f is implicitly existentially quantified. In some sense, a model B of ϕ Sk must be a bit more specific than any model A of ϕ in that B needs to explicitly provide a mapping f B : B × B → B that returns some suitable domain element f B (a, b), given any two elements a and b that have been assigned to x and z, respectively. We do not expect such an explicit semantic object from A. The semantics definition merely says that every variable assignment β := [x →a, z →b] can be extended to some variable assignment γ := β[y →c] such that A, γ satisfy the matrix of ϕ, in symbols A, γ |= P (x) ↔ Q(x) ↔ R y, z . This means that we only implicitly ask for the existence of some strategy σ for finding suitable extensions γ = β[y →c] for all β = [x →a, z →b].

The main difference is that A is not expected to give us a concrete semantic object that embodies the strategy, while B needs to explicitly provide such an object, namely f B . Viewing this picture of ϕ through the lens of separateness, we observe that the variables x and y do not co-occur in any atom in ϕ and neither do x and z. Moreover, we noted on page 19 that there is the equivalent sentence

ϕ := ∃x 1 . P (x 1 ) ∧ Q(x 1 ) → ∀z 1 ∃y 1 . R(y 1 , z 1 ) ∧ ∃x 2 . P (x 2 ) ∧ ¬Q(x 2 ) → ∀z 2 ∃y 2 . ¬R(y 2 , z 2 ) ∧ ∃x 3 . ¬P (x 3 ) ∧ Q(x 3 ) → ∀z 3 ∃y 3 . ¬R(y 3 , z 3 ) ∧ ∃x 4 . ¬P (x 4 ) ∧ ¬Q(x 4 ) → ∀z 4 ∃y 4 . R(y 4 , z 4 )
in which each existential quantifier occurs in the scope of at most one universal quantifier. This raises the question of whether y in the original ϕ really depends on two universally quantified variables and, if so, how strong this dependence is. The short answer is: yes, y in ϕ depends on x and z. However, while the dependence of y on z could be considered of the "usual" kind, the dependence of y on x is of a weaker form. To verbalize this distinction, we shall call the former kind of dependence strong and the latter kind weak, as already proposed in Chapter 2. Definition 4.0.1 (Weak dependence). Recall that we tacitly assume that distinct quantifiers in formulas bind distinct variables and that no variable has free and bound occurrences.

Consider any satisfiable relational first-order sentence ψ in negation normal form that contains some subformula χ := ∃y. χ (ū, v, x, y) such that the variables from ū and x are universally quantified in ψ, and the variables from v are existentially quantified in ψ. Let ψ Sk be the result of replacing every occurrence of y in ψ with the Skolem term f (ū, x) for some fresh Skolem function f . Then, y depends weakly on the variables in x, if every model A |= ψ Sk can be turned into a model B |= ψ Sk by replacing f A with some mapping f B that satisfies the following property. There exists a finite family of mappings g i : A |ū| → A i∈I and some mapping h :

A |x| → I such that we have f B (ā, b) := g h( b) (ā) for all ā ∈ A |ū| and b ∈ A |x| .
Let us go back to the exemplary sentence ϕ = ∀xz∃y. P (x) ↔ Q(x) ↔ R(y, z) and the insight the every model of A is equipped with some strategy σ : A × A → A that, given any two values a and b for x and z, respectively, provides a suitable value for y such that

A |= P (a) ↔ Q(a) ↔ R σ(a, b), b .
The syntactic structure of the quantifier-free part of ϕ is such that we can group all the domain elements a that can be assigned to x into four categories: Category I satisfies P (a) ∧ Q(a), Category II satisfies P (a) ∧ ¬Q(a), Category III satisfies ¬P (a) ∧ Q(a), and Category IV satisfies ¬P (a) ∧ ¬Q(a). In order to make the sentence true under A, the strategy σ does not have to distinguish different elements a, a that belong to the same category. Let S := {P (x), Q(x)}, {P (x), ¬Q(x)}, {¬P (x), Q(x)}, {¬P (x), ¬Q(x)} be a collection of sets representing the Categories I to IV. We shall call such sets fingerprints. From the perspective of σ, any input individual a in σ's first argument is sufficiently characterized by its fingerprint. Therefore, we can find a finite family of component strategies τ S S∈S , containing one strategy τ S : A → A for each of the Categories I to IV, such that the combined strategy τ :

A × A → A -given by τ (a, b) := τ S (b) whenever a's fingerprint is S -also yields A |= P (a) ↔ Q(a) ↔ R τ (a, b), b .
This point of view highlights the fact that a good choice for y's value does not depend on the individual a assigned to x but rather on a's fingerprint S a . Hence, the strategy witnesses the fact that y depends only weakly on x.

Although Definition 4.0.1 suggests a more general notion of weak dependence, we shall focus on the kind of weak dependence that can be phrased in terms of fingerprints. An important property of the different sorts of fingerprints we consider in the present chapter is that there are only finitely many fingerprints available at a time. Our concept of fingerprints shall always be based on the syntax of the formula at hand and the number of fingerprints is always bounded by some function in the length of the formula or a similar quantity. If we speak of weak dependences in a given formula ϕ, then it is understood that they are weak with respect to all models of ϕ. We will encounter strong dependences, however, that behave similar to weak dependences in certain models. In particular, classes of sentences with strong dependences may still enjoy the finite model property, i.e. any satisfiable sentence in the class possesses a finite model. This is, for instance, the case for GAF. We shall occasionally refer to the dependences in such classes as finitely controllable1 .

Let us, once more, go back to the above example. As the case distinction τ (a, b) := τ S (b), where S denotes a's fingerprint, ranges over a finite number of fingerprints S ∈ S that is bounded irrespectively of A, we can also express the idea entirely at the syntactic level using second-order quantifiers: ∃g 1 . . . g 4 . ∀xz.

4 i=1 P (x) ↔ Q(x) ↔ R(g i (z), z)
. This sentence can be read as the result of applying to ϕ a non-standard form of Skolemization that is sensitive to the difference between weak and strong dependences. To this end, we introduce more than one Skolem term for the single quantifier ∃y, each of which has only the variable z as argument. In the field of proof complexity it is known that using different forms of Skolemization can have dramatic effects on the length of shortest refutation proofs [START_REF] Baaz | On Skolemization and Proof Complexity[END_REF][START_REF] Egly | On the Value of Antiprenexing[END_REF]. Hence, the proposed form of Skolemization might be an interesting object of study in that context. In Section 7.2, we will briefly look into the topic.

In the rest of the chapter, we shall concentrate on the description of syntactic criteria that entail weakness of dependences in the context of SF, GBSR, and GAF. Indeed we will observe that in GBSR sentences all occurring dependences between existentially and universally quantified variables are weak. In GAF sentences, on the other hand, also strong dependences might occur, namely between existentially quantified variables and their respective reference variable.

The main tools for studying dependences in SF, GBSR, and GAF sentences will be developed in the framework of model-checking games in the spirit of Hintikka [START_REF] Hintikka | Logic, Language-Games and Information: Kantian Themes in the Philosophy of Logic[END_REF] and Henkin [START_REF] Henkin | Some remarks on infinitely long formulas[END_REF]. Roughly speaking, Hintikka ([Hin73], Section III.8) defines such games as follows. We a priori fix a prenex sentence, e.g. ϕ from above, and some structure A and play against some opponent, "some recalcitrant malin génie making the most of his chances of frustrating us." [START_REF] Hintikka | Logic, Language-Games and Information: Kantian Themes in the Philosophy of Logic[END_REF], page 63) Our goal in a play is to create an assignment for the variables in ϕ that makes the quantifier-free part of ϕ true under A. The values for the variables are successively chosen from left to right in the order the respective quantifiers appear in ϕ's quantifier prefix. Our opponent picks the values for the universally quantified variables, we have control over the existentially quantified ones. It is easy to see that we have a winning strategy (also: satisfying strategy) for this game if and only if ϕ is satisfied under A in the standard semantics. In the presence of weak dependences, there are winning strategies that consider the fingerprints of the elements chosen by our opponent rather than the particular individuals. Individuals have to be considered only where strong dependences occur. We shall call such special kinds of winning strategies (semi-)uniform, cf. Definitions 4.2.6 and 4.3.3. They respond uniformly to moves by our opponent that result in identical fingerprints.

The Simple Case of SF

As a starter, we investigate the dependence patterns that emerge in SF sentences. We will do this on a rather informal level to get acquainted with the basic ideas. The formal treatment for GBSR in the subsequent section will of course subsume the case of SF.

As it turns out, all dependences of existential on universal variables in any satisfiable SF sentence ϕ are weak. By Definition 4.0.1, it follows that the sentence ϕ Sk , which is the result of exhaustively Skolemizing all existentially quantified variables in ϕ, has a model A that interprets all Skolem functions f in ϕ Sk with some function f A whose image f A (ā) ā ∈ A arity(f ) is finite. This has an interesting consequence: any model A |= ϕ contains some finite substructure B that is also a model of ϕ. This certainly already follows from our earlier observation that there is some BSR sentence equivalent to ϕ. But this time, the argument emphasizes a semantic point of view and the original sentence need not be transformed syntactically.

Next, we outline the reasoning that leads to the above observation. Consider any satisfiable SF sentence ϕ = ∀x 1 ∃y 1 . . . ∀x n ∃y n . ψ where ψ is quantifier free and let A be any model of ϕ. Then, the two sets {x 1 , . . . , x n } and {y 1 , . . . , y n } are separated in ϕ. In order to show that there is a finite substructure of A that still satisfies ϕ, we consider the model-checking game associated with the pair ϕ, A. Recall that we play against some opponent: we take turns while constructing a variable assignment for the variables in ϕ's quantifier prefix. In the i-th round, our opponent picks the same value for x i from A and right afterwards we are to choose a value for y i from A. The play ends, as soon as all variables are assigned a value. If the resulting variable assignment is satisfying for the matrix ψ under A, we win. Otherwise, our opponent wins. Evidently, since ϕ is satisfied by A, there must exist a strategy that guarantees our victory, if we adhere to it.

The proof of the existence of the satisfying finite substructure B of A rests on two aspects:

(1) There exists a mapping µ that labels tuples of domain elements of A with suitable fingerprints taken from a finite supply.

(2) There exists a winning strategy σ for us that is uniform in the following sense. Consider the i-th move, in which our opponent has already assigned values to x 1 , . . . , x i . Based on these values, the strategy σ now proposes a value for y i . σ is uniform if for all sequences a 1 , . . . , a i and b 1 , . . . , b i of domain elements that could have been assigned to x 1 , . . . , x i , we have σ(a 1 , . . . ,

a i ) = σ(b 1 , . . . , b i ), whenever µ(a 1 , . . . , a i-1 , a i ) = µ(b 1 , . . . , b i-1 , b i ) , µ(a 1 , . . . , a i-1 ) = µ(b 1 , . . . , b i-1 ) , . . . µ(a 1 , a 2 ) = µ(b 1 , b 2 ) , and
µ(a 1 ) = µ(b 1 ) .
In other words, the strategy σ is uniform if it proposes the same response for all inputs whose prefixes are labeled identically by µ. As µ can assign only finitely many labels to sequences of domain elements, this means that a uniform winning strategy σ gets along with only finitely many different moves, even if the universal player has infinitely many moving options.

From this point on the argument for the existence of a finite substructure of A that is still satisfying for ϕ roughly proceeds as follows. If we Skolemize ϕ exhaustively, and thus replace every occurrence of an existentially quantified variable by an appropriate Skolem term, the strategy σ induces an interpretation for the introduced Skolem functions. As σ is uniform, the image of each of these functions is finite. The Skolem functions then generate only a finite subset of A's domain, and thus, by the Substructure Lemma, induce a finite substructure of A that is still satisfying for ϕ.

It remains to discuss the mapping µ and the available fingerprints. Let At x be the set of atoms in ϕ which contain at least one variable from the list x 1 , . . . , x n . Then, At x comprises exactly the atoms in ϕ that are affected by the values assigned to x 1 , . . . , x n . We define µ recursively as follows:

Base case: for every sequence a 1 , . . . , a n of domain elements we set µ(a 1 , . . . , a n ) := A(x 1 , . . . , x n ) ∈ At x A |= A(a 1 , . . . , a n ) .

Inductive case: for any sequence a 1 , . . . , a i of domain elements we set µ(a 1 , . . . , a i ) := S S = µ(a 1 , . . . , a i , b) for some domain element b .

Hence, µ ranges over iterated power sets of the set At x ; the nesting becomes deeper the fewer arguments µ gets as input, i.e. µ(a 1 , . . . , a i ) ∈ P n-i+1 At x .

From the perspective of the argument sketched above, the i-th move a uniform strategy σ proposes based on µ is determined by the set of atoms that are factually or potentially satisfied by the domain elements our opponent has chosen for x 1 , ..., x i and is potentially going to choose for x i+1 , . . . , x n . It is one peculiarity of SF that this set of atoms is not affected by the choices made for y 1 , . . . , y n . This leads to the existence of uniform winning strategies whenever the SF formula at hand is satisfiable.

Example 4.1.1. Consider the SF sentence

ϕ := ∀x 1 ∃y 1 ∀x 2 ∃y 2 . P 1 (x 1 , x 2 ) ↔ Q 1 (y 1 , y 2 ) ∧ P 2 (x 1 , x 2 ) ↔ Q 2 (y 1 , y 2 ) .
Let A be the structure with domain A := {1, 2, 3, 4} that interprets P 1 , P 2 , Q 1 , Q 2 by symmetric relations depicted below, which we, in addition, assume to be reflexive without depicting it.

P A 1 : 1 2 3 4 P A 2 : 1 2 3 4 Q A 1 : 1 2 3 4 Q A 2 : 1 2 3 4
Based on A, we get the following fingerprint function µ. The pairs 1, 2 and 2, 3 are assigned the fingerprint P 1 (x 1 , x 2 ), P 2 (x 1 , x 2 ) by µ. The same fingerprint is assigned to their symmetric counterparts 2, 1 , 3.2, and to the reflexive pairs 1, 1 , 2, 2 , 3, 3 , and 4, 4 . The pairs 1, 3 , 2, 4 , 3, 4 and their symmetric counterparts are assigned the fingerprint P 2 (x 1 , x 2 ) by µ. Finally, the pairs 1, 4 and 4, 1 have the fingerprint ∅. Concerning the single elements, we get the fingerprints µ(1) = µ(4) = P 1 (x 1 , x 2 ), P 2 (x 1 , x 2 ) , P 2 (x 1 , x 2 ) , ∅ , and

µ(2) = µ(3) = P 1 (x 1 , x 2 ), P 2 (x 1 , x 2 ) , P 2 (x 1 , x 2 )
.

Having all this, a satisfying strategy that is uniform with respect to µ is given, for instance, by setting σ(a) := 4 and

σ(a, b) :=          4 if µ(a, b) = P 1 (x 1 , x 2 ), P 2 (x 1 , x 2 ) , 3 if µ(a, b) = P 1 (x 1 , x 2 ) , 1 if µ(a, b) = P 2 (x 1 , x 2 ) , and
2 if µ(a, b) = ∅
for all a, b ∈ A. Then, we get

A |= P 1 a, b ↔ Q 1 σ(a), σ(a, b) ∧ P 2 a, b ↔ Q 2 σ(a), σ(a, b)
for any choice of a, b ∈ A, which entails that σ is indeed a winning strategy.

Remark 4.1.2. In his thesis [START_REF] Herbrand | Recherches sur la théorie de la démonstration[END_REF], Section 9 of Chapter 2, Herbrand gave a proof of the decidability of MFO using an approach which differs from the ones published by then by Löwenheim [START_REF] Löwenheim | Über Möglichkeiten im Relativkalkül[END_REF], Skolem [START_REF] Skolem | Untersuchungen über die Axiome des Klassenkalküls und über Produktations-und Summationsprobleme welche gewisse Klassen von Aussagen betreffen[END_REF], Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF], and Hilbert and Ackermann [START_REF] Hilbert | Grundzüge der theoretischen Logik[END_REF] (page 77). Herbrand's proof uses an equivalence-preserving transformation of MFO sentences into a normal form in which no quantifier occurs in the scope of another quantifier. This part is similar to the approaches we took in Chapter 3 to devise translations from our novel extended fragments into the respective original fragment.

Starting from this normal form and the following arguments, Quine [START_REF] Van Orman Quine | On the Limits of Decision[END_REF] extrapolated his proof of the decidability of the class of homogeneous k-adic sentences, i.e. the class of FL sentences in which all occurring predicate symbols have arity k. In retrospect, it seems fair to say that Quine was on a track that eventually could have lead to the discovery of SF and to a proof of its decidability. Quine's arguments for the decidability of homogeneous k-adic sentences are very closely linked to the concept of fingerprints. For example, given a homogeneous dyadic sentence ϕ ϕ containing the atoms P (x, y), Q(x, y), R(x, y), Quine defines super-constituents to be sentences of the form ∃x.

i [¬]∃y. [¬]P (x, y) ∧ [¬]Q(x, y) ∧ [¬]R(x, y)
, where [¬] means that the negation sign may be present or not and where every conjunct differs from every other conjunct in the presence or absence of at least one negation sign within the scope of ∃y. It is easy to see that such a sentence corresponds to a fingerprint. For instance, the super-constituent ∃x. ¬∃y. P (x, y)∧ Q(x, y)∧ R(x, y) ∧ ∃y. P (x, y)∧ Q(x, y)∧¬R(x, y) ∧ ∃y. P (x, y)∧¬Q(x, y)∧ R(x, y) ∧ ¬∃y. P (x, y)∧¬Q(x, y)∧¬R(x, y) ∧ ¬∃y. ¬P (x, y)∧ Q(x, y)∧ R(x, y) ∧ ∃y. ¬P (x, y)∧ Q(x, y)∧¬R(x, y) ∧ ¬∃y. ¬P (x, y)∧¬Q(x, y)∧ R(x, y) ∧ ¬∃y. ¬P (x, y)∧¬Q(x, y)∧¬R(x, y) corresponds to the fingerprint {P (x, y), Q(x, y)}, {P (x, y), R(x, y)}, {Q(x, y)} . One can now argue that every sentence j [¬]C i , where C i ranges over all super-constituents with respect to ϕ's vocabulary, induces a finite structure and that it is sufficient to consider only such structures in order to find a model for ϕ.

We shall use fingerprints in a different way, though, when constructing finite models from uniform winning strategies. Nevertheless, in the light of the above said, it might have been pure coincidence that Quine has extrapolated Herbrand's ideas in the direction of the fluted fragment rather than the direction of the separated fragment. In Section 7.1 we will establish a formal link between fingerprints and sentences that are similar to the generalization of super-constituents for k-adic sentences.2

GBSR Sentences and the Existence of Uniform Winning Strategies

It is obvious that all dependences in any satisfiable BSR sentences ϕ := ∃ȳ∀x. ψ are trivially weak: existential quantifiers never occur within the scope of universal quantifiers. Hence, each y ∈ ȳ is independent of any x ∈ x, and for any model A we need at most a supply of |ȳ| domain elements from which suitable values for the y ∈ ȳ can be picked. Concerning expressiveness, BSR sentences are in the following sense prototypical for the class of sentences with only weak dependences.

Theorem 4.2.1. Consider any satisfiable relational sentence ϕ in which all dependences of existentially quantified variables on universally quantified variables are weak. Let ϕ Sk be the sentence that results from ϕ by exhaustive Skolemization of all existentially quantified variables.

Suppose Ω is the set containing exactly all the Skolem functions introduced in ϕ Sk . Then, we observe the following.

(i) There is some positive integer m such that for every model A |= ϕ Sk there is some model B |= ϕ Sk that differs from A only in the interpretation of the Skolem functions in Ω and for which the set f ∈Ω f B (ā) ā ∈ B arity(f ) contains at most m domain elements.

(ii) There is some BSR sentence ϕ that is equivalent to ϕ.

Proof sketch.

Ad (i). Suppose that there is no such integer m. For every positive n let z 1 , . . . , z n be fresh variables that do not occur in ϕ and let ϕ n be the sentence that results from ϕ by iteratively replacing every subformula ∃y. ψ with 1≤i≤n ψ[y/z i ]. Due to our assumptions -ϕ is satisfiable and m does not exist -, for every positive integer n the sentence ϕ Sk ∧¬∃z 1 . . . z n . ϕ n is satisfiable. But then, by compactness of first-order logic, the set of sentences {ϕ Sk } ∪ {¬∃z 1 . . . z n . ϕ n | n ≥ 1} is satisfied by some model A. Moreover, there is no model B |= ϕ Sk that differs from A only in the interpretation of the Skolem functions f ∈ Ω and for which the set ) is finite. This contradicts our assumption that all dependences in ϕ are weak, as the latter entails that every model A |= ϕ Sk can be turned into some model B |= ϕ Sk by replacing every f A with some mapping f B with a finite image. ♦ Ad (ii). Let m be the integer whose existence is stipulated in (i). Then, under any of ϕ's models each existential quantifier ∃y in ϕ needs to range over at most m domain elements. Hence, we can replace any subformula χ of the form ∃y. ψ(y, v) in ϕ with a finite disjunction m i=1 ψ(z i , v), where the z i are fresh variables, and add the quantifier block ∃z 1 . . . z m to the front. The resulting sentence ∃z 1 . . . z m . ϕ χ m i=1 ψ(z i , v) is equivalent to ϕ. Applying this transformation exhaustively eventually leads to an equivalent BSR sentence.

f ∈Ω f B (ā) ā ∈ B arity(f
As we already know from Theorem 3.2.7, the sentence ϕ Theorem 4.2.1 may be non-elementarily more succinct than any equivalent BSR sentence, as the numbers m in part (i) of the theorem may be very large.

In contrast to BSR sentences, GBSR sentences may contain non-trivial weak dependences. We aim to show in the present section that GBSR sentences may, on the other hand, not contain any strong dependences. We have already obtained indirect evidence that all dependences in a GBSR sentence are weak in Section 3.5, when we devised the equivalence-preserving translation from GBSR into BSR. However, this does not reveal much about the underlying semantic reasons. A direct approach in the framework of model-checking games sheds more light on the involved semantic properties and concepts, i.e. uniform satisfying strategies based on fingerprints.

The following are key concepts: fingerprints are, again, sets of sets of . . . sets of atoms that characterize certain classes of indistinguishable tuples of domain elements by finite means; fingerprint functions µ ,k assign fingerprints to such tuples; µ-uniform strategies select domain elements for existentially quantified variables exclusively depending on the fingerprints of the values assigned to preceding universally quantified variables. We base our considerations on some fixed GBSR sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ ϕ in standard form. Let the sets At, x, and ȳ be defined like in Definition 3.4.1. Then, At can be partitioned into (possibly empty) sets At 0 , . . . , At n such that Conditions (i) and (ii) of Definition 3.4.1 are met. Let A A be any structure over the vocabulary of ϕ and consider the model-checking game associated with ϕ over A. We next define the notion of strategy in the context of GBSR. Definition 4.2.2 (Strategy, satisfying strategy, outcome). A strategy σ comprises a tuple of n mappings σ 1 , . . . , σ n with signatures σ i : Satisfying strategies can be considered winning strategies against our opponent in the modelchecking game associated with ϕ over A. If we adhere to a satisfying strategy σ during a play, then every possible outcome in Out σ represents a satisfying assignment of truth values to the atoms in ψ -an atom A is true if and only if is belongs to the outcome. Hence, the structure A satisfies ϕ if and only if there is a satisfying strategy for ϕ.

A |x1| × . . . × A |xi| → A |ȳi| . A strategy σ is satisfying for ϕ (under A) if A, [x 1 →ā 1 , . . . ,
Every strategy σ induces a structure A| σ A| σ that is given by the substructure of A with the domain A| σ := a ∈ A σ k ( b1 , . . . , bk ) = . . . , a, . . . for some b1 , . . . , bk .

As we assume ϕ to be relational, such a substructure A| σ exists. If ϕ is satisfied by A, and if all dependences in ϕ are weak, then there must be a special form of satisfying strategies whose image only covers a finite portion of A's domain. Such a strategy σ induces a finite substructure A| σ of A that also satisfies ϕ. In order to find σ, we need to identify the key features of domain elements that make them distinguishable by the formula ϕ. We express these features by suitable fingerprints. Definition 4.2.4 (Fingerprint functions µ ,k ). We define the family of fingerprint functions µ ,k µ ,k with 0 ≤ < k ≤ n as follows:

µ ,n : A |ȳ1| ×. . .×A |ȳ | ×A |x +1 | ×. . .
, +2 (ā 1 , . . . , ā , b +1 , b +2 ) = S.
We denote the image of a fingerprint function µ ,k under a strategy σ = σ 1 , . . . , σ n by

im σ (µ ,k ) im σ (µ ,k ) := µ ,k σ 1 ( b1 ), . . . , σ ( b1 , . . . , b ), b +1 , . . . , bk b1 ∈ A |x1| , . . . , bk ∈ A |x k | .
Example 4.2.5. Consider the sentence ϕ := ∀x 1 x 2 ∃y 1 ∀u∃y 2 ∀v. R(x 1 , u) ∨ P (x 2 , v) ∧ T (y 1 , y 2 ) . We partition the set At = {R(x 1 , u), P (x 2 , v), T (y 1 , y 2 )} as follows:

At 0 := {R(x 1 , u), P (x 2 , v)}, At 1 := ∅, At 2 := {T (y 1 , y 2 )}, At 3 := ∅.
Regarding the images of the fingerprint functions µ k, , we observe the following. Let σ be any strategy, based on any structure. Then, we have

im σ (µ 2,3 ) ⊆ {}, {T (y 1 , y 2 )} , im σ (µ 0,3 ) ⊆ {}, {R(x 1 , u)}, {P (x 2 , v)}, {R(x 1 , u), P (x 2 , v} , im σ (µ 0,2 ) ⊆ {} , {R(x 1 , u)} , {P (x 2 , v)} , {R(x 1 , u), P (x 2 , v)} , {}, {P (x 2 , v)} , {R(x 1 , u)}, {R(x 1 , u), P (x 2 , v)} .
One aspect that restricts the image of µ 0,2 compared to the full set P 2 At 2 is the fact that u and v do not co-occur in any atom. For every fingerprint S ∈ im σ (µ 0,2 ) either R(x 1 , u) occurs in each and every set S ∈ S or in none, since the truth value of R(x 1 , u) does not depend on the value of v. Therefore, fingerprints such as {}, {R(x 1 , u), P (x 2 , v)} or {R(x 1 , u)}, {P (x 2 , v)}, {R(x 1 , u), P (x 2 , v)} cannot be the result of µ 0,2 .

Having a suitable notion of fingerprints at hand, we next define a special kind of strategies that highlight the weak nature of dependences in GBSR sentences and, hence, have a finite image. Definition 4.2.6 (µ-uniformity). A strategy σ = σ 1 , . . . , σ n is µ-uniform if for every k ≤ n the following holds. For all tuples b1 , b

1 ∈ A |x1| , . . . , bk , b k ∈ A |x k | we have σ k ( b1 , . . . , bk ) = σ k ( b 1 , . . . , b k
) whenever for every k ≤ k all of the following conditions are met:

µ 0,k b1 , . . . , bk ) = µ 0,k ( b 1 , . . . , b k , µ 1,k σ 1 ( b1 ), b2 , . . . , bk = µ 1,k σ 1 ( b 1 ), b 2 , . . . , b k , . . . µ k -1,k σ 1 ( b1 ), . . . , σ k -1 ( b1 , . . . , bk -1 ), bk = µ k -1,k σ 1 ( b 1 ), . . . , σ k -1 ( b 1 , . . . , b k -1 ), b k .
Intuitively, µ-uniformity of a strategy σ means that σ responds in the same way to inputs that have identical fingerprints. The next lemma provides the key argument to infer the existence of some satisfying µ-uniform strategy from the existence of any satisfying strategy. Lemma 4.2.7. For every strategy σ = σ 1 , . . . , σ n there is a µ-uniform strategy τ = τ 1 , . . . , τ n such that Out τ ⊆ Out σ .

Proof. We start with two preliminary results.

Claim I: Let , k be two integers such that 0 ≤ < k ≤ n. We construct certain repre-

sentatives α k, S (k) 0 ,...,S (k) k-1 ∈ A k inductively as follows. The S (k) i stand for sequences S (k) i,i+1 . . . S (k) i,k of fingerprints satisfying S (k) i,k ∈ S (k) i,k-1 ∈ . . . ∈ S (k) i,i+1 . Let k = 1. A i, ... We partition A 1 into sets A 1, S (1) 0 with S (1) 0 ∈ im σ (µ 0,1 ) by setting A 1, S (1) 0 := b1 ∈ A |x1| | µ 0,1 ( b1 ) = S (1) 0 . We pick one representative α 1, S (1) 0 ∈ A 1, S (1) 0 from every part. Let k > 1. We construct subsets A k, S (k) 0 ,...,S (k) k-1 ⊆ A k with S (k) 0,j ∈ im σ (µ 0,j ), . . . , S (k) k-1,j ∈ im σ (µ k-1,j ) for every j ≤ k by setting A k, S (k) 0 ,...,S (k) k-1 := c1 , . . . , ck-1 , bk bk ∈ A |x k | and there is some α k-1, S (k-1) 0 ,...,S (k-1) k-2 = c1 , . . . , ck-1 with ci ∈ A |xi| for every i such that µ 0,k c1 , . . . , ck-1 , bk = S 0 , µ 1,k σ 1 (c 1 ), c2 , . . . , ck-1 , bk = S 1 , . . . µ k-2,k σ 1 (c 1 ), . . . , σ k-2 (c 1 , . . . , ck-2 ), ck-1 , bk = S k-2 , µ k-1,k σ 1 (c 1 ), . . . , σ k-1 (c 1 , . . . , ck-1 ), bk = S k-1 , S (k) 0 = S (k-1) 0 S 0 , . . . S (k) k-2 = S (k-1) k-2 S k-2 , and S (k) k-1 = S k-1 .
We pick one representative α k, S (k) 0 ,...,S

1,j = µ 1,j τ 1 ( b1 ), b2 , . . . , bj for every j, 1 < j ≤ k, . . .

S (k) k-2,j = µ k-2,j τ 1 ( b1 ), . . . , τ k-2 ( b1 , . . . , bk-2 ), bk-1 , . . . , bj for every j, k -2 < j ≤ k, S (k)
k-1,k = µ k-1,k τ 1 ( b1 ), . . . , τ k-1 ( b1 , . . . , bk-1 ), bk ,

if such an α k, S (k) 0 ,...,S (k) k-1
exists -we shall show in Claim IV that this is always the case.

Claim III: For all , k, 0 ≤ < k ≤ n, we have im τ µ ,k ⊆ im σ µ ,k .

Proof: Fix some µ ,k and let S ∈ im τ (µ ,k ). Hence, there are tuples b1 , . . . , bk such that τ 1 ( b1 ), . . . , τ k ( b1 , . . . , bk ) are defined and we have S = µ ,k τ 1 ( b1 ), . . . , τ ( b1 , . . . , b ), b +1 , . . . , bk . By definition of τ , there are representatives α j, S (j) 0 ,...,S

(j) j-1 = c(j) 1 , . . . , c (j) j
, 1 ≤ j ≤ , for which we observe the following properties.

(a) For every i, 0 ≤ i < , all the S (j) i are prefixes of S ( )

i . This means, if we write S ( ) i for the sequence S i,i+1 , . . . , S i, , we have

S i,i+1 . . . S i, = S (1) i S i,i+2 . . . S i, = S (2) i S i,i+3 . . . S i, = . . . = S ( -1) i S i, = S ( ) i .
(b) For every j, 1 ≤ j ≤ , we have τ j ( b1 , . . . , bj ) = σ j (c

(j) 1 , . . . , c(j) j ).
Because of (a) and due to the construction of the α j, S (j) 0 ,...,S Claim IV: For every k, 1 ≤ k ≤ n, and all tuples b1 , . . . , bk there is a representative α k, S0,...,S k-1 such that S 0,j = µ 0,j b1 , . . . , bj for every j, 0 < j ≤ k, S 1,j = µ 1,j τ 1 ( b1 ), b2 , . . . , bj for every j, 1 < j ≤ k, . . . S k-2,j = µ k-2,j τ 1 ( b1 ), . . . , τ k-2 ( b1 , . . . , bk-2 ), bk-1 , . . . , bj for every j, k -2 < j ≤ k, S k-1,k = µ k-1,k τ 1 ( b1 ), . . . , τ k-1 ( b1 , . . . , bk-1 ), bk .

(j) j-1 = c(j) 1 , . . . , c (j)
Proof: We proceed by induction on k.

Let k = 1. Consider any tuple b1 ∈ A |x1| and set S 0 := µ 0,1 b1 . Hence, S 0 ∈ im σ (µ 0,1 ) and we thus have defined the partition A 1, S0 . Since b1 ∈ A 1, S0 , the set is nonempty and there is a representative α 1, S0 ∈ A 1, S0 .

Let k > 1. Consider any sequence of tuples b1 ∈ A |x1| , . . . , bk ∈ A |x k | and defing S i , j as in the claim. By Claim III, we have S i,j ∈ im τ (µ i,j ) ⊆ im σ (µ i,j ) for all i, j with 0 ≤ i < j ≤ k and, therefore, we have constructed the subset A k, S0,...,S k-1 ⊆ A k when we have been defining representatives. It remains to show that this set is not empty.

For every , 0 ≤ < k -1, we set S (k-1) := S , +1 . . . S ,k-1 . By induction, there is a

representative α k-1, S (k-1) 0 ,...,S (k-1) k-2 =: c1 , . . . , ck-1 .
As one consequence, the definition of τ entails

τ 1 ( b1 ) = σ 1 (c 1 ) = τ 1 (c 1 ) , . . . τ k-1 ( b1 , . . . , bk-1 ) = σ k-1 (c 1 , . . . , ck-1 ) = τ k-1 (c 1 , . . . , ck-1 ) ,
which entails ( * ) µ k-1,k τ 1 (c 1 ), . . . , τ k-1 (c 1 , . . . , ck-1 ), bk = µ k-1,k τ 1 ( b1 ), . . . , τ k-1 ( b1 , . . . , bk-1 ), bk = S k-1,k . By definition of the µ ,k-1 and since we have

S 0,k ∈ S 0,k-1 , . . . , S k-2,k ∈ S k-2,k-1 , the properties of α k-1, S (k-1) 0 ,...,S (k-1) k-2 = c1 , . . . , ck-1 entail the existence of tuples d(0) k , . . . , d(k-2) k ∈ A |x k | such that µ 0,k c1 , . . . , ck-1 , d (0)
k = S 0,k , µ 1,k τ 1 (c 1 ), c2 , . . . , ck-1 , d (1)
k = S 1,k , . . . µ k-2,k τ 1 (c 1 ), . . . , τ k-2 (c 1 , . . . , ck-2 ), ck-1 , d(k-2) k = S k-2,k , and
µ k-1,k τ 1 (c 1 ), . . . , τ k-2 (c 1 , . . . , ck-2 ), τ k-1 (c 1 , . . . , ck-1 ), bk = S k-1,k (
d k,i :=      d (j) k,i if x k,i ∈ vars(S j,k ) ∩ x with j < k -1, b k,i if x k,i ∈ vars(S k-1,k ) ∩ x,
b k,i otherwise (we could use any value here).

Due to the pairwise disjointness of the sets vars(S 0,k ) ∩ x, . . . , vars(S k-1,k ) ∩ x, Claim II implies that for every , 0

≤ < k -1, µ ,k τ 1 (c 1 ), . . . , τ (c 1 , . . . , c ), c +1 , . . . , ck-1 , d k = µ ,k τ 1 (c 1 ), . . . , τ (c 1 , . . . , c ), c +1 , . . . , ck-1 , d( ) k = S ,k and µ k-1,k τ 1 (c 1 ), . . . , τ k-1 (c 1 , . . . , ck-1 ), d k = µ k-1,k τ 1 (c 1 ), .
. . , τ k-1 (c 1 , . . . , ck-1 ), bk = S k-1,k . Consequently, the set A k, S0,...,S k-1 contains at least the tuple c1 , . . . , ck-1 , d k . Therefore, there exists some representative α k, S0,...,S k-1 ∈ A k, S0,...,S k-1 . ♦ Claim V: τ is µ-uniform.

Proof: By construction of τ . ♦

Now let S ∈ Out τ . Then, there exist tuples b1 , . . . , bn such that S = out τ ( b1 , . . . , bn ). We partition S into sets S 0 := S ∩ At 0 , . . . , S n := S ∩ At n and thus obtain the fingerprints S = µ ,n τ 1 ( b1 ), . . . , τ ( b1 , . . . , b ), b +1 , . . . , bn ⊆ At for every , 0 ≤ < n. Claim IV guarantees the existence of some representative α n, S 0 ,...,S n-1 = c1 , . . . , cn such that S = µ ,n σ 1 (c 1 ), . . . , σ (c 1 , . . . , c ), c +1 , . . . , cn for every , 0 ≤ < n.

Consider any A(ȳ 1 , . . . , ȳ , x +1 , . . . , xn ) ∈ At, and fix the for which A ∈ At . We distinguish two cases. Suppose that < n. The definition of α n, S 0 ,...,S n-1 and the fingerprint functions µ ,n entail that A ∈ S if and only if

A |= A τ 1 ( b1 ), . . . , τ ( b1 , . . . , b ), b +1 , . . .

, bn if and only if

A |= A σ 1 (c 1 ), . . . , σ (c 1 , . . . , c ), c +1 , . . . , cn . In case of = n, we have A(ȳ 1 , . . . , ȳn ) ∈ S n if and only if

A |= A τ 1 ( b1 ), . . . , τ n ( b1 , . .

. , bn ) if and only if

A |= A σ 1 (c 1 ), . . . , σ n (c 1 , . . . , cn ) . In both cases, we get A ∈ out τ ( b1 , . . . , bn ) if and only if A ∈ out σ (c 1 , . . . , cn ). Consequently, we have S = out τ ( b1 , . . . , bn ) = out σ (c 1 , . . . , cn ) ∈ Out σ . Altogether, it follows that Out τ ⊆ Out σ .

Corollary 4.2.8. If there is a satisfying strategy σ for ϕ, then there is also a µ-uniform strategy τ that is satisfying for ϕ (under A).

Proof. Let σ be a satisfying strategy for ϕ. By Lemma 4.2.7, there is a µ-uniform strategy τ such that for every S ∈ Out τ we have S ∈ Out σ . Since σ is satisfying for ϕ, every S ∈ Out σ can be conceived as an assignment of truth values to the atoms in ϕ's quantifier-free part ψ such that ψ is satisfied. If this applies to every S ∈ Out σ , then it certainly applies to any S ∈ Out τ ⊆ Out σ . Therefore, τ is also satisfying for ϕ.

The guaranteed existence of µ-uniform satisfying strategies for all models of GBSR sentences confirms that all dependences in GBSR sentences are weak. On the other hand, it entails that GBSR enjoys the finite model property. In order to formulate the induced bound regarding the cardinality of small models accurately, we introduce another notion of degree for GBSR sentences that is suitable for this purpose. This time the degree is based on co-occurrences of universally quantified variables in atoms. This notion complements the notion introduced in Section 3.5 (Definition 3.5.1). Definition 4.2.9 (Degree of interaction of universal variables). We denote by

∂ ∀ (ϕ) ∂ ∀ (ϕ)
the degree of interaction of universal variables in ϕ, defined to be the smallest nonnegative integer meeting the following condition. For every At i , 0 ≤ i < n, there are at most

∂ ∀ (ϕ) pairwise distinct indices i + 1 < j 1 < . . . < j ∂ ∀ (ϕ) ≤ n such that xj ∩ vars(At i ) = ∅.

GBSR SENTENCES AND UNIFORM WINNING STRATEGIES

123 Notice that we have 0 ≤ ∂ ∀ (ϕ) < n. Moreover, in this definition the degree ∂ ∀ (ϕ) implicitly depends on the currently chosen partition of At into the sets At 0 , . . . , At n . Consider, for instance, an MFO sentence ϕ MFO . We could partition its atoms into two parts At 0 , At n , where At 0 contains all atoms with a universally quantified variable and At n comprises all other atoms. Clearly, At 0 will cause the highest possible degree for ϕ MFO , since all universal variables occur in At 0 . We get a lower degree, if we partition At as follows. For every i, 0 ≤ i < n, we set At i := P (x) ∈ At x ∈ xi+1 , and the set At n again contains the rest of the atoms. This partition induces the potentially much lower degree ∂ ∀ (ϕ MFO ) = 0. Although this dependence on the current partition of At could be eliminated by minimizing the degree over all possible partitions, compare also Definition 3.5.1, the weaker notion given in Definition 4.2.9 suffices for the moment.

Lemma 4.2.10. If there is a satisfying µ-uniform strategy σ for ϕ, then the substructure

A| σ of A is a model of ϕ. Moreover, A| σ comprises at most n • |ȳ| • 2 ↑∂ ∀ (ϕ)+1 (|At|) n 2 elements.
Proof. We start with two preliminary results. Let T σ be the target set of σ, defined by

T σ := n k=1 T k T σ , T k , where
T k := a ∈ A there are tuples b1 , . . . , bk such that σ k ( b1 , . . . , bk ) = . . . , a, . . . . Notice that T σ coincides with the domain of A| σ . Since σ is µ-uniform, we know that T σ is a finite set. By definition of the fingerprint functions µ ,k , we get the following upper bounds, where we write im σ (µ i,j ) im σ (µ i,j ) to abbreviate im σ (µ i,i+1 ) × im σ (µ i,i+2 ) × . . . × im σ (µ i,j ) for all i, j, 0 ≤ i < j ≤ n.

T 1 ≤ |ȳ 1 | • im σ (µ 0,1 ) ≤ |ȳ 1 | • 2 ↑n (|At 0 |) ≤ |ȳ 1 | • 2 ↑n (|At|), T 2 ≤ |ȳ 2 | • im σ (µ 0,2 ) × im σ (µ 1,2 ) ≤ |ȳ 2 | • 2 ↑n (|At 0 |) • 2 ↑n-1 (|At 0 |) • 2 ↑n-1 (|At 1 |) ≤ |ȳ 2 | • 2 ↑n (|At|) 3 , . . . T n ≤ |ȳ n | • im σ (µ 0,n ) × . . . × im σ (µ n-1,n ) ≤ |ȳ n | • n-1 i=0 n-1 j=i 2 ↑n-j (|At j |) ≤ |ȳ n | • 2 ↑n (|At|) n 2
. When we combine these bounds with the bound formulated in ( * ), it follows that T σ contains at most

n =1 |ȳ | • n-1 i=0 n-1 j=i 2 ↑min(∂ ∀ (ϕ)+1,n-j) (|At j |) ≤ n • |ȳ| • 2 ↑∂ ∀ (ϕ)+1 (|At|) n 2 domain elements.
Now consider the structure A| σ . We have already noted that A| σ = T σ . Hence, the above bound also applies to the number of elements in A| σ 's domain. By Lemma 4.2.3, A| σ is a finite model of ϕ.

Theorem 4.2.11. Every satisfiable GBSR sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifier-free ψ has a model with at most len(ϕ) 2 • 2 ↑∂ ∀ (ϕ)+1 (len(ϕ)) n 2 domain elements. More precisely, every model A |= ϕ contains a substructure that satisfies ϕ and whose domain size is bounded as stated.

It is worth noticing that Theorem 4.2.11 states a small model property for GBSR that is, in contrast to Corollary 3.5.4, not based on the equivalence with BSR but is solely inferred via the analysis of weak dependences and the existence of µ-uniform satisfying strategies for satisfiable sentences. Moreover, when applied to SF sentences, the bounds in Theorem 4.2.11 might be smaller than the bounds given in Theorem 3.2.6, or vice versa, as for any SF sentence ψ the two degrees ∂ ∃ (ψ) and ∂ ∀ (ψ) are largely independent from each other.

Remark 4.2.12. The second part of Theorem 4.2.11 emphasizes the fact that all models of a GBSR sentence ϕ contain a finite substructure that satisfies ϕ as well. This observation is trivial for BSR sentences, and, via the equivalence of GBSR and BSR, the property follows already from syntactic arguments.

What is also easy to verify for any BSR Σ-sentence ψ is the following. Let A 1 , . . . , A n be any chain of Σ-structures where every A i+1 is a proper substructure of A i . If A 1 and A n are models of ψ, then each and every A i in the chain satisfies ψ. In general, there is no guarantee that non-trivial chains of such satisfying (sub)structures can be extended to the right until A n comprises only a single domain element. The Loś-Tarski Theorem [Tar54, Loś55] (see also Theorem 6.5.4 in [START_REF] Hodges | Model theory[END_REF]) stipulates that this is possible if and only if ψ is equivalent to some ∀ * -sentence.

In [START_REF] Sankaran | On Semantic Generalizations of the Bernays-Schönfinkel-Ramsey Class with Finite or Co-finite Spectra[END_REF], Section 3, the above property of BSR sentences is described as "preservation under substructures modulo a bounded 'core'" and the close relation to the Loś-Tarski is pointed out. Moreover, the authors propose a generalization of this property as a semantic characterization of BSR.

By Theorems 3.5.3 and 4.2.1, all of the above said also applies to GBSR and the class of first-order sentences in which all dependences of existentially quantified variables on universally quantified variables are weak.

GAF Sentences and the Existence of Semi-Uniform Winning Strategies

In the present section we investigate the dependences occurring in GAF sentences. Evidently, strong dependences may occur, like the simple Ackermann sentence ∀x∃y. E(x, y) illustrates. Its Skolemized variant ∀x. E(x, f (x)) has a model A with

A := {0, 1, 2, . . .}, E A := { k, k + 1 | k ≥ 0},
and f A (k) = k + 1 for every k, where altering f A to any function with a finite image does not result in a model of the sentence. Nevertheless, we will see that strong dependences in GAF sentences are finitely controllable, i.e. infinite models cannot be enforced. This coincides with our earlier observation that GAF enjoys the finite model property. In contrast to sentences with only weak dependences, not every model of a given GAF sentence admits satisfying strategies with finite images.

Consider any GAF sentence ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ. As usual, we set x := x1 ∪ . . . ∪ xn , ȳ := ȳ1 ∪ . . . ∪ ȳn , and ū := ū1 ∪ . . . ∪ ūn . Recall that, according to Definition 3.7.1, every variable u ∈ ū that occurs in ϕ is associated with exactly one reference variable x ∈ x, determined by the set At x in which u occurs. When we investigate the occurring dependences in the framework of model-checking games, we observe that the only strong dependences in ϕ occur between variables u and their respective reference variable x. All other dependences in ϕ are weak, in particular the ones between any y ∈ ȳ and any variables from x. Satisfying strategies may need infinitely many options for variables from ū to appropriately respond to all possible values of variables from x, just like in the case of the above described model A for ∀x∃y. E(x, y). Example 4.3.1 illustrates this observation in a slightly more involved setting. This means, we cannot always find uniform satisfying strategies in the sense of Definition 4.2.6 with respect to appropriate fingerprints for GAF. In order to compensate for this, we introduce the weaker notion of semi-uniform strategies, which exist for every model of ϕ. Although semi-uniform satisfying strategies do not directly induce finite models, they do facilitate the construction of finite models.

We base our considerations on a fixed GAF sentence ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ ϕ in standard form with quantifier-free ψ. The set At and the tuples x, ȳ, ū are defined as in Definition 3.7.1. Then, At can be partitioned into sets At 0 and At x , x ∈ x, in accordance with Definition 3.7.1. In addition, we define the set U x := vars(At x ) ∩ ū U x for every x ∈ x. Recall that we have vars(At x ) ⊆ ȳ1 ∪ . . . ∪ ȳidx(x)-1 ∪ {x} ∪ ūidx(x) ∪ . . . ∪ ūn for every x, and that for any two distinct x, x ∈ x we have U x ∩ U x = ∅.

Let A A be any structure over the vocabulary of ϕ. We adapt the definition of strategy and related notions from Section 4.2 as follows. In the GAF setting, a strategy σ is a tuple of mappings σ 1 , . . . , σ n with the signatures σ i :

A |x1| × . . . × A |xi| → A |ȳi| × A |ūi| .
ϕ := ∃z∀x∃y 1 y 2 . Q(z) ∧ ¬R(x, x) ∧ R(x, y 1 ) ∧ Q(y 1 ) ∧ R(x, y 2 ) ∧ ¬Q(y 2 ) .
We partition the set of atoms of ϕ into At 0 := {Q(z)} and At x := {R(x, x), R(x, y 1 ), Q(y 1 ), R(x, y 2 ), Q(y 2 )}. One possible model A is given by A := {0, 1, 2, 3, . . .}, Q A := {0, 1, 3, 5, . . .}, R A := i, i + 1 , i, i + 2 i even ∪ i, i + 2 , i, i + 3 i odd . A satisfying strategy is the canonical σ with σ 1 1 () := 0, where () denotes the empty list of arguments, and σ 2 2 (i) := i + 1, i + 2 for even i, σ 2 2 (i) := i + 2, i + 3 for odd i. The model A is depicted in Figure 4.1, and the strategy σ is indicated by the arrows together with their annotation. Notice that none of the finite substructures of A is a model of ϕ. Hence, there is no satisfying strategy with a finite image. A fingerprint characterizes a class of tuples of domain elements that cannot be distinguished by a given GAF sentence. Again, there will be only finitely many such fingerprints. Definition 4.3.2 (Fingerprint functions λ x, ). We define the family of fingerprint functions λ x, λ x, as follows. For every k, 1 ≤ k ≤ n, and every x ∈ xk we define the mappings

s ∃z s ¨¨¨B r r r r

Q p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p ¬Q

λ x,n : A |ȳ1| ×. . .×A |ȳ k-1 | ×A×A |ū k | ×. . .×A |ūn| →
λ x,n-1 : A |ȳ1| × . . . × A |ȳ k-1 | × A × A |ū k | × . . . × A |ūn-1| → P 2 At
x such that for every S ∈ PAt x we have S ∈ λ x,n-1 ( b1 , . . . , bk-1 , a, ck , . . . , cn-1 ) if and only if there exists some cn for which λ x,n ( b1 , . . . , bk-1 , a, ck , . . . , cn-1 , cn ) = S;

. . .

λ x,k : A |ȳ1| × . . . × A |ȳ k-1 | × A × A |ū k | → P n-k+1
At x such that for every S ∈ P n-k At x we have S ∈ λ x,k ( b1 , . . . , bk-1 , a, ck ) if and only if there is some ck+1 for which λ x,k+1 ( b1 , . . . , bk-1 , a, ck , ck+1 ) = S;

λ x,0 : A |ȳ1| × . . . × A |ȳ k-1 | × A → P n-k+2
At x such that for every S ∈ P n-k+1 At x we have S ∈ λ x,0 ( b1 , . . . , bk-1 , a) if and only if there exists some ck for which λ x,k ( b1 , . . . , bk-1 , a, ck ) = S.

For every x ∈ xk we define the image of λ x,0 under strategy σ by

im σ (λ x,0 ) im σ (λ x,0 ) := λ x,0 σ 1 1 (ā 1 ), . . . , σ 1 k-1 (ā 1 , . . . , āk-1 ), a ā1 ∈ A |x1| , . . . , āk-1 ∈ A |x k-1 | , a ∈ A . The notation λ k, ( b1 , . . . , bk-1 , ā, ck , . . . , c ) λ k,
abbreviates the tuple λ x1, ( b1 , . . . , bk-1 , a 1 , ck , . . . , c ), . . . , λ xm, ( b1 , . . . , bk-1 , a m , ck , . . . , c ) , where x 1 , . . . , x m := xk and a 1 , . . . , a m := ā. For k > 0 we denote the image of λ k,0 under σ by im σ (λ k,0

) := λ k,0 σ 1 1 (ā 1 ), . . . , σ 1 k-1 (ā 1 , . . . , āk-1 ), āk ā1 ∈ A |x1| , . . . , āk ∈ A |x k | .
Definition 4.3.3. (λ-semi-uniformity) A strategy σ = σ 1 , . . . , σ n is λ-semi-uniform if for every , 1 ≤ ≤ n, the following property holds. For all tuples ā1 , ā

1 ∈ A |x1| , . . . , ā , ā ∈ A |x | we have (a) σ 1 (ā 1 , . . . , ā ) = σ 1 (ā 1 , . . . , ā ) and (b) for every k with 1 ≤ k ≤ we have λ k, σ 1 1 (ā 1 ), . . . , σ 1 k-1 (ā 1 , . . . , āk-1 ), āk , σ 2 k (ā 1 , . . . , āk ), . . . , σ 2 (ā 1 , . . . , ā ) = λ k, σ 1 1 (ā 1 ), . . . , σ 1 k-1 (ā 1 , . . . , ā k-1 ), ā k , σ 2 k (ā 1 , . . . , ā k ), . . . , σ 2 (ā 1 , . . . , ā ) ,
whenever all of the following conditions are satisfied:

λ 1,0 ā1 = λ 1,0 ā 1 , λ 2,0 σ 1 1 (ā 1 ), ā2 = λ 2,0 σ 1 1 (ā 1 ), ā 2 , . . . λ ,0 σ 1 1 (ā 1 ), . . . , σ 1 -1 (ā 1 , . . . , ā -1 ), ā = λ ,0 σ 1 1 (ā 1 ), . . . , σ 1 -1 (ā 1 , . . . , ā -1 ), ā .
Consider a λ-semi-uniform strategy σ. The images of the mappings σ 1 k are finite. This indicates that every y ∈ ȳ is only subject to weak dependences. For the mappings σ 2 k the situation is different. This can be observed in Example 4.3.1, for instance, where σ is indeed λ-semi-uniform. Hence, λ-semi-uniform strategies do not necessarily induce finite substructures -in contrast to µ-uniform strategies. We shall see later, however, that a model A of ϕ and a λ-semi-uniform strategy σ can be used as blueprint for constructing a finite model B for ϕ equipped with a satisfying λ-semi-uniform strategy τ that has a finite image. Lemma 4.3.4. For every strategy σ = σ 1 , . . . , σ n there is a λ-semi-uniform strategy τ = τ 1 , . . . , τ n with Out τ ⊆ Out σ .

Proof. We start with two preliminary results. We inductively construct certain representatives α T1,...,T k ∈ A k as follows.

Let k = 1.

A i, ... We partition

A 1 into sets A 1, T1 with T 1 ∈ im σ (λ 1,0 ) by setting A 1, T1 := ā1 ∈ A |x1| λ 1,0 ā1 = T 1 . We pick one representative α T1 ∈ A 1, T1 from each nonempty part A 1, T1 . Let k > 1. We construct subsets A k, T1,...,T k ⊆ A k with T 1 ∈ im σ (λ 1,0 ), . . . , T k ∈ im σ (λ k,0 ) by setting A k, T1,...,T k := c1 , . . . , ck-1 , āk āk ∈ A |x k |
and there is some α T1,...,T k-1 = c1 , . . . , ck-1 with ci ∈ A |xi| for every i such that

λ 1,0 c1 = T 1 , λ 2,0 σ 1 1 (c 1 ), c2 = T 2 , . . . λ k-1,0 σ 1 1 (c 1 ), . . . , σ 1 k-2 (c 1 , . . . , ck-2 ), ck-1 = T k-1 , λ k,0 σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), āk = T k .
We pick one representative α T1,...,T k from each nonempty A k, T1,...,T k .

Having all the representatives α T1,...,T k at hand, we inductively construct τ , starting from τ 1 1 , τ 2 1 and going to τ 1 n , τ 2 n , and show that τ is λ-semi-uniform.

Let k = 1. For every ā1 ∈ A |x1| we set τ 1 1 (ā 1 ) := σ 1 1 (α T ), where T := λ 1,0 ā1 . Let T := λ 1,1 α T , σ 2 1 (α T ) . Hence, there are fingerprints S 1 , . . . , S |x1| , S 1 , . . . , S |x1| such that T = S 1 , . . . , S |x1| , T = S 1 , . . . , S |x1| , and S i ∈ S i for every i. Since λ 1,0 ā1 = T , Claim I entails that there must be some b1 ∈ A |ū1| such that λ 1,1 ā1 , b1 = T . We set τ 2 1 (ā 1 ) := b1 . In case of ā1 = α T , we make sure that b1 = σ 2 1 (α T ), i.e. we then set τ 2 1 (α T ) := σ 2 1 (α T ). By construction, τ is λ-semi-uniform up to this point.

Let k > 1. Given tuples ā1 ∈ A |x1| , . . . , āk ∈ A |x k | , let T 1 := λ 1,0 ā1 , T 2 := λ 2,0 τ 1 1 (ā 1 ), ā2 , . . . T k := λ k,0 τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk .
Based on these fingerprints, let c1 , . . . , ck := α T1,...,T k with ci ∈ A |xi| for every i. (We argue in Claim IV that such a representative α T1,...,T k always exists.) We set τ 1 k (ā 1 , . . . , āk ) := σ 1 k (c 1 , . . . , ck ). Hence, Condition (a) of the definition of λ-semi-uniformity is satisfied for τ . Moreover, we set τ 2 k (c 1 , . . . , ck ) := σ 2 k (c 1 , . . . , ck ). In order to define τ 2 k (ā 1 , . . . , āk ) in cases where ā1 , . . . , ān = c1 , . . . , cn , we proceed as follows.

Let

T 1 := λ 1,k c1 , σ 2 1 (c 1 ), . . . , σ 2 k (c 1 , . . . , ck ) , T 2 := λ 2,k τ 1 1 (c 1 ), c2 , σ 2 2 (c 1 , c2 ), . . . , σ 2 k (c 1 , . . . , ck ) , . . . T k := λ k,k τ 1 1 (c 1 ), . . . , τ 1 k-1 (c 1 , . . . , ck-1 ), ck .
By induction, i.e. by λ-semi-uniformity of τ for τ 2 1 , . . . , τ 2 k-1 and by definition of τ 2 1 , . . . , τ 2 k-1 , we observe that

T j := λ j,k-1 τ 1 1 (ā 1 ), . . . , τ 1 j-1 (ā 1 , . . . , āj-1 ), āj , τ 2 j (ā 1 , . . . , āj ), . . . , τ 2 k-1 (ā 1 , . . . , āk-1 ) = λ j,k-1 τ 1 1 (c 1 ), . . . , τ 1 j-1 (c 1 , . . . , cj-1 ), cj , τ 2 j (c 1 , . . . , cj ), . . . , τ 2 k-1 (c 1 , . . . , ck-1 ) = λ j,k-1 τ 1 1 (c 1 ), . . . , τ 1 j-1 (c 1 , . . . , cj-1 ), cj , σ 2 j (c 1 , . . . , cj ), . . . , σ 2 k-1 (c 1 , . . . , ck-1 )
for every j = 1, . . . , k -1, and we have T j = S 1 , . . . , S |xj | and T j = S 1 , . . . , S |xj | with S i ∈ S i for every i. By virtue of Claims I and II, there exist b1 k , . . . , bk

k ∈ A |ū k | such that λ 1,k ā1 , τ 2 1 (ā 1 ), . . . , τ 2 k-1 (ā 1 , . . . , āk-1 ), b1 k = T 1 , λ 2,k τ 1 1 (ā 1 ), ā2 , τ 2 2 (ā 1 , ā2 ), . . . , τ 2 k-1 (ā 1 , . . . , āk-1 ), b2 k = T 2 , . . . λ k,k τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk , bk k = T k .
Since the sets At x do not share any variables from ūk , we can merge the tuples b1 k , . . . , bk k into one bk such that

λ 1,k ā1 , τ 2 1 (ā 1 ), . . . , τ 2 k-1 (ā 1 , . . . , āk-1 ), bk = T 1 , λ 2,k τ 1 1 (ā 1 ), ā2 , τ 2 2 (ā 1 , ā2 ), . . . , τ 2 k-1 (ā 1 , . . . , āk-1 ), bk = T 2 , . . . λ k,k τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk , bk = T k .
We set τ 2 k (ā 1 , . . . , āk ) := bk . Then, τ satisfies Condition (b) of the definition of λ-semiuniformity.

Notice that, by construction of τ , every representative α T1,...,Ti =: c1 , . . . , ci satisfies

λ k, τ 1 1 (c 1 ), . . . , τ 1 1 (c 1 , . . . , ck-1 ), ck , τ 2 k (c 1 , . . . , ck ), . . . , τ 2 (c 1 , . . . , c ) = λ k, σ 1 1 (c 1 ), . . . , σ 1 1 (c 1 , . . . , ck-1 ), ck , σ 2 k (c 1 , . . . , ck ), . . . , σ 2 (c 1 , . . . , c ) (4.1)
for all k, with 1 ≤ k ≤ ≤ i.

Claim III: For every k, 1 ≤ k ≤ n, we have im τ λ k,0 ⊆ im σ λ k,0 .

Proof: Fix some k and let T ∈ im τ (λ k,0 ). Then, there are tuples ā1 ∈ A |x1| , . . . , āk ∈ A |x k | such that τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ) are defined and we have T = λ k,0 τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk . By definition of τ , there is some α T1,...,T k-1 = c1 , . . . , ck-1 for which we observe

τ 1 1 (ā 1 ) = σ 1 1 (c 1 ) . . . τ 1 k-1 (ā 1 , . . . , āk-1 ) = σ 1 k-1 (c 1 , . . . , ck-1 ) .
Consequently, T = λ k,0 σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), āk ∈ im σ λ k,0 . ♦ Claim IV: For every k, 1 ≤ k ≤ n, and all tuples ā1 ∈ A |x1| , . . . , āk ∈ A |x k | there is a representative α T1,...,T k such that

T 1 = λ 1,0 ā1 , T 2 = λ 2,0 τ 1 1 (ā 1 ), ā2 , . . . T k-1 = λ k-1,0 τ 1 1 (ā 1 ), . . . , τ 1 k-2 (ā 1 , . . . , āk-2 ), āk-1 , T k = λ k,0 τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk .
Proof: We proceed by induction on k.

Let k = 1. Consider any tuple ā1 ∈ A |x1| and set T 1 := λ 1,0 ā1 . Then, T 1 ∈ im σ (λ 1,0 ) and we thus have defined the partition A 1, T1 . Since ā1 ∈ A 1, T1 , the set is nonempty and there is some representative α T1 ∈ A 1, T1 .

Let k > 1. Consider any sequence of tuples ā1 ∈ A |x1| , . . . , āk ∈ A |x k | . By Claim III, we have

T 1 ∈ im τ (λ 1,0 ) ⊆ im σ (λ 1,0 ) , . . . T k ∈ im τ (λ k,0 ) ⊆ im σ (λ k,0 ) ,
and, therefore, we have constructed the subset A k, T1,...,T k ⊆ A k when defining representatives. It remains to show that this set is not empty. By induction, there is a unique representative α T1,...,T k-1 =: c1 , . . . , ck-1 with

T 1 = λ 1,0 c1 , T 2 = λ 2,0 τ 1 1 (c 1 ), c2 = λ 2,0 σ 1 1 (c 1 ), c2 , . . . T k-1 = λ k-1,0 τ 1 1 (c 1 ), . . . , τ 1 k-2 (c 1 , . . . , ck-2 ), ck-1 = λ k-1,0 σ 1 1 (c 1 ), . . . , σ 1 k-2 (c 1 , . . . , ck-2 ), ck-1 .
This entails τ 1 i (c 1 , . . . , ci ) = τ 1 i (ā 1 , . . . , āi ) for every i with 1 ≤ i ≤ k -1. Therefore,

T k = λ k,0 τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk = λ k,0 τ 1 1 (c 1 ), . . . , τ 1 k-1 (c 1 , . . . , ck-1 ), āk = λ k,0 σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), āk .
Hence, we have c1 , . . . , ck-1 , āk ∈ A k, T1,...,T k . Since A k, T1,...,T k contains at least one element, there exists a representative α T1,...,T k . ♦

At this point we have finished showing that the constructed strategy τ is well defined and λ-semi-uniform. It remains to prove Out τ ⊆ Out σ . Let S ∈ Out τ S, S 0 , S x , i.e. there exist tuples ā1 ∈ A |x1| , . . . , ān ∈ A |xn| such that S = out τ (ā 1 , . . . , ān ). We partition S into sets S 0 := S ∩ At 0 and S x := S ∩ At x for every x ∈ x. Doing so, for every k, 1 ≤ k ≤ n, and every x ∈ xk we obtain the fingerprint

S x = λ x,n τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . ,
T k = λ k,n τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk , τ 2 k (ā 1 , . . . , āk ), . . . , τ 2 n (ā 1 , . . . , ān )
for every k = 1, . . . , n.

Let T k = λ k,0 τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk T k for k = 1, . . . , n.
By virtue of Claim IV, there is some representative α T 1 ,...,T n = c1 , . . . , cn . Because of λ-semi-uniformity of τ and due to Equation (4.1), we have

λ k, τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), āk , τ 2 k (ā 1 , . . . , āk ), . . . , τ 2 (ā 1 , . . . , ā ) = λ k, τ 1 1 (c 1 ), . . . , τ 1 k-1 (c 1 , . . . , ck-1 ), ck , τ 2 k (c 1 , . . . , ck ), . . . , τ 2 (c 1 , . . . , c ) = λ k, σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), ck , σ 2 k (c 1 , . . . , ck ), . . . , σ 2 (c 1 , . . . , c ) for all k, with 1 ≤ k ≤ ≤ n. Consequently, for every k we get λ k,n σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), ck , σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn ) = T k . When we decompose T k into its constituents S x1 , . . . , S x |x k | , we get for every x ∈ xk that S x = λ x,n σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), c, σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn )
, where c from ck corresponds to x in xk . Since the union over the S x yields S, this entails S = out σ (c 1 , . . . , cn ) ∈ Out σ . Altogether, we thus have shown Out τ ⊆ Out σ .

Consider a λ-semi-uniform strategy σ under A. Since σ does not necessarily have a finite image, we cannot expect that the substructure A| σ of A is finite. However, starting from A we can construct another, possibly infinite structure B accompanied with a satisfying λ-semi-uniform strategy τ with a finite image. Then, B| τ is a finite model for ϕ. The theorem is a consequence of the following lemma.

Lemma 4.3.6. Suppose that A is a model of ϕ. Let σ be a λ-semi-uniform strategy that is satisfying for ϕ. Then, ϕ has a finite model C with at most p(len(ϕ))

2|x| • 2 ↑n+1 (|At|) 2|x|+2
domain elements, where p is some polynomial and where we assume |x| ≥ 1 and |ȳ| ≥ 1.

Proof. We take over the definition of the sets A k A k from the proof of Lemma 4.3.4, based on A's domain. Let T σ 1 T σ 1 be the target set of the mappings σ 1 k , which we define by

T σ 1 := b ∈ A | σ 1 k (ā 1 , . . . , āk ) = . . . b . . . for some k and some ā1 ∈ A |x1| , . . . , āk ∈ A |x k | . Notice that, since σ is λ-semi-uniform, T σ 1 is finite.
We start by defining an equivalence relation ∼ ∼ on tuples taken from the sets A k . Let ā1 , . . . , āk and ā 1 , . . . , ā k be tuples in A k for some k, 1 ≤ k ≤ n. We say ā1 , . . . , āk ∼ ā 1 , . . . , ā k if and only if the following conditions are satisfied:

(1) For all indices i, j we have a i,j ∈ T σ 1 if and only if a i,j ∈ T σ 1 . Moreover, if a i,j , a i,j ∈ T σ 1 then a i,j = a i,j .

(2) For every i, 1 ≤ i ≤ k, we have λ i,0 σ 1 1 (ā 1 ), . . . , σ 1 i-1 (ā 1 , . . . , āi-1 ), āi = λ i,0 σ 1 1 (ā 1 ), . . . , σ 1 i-1 (ā 1 , . . . , ā i-1 ), ā i . Since T σ 1 is finite and because there are only finitely many fingerprints, the relation ∼ induces finitely many equivalence classes that partition the set A 1 ∪ . . . ∪ A n . For each nonempty equivalence class [ ā1 , . . . , āk ] ∼ we fix some representative α [ ā1,..., āk ]∼ such that there are tuples c1 , . . . , ck with ci ∈ A |xi| and c1 = α [ ā1 ]∼ , c1 , c2 = α [ ā1, ā2 ]∼ , . . . , c1 , . . . , ck = α [ ā1,..., āk ]∼ . The existence of such representatives is a consequence of the following claim, Claim I, and the fact that c1 , . . . , ck ∼ ā1 , . . . , āk entails c1 , . . . , ci ∼ ā1 , . . . , āi for every i with 1 ≤ i ≤ k. Proof: As Condition (1) of the definition of ∼ is obviously satisfied, we concentrate on Condition (2).

Our assumption b1 , . . . , b ∼ d1 , . . . , d entails

λ 1,0 b1 = λ 1,0 d1 , λ 2,0 σ 1 1 ( b1 ), b2 = λ 1,0 σ 1 1 ( d1 ), d2 , . . . λ ,0 σ 1 1 ( b1 ), . . . , σ 1 -1 ( b1 , . . . , b -1 ), b = λ 1,0 σ 1 1 ( d1 ), . . . , σ 1 -1 ( d1 , . . . , d -1 ), d . Hence, λ-semi-uniformity of σ leads to σ 1 1 ( b1 ) = σ 1 1 ( d1 ), . . . , σ 1 ( b1 , . . . , b ) = σ 1 ( d1 , . . . , d ). We next show for every i, ≤ i ≤ k, that (a) λ i,0 σ 1 1 ( b1 ), . . . , σ 1 ( b1 , . . . , b ), σ 1 +1 ( b1 , . . . , b , d +1 ), . . . , σ 1 i-1 ( b1 , . . . , b , d +1 , . . . , di-1 ), di = λ i,0 σ 1 1 ( d1 ), . . . , σ 1 i-1 ( d1 , . . . , di-1 ), di and (b) σ 1 i ( b1 , . . . , b , d +1 , . . . , di ) = σ 1 i ( d1 , .
. . , di ). We proceed by induction on i. For the base case i = there is nothing to do, as the above observations already state what we have to show. Consider the case i ≥ + 1. By induction, Equation (b) for , . . . , i -1 entails λ i,0 σ 1 1 ( d1 ), . . . , σ 1 i-1 ( d1 , . . . , di-1 ), di = λ i,0 σ 1 1 ( b1 ), . . . , σ 1 i-1 ( b1 , . . . , b , d +1 , . . . , di-1 ), di . By λ-semi-uniformity, this together with the previous observations and (a) for , . . . , i -1 implies σ 1 i ( b1 , . . . , b , d +1 , . . . , di ) = σ 1 i ( d1 , . . . , di ). This finishes the inductive proof of (a) and (b). Now, part (a) for i = k immediately entails that Condition (2) for b1 , . . . , b , d +1 , . . . , dk ∼ d1 , . . . , dk is satisfied. ♦

Next, we construct a certain structure B from A. Let denote the disjoint-union operator. We compose the domain of B by setting

B := D -1 D 0 D 1 D 2 for four subdomains D -1 , D 0 , D 1 , D 2 D -1 ,D 0 ,D 1 ,D 2 D i,C,u , D -1,C,y
. Every D i with i ≥ 0 is a disjoint union of layers: one layer D i,C,u for every equivalence class C induced by ∼ on the set A 1 ∪ . . . ∪ A n and every u ∈ ū. Each of these layers D i,C,u is a copy of A's domain A. We impose a similar layered structure on D -1 , however with references to y ∈ ȳ instead of u ∈ ū. Given any domain element a ∈ D -1 D 0 D 1 D 2 , we denote by a ↓ a ↓ , ā↓ , β ↓ the element a ∈ A from which the copy a originated. We extend this notation to tuples ā by setting by ā↓ := a ↓ 1 , . . . , a ↓ |ā| . We further extend the notation to variable assignments, i.e. for every variable assignment β over B's domain we write β ↓ to address the variable assignment over A's domain that is defined by setting β ↓ (v) := β(v)

↓ for every variable v. (c) For every x ∈ x with 1 ≤ ≤ k we have that if the corresponding a ∈ ā stems from D i then every element b in the tuple τ 2 k (ā 1 , . . . , āk ) that corresponds to some variable u ∈ U x ∩ ūk is taken from D (i+1 mod 3),C,u .

Claim II: For every k we have

σ 1 k (ā ↓ 1 , . . . , ā↓ k ) = τ 1 k (ā 1 , . . . , āk ) ↓ .
Proof: We prove this claim by induction on k.

For the base case k = 1 the claim holds due to our assumption that σ is λ-semi-uniform.

More precisely, we have

τ 1 1 (ā 1 ) ↓ = σ 1 1 (c 1 ) = σ 1 1 (ā ↓ 1 ) where c1 = α [ā ↓ 1 ]∼ . In the case k > 1 let T i := λ i,0 (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 i-1 (ā 1 , . . . , āi-1 )) ↓ , ā↓ i for every i, 1 ≤ i ≤ k. Since we have σ 1 i (ā ↓ 1 , . . . , ā↓ i ) = τ 1 i (ā 1 , . . . , āi )
↓ for every i = 1, . . . , k -1 by induction, we get

T i = λ i,0 σ 1 1 (ā ↓ 1 ), . . . , σ 1 i-1 (ā ↓ 1 , . . . , ā↓ i-1 ), ā↓ i for every i, 1 ≤ i ≤ k. Let c1 , . . . , ck := α [ ā↓ 1 ,...,ā ↓ k ]∼
. By λ-semi-uniformity of σ and due to the construction of τ , we then have

σ 1 k (ā ↓ 1 , . . . , ā↓ k ) = σ 1 k (c 1 , . . . , ck ) = τ 1 k (ā 1 , . . . , āk ) ↓ .
Hence, the claim follows. ♦

We next define how B interprets predicate symbols. For every predicate symbol P occurring in ϕ we define P B to be the smallest set satisfying the following properties for all tuples ā1 , . . . , ān with āi ∈ B |xi| . Let c1 , . . . , cn :

= α [ ā↓ 1 ,...,ā ↓ n ]∼ . (i) For every atom A(ȳ 1 , . . . , ȳn ) ∈ At 0 we require B |= A τ 1 1 (ā 1 ), . . . , τ 1 n (ā 1 , . . . , ān ) if and only if A |= A σ 1 1 (c 1 ), . . . , σ 1 n (c 1 , . . . , cn ) .
(ii) For every k, 1 ≤ k ≤ n, every x ∈ xk , and every atom A(ȳ 1 , . . . , ȳk-1 , x, ūk , . . . , ūn ) ∈ At x we require

B |= A τ 1 1 (ā 1 ), . . . , τ 1 k-1 (ā 1 , . . . , āk-1 ), a, τ 2 k (ā 1 , . . . , āk ), . . . , τ 2 n (ā 1 , . . .

, ān ) if and only if

A |= A σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), c, σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn ) , where a from āk and c from ck correspond to x ∈ xk .

Notice that the last line implies

A ∈ λ x,n σ 1 1 (c 1 ), . . . , σ 1 k-1 , c, σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn ) where c corresponds to x in xk .

Claim III: The structure B is well defined.

Proof: We assume to the contrary that the definition of B is contradictory while A is well defined.

Consider any two sequences of tuples ā1 , . . . , ān and ā 1 , . . . , ā n āk , ā k with āk , ā k ∈ B |x k | for every k. Let β β, β be the variable assignment that maps every xk to āk , every ȳk to τ 1 k (ā 1 , . . . , āk ), and every ūk to τ 2 k (ā 1 , . . . , āk ). Let β be defined analogously based on ā 1 , . . . , ā n . Suppose there are atoms A, B A, B, s i , t i occurring in ϕ such that B, β |= A and B, β |= B. Moreover, suppose that A has the shape P (s 1 , . . . , s m ) and B has the shape P (t 1 , . . . , t m ) and that we have β(s ) = β (t ) for every . Recall that, since ϕ is relational, all the terms s and t are in fact variables.

Let T 1 , . . . , T n T k be the unique sequence of fingerprints defined by

T k := λ k,0 (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k-1 (ā 1 , . . . , āk-1 )) ↓ , ā↓ k = λ k,0 σ 1 1 (ā ↓ 1 ), . . . , σ 1 k-1 (ā ↓ 1 , . . . , ā↓ k-1 ), ā↓ k for every k. Let c1 , . . . , cn := α [ ā↓ 1 ,...,ā ↓ n ]∼ c1 , . . . , cn , c 1 , . . . , c n , T k , γ, γ
and let γ be the variable assignment that maps every xk to ck , every ȳk to σ 1 k (c 1 , . . . , ck ), and every ūk to σ 2 k (c 1 , . . . , ck ). We define T 1 , . . . , T n and c 1 , . . . , c n and γ analogously, based on ā 1 , . . . , ā n .

By Requirements (i) and (ii), our assumptions entail

A, γ |= A and A, γ |= B. (4.2)
Consider the variable assignments β ↓ and β ↓ . Clearly, for all variables v, v we have that

β(v) = β (v ) implies β ↓ (v) = β ↓ (v )
. Hence, we have

A(β ↓ )(A) = P β ↓ (s 1 ), . . . , β ↓ (s m ) = P β ↓ (t 1 ), . . . , β ↓ (t m ) = A(β ↓ )(B). (4.3)
Regarding the atoms A and B, we distinguish several cases.

Case (A1).

If A(ȳ 1 , . . . , ȳn ) ∈ At 0 , we observe the following. By definition of γ, A, γ |= A translates to A |= A σ 1 1 (c 1 ), . . . , σ 1 n (c 1 , . . . , cn ) . Since τ is defined such that σ 1 i (c 1 , . . . , ci ) = τ 1 i (ā 1 , . . . , āi ) ↓ for every i, we thus obtain

A |= A (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 n (ā 1 , . . . , ān )) ↓ . By definition of β, this translates to A, β ↓ |= A.
Case (A2). If A(ȳ 1 , . . . , ȳk-1 , xk , ūk , . . . , ūn ) ∈ At x for some x ∈ xk

x, k , we observe the following. By definition of γ, A, γ |= A translates to

A |= A σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), ck , σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn ) .
Because of c1 , . . . , cn ∼ ā↓ 1 , . . . , ā↓ n , λ-semi-uniformity of σ entails

A ∈ λ k,n σ 1 1 (c 1 ), . . . , σ 1 k-1 (c 1 , . . . , ck-1 ), ck , σ 2 k (c 1 , . . . , ck ), . . . , σ 2 n (c 1 , . . . , cn ) = λ k,n σ 1 1 (ā ↓ 1 ), . . . , σ 1 k-1 (ā ↓ 1 , . . . , ā↓ k-1 ), ā↓ k , σ 2 k (ā ↓ 1 , . . . , ā↓ k ), . . . , σ 2 n (ā ↓ 1 , . . . , ā↓ n ) .
Therefore, we get

A |= A σ 1 1 (ā ↓ 1 ), . . . , σ 1 k-1 (ā ↓ 1 , . . . , ā↓ k-1 ), ā↓ k , σ 2 k (ā ↓ 1 , . . . , ā↓ k ), . . . , σ 2 n (ā ↓ 1 , . . . , ā↓ n ) .
By virtue of Claim II, this can be rewritten to

A |= A (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k-1 (ā 1 , . . . , āk-1 )) ↓ , ā↓ k , σ 2 k (ā ↓ 1 , . . . , ā↓ k ), . . . , σ 2 n (ā ↓ 1 , . . . , ā↓ n ) .
Case (B1). If B ∈ At 0 , we conclude A, β ↓ |= B in analogy to Case (A1).

Case (B2). If B(ȳ 1 , . . . , ȳk -1 , xk , ūk , . . . , ūn ) ∈ At x for some x ∈ xk x , k , we can derive

A |= B (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k -1 (ā 1 , . . . , ā k -1 )) ↓ , ā k ↓ , σ 2 k (ā 1 ↓ , . . . , ā k ↓ ), . . . , σ 2 n (ā 1 ↓ , . . . , ā n ↓ )
in analogy to Case (A2).

We next consider the four possible combinations of the above cases.

Suppose Cases (A1) and (B1) apply. We then have A, β ↓ |= A and A, β ↓ |= B. But by Equation (4.3) we also have

β ↓ (A) = P β ↓ (s 1 ), . . . , β ↓ (s m ) = P β ↓ (t 1 ), . . . , β ↓ (t m ) = β ↓ (B).
In other words, the structure A is inconsistent, which contradicts our assumptions.

Next, suppose that Cases (A2) and (B1) apply. Since B belongs to At 0 , we have t 1 , . . . , t m ∈ ȳ and, hence, β (t ) ∈ D -1 for every . This means that A cannot contain any variables u ∈ ū, for otherwise there would be some with s = u leading to β(s ) ∈ D i with i ≥ 0 and β (t ) ∈ D -1 , which would contradict our assumption β(s ) = β (t ). This means, we have

A |= A (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k-1 (ā 1 , . . . , āk-1 )) ↓ , ā↓ k , which translates to A, β ↓ |= A(ȳ 1 , . . . , ȳk-1 , xk ). As in the previous case, A, β ↓ |= A together with A, β ↓ |= B leads to a contradiction.
The combination of Case (A1) and Case (B2) also leads to a contradiction.

Finally, suppose that Case (A2) applies together with Case (B2). First, we make two more observations: Moreover, the definition of the τ 1 k also entails that β(y 1 ) ↓ = γ(y 1 ) and β (y

2 ) ↓ = γ (y 2 ). (II) Consider any two variables u 1 ∈ ūk1 , u 2 ∈ ūk2 . By definition of τ , β(u 1 ) = β (u 2 ) entails (a) β(u 1 ) ↓ = β (u 2 ) ↓ , (b) k 1 = k 2 and u 1 = u 2 and x = x and u 1 , u 2 ∈ U x , (c) k = k ≤ k 1 , (d) ā↓ 1 , . . . , ā↓ k1 ∼ ā 1 ↓ , . . . , ā k1 ↓ , (e) T i = T i and ci = c i for every i with 1 ≤ i ≤ k 1 , (f) β(x) ∈ T σ 1 if and only if β (x) ∈ T σ 1 , and (g) if β(x), β (x) ∈ T σ 1 then β(x) = β (x) and β(x) = γ(x) and β (x) = γ (x).
Moreover, the definition of τ also entails that β(u 1 ) ↓ = γ(u 1 ) and β (u 2 ) ↓ = γ (u 2 ).

We now derive contradictions the following cases (the remaining cases can be treated analogously).

Suppose there is some such that s = u ∈ ūk1 and t = u ∈ ūk2 . According to Observation (II), this entails, among other things, that x = x . Now, let k * be the largest index for which there is such an with s = u ∈ ūk * and t = u ∈ ūk * . Then, we know that k * ≥ k. Moreover, T i = T i and ci = c i for every i with 1 ≤ i ≤ k * . Hence, γ and γ coincide on all variables in ȳi , xi , ūi with

1 ≤ i ≤ k * .
By definition of τ , there is some D i with i ≥ 0 to which all elements β(u ) with u ∈ vars(A) ∩ U x and all β (u ) with u ∈ vars(B) ∩ U x belong. Moreover, β(x) and β (x) cannot belong to this D i . Therefore, there is no such that s is a variable from ū and t is not from ū or vice versa. Hence, every u ∈ ū that occurs in A or in B stems from ū1 ∪ . . . ∪ ūk * . Consequently, γ and γ indeed coincide on all variables that occur in A or in B. This leads to A, γ |= B (as A, γ |= B and γ(B) = γ (B)) and A, γ |= A (as A, γ |= A and γ (A) = γ(A)). Moreover, by definition of τ , β and β coincide on all variables in ȳi , ūi with 1 ≤ i ≤ k * . Due to the above observations and because of definition of τ , there are two variables y 1 , y 2 ∈ ȳ such that for all arguments s and t one of the following cases applies: s = y = t for a certain variable y ∈ ȳ, s = x and t = y 2 , s = y 1 and t = x, s = x = t , or s = u = t for a certain variable u ∈ ū. Let L be the set of all indices such that s = x and t = y 2 ∈ ȳ. Similarly, let L be the set of all indices such that s = y 1 ∈ ȳ and t = x. Suppose L is nonempty, i.e. there is some with s = x and t = y 2 . Then, our assumption β(x) = β(s ) = β (t ) = β (y 2 ) entails β(x) ∈ T σ 1 . This leads to the following chain of equations:

γ(x) = β ↓ (x) = β ↓ (y 2 ) = γ (y 2 ).
Hence, for every ∈ L we have

γ(s ) = γ(x) = γ (y 2 ) = γ(y 2 ) = γ(t ). Symmetrically, we have γ (x) = β ↓ (x) = β ↓ (y 1 ) = γ(y 1 ) and γ(s ) = γ(y 1 ) = γ (x) = γ(x) = γ(t ) for every ∈ L , if L in nonempty.
Put together, the above observations entail γ(A) = P γ(s 1 ), . . . , γ(s m ) = P γ(t 1 ), . . . , γ(t m ) = γ(B). Recall that we have already inferred A, γ |= A and also A, γ |= B. Together with the equality of A and B under γ, this yields a contradiction with our assumption that A is a well defined structure. Suppose we have t ∈ ū for every for which s ∈ ū. Further suppose, there is indeed some u ∈ ū such that s = u. Since β(s ) = β (t ), the definition of τ entails that t = x . Let D i be the subdomain that contains β (x ) and thus also β(u). Then, β(x) ∈ D (i-1 mod 3) and for any u ∈ vars(B) ∩ ū we have β (u ) ∈ D (i+1 mod 3) , which entails β (u ) = β(x). Hence, B cannot contain any variable from ū. Moreover, u is the only variable from ū that occurs in A, since for any u ∈ ū \ {u} with u = s we would have β(u ) = β(u), on the one hand, but β(u ) = β(s ) = β (t ) = β (x ) = β(u) on the other hand. Therefore and by definition of τ , there is some y 2 ∈ ȳ such that for all arguments s , t one of the following cases applies: s = y = t for a certain variable y ∈ ȳ, s = x and t = y 2 , or s = u and t = x . Let k * be the largest index for which there is some with s = t = y ∈ ȳk * (let k * := 0 if no such index exists). By virtue of Observation (I), we then get T i = T i and ci = c i for every i with 1 ≤ i ≤ k * . Hence, γ and γ coincide on all variables in ȳi with 1 ≤ i ≤ k * . By definition of β , this also applies to γ and β ↓ .

If there is some such that s = x and t = y 2 , then we have

β ↓ (x) = β ↓ (s ) = β ↓ (t ) = β ↓ (y 2 ) ∈ T σ 1 . This leads to β ↓ (x) = γ(x). Therefore, we have γ(x) = β ↓ (y 2 ).
Finally, consider the for which s = u and t = x . Since γ(u)

= β ↓ (u) = β ↓ (x ), we have γ(u) = β ↓ (x ).
Consequently, we have all pieces together to conclude P γ(s 1 ), . . . , γ(s m ) = P β ↓ (s 1 ), . . . , β ↓ (s m ) .

In other words, A under γ equals B under β ↓ . Since we have A, γ |= A and A, β ↓ |= B (cf. Case (B2) together with the observation that B does not contain any variable from ū), this leads to a contradiction with the assumption that the structure A is well defined.

Suppose neither A nor B contain any variable from ū. According to the statements derived for Case (A2) and Case (B2), we have

A |= A (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k-1 (ā 1 , . . . , āk-1 )) ↓ , ā↓ k . and A |= B (τ 1 1 (ā 1 )) ↓ , . . . , (τ 1 k -1 (ā 1 , . . . , ā k -1 )) ↓ , ā k ↓ . Put differently, A, β ↓ |= A and A, β ↓ |= B.
As we, by Equation (4.3), already know that A under β ↓ equals B under β ↓ , this contradicts our assumption that A is a well-defined structure. ♦

Claim IV: Under B the strategy τ is satisfying for ϕ.

Proof: Let ā1 , . . . , ān be any sequence of tuples with āi ∈ B |xi| for every i. Let β be the variable assignment that maps every xi to āi , every ȳi to τ 1 i (ā 1 , . . . , āi ), and every ūi to τ 2 i (ā 1 , . . . , āi ). We intend to show B, β |= ψ. Let c1 , . . . , cn be the distinguished representative of the equivalence class [ ā↓ 1 , . . . , ā↓ n ] ∼ . Let γ be the variable assignment that maps every xi to ci , every ȳi to σ 1 i (c 1 , . . . , ci ), and every ūi to σ 2 i (c 1 , . . . , ci ). Since we assume σ to be a satisfying strategy for ϕ under A, Notice that T τ coincides with the domain of B| τ . Hence, by Lemma 4.2.3, B| τ is a finite model of ϕ and it can thus serve as the sought model C. Finally, we give an upper bound on the size of C's domain. First, we bound the number of distinct sequences of fingerprints T 1 , . . . , T k ∈ im σ λ 1,0 × . . . × im σ λ k,0 . Let At xi denote the set x∈xi At x . For every i with

1 ≤ i ≤ k we have im σ (λ i,0 ) = x∈xi im σ (λ x,0 ) ≤ x∈xi 2 ↑n-i+2 (|At x |) ≤ 2 ↑n-i+2 x∈xi |At x | ≤ 2 ↑n-i+2 (|At xi |) .
This leads to the following bound on the number of sequences of fingerprints:

n k=1 im σ λ 1,0 × . . . × im σ λ k,0 ≤ n k=1 k i=1 2 ↑n-i+2 (|At xi |) ≤ n k=1 2 ↑n+1 k i=1 |At xi | ≤ n • 2 ↑n+1 (|At|) .
Since σ is λ-semi-uniform, this entails an upper bound regarding the cardinality of the set T σ 1 :

|T σ 1 | ≤ |ȳ| • n • 2 ↑n+1 (|At|).
The number of equivalence classes induced by the relation ∼ depends on the cardinality of T σ 1 and the number of sequences of fingerprints:

(A 1 ∪ . . . ∪ A n )/ ∼ ≤ n k=1 (|T σ 1 | + 1) |x1|+...+|x k | • n • 2 ↑n+1 (|At|) ≤ n 2 • (|T σ 1 | + 1) |x| • 2 ↑n+1 (|At|) .
Given this, we can bound the number of elements in the set S σ :

|S σ | ≤ |T σ 1 | + (A 1 ∪ . . . ∪ A n )/ ∼ • |ū|.
The last component that we need to establish an upper bound on the cardinality of the set T τ , is the number of copies of A that are used as building blocks for the sets

D -1 , D 0 , D 1 , D 2 . An upper bound for this number is |ȳ| • (A 1 ∪ . . . ∪ A n )/ ∼ + 3 • |ū| • (A 1 ∪ . . . ∪ A n )/ ∼ .
All in all we obtain the following upper bound:

|T τ | ≤ |S σ | • (|ȳ| + 3 • |ū|) • (A 1 ∪ . . . ∪ A n )/ ∼ ≤ p(len(ϕ)) 2|x| • 2 ↑n+1 (|At|) 2|x|+2 ,
where p is some polynomial and where we assume |x| ≥ 1 and

|T σ 1 | ≥ 1.
In analogy to Theorem 4.2.11, the bound given in Lemma 4.3.6 and Theorem 4.3.5 could be refined using a notion of degree for GAF sentences, cf. Definition 4.2.9. For ϕ the degree ∂ GAF (ϕ)

∂ GAF (ϕ) is the smallest nonnegative integer m such that for every At x , x ∈ xi , there are at most m distinct indices j 1 , . . . , j m with i ≤ j 1 < . . . < j m ≤ n such that ūj ∩ vars(At x ) = ∅.

We conclude this section with an example that illustrates the construction of a finite model from the proof of Theorem 4.3.5.

Example 4.3.7. Consider again the sentence ϕ and its model A from Example 4.3.1:

ϕ := ∃z∀x∃y 1 y 2 . Q(z) ∧ ¬R(x, x) ∧ R(x, y 1 ) ∧ Q(y 1 ) ∧ R(x, y 2 ) ∧ ¬Q(y 2 ) .
We observe that all elements in A have the same fingerprint. More precisely, for every a ∈ A we have λ x,0 σ 1 1 (), a) = P At x \ {R(x, x)} and λ x,1 σ 1 1 (), a, σ 2 2 (a) = {R(x, y 1 ), Q(y 1 ), R(x, y 2 )}. As we have already pointed out, none of the finite substructures of A is a model of ϕ. Nevertheless, we can use parts of A as a blueprint for constructing the following structure C that is finite and satisfies ϕ. Chapter 5

The domain of C consists of the disjoint union D

-1 D 0 D 1 D 2 = {0} {1, 2, 3, 4} {3, 4} {3, 4}, which results in C := {0, 1, 2, 3, 4, 3 , 4 , 3 , 4 }.

Q p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p p ¬Q

Computational Complexity of SF-Sat and GBSR-Sat

The investigation of the classical decision problem has not stopped at the point where fragments had been found to be decidable. The computational complexity of the satisfiability problem associated with a decidable class is of interest as well. Systematic investigations in this direction were started in the late 1970s [Lew78, Lew80, Für81, Pla84, DL84a, DL84b]. 1 There is an easy route to upper bounds whenever we know that the fragment under consideration enjoys a small model property.

The following lemma links bounds regarding the size of models with the computing time that is required to decide satisfiability.

Proposition 5.0.1 ([Lew80], Proposition 3.2, see also [START_REF] Börger | The Classical Decision Problem[END_REF], Proposition 6.0.4). Let ϕ be a first-order sentence in prenex normal form containing n universally quantified variables. The question whether ϕ has a model of cardinality m can be decided nondeterministically in time p m n • len(ϕ) for some polynomial p.

With this lemma at hand, it is enough to prove a small model property for a given class of first-order sentences, in order to bound the worst-case time complexity of the corresponding satisfiability problem from above. This approach yields good upper bounds in cases where the Boolean structure of the considered sentences is not restricted. As we shall see later, namely in Sections 5.1 and 5.2, certain prefix classes of Horn or Krom sentences are complete for deterministic time complexity classes or for space complexity classes. Then, a small model property alone does not immediately lead to good upper bounds and one needs more sophisticated arguments.

In the present chapter, we aim to investigate the computational complexity of SF-Sat and GBSR-Sat. Considerations regarding the other decidable fragments that we have introduced in Chapter 3 remain future work. 2 Recall that we have shown several small model properties for SF and GBSR, cf. Theorem 3.2.6 for SF and Corollary 3.5.4 and Theorem 4.2.11 for GBSR. More concretely, any satisfiable SF or GBSR sentence ϕ with degree k has a model whose domain is of a size that is at most k-fold exponential in the length of ϕ. Therefore, Proposition 5.0.1 immediately supplies us with upper bounds regarding the computational complexity of SF-Sat and GBSR-Sat. If we use the (various) degrees of interaction of variables as parameters, we obtain upper bounds for infinitely many subclasses SF ≤k SF ≤k , GBSR ≤k and GBSR ≤k with k ≥ 0, as depicted in Figure 5.1. The set SF ≤k collects all SF formulas ϕ with ∂ ∃ (ϕ) ≤ k or ∂ ∀ (ϕ) ≤ k or both. The satisfiability problem associated with any fragment SF ≤k is denoted by SF ≤k -Sat. The set GBSR ≤k is the 1 The foundations of computational complexity theory can be found in many standard textbooks, e.g. [HU79, Pap94, Gol08, AB09]

2 It seems safe to assume that the satisfiability problem for each of the decidable relational first-order fragments introduced in Chapter 3 lies in Tower (cf. Definition 5.0.2). Intuitively, the translations of the separated versions into their respective base fragment lead to a blowup that is at most p(n)-fold exponential in the length n of the formula for some polynomial p. Moreover, the satisfiability problems of the base fragments usually do not go beyond 2-ExpTime, except for FL, whose satisfiability problem lies in Tower. But even SFL-Sat should lie in Tower. collection of all GBSR sentences ϕ with ∂ ∃∀ (ϕ) ≤ k or ∂ ∀ (ϕ) ≤ k -1 or both. GBSR ≤k -Sat denotes the satisfiability problem associated with GBSR ≤k . Our results then entail for every positive k that SF ≤k -Sat and GBSR ≤k -Sat are in k-NExpTime. The decision problems SF ≤0 -Sat and GBSR ≤0 -Sat belong to NExpTime. If we consider SF or GBSR without universal quantifiers, we obtains the fragments ∃ * -SF and ∃ * -GBSR ∃ * -SF, ∃ * -GBSR , which coincide with the existential fragment of relational first-order logic, see also Section 5.1. The corresponding decision problems ∃ * -SF-Sat and ∃ * -GBSR-Sat coincide as well and belong to NP.

We shall complement these upper bounds with matching lower bounds, which in the end will lead to a hierarchy of computationally hard satisfiability problems that are even complete for k-NExpTime. Recall that Elementary := k≥1 k-ExpTime Elementary is the complexity class containing k-ExpTime, k-NExpTime, and k-ExpSpace for every positive k. The unrestricted problems SF-Sat and GBSR-Sat lie even beyond Elementary. Indeed, both are complete for the complexity class Tower, which contains Elementary but is slightly larger [START_REF] Schmitz | Complexity Hierarchies beyond Elementary[END_REF]. In contrast to Elementary, Tower contains problems that are complete for the class.

Definition 5.0.2 (Tower, [START_REF] Schmitz | Complexity Hierarchies beyond Elementary[END_REF]). First, we define the following functions F i : N → N for i = 0, 1, 2, 3, where F k j (n) := F j F j . . . F j (n) . . . k times denotes k-fold application of F j to the argument n:

F 0 (n) := n + 1 , F 1 (n) := F n+1 0 (n) = 2n + 1 , F 2 (n) := F n+1 1 (n) = 2 n+1 • (n + 1) -1 , F 3 (n) := F n+1 2 (n) > 2 ↑n (2) .
Let FElem denote the set of elementary functions f : N → N, i.e. of all functions that can be bounded from above by 2 ↑k (n) for some constant k. The complexity class Tower is defined by

Tower := f (n)∈FElem DTime F 3 (f (n)) .
Since F 3 is a non-elementary function that grows faster than 2 ↑n (2) ([Sch16], page 4), the complexity class Tower properly contains Elementary.

We now state the main result of the present chapter.

Theorem 5.0.3. The decision problems ∃ * -SF-Sat and ∃ * -GBSR-Sat are NP-complete and the problems SF ≤0 -Sat and GBSR ≤0 -Sat are NExpTime-complete. For any positive integer k the problems SF ≤k and GBSR ≤k are complete for k-fold nondeterministic exponential time. The problems SF-Sat and GBSR-Sat are Tower-complete (with respect to elementary reductions).

Proof. The upper bounds and hardness results for ∃ * -SF-Sat and ∃ * -GBSR-Sat will be derived in Section 5.1, in particular in Proposition 5.1.4. The upper bounds for SF ≤k -Sat and GBSR ≤k -Sat with nonnegative k follow from Proposition 5.0.1 together with the small model properties given in Theorem 3.2.6, Corollary 3.5.4, and Theorem 4.2.11. These bounds also lead to the observation that the unrestricted problems SF-Sat and GBSR-Sat belong to Tower. In Section 5.3 we derive corresponding lower bounds. More precisely, Theorem 5.3.11 establishes k-NExpTime-hardness for SF ≤k -Sat for every positive k and thus also for SF-Sat. According to [START_REF] Schmitz | Complexity Hierarchies beyond Elementary[END_REF], Section 3.1, k-NExpTime-hardness of SF-Sat for every positive k entails hardness for the class Tower. NExpTime-hardness for SF ≤0 follows from NExpTime-hardness of BSR-Sat. As for every nonnegative k the set SF ≤k -Sat is a subproblem of GBSR ≤k -Sat, we get the same lower bounds for every GBSR ≤k -Sat and for GBSR-Sat, respectively.

Recall that we have already derived a general reducibility result in Theorem 3.3.11, which entails that SF-Sat inherits computational hardness from the satisfiability problems of other first-order fragments that exhibit a small model property with a bound 2 ↑c•len(ϕ) (d • len(ϕ)). Although this already entails that SF-Sat is, e.g., as hard as the satisfiability problem associated with the fluted

Tower

Primitive Recursive

∃ * -SF-Sat SF ≤1 -Sat, SF ≤0 -Sat SF ≤2 -Sat SF ≤k -Sat SF-Sat ∃ * -GBSR-Sat GBSR ≤1 -Sat, GBSR ≤0 -Sat GBSR ≤2 -Sat GBSR ≤k -Sat GBSR-Sat
Figure 5.1: The computational complexity of the subfragments of SF and GBSR scale over the major nondeterministic complexity classes in Elementary, while the unrestricted problems SF-Sat and GBSR-Sat even go beyond.

fragment, which is known to be non-elementary [START_REF] Pratt-Hartmann | Quine's Fluted Fragment is Non-Elementary[END_REF], Theorem 5.0.3 is much more accurate and yields better lower bounds than what we could derive from Theorem 3.3.11. Moreover, the lower-bound proof for SF-Sat that will be presented in Section 5.3 is more instructive in that it provides a better understanding of how large models can be enforced with SF sentences. It is worth mentioning that Theorem 5.0.3 adequately accounts for the known complexity of MFO-Sat. This works in spite of the fact that monadic sentences may contain arbitrarily nested alternating quantifiers. For every MFO sentence ϕ we trivially have ∂ ∃ (ϕ) = 1, since all occurring predicate symbols have an arity of at most one. Theorem 5.0.3 entails that MFO-Sat is in NExpTime, which is well known. Moreover, we have introduced the strongly separated fragment (SSF) as the set of SF sentences that have degree one, see Definition 3.2.3 and the short paragraph preceding it. SSF contains BSR and MFO as subfragments and, by Theorem 5.0.3, shares their computational complexity.

Corollary 5.0.4. The satisfiability problem for SSF is NExpTime-complete.

Theorem 5.0.3 establishes two hierarchies of computationally hard problems that are complete for infinitely many subclasses of Elementary and as a whole form a problem that is complete for Tower. The overall structure is depicted in Figure 5.1.

Apparently, non-elementary satisfiability problems are not very widespread among the decidable fragments of classical relational fist-order logic known today. We have argued that SF and GBSR fall into this category. To the present author's knowledge, the only known companion in this respect is the fluted fragment. Indeed, Pratt-Hartmann, Szwast, and Tendera showed in [START_REF] Pratt-Hartmann | Quine's Fluted Fragment is Non-Elementary[END_REF] that satisfiability of fluted sentences with at most 2k variables is k-NExpTime-hard. Moreover, they argue that satisfiability of fluted sentences with at most k variables lies in k-NExpTime. Although a significant gap between these lower and upper bounds remains to be closed, the fluted fragment seems to comprise a similar hierarchy of hard problems as SF does, and the unrestricted problem FL-Sat is Tower-complete as well. Another candidate for a first-order fragment with such a high computational complexity might be Maslov's fragment K. 3Remark 5.0.5. In computational complexity theory, several hierarchies have been defined where the hardness of problems is suspected to grow with the number of quantifier alternations that are admitted in the formal problem description. One example is the polynomial-time hierarchy (PH) PH (cf. Definition 3.8 in [START_REF] Goldreich | Computational Complexity -A Conceptual Perspective[END_REF], or Definition 5.3 in [START_REF] Arora | Computational Complexity -A Modern Approach[END_REF]). Another example is the exponentialtime hierarchy (see, e.g. [START_REF] Hartmanis | The Structural Complexity Column: The Collapsing Hierarchies[END_REF]). 4 It is well known that the problem of determining validity of quantified Boolean formulas (QBF) has a complete subproblem for every level of PH. Consider a quantified Boolean formula ϕ := ∃r ∀p 1 ∃q 1 . . . ∀p n ∃q n . ψ, n ≥ 0, with quantifier-free ψ, which is a Boolean combination of propositional variables from the set r ∪ p1 ∪ . . . ∪ pn ∪ q1 ∪ . . . ∪ qn . All valid formulas of this shape together form a complete problem for the (2n + 1)-st level of PH. When we remove the trailing existential quantifier block, we obtain a problem that is complete for the (2n)-th level.

A weaker form of Theorem 5.0.3, based on the number of quantifier alternations allowed in SF or GBSR sentences rather than the admitted degrees of variable interaction, leads to a similar pattern of increasing computational difficulty, yet based on a different hierarchy of complexity classes. More concretely, for every positive k the set of satisfiable SF-sentences restricted to the quantifier prefix ∃ * (∀ * ∃ * ) k gives rise to a k-NExpTime-complete problem, cf. Figure 5.2 on page 149. The same applies to GBSR. This is easy to see, as every SF or GBSR sentence with at most n ∀∃ quantifier alternations has a degree of at most n. On the other hand, the SF sentences used in Section 5.3 to encode k-NExpTime-hard decision problems need exactly n ∀∃ quantifier alternations.

We have already demonstrated that an analysis of the computational complexity of satisfiability problems can greatly benefit from an analysis of how variables co-occur in atoms instead of exclusively considering the number of occurring quantifier alternations. One instance was the derivation of NExpTime-completeness of MFO-Sat by virtue of Theorem 5.0.3. The reason is simply that the degree of variable interaction might be considerably lower than the number of quantifier alternations.

What we have not yet taken into account is the Boolean structure of sentences. This may widen the scope of our methods considerably and may moreover help understand where the hardness of satisfiability problems stems from. For example, consider a quantified Boolean formula ϕ := ∀p 1 ∃q 1 . . . ∀p n ∃q n . ψ with quantifier-free ψ. As already indicated above, the validity problem for such formulas is complete for the (2n + 1)-st level of PH. But what if, say, ψ has the form i K i ∧ j L j , where the K i and the L j are literals and none of the existential variables in i K i occurs in j L j ? Since two distinct Boolean variables can never co-occur in any atom, ϕ can be transformed into the equivalent formula ∃q 1 . . . qn ∀p 1 . . . pn . ψ by quantifier shifting. Apparently, ϕ belongs to a class of sentences that resides on the second level of the polynomial hierarchy rather than on the (2n + 1)-st. Indeed, propositional variables in quantified Boolean formulas are as separated as first-order variables are in MFO sentences. It is, hence, easy to see that every quantified Boolean formula can be converted into an equivalent ∃ * ∀ * formula. However, this might come at the cost of a super-polynomial blowup in the length of the formula, like we have seen for the MFO case in Theorem 3.2.7. If no such blowup were to occur necessarily, this would indicate a collapse of some levels of PH. Still, it might be worth to reconsider some of the definitions that are based on the shape of quantifier prefixes alone. The ideas sketched in Section 3.6 might also give a good starting point for this endeavor.

Computational Complexity of the Existential Fragments of SF and GBSR

A special case that is worth considering are the ∃ * subfragments of SF and GBSR. It is easy to see that these two classes are the same and coincide with the existential fragment of relational first-order logic. The latter, in turn, is a close relative of propositional logic. We shall refer to this fragment as ∃FO ∃FO and we shall write Horn-∃FO and Korm-∃FO to address its Horn and Krom subfragments, respectively. As ∃FO without equality is essentially as expressive as propositional logic, it is an easy step to reduce the satisfiability problems associated with equality-free ∃FO and its Horn and Krom subfragments to the corresponding fragments of propositional logic. This even applies to ∃FO and Horn-∃FO with equality.

Let SAT , Horn-SAT , and Krom-SAT denote the satisfiability problems associated with the sets of all propositional formulas, propositional Horn formulas, and propositional Krom formulas, respectively. In the literature, Krom-SAT is often called 2SAT. Recall the following well-known results.

Proposition 5.1.1. SAT is NP-complete [START_REF] Cook | The Complexity of Theorem-Proving Procedures[END_REF][START_REF] Levin | Universal Sequential Search Problems[END_REF], Horn-SAT is P-complete [JL77, Kas86, Pla84], and Krom-SAT is NL-complete [START_REF] Neil | New problems complete for nondeterministic log space[END_REF].

In the remainder of the present section we intend to show that (i) satisfiability for ∃FO is NP-complete, (ii) satisfiability for Horn-∃FO is P-complete, (iii) satisfiability for Krom-∃FO without equality is NL-complete. Moreover, we shall see that (iv) satisfiability for Krom-∃FO with equality is complete for NP. The proof of (i) -(iii) proceeds by reductions to the corresponding satisfiability problems for propositional logic and back. This is straightforwardly done by Skolemization as long as we consider only ∃FO sentences without equality, see Lemma 5.1.2. If equality is present in the given ∃FO sentence ϕ, we first Skolemize exhaustively, thus producing ϕ gnd , which is ground and contains only Skolem constants and no non-constant function symbols. Then we use the standard trick to eliminate the equality predicate ≈. We introduce a fresh binary predicate symbol E and replace every equation c ≈ d with the atom E(c, d). Moreover, we add the axioms of a congruence relation for E, i.e. reflexivity, symmetry, transitivity, and compatibility with predicates. Of course, we do not use the universally quantified axioms but rather add their ground instances with respect to all the constant symbols that occur in ϕ gnd . To avoid an exponential blow-up in the case of the axioms regarding compatibility with predicates, we only add the instances that affect non-equational atoms which really occur in ϕ gnd . The result is called ϕ gnd . Let ϕ prop be the propositional formula that results from ϕ gnd by replacing every ground atom A with the propositional variable p A . We observe that len(ϕ prop ) ∈ O len(ϕ) 3 . Moreover, if ϕ is a Horn formula, then ϕ prop is Horn. Notice that the outlined elimination of equality does not preserve the Krom property.

Lemma 5.1.2.

(i) Satisfiability for ∃FO sentences without equality can be decided nondeterministically in poly len(ϕ) time.

(ii) Satisfiability for Horn-∃FO sentences without equality can be decided deterministically in poly len(ϕ) time.

(iii) Satisfiability for Krom-∃FO sentences without equality can be decided nondeterministically using space that is logarithmic in len(ϕ).

Proof. We reduce the above satisfiability problems for ∃FO (sub)fragments to the respective satisfiability problems for propositional logic and vice versa. Let ϕ be an ∃FO sentence without equality. Skolemization of all its existential quantifiers leads to the equisatisfiable ground sentence ϕ gnd in which every atom has the shape P (c 1 , . . . , c m ). Let A 1 , . . . , A k be a complete enumeration of all the atoms -without duplicates -that occur in ϕ gnd . Let q 1 , . . . , q k be a list of pairwise distinct propositional variables. We construct the propositional formula ϕ prop from ϕ gnd by replacing every atom A i with q i . Clearly, any model A of ϕ gnd induces a model B of ϕ prop : B |= q i if and only if A |= A i . Conversely, any model B of ϕ prop induces a Herbrand model A of ϕ: A |= A i if and only if B |= q i . Consequently, deciding satisfiability of ϕ can be reduced to deciding satisfiability of ϕ prop . Moreover, we observe the following properties: Conversely, any propositional formula over the propositional variables q 1 , . . . , q k can be straightforwardly transformed into an equisatisfiable ∃FO sentence ∃y. ψ with quantifier-free ψ over the monadic atoms Q 1 (y), . . . , Q k (y).

Lemma 5.1.3. There is an effective translation T from ∃FO with equality to ∃FO without equality such that for every ∃FO sentence ϕ we have that Proof. We describe the translation T informally. Let ϕ be some ∃FO sentence with equality. Let ϕ Sk be the result of Skolemizing all existential quantifiers in ϕ. Notice that ϕ Sk does not contain any non-constant function symbols. Let E be a binary predicate symbol that does not occur in ϕ Sk and let Ω be the set of all constant symbols occurring in ϕ Sk . We construct the following ground formulas: Claim We define A such that A := B, E A := E B , and c A := c B for every c ∈ Ω. Moreover, for every m-ary predicate symbol P occurring in ϕ and every tuple a 1 , . . . , a m ∈ A we set a 1 , . . . , a m ∈ P A if and only if there is some atom P (c 1 , . . . , c m ) in ϕ for which we have (ii) Satisfiability for Horn-∃FO is P-complete.

ψ refl := c ∈ Ω E(c, c) , ψ symm := c,d ∈ Ω E(c, d) → E(d,
(iii) Satisfiability for Krom-∃FO without equality is NL-complete.

(iv) Satisfiability for Krom-∃FO with equality is NP-complete.

Proof sketch. The membership in the respective complexity classes is settled in Lemmas 5.1.2 and 5.1.3 for (i) -(iii). The membership part of (iv) follows from (i). In order to show hardness for these cases, it remains to reduce the respective SAT problems to the corresponding satisfiability problems for SF.

Let ϕ prop be some propositional sentence and let q 1 , . . . , q k be a complete list of all propositional variables occurring in ϕ prop (without duplicates). Let y 1 , . . . , y k be pairwise distinct first-order variables. We construct the first-order sentence ∃ȳ. ϕ from ϕ prop by replacing every q i by the atom P (y i ) and adding the quantifier block ∃y 1 . . . y k to the front. By similar arguments as we have used in the proof of Lemma 5.1.2, we can show that ϕ prop is satisfiable if and only if ϕ is satisfiable. Moreover, we observe the following properties: The outlined construction polynomially reduces SAT, Horn-SAT, and Krom-SAT to the respective satisfiability problems for ∃FO, Horn-∃FO, and Krom-∃FO, all without equality.

It remains to show the NP-hardness part of (iv). We reduce 3SAT -the satisfiability problem for propositional formulas in CNF in which each clause contains at most three literals -, which was shown to be NP-hard by Cook [START_REF] Cook | The Complexity of Theorem-Proving Procedures[END_REF]. 5 Let ϕ := ϕ 3 ∧ ϕ ≤2 be any propositional formula in conjunctive normal form where ϕ 3 is a conjunction of clauses that contain exactly three literals each and ϕ ≤2 is a conjunction of clauses with at most two literals each. Our first step will be to transform ϕ into an equisatisfiable formula such that all clauses with three literals are Horn and do not share any propositional variables. To achieve this goal, we introduce fresh propositional variables together with definitions of the form p ↔ q or p ↔ ¬q, each of which can readily be transformed into two two-literal clauses, respectively. Put more precisely, we construct two propositional formulas ϕ 3 and ϕ def such that (d) ϕ def is a conjunction of formulas of the form p ↔ q or p ↔ ¬q with p = q;

(e) ϕ 3 is a conjunction of pairwise variable-disjoint Horn clauses;

(f) every clause in ϕ 3 contains exactly three literals, exactly one positive literal, and exactly three pairwise distinct propositional variables;

(g) none of the propositional variables in ϕ 3 occurs in ϕ ≤2 and each of the variables in ϕ 3 occurs in exactly one clause in ϕ def , (h) we have ϕ 3 ∧ ϕ def ∧ ϕ ≤2 |= ϕ 3 ∧ ϕ ≤2 and every satisfying assignment for ϕ 3 ∧ ϕ ≤2 can be extended to some satisfying assignment for ϕ 3 ∧ ϕ def ∧ ϕ ≤2 .

Then, we have ϕ 3 = 1≤i≤m (¬p i ∨ ¬q i ∨ r i ) for some integer m and pairwise-distinct propositional variables p 1 , . . . , p m , q 1 , . . . , q m , r 1 , . . . , r m . Let ϕ 3 be the first-order formula

ϕ 3 := 1≤i≤m (a i ≈ b i ∧ b i ≈ c i → a i ≈ c i )
such that all a 1 , . . . , a m , b 1 , . . . , b m , c 1 , . . . , c m are pairwise-distinct constant symbols. Moreover, let ϕ def result from ϕ def after the following transformations. We replace every atom p i with a i ≈ b i , every atom q i with b i ≈ c i , and every atom r i with a i ≈ c i . In addition, we replace every propositional variable q that occurs in ϕ def but not in ϕ 3 with the first-order atom P q (d) for some fresh predicate symbol P q and some constant symbol d that is different from all the a i , b i , c i . Let ϕ ≤2 be the result of repeating the latter replacement for ϕ ≤2 . Then, the ∃FO sentence ∃a 1 . . . a m b 1 . . . b m c 1 . . . c m d. ϕ 3 ∧ ϕ def ∧ ϕ ≤2 is satisfiable if and only if ϕ 3 ∧ ϕ def ∧ ϕ ≤2 is satisfiable. Finally, notice that every clause in ϕ 3 is an instance of the transitivity axiom of equality and, hence, it is a tautology. Consequently, ϕ 3 ∧ ϕ def ∧ ϕ ≤2 is satisfiable if and only if ϕ := ∃a 1 . . . a m b 1 . . . b m c 1 . . . c m d. ϕ def ∧ ϕ ≤2 is satisfiable, and the latter sentence is equivalent to some Krom-∃FO sentence whose length is linear in len(ϕ ). Moreover, len(ϕ ) is linear in len(ϕ). Therefore, 3SAT is polynomially reducible to the satisfiability problem for Krom-∃FO sentences with equality.

Horn and Krom Special Cases of SF and a Conjecture

It is well known that the restriction to Horn or Krom sentences can tremendously reduce the computational effort required to decide satisfiability of first-order formulas, unless widely believed conjectures in computational complexity theory fail to be true. We have already recalled in Proposition 5.1.1 that this holds true when going from SAT to Horn-SAT or Krom-SAT. But the effect is also known for Horn and Krom variants of BS-Sat and MFO-Sat. Table 5.1 provides an overview of satisfiability problems that are complete for the complexity classes NL, P, NP, PSpace, ExpTime, and k-NExpTime for k ≥ 1. When we understand ∃ * -sentences without equalityafter exhaustive Skolemization -as being essentially equivalent to propositional sentences -cf. Lemma 5.1.2 and its proof -, then we can conceive SAT as a restricted case of SF-Sat, namely ∃ * -SF-Sat (= ∃FO-Sat). Following this train of thought further leads to the correspondence between Horn-SAT and Horn-∃ * -SF-Sat (= Horn-∃FO-Sat) and the correspondence between Krom-SAT and Krom-∃ * -SF-Sat (=Krom-∃FO-Sat).

Given the complexity hierarchies that result from Theorem 5.0.3 together with the fact that the number of ∀∃-alternations in an SF sentence ϕ bounds the degree ∂ ∃ (ϕ) from above, we conclude that 5.1: Some basic complexity classes and corresponding complete problems. Recall that BS stands for the Bernays-Schönfinkel fragment, i.e. BSR without equality. Maslov-Sat denotes the satisfiability problem associated with the Maslov fragment, i.e. the set of satisfiable relational ∃ * ∀ * ∃ * sentences without equality that are Krom, cf. page 26. Except for Maslov-Sat, all mentioned problems can be conceived as special cases of SF-Sat and GBSR-Sat. The lower-bound proof for the Maslov fragment in [START_REF] Denenberg | The Complexity of the Satisfiability Problem for Krom Formulas[END_REF] is based on a ∀ * ∃-sentence that is neither in SF nor in GBSR. SF-Sat restricted to sentences with a ∃ * (∀ * ∃ * ) k quantifier prefix yields a k-NExpTime-complete problem, where 0-NExpTime is understood to be NP. With the results from Table 1, we already know the computational complexity of certain special cases for SF-Sat when restricted to ∃ * and ∃ * ∀ * quantifier prefixes and Krom or Horn form without equality. The following proposition shows that also in the case with equality the restriction to Horn or Krom sentences yields computationally less hard satisfiability problem, unless NExpTime equals ExpTime and/or PSpace.

Proposition 5.2.1. Horn-BSR-Sat is in ExpTime and Krom-BSR-Sat is in PSpace.

Proof sketch. The reduction of Horn-BSR-Sat to Horn-BS-Sat is even simpler than the reduction of Horn-∃FO-Sat with equality to Horn-∃FO-Sat without equality. We again replace ≈ with a fresh binary predicate E and conjoin the equality axioms for E to the original formula: reflexivity, symmetry, transitivity, and compatibility with predicates. As universal quantification is available now, this can be done using BS formulas whose length is polynomial in the underlying vocabulary.

We now turn our attention to the case of Krom BSR sentences. Usually, upper bounds for Krom fragments are shown via a chain argument (cf. [START_REF] Denenberg | The Complexity of the Satisfiability Problem for Krom Formulas[END_REF], and Section 8.3.1 in [START_REF] Börger | The Classical Decision Problem[END_REF]). We recap the idea for Krom-BS-Sat before we use it for the case with equality. Let ψ be a Krom BS sentence without equality after exhaustive Skolemization. We assume that ψ has the shape ∀x. i∈I (L i ∨ K i ) where the L i and K i are literals. This is not a restriction, as every unit clause

L is equivalent to L ∨ L. We denote by G(ψ) G(ψ) = V, E
the directed graph with the following components: The vertex set V is the set of all ground literals that can be built from the predicate and constant symbols in ψ. The edge relation E contains an edge from L to K if and only if ψ contains a clause that has an instance equivalent to L → K. It can be shown that ψ is unsatisfiable if and only if the graph G(ψ) contains a cycle along which some ground atom A and its negation occur (Lemmas 8.3.1, 8.3.4, and 8.3.5 in [START_REF] Börger | The Classical Decision Problem[END_REF]).

A PSpace decision procedure for Krom-BS-Sat then detects such a cycle by nondeterministically choosing the ground atom A as its starting point and then, again nondeterministically, exploring a shortest path to ¬A in G(ψ) by constructing the appropriate instances of clauses L ∨ K nondeterministically one after the other. Notice that such a shortest path is not longer than |V | ≤ len(ϕ) • 2 log(len(ϕ))•len(ϕ) , which yields a termination criterion for the nondeterministic procedure. During that process, the procedure at every step only needs to store the instance A, (an instance of) the current clause L ∨ K, including the direction of the considered edge from G(ψ), and the length of the currently explored path. If a path from A to ¬A has been detected, the procedure starts to seek for a path from ¬A to A. If it succeeds in both directions, the sentence ψ is unsatisfiable. Conversely, the procedure succeeds whenever ψ is unsatisfiable. This entails that checking unsatisfiability for Krom BS sentences is in NPSpace and, hence, that Krom-BS-Sat is in co-NPSpace. But since the two complexity classes coincide with PSpace, which is a consequence of the famous theorems by Savitch [START_REF] Walter | Relationships between nondeterministic and deterministic tape complexities[END_REF] and Immerman and Szelepcsényi [START_REF] Immerman | Nondeterministic Space is Closed Under Complementation[END_REF][START_REF] Szelepcsényi | The Method of Forced Enumeration for Nondeterministic Automata[END_REF], it follows that both problems are in PSpace.

We now extend this idea so that equality can be handled. Consider any Krom BSR sentence ϕ := ∃z∀x. χ with quantifier-free χ. As a first step, we construct the Krom BSR sentence ϕ ϕ from ϕ as follows. Consider each and every clause C in ϕ and let {x 1 , x 2 , x 3 , x 4 } ⊆ x be the set of all universally quantified variables that occur in equations in C. Since C is a Krom clause, this set contains at most four variables. We replace C with the conjunction z1,z2,z3,z4∈z C x 1 /z 1 , . . . , x 4 /z 4 . The resulting sentence ϕ is a Krom BSR sentence with len(ϕ ) ≤ len(ϕ) that maps any z ∈ z to the least z ∼ T z (with respect to ≺). Storing ρ T requires polynomial space only.

The nondeterministic decision procedure for Krom BSR sentences employs the one described above for Krom BS sentences as subroutine. Given any Krom BSR sentence ϕ, the procedure transforms it into some equisatisfiable sentence ϕ in which all variables in equations are existentially quantified, just as described above. Then, the procedure iterates over all rewrite functions ρ T one after another, and considers the sentence ϕ T ϕ T that is a copy of ϕ = ∃z∀x. χ in which every z ∈ z in χ is replaced with the variable ρ(z). In case of ρ(z) = z, the quantifier ∃z is removed from the quantifier prefix. After these replacements, every trivial equation z ≈ z is replaced with the logical constant true, and every equation z ≈ z with z = z is replaced with false. For technical reasons the procedure afterwards removes all logical constants true and false in a way that preserves semantics and so that in the resulting (equivalent) sentence every clause consists of two non-equational literals. Hence, ϕ T is a Krom BS sentence. Now the procedure employs the subroutine described above to check whether ϕ T is unsatisfiable or not, using polynomial space only. If it is, the procedure deletes ϕ T from memory -recall that the original ϕ was kept -and goes on iterating over the rewrite functions ρ T . If ϕ T happens to be satisfiable, then the original ϕ is satisfiable as well. If all the ϕ T with T ⊆ S are found to be unsatisfiable, then the original ϕ is unsatisfiable. To keep track of the iteration over all T ⊆ S, a counter suffices that can be represented with |z| 2 bits. This shows that Krom-BSR-Sat is in PSpace.

It is tempting to try to extrapolate a pattern from the observations in Table 5.1, Proposition 5.2.1, and Theorem 5.0.3, and speculate that ∃ * (∀ * ∃ * ) k -Horn-SF-Sat is complete for k-ExpTime for every k ≥ 1, and that ∃ * (∀ * ∃ * ) k -Krom-SF-Sat is complete for (k -1)-ExpSpace for every k ≥ 2. The overall picture of this conjecture is sketched in Figure 5.2. The conjecture can also be formulated in a more precise way in terms of the degree ∂ ∃ (ϕ) of SF sentences ϕ, i.e. for Horn-SF ≤k -Sat and Krom-SF ≤k -Sat. Then, the ExpTime-completeness of Horn-MFO-Sat fits nicely into the picture, as MFO sentences have degree at most one. The membership of Krom-MFO-Sat in P indicates that this problem is very likely to be easier to solve than what one would have gotten from the extrapolation.

Conjecture 5.2.2. For every positive k we conjecture that Horn-SF ≤k -Sat is complete for k-ExpTime. Moreover, we conjecture that Krom-SF ≤k -Sat is complete for (k -1)-ExpSpace, where

∃ * -Horn-SF-Sat ∃ * -SF-Sat ∃ * -Krom-SF-Sat ∃ * ∀ * -Krom-SF-Sat ∃ * ∀ * -Horn-SF-Sat ∃ * ∀ * ∃ * -SF-Sat ∃ * ∀ * ∃ * -Krom-SF-Sat ? ∃ * ∀ * ∃ * -Horn-SF-Sat ? ∃ * (∀ * ∃ * ) k -Krom-SF-Sat ? ∃ * (∀ * ∃ * ) k -Horn-SF-Sat ? ∃ * (∀ * ∃ * ) k -SF-Sat ∃ * ∀ * ∃ * -Krom-Sat
Figure 5.2: On the left-hand side the conjectured pattern of complexity is shown for the sets of ∃ * (∀ * ∃ * ) k -SF-sentences that are Horn and Krom, respectively. On the right-hand side the known complexity results are depicted. Note that the blue part stems from the complexity of the Maslov fragment.

0-ExpSpace is meant as a synonym for PSpace.

Another hint that may speak in favor of the conjecture that also the satisfiability problems for Krom and Horn SF sentences become harder with an increasing number of quantifier alternations is given by Theorem 3.2.7. In that theorem we have shown the existence of an SF sentence ϕ n , for arbitrary n ≥ 1, that is Krom and Horn and whose shortest BSR equivalent has a length that is n-fold exponential in len(ϕ n ). Of course, all of the above said also applies when we replace SF with GBSR. Hence, the same conjecture can be made for Horn-GBSR ≤k -Sat and Krom-GBSR ≤k -Sat.

Proving Lower Bounds for SF-Sat

In the present section we establish lower bounds regarding the worst-case time complexity of SF-Sat. Our arguments will be based on a particular form of bounded domino (or tiling) problems developed by Grädel (see [START_REF] Grädel | On solvable cases of Hilbert's 'Entscheidungsproblem[END_REF] and [START_REF] Börger | The Classical Decision Problem[END_REF], Section 6.1.1). By Z t we denote the set of integers {0, . . . , t -1} for any positive t ≥ 1. Definition 5.3.1 (Bounded domino systems, cf. Definition 6.1.1 in [START_REF] Börger | The Classical Decision Problem[END_REF]). A domino system D := D, H, V D = D, H, V is a triple where D is a finite set of tiles and H, V ⊆ D × D are binary relations determining the allowed horizontal and vertical neighbors of tiles, respectively. Consider the torus Z 2 t := Z t × Z t and let D := D 0 . . . D n-1 be a word over D of length n ≤ t. The letters of D represent tiles. We say that D tiles the torus Z 2 t with initial condition D if and only if there exists a mapping τ : Z 2 t → D such that for every x, y ∈ Z 2 t the following conditions hold, where "+1" denotes increment modulo t. Notice that Definition 5.3.1 is similar to Definition 3.3.1 on page 41, where we introduced unconstrained domino problems. The main difference lies in the fact that the bounded variant of domino systems speaks about tiling a torus, i.e. a finite space, in contrast to an infinite plane.

Definition 5.3.2 (Bounded domino problems, cf. Definition 6.1.5 in [START_REF] Börger | The Classical Decision Problem[END_REF]). Let T : N → N be a function representing some time bound and let D := D, H, V be a domino system. The problem DOMINO(D, T (n)) DOMINO is the set of those words D over the alphabet D for which D tiles Z 2 T (|D|) with initial condition D.

Bounded domino problems provide a convenient way of deriving lower bounds via reductions. Suppose we are given some well-behaved time bound T (n) that grows sufficiently fast. Further assume there is a reasonable translation from DOMINO(D, T (n)) into some problem L where the length of the results is bounded from above by some function g(n). It then follows that the time required to solve the hardest instances of L lies in Ω T (h(n)) , where h(n) may be conceived as an inverse of g(n) from an asymptotic point of view. Proposition 5.3.6 shall formalize this observation. But before we write it down, we need some more results to establish the link between resource-bounded Turing machines and bounded domino problems. Moreover, in order to derive hardness results for (subproblems of) SF-Sat via the reductions from bounded domino problems, we need more knowledge about the computational hardness of these problems.

Proposition 5.3.3 ([BGG97], Theorem 6.1.2). Let M be a simple nondeterministic one-tape Turing machine with input alphabet Γ. Then there is a domino system D = D, H, V and a linear-time reduction which takes any input w ∈ Γ * to some word D ∈ D * with |w| = |D| such that (a) if M accepts w in time t 0 with space s 0 , then D tiles Z s × Z t with initial condition D for all s ≥ s 0 + 2 and t ≥ t 0 + 2;

(b) if M does not accept w, then D does not tile Z s × Z t with initial condition D for any s, t ≥ 2.

By a simple Turing machine simple Turing machines the authors of [BGG97] mean a nondeterministic one-tape Turing machine M over the input alphabet Γ that meets the following conditions: "The alphabet of M contains Γ and at least one other symbol (blank). M works on a semi-infinite tape and never tries to move left from the left-most tape cell. At every stage of the computation there is some s such the tape cells 0, . . . , s contain only non-blank symbols, all other tape cells contain ; in particular, to the right of a blank only other blanks may appear. Furthermore, we assume that M has a unique accepting configuration: the machine is in the unique accepting state q a , the tape contains only blanks and the head is in position 0.

These conditions do not restrict computational power. Every language accepted in time T (n) and space S(n) by some one-tape nondeterministic Turing machine is accepted within the same time and space bounds by a simple Turing machine, as long as S(n), T (n) ≥ 2n."

[BGG97], page 243 Proposition 5.3.4 ([BGG97], Theorem 6.1.6). We call a function T : N → N time constructible if there exists a deterministic Turing machine making precisely T (n) steps on inputs of length n. Let T : N → N be a time-constructible function with T (dn) 2 ∈ o(T (n)) for some constant d > 0. There exists a domino system D and a constant c > 0 such that DOMINO(D, T (n)) ∈ NTIME(T (cn)).

Definition 5.3.5 (Polynomially reducible, cf. Definition 6.1.7 in [START_REF] Börger | The Classical Decision Problem[END_REF]). Let Γ, ∆ be two alphabets and let L ⊆ Γ * and K ⊆ ∆ * be two problems (formal languages). Moreover, let g : N → N be some function. We say that L is polynomially reducible to K via length order g(n), denoted L ≤ g(n) K, if there exists a total mapping f : Γ * → ∆ * which is computable in polynomial time such that for every w ∈ Γ * we have |f (w)| ≤ O g(|w|) and f (w) ∈ K if and only if w ∈ L.

Hence, in order to prove that there is some n 0 such that d • 2 ↑ n/2 2 ≤ 2 ↑n holds for every n ≥ n 0 , it suffices to show that there is some n 0 such that

d + 2 ↑ n/2 -2 ≤ 2 ↑n-2
where d := log 2 (log 2 d + 2). The proof thus boils down to asking whether the difference 2 ↑n-2 -2 ↑ n/2 -2 exceeds any constant value d for sufficiently large n. This is certainly the case.

The following lemma contains the key technical result of the present section: reductions of bounded domino problems to SF ≤k -Sat, for any positive k, and SF-Sat, respectively. Lemma 5.3.9.

(i) Fix some positive integer k > 0 and let D be any domino system. Let Sat(SF ∂ ∃ ≤k ) be the set containing all satisfiable SF sentences ϕ whose degree ∂ ∃ (ϕ) is at most k. We have

DOMINO D, 2 ↑k (n) ≤ n•log n Sat(SF ∂ ∃ ≤k ).
(ii) Fix some positive integer m > 1 and let D be any domino system. Let Sat(SF) be the set containing all satisfiable SF sentences. We have DOMINO(D, 2 ↑n (m)) ≤ n 2 •log n Sat(SF).

Having these reduction results at hand (we shall prove them shortly), Proposition 5.3.6 implies the following lower bounds regarding the time required to decide instances of SF ≤k -Sat and SF-Sat.

Theorem 5.3.10. There are positive constants c, d > 0 for which

Sat(SF ∂ ∃ ≤k ) ∈ NTIME 2 ↑k (cn/ log n) and Sat(SF) ∈ NTIME 2 ↑d• √ n/ log n (2) .
Theorem 5.3.10 provides lower bounds regarding the time needed to decide SF-Sat and its subproblems in the worst-case. However, hardness for k-NExpTime, say, does not follow immediately. As Proposition 5.3.3 provides a reduction from the acceptance problem for nondeterministic T (n)time-bounded Turing machines to bounded domino problems DOMINO(D, T (n)) and Lemma 5.3.9 provides a reduction from such domino problems to subproblems of SF-Sat, we obtain the following hardness result.

Theorem 5.3.11. For every positive integer k, the problem SF ≤k -Sat is k-NExpTime-hard.

It is worth mentioning that Theorems 5.3.10 and 5.3.11 even hold for SF without equality, see Section 5.3.3. In the rest of the present section we outline the reductions described in Lemma 5.3.9.

Enforcing a Large Domain in SF

Recall that we intend to encode a given domino system D = D, H, V -for nonempty D, H, V -plus an initial condition D into an SF sentence ϕ such that ϕ is satisfiable if and only if D ∈ DOMINO(D, T i (|D|)) with T 1 (n) = 2 ↑κ (n) for any fixed κ > 0 and T 2 (n) = 2 ↑n (µ) for any fixed µ > 1. The key issue in the encoding is the formalization of sufficiently large tori in SF. The following description gives a somewhat simplified view. Technical details will follow. For convenience, we allow the use of constant symbols in the encoding. This does certainly not change the computational complexity of SF-Sat.

We shall devise a satisfiable SF sentence whose models contain a grid of size t × t, where t defines the required computing time and we assume t := 2 ↑κ (µ) for positive integers κ and µ > 1 that we consider as parameters of the construction.

κ, µ

Every point p on the grid is represented by a pair p = x, y , where each of the coordinates x and y may assume a value from 0 to 2 ↑κ (µ) -1. Each of the integers in that range is encoded by a bit string b of length log 2 ↑κ (µ) = 2 ↑κ-1 (µ).

The crux of our approach is that we have to enforce the existence of sufficiently many indices j, namely 2 ↑κ-1 (µ) many, to address the single bits of b. Again, we address each of these indices using a bit string, this time of length 2 ↑κ-2 (µ). Thus, we proceed in an inductive fashion, building up a hierarchy of indices with κ + 1 levels. The lowest level, level zero, is inhabited by µ indices, which we represent by constant symbols with pairwise distinct values. For every ≥ 1 any index j on the -th level is represented by a bit string consisting of 2 ↑ -1 (µ) bits, i.e. the -th level of the index hierarchy contains 2 ↑ (µ) indices. The i-th bit of an -th-level index j corresponds to the truth value of the atom J( , j, i), where is a constant symbol used to address the -th level of the index hierarchy.

Example 5.3.12. Assume µ = 2 and κ = 3.

index 65536 On every index level, the bits of one index are indexed by the indices from the previous level. We illustrate this for the word 1010 on all levels from 2 down to 0. The bits of 1010 on level two are indexed by bit strings from level one, each of them having a length of two. The bits of the indices of level one are themselves indexed by objects of level zero which are some values c 1 , c 2 assigned to the constant symbols c 1 , c 2 . To improve readability, we connect the bits of words by dashes.

level 2: 1----0----1----0 ↑ ↑ ↑ ↑ level 1: 1-1 1-0 0-1 0-0 ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ level 0: c 2 c 1 c 2 c 1 c 2 c 1 c 2 c 1
For technical reasons the number of indices per level shall grow slightly slower in our formalization than described above (cf. Lemma 5.3.14). The described index hierarchies can be encoded by SF formulas with the quantifier prefix ∃ * (∀∃) κ that have a length that is polynomial in κ and µ. We use the following constant and predicate symbols with the indicated meaning: 0, 1, . . . , κ constant symbols addressing the levels from 0 to κ, c 1 , . . . , c µ addresses the indices at level 0, d 1 , . . . , d κ d is the min. index at level , e 1 , . . . , e κ e is the max. index at level , L( , j)

index j belongs to level , MinIdx( , j) j is a min. index at level , MaxIdx( , j) j is a max. index at level , J( , j, i, b) the i-th bit of the index j at level is b, J * ( , j, i, b) b = 1 indicates that all the bits of the index j that are less significant than j's i-th bit are 1, Succ( , j, j ) j is the successor index of j at level . On every level we implicitly establish an ordering over the indices of that level, from which we derive the concepts of minimal and maximal indices for each level. For this purpose, we use the usual ordering on natural numbers encoded in binary. Moreover, we formalize the usual successor relation by the predicate Succ. The idea underlying the formalization of binary successor is inspired by [START_REF] Börger | The Classical Decision Problem[END_REF] (proof of Theorem 6.2.13) and is sketched in the following example. It is based on the observation that a bit sting b n . . . b 0 is the successor of b n . . . b 0 , if we have for every i,

0 ≤ i ≤ n, that b i = b i ⊕ (b i-1 ∧ . . . ∧ b 0 ) ,
where ⊕ denotes the exclusive OR operation.

Example 5.3.13. Consider the index j := 1011, which resides on the second level of the index hierarchy. The indices of the first level are 00, 01, 10, 11. In terms of the predicates J and J * , we

A major difficulty that we encounter is that we cannot assert the existence of successors simply by adding ∀j∃j . Succ( , j, j ), as j and j would not be separated. Therefore, we fall back on a trick that we have already used in Section 3.3.3 (cf. pages 42-45) when we investigated the expressiveness of SF when only models of a bounded size are considered. We start from the equivalent formula ∀j∃ jj . j ≈ j ∧ Succ( , j, j ), and replace the atom j ≈ j by a subformula eq j, j in which j and j are separated and which expresses a certain similarity between j and j instead of identity. However, we specify the hierarchy of indices in a sufficiently strong way such that the similarity expressed by eq j, j actually coincides with identity. The subformula eq j, j will also reoccur in other places, namely, whenever we need to enforce the existence of successors of one kind or another. It will be the main source of nested quantifier alternations. The depth of the nesting depends linearly on the parameter , which will become at most κ in the construction.

Next, we formalize the described index hierarchies in SF ≤κ . Technically speaking, we will be more liberal than the formal SF syntax allows in that the given sentences will contain constant symbols and will not be in prenex normal form. However, equivalent SF sentences of (almost) the same length can be derived easily. Every formula is accompanied by a brief description of its purpose. We shall try to use as few essentially non-Horn sentences as possible.

ψ 1 := κ =0 κ = 0 = ∀j. L( , j) → ¬L( , j)
Every index belongs to at most one level.

ψ 2 := κ =0 ∀j. MinIdx( , j) → L( , j) ∧ ∀jj . MinIdx( , j) → ¬Succ( , j , j)
A min. index of level belongs to level . A min. index does not have a predecessor.

ψ 3 := κ =0 MinIdx( , d ) ∧ ∀j. MinIdx( , j) → j ≈ d
There is a unique min. index on every level.

ψ 4 := κ =0
∀j. MaxIdx( , j) → L( , j) ∧ ∀jj . MaxIdx( , j) → ¬Succ( , j, j ) A max. index of level belongs to level . A max. index does not have a successor.

ψ 5 := κ =0 MaxIdx( , e ) ∧ ∀j. MaxIdx( , j) → j ≈ e
There is a unique max. index on every level.

ψ 6 := κ =0 ∀jj . Succ( , j, j ) → L( , j) ∧ L( , j )
If j is the successor of j at level , then both j and j belong to level .

ψ 7 := κ =0 ∀jj j . ¬Succ( , j, j) ∧ Succ( , j, j ) ∧ Succ( , j, j ) → j ≈ j ∧ Succ( , j , j) ∧ Succ( , j , j) → j ≈ j
The successor relation is irreflexive. Every index j has at most one successor and at most one predecessor.

ψ 8 := MinIdx(0, c 1 ) ∧ MaxIdx(0, c µ ) ∧ µ-1 i=1 Succ(0, c i , c i+1 )
At level zero we have the sequence c 1 , . . . , c µ of successors, where c 1 is min. and c µ max.

ψ 9 := κ =1 ∀jj i. Succ( , j, j ) ∧ L( -1, i) →
J * ( , j, i, 1) ∧ J( , j, i, 1) → J( , j , i, 0) ∧ J * ( , j, i, 1) ∧ J( , j, i, 0) → J( , j , i, 1) ∧ J * ( , j, i, 0) ∧ J( , j, i, 1) → J( , j , i, 1)

∧ J * ( , j, i, 0) ∧ J( , j, i, 0) → J( , j , i, 0)
Define what it means to be a successor at level , > 0, in terms of the binary increment operation modulo 2 ↑ (µ). This formula resembles the bitwise exclusive OR operation as illustrated in Example 5.3.13.

ψ 10 := κ =1 ∀ji. MinIdx( , j) ∧ L( -1, i) → J( , j, i, 0)
All bits of a minimal index j are 0.

ψ 11 := κ =1 ∀ji. MaxIdx( , j) ∧ MaxIdx( -1, i) → J( , j, i, 1)
Define what it means to be max. (part 1): the most significant bit is 1.

ψ 12 := κ =1 ∀ji. L( , j) ∧ MaxIdx( -1, i) ∧ J( , j, i, 1) → MaxIdx( , j)
Define what it means to be max. (part 2): any index with 1 as its most significant bit is max.

ψ 13 := κ =1 ∀ji. L( , j) ∧ L( -1, i) → J( , j, i, 0) → ¬J( , j, i, 1) ∧ J * ( , j, i, 0) → ¬J * ( , j, i, 1)
No bit of an index is 0 and 1 at the same time. An analogous requirement is stipulated for J * .

ψ 14 := κ =1 ∀ji. L( , j) ∧ MinIdx( -1, i) → J * ( , j, i, 1)
We stipulate J * ( , j, d -1 , 1) for every index j.

ψ 15 := κ =1
∀jii . L( , j) ∧ Succ( -1, i, i ) → J * ( , j, i , 1) ↔ J * ( , j, i, 1) ∧ J( , j, i, 1)

∧ J( , j, i, 0) → J * ( , j, i , 0)

∧ J * ( , j, i, 0) → J * ( , j, i , 0)
Define the semantics of J * as indicating that all bits strictly less significant than the i-th bit are 1.

eq 1 j, j := L(1, j) ∧ L(1, j) ∧ µ i=1 J(1, j, c i , 0) ↔ J(1, j, c i , 0) ∧ J(1, j, c i , 1) ↔ J(1, j, c i , 1)
Base case of equality of indices.

eq j, j := L( , j) ∧ L( , j) ∧ ∀i. L( -1, i) → ∃ i. L( -1, i) ∧ eq -1 i, i ∧ J( , j, i, 0) ↔ J( , j, i, 0) ∧ J( , j, i, 1) ↔ J( , j, i, 1)

Inductive case of equality of indices for > 1.

ψ 16 := κ =1
∀ji. L( , j) ∧ MaxIdx( -1, i) ∧ J( , j, i, 0) → ∃ j. eq j, j ∧ ∃ j . Succ( , j, j )

For every index at level that is not maximal, i.e. whose most significant bit is 0, there exists a successor index.

Until now, we have only introduced sentences that can easily be transformed into SF sentences in Horn form. This follows from the fact that all consequents of implications are either literals or conjunctions of literals. Moreover, all existentially quantified variables are separated from universally quantified variables. To verify this, simple inspection of the formulas suffices, since all quantifiers occur with positive polarity, i.e. within the scope of an even number of (implicit) negation signs.

Regarding the length of the above sentences, we observe the following: len(ψ 1 ) ∈ O(κ 2 log κ), len(ψ 2 ), . . . , len(ψ 7 ), len(ψ 9 ), . . . , len(ψ 15 ) ∈ O(κ log κ), len(ψ 8 ) ∈ O µ(log κ + log µ) , len eq 1 j,j

∈ O µ(log κ + log µ) , len eq j,j ∈ O(log κ) + len eq -1 j,j , len(ψ 16 ) ∈ O κ 2 log κ + κµ(log κ + log µ) .

In total, this yields len(ψ 1 ∧ . . . ∧ ψ 16 ) ∈ O κ 2 log κ + κµ(log κ + log µ) .

The following three sentences do not produce Horn formulas when transformed into CNF. They serve the purpose of removing spurious elements from the model. In particular, χ 3 is essential to enforce large models for κ ≥ 2.

χ 1 := ∀j. L(0, j) → µ i=1 j ≈ c i
On level 0 there are no indices but c 1 , . . . , c µ .

χ 2 := κ =1 ∀ji. L( , j) ∧ L( -1, i) → J( , j, i, 0) ∨ J( , j, i, 1)
We stipulate totality for the predicate J. χ 3 := κ =1 ∀jj . L( , j) ∧ L( , j ) → ∃ j. eq j, j ∧ ∃ j . eq j , j ∧ ∀ i. L( -1, i) → J( , j, i, 0) ↔ J( , j , i, 0) → j ≈ j Two indices at the same level that agree on all of their bits are required to be identical.

Notice that χ 3 is (almost) an SF sentence, since the ∀ i turns into a ∃ i as soon as we bring the sentence into prenex normal form. Regarding the length of χ 1 , χ 2 , χ 3 , we observe len(χ 1 ) ∈ O(log κ+µ log µ), len(χ 2 ) ∈ O(κ log κ), and len(χ 3 ) ∈ O κ 2 log κ + κµ(log κ + log µ) . Hence, we overall have len(

χ 1 ∧ χ 2 ∧ χ 3 ) ∈ O κ 2 log κ + κµ(log κ + log µ) .
This finishes the formalization of the index hierarchy. Before we go on with the formalization of tiling problems -starting from page 163 -, we shall make sure that the formalization of the hierarchy is correct. More concretely, we aim to show that in any model A of the sentence ψ 1 ∧ . . . ∧ ψ 16 ∧ χ 1 ∧ χ 2 ∧ χ 3 every level contains exactly 2 ↑ (µ -1) + 1 indices and that for every level the successor relation Succ induces a unique chain in which all the indices of level are lined up in a linear fashion. To this end, for the rest of this subsection, we fix any model A of the sentence ψ 1 ∧ . . . ∧ ψ 16 ∧ χ 1 ∧ χ 2 ∧ χ 3 . Lemma 5.3.14 (Short version of Lemma 5.3.23). For every = 0, . . . , κ let I

I := a ∈ A | A |= L( , a)
and let the relation ≺ ⊆ I × I a ≺ a be defined such that a ≺ a holds if and only if A |= Succ( , a, a ). Then, for every = 1, . . . , κ we have |I | = p where p := 2 |I -1 |-1 + 1 = 2 ↑ (µ -1) + 1. Moreover, there is a unique chain a 1 ≺ . . . ≺ a p comprising all elements in I , and we have a 1 = d A and a p = e A .

Leaving out the non-Horn parts χ 1 , χ 2 , χ 3 renders the lemma invalid for > 1. On the other hand, for κ = 1 the sentence ψ 1 ∧ . . . ∧ ψ 16 -which can be transformed into an equivalent Horn sentence -has only models A for which I 1 contains at least 2 µ-1 + 1 elements. This observation could be used to derive ExpTime-hardness of Horn-SF ≤1 -Sat. But since the subproblems Horn-MFO-Sat and Horn-BSR-Sat are already known to be ExpTime-hard (cf. Table 5.1), we would not gain new insights.

We now embark on proving Lemma 5.3.14 (via proving its extended version, Lemma 5.3.23).

Definition 5.3.15. In addition to the sets and relations defined in Lemma 5.3.14, we fix the following notation:

For every = 0, . . . , κ -1 we define F F := {f : I → {0, 1} | f is total and for every a with A |= MaxIdx( , a) we have that f (a) = 1 entails f (b) = 0 for every b = a}. (Intended meaning: Suppose, there is a unique chain a 1 ≺ . . . ≺ a n comprising all elements from I . Then, every function f in F corresponds to a bit string f (a 1 ) . . . f (a n ) (with the least significant bit on the left). Unless we can prove the uniqueness of the above chain, f merely remains an unordered collection of bits, each addressed by some elements from I . The special requirements towards the functions in F regarding maximal indices is due to the technical detail that we define maximal indices to be the ones that are represented by bit strings of the form 10 . . . 0.) For every = 0, . . . , κ -1 and any two total functions f, g : I → {0, 1} we write f g f g if and only if (a) there is some integer p and a unique chain a 1 ≺ . . . ≺ a p comprising all elements in I , and (b) incrementing the bit string f (a 1 )f (a 2 ) . . . f (a p ) (interpreted as number encoded in binary where the leftmost bit is the least significant one) by one yields g(a 1 )g(a 2 ) . . . g(a p ).

For every = 1, . . . , κ and every f ∈ F -1 we define S ,f S ,f := a ∈ I | A |= J( , a, b, f (b)) for every b ∈ I -1 . (Intended meaning: Suppose, there is a unique chain b 1 ≺ -1 . . . ≺ -1 b n comprising all elements from I -1 . Then, the set S ,f ⊆ I comprises all elements from I that are represented by the bit string f (b 1 ) . . . f (b n ). We aim to prove that every S ,f contains exactly one element or, in other words, that every f ∈ F -1 represents exactly one element from I .) For every = 1, . . . , κ and any two elements a, a ∈ I we write a ∼ a a ∼ a if and only if for every b ∈ I -1 we observe A |= J( , a, b, 0) if and only if A |= J( , a , b, 0) and A |= J( , a, b, 1) if and only if A |= J( , a , b, 1).

Proposition 5.3.16. For every , 1 ≤ ≤ κ, ∼ is an equivalence relation.

Proposition 5.3.17. For all distinct , , 0 ≤ , ≤ κ, I and I are disjoint.

Proof. This is a direct consequence of A |= ψ 1 .

Lemmas 5.3.18 to 5.3.22 are auxiliary technical lemmas that will be used in the proof of Lemma 5.3.23. Recall that the relation ≺ over I represents the successor relation on index level induced by the predicate Succ A . Further recall that the relation -1 over F -1 is intended to represent the successor relation over bit strings of length |I -1 |. Roughly speaking, Lemma 5.3.18 shows that, if we link the functions in F -1 with the elements in I via the predicate J A , then the relation -1 reflects the relation ≺ . Lemmas 5.3.19 and 5.3.20 together entail that the sets S ,f ⊆ I resemble the equivalence classes induced by ∼ . Lemma 5.3.21 states that the functions in any F can be uniquely arranged into a chain f 1 . . . f p , provided that there is a corresponding unique chain a 1 ≺ . . . ≺ a p of all elements from I . Lemma 5.3.22 establishes the existence of such a unique chain a 1 ≺ 0 . . . ≺ 0 a µ for the elements in I 0 . Finally, Lemma 5.3.23 brings it all together and, roughly speaking, states that (a) the relations ∼ coincide with the semantics of eq j, j under A, (b) each of the sets S ,f , which resemble the equivalence classes of ∼ , contains exactly one element, and (c) the elements of any set I can be uniquely arranged in a chain a 1 ≺ . . . ≺ a p with p = |F -1 | = 2 ↑ (µ -1) + 1.

Lemma 5.3.18. Let a, a ∈ I for some , 1 ≤ ≤ κ. Let f, g : I -1 → {0, 1} be two total functions such that for every b ∈ I -1 we have A |= J( , a, b, f (b)) and A |= J( , a , b, g(b)). Moreover, we assume that there is a unique chain c 1 ≺ -1 . . . ≺ -1 c p comprising all elements in I -1 . Then a ≺ a implies f -1 g.

Proof.

Since c 1 is the only element in I -1 for which there is no element c

∈ I -1 with c ≺ -1 c 1 , A |= ψ 2 ∧ ψ 3 implies A |= MinIdx( -1, c 1 ). Let f * : I -1 → {0, 1} be defined such that f * (b) = 0 if and only if A |= J * ( , a, b, 0) and f * (b) = 1 if and only if A |= J * ( , a, b, 1).
This function is well-defined because of A |= ψ 13 . Due to A |= χ 2 ∧ ψ 14 ∧ ψ 15 it is also total.

A |= ψ 14 enforces A |= J * ( , a, c 1 , 1), i.e. f * (c 1 ) = 1. Moreover, for any k with 1 < k ≤ p we have f * (c k ) = 1 if and only if f (c 1 ) = . . . = f (c k-1 ) = 1, because of A |= ψ 15 . A |= ψ 9 together with our assumption a ≺ a translates to the following property, which we phrase in terms of operations on bits: for every k, 1 ≤ k ≤ p, we observe g(c k ) = f (c k ) ⊕ f * (c k ) where ⊕ denotes exclusive OR. But this corresponds to an increment of the bit string f (c 1 ) . . . f (c p ) by one (where f (c 1 ) is the least significant bit). Hence, f -1 g.

Lemma 5.3.19. Let a, a ∈ I for some , 1 ≤ ≤ κ. If a and a belong to the same S ,f for some function f ∈ F -1 , then a ∼ a .

Ad (v). Consider any set S 1,f . By virtue of (iii), S 1,f contains at least one element. Suppose we are given two elements a, a in S 1,f . By virtue of Lemma 5.3.19, this means a ∼ 1 a . Because of A |= χ 3 , there are two elements a, a ∈ I 1 for which (i) entails a ∼ 1 a and a ∼ 1 a . By symmetry and transitivity of ∼ 1 , we have a ∼ 1 a . Hence, we observe

A |= ∀ i. L( -1, i) → J( , a, i, 0) ↔ J( , a , i, 0) .
Consequently, A |= χ 3 leads to a = a .

Ad (vi). As we have seen in the proof of Lemma 5.3.21, we can define a bijective mapping ρ that maps the functions in F 0 to bit strings of length µ that either have a 0 as most significant bit or correspond to 10 . . . 0. Let p := 2 µ-1 + 1. By virtue of Lemma 5.3.21, we can uniquely construct a chain

f 1 0 f 2 0 . . . 0 f p comprising all functions in F 0 .
Properties (iv) and (v) together yield that I 1 = {a 1 , . . . , a p } where a k ∈ S 1,f k for every k = 1, . . . , p. Lemma 5.3.18 says that for any a k , a k with a k ≺ 1 a k we also observe f k 0 f k . By definition of 0 and the fact that all the f k , f k are distinct, we infer that

f k 0 f k implies k = k + 1 and 1 ≤ k < k ≤ p. Hence, a k ≺ 1 a k can only hold if k = k + 1 and 1 ≤ k < k ≤ p.
Consider any element a ∈ I 1 for which A |= J(1, a, c µ , 0). By A |= ψ 16 , we know that there are elements a, a ∈ I 1 such that a ≺ 1 a and A, [j →a, j → a] |= eq 1 j, j . By (i), the latter translates to a ∼ 1 a. Let g, g be functions such that a ∈ S 1,g and a ∈ S 1, g . Such functions exist by virtue of (iv). However, a ∼ 1 a entails g = g, by Lemma 5.3.20. But then (v) leads to a = a. Consequently, we have a ≺ 1 a . By (v), this means that all but one element in I 1 must have a ≺ 1 -successor in I 1 and all but one elements in I 1 are ≺ 1 -successors in I 1 . Hence, we obtain the chain a 1 ≺ 1 a 2 ≺ 1 . . . ≺ 1 a p-1 ≺ 1 a p where a 1 = d A 1 and a p = e A 1 .

Inductive case > 1.

Ad (i). Due to the assumption A, [j →a, j → a] |= eq j, j with > 1, the construction of eq j, j entails

A |= ∀i. L( -1, i) → ∃ i. L( -1, i) ∧ eq -1 i, i ∧ J( , a, i, 0) ↔ J( , a, i, 0) ∧ J( , a, i, 1) ↔ J( , a, i, 1)
.

By inductive application of (i), A, [i →b, i → b] |= eq -1 i, i entails b ∼ -1 b.
Inductive application of (iv) implies that b ∈ S -1,f for some f ∈ F -1 . By Lemma 5.3.20 together with b ∼ -1 b, we conclude b ∈ S -1,f . Now, inductive application of (v) leads to b = b. This means we in fact have a,i,1) .

A |= ∀i. L( -1, i) → J( , a, i, 0) ↔ J( , a, i, 0) ∧ J( , a, i, 1) ↔ J( ,
In other words, a ∼ a.

Ad (ii)

. By definition of ∼ , a ∼ a entails that for every b ∈ I -1 we have A |= J(1, a, b, 0) if and only if A |= J(1, a, b, 0) and A |= J(1, a, b, 1) if and only if A |= J(1, a, b, 1). By (i) and the fact that ∼ -1 is an equivalence relation and thus b ∼ -1 b, we conclude A, [i →b, i →b] |= eq -1 i, i for every b ∈ I -1 . Consequently, A, [j →a, j → a] |= eq j, j . Ad (iii). By inductive application of (vi), we know that there is a unique chain b 1 ≺ -1 . . . We next show that for every k,

1 ≤ k < p , if S ,f k is nonempty, then S ,f k+1 is nonempty.
Let a be an element of S ,f k . Because of k < p , we know that A |= J( , a, b p , 0). By virtue of (i) and due to A |= ψ 16 we conclude that there are elements a, a ∈ I such that a ∼ a and a ≺ a . Moreover, Lemma 5.3.20 leads to a ∈ S ,f k . By Lemma 5.3.18, this results in a ∈ S ,f k+1 .

Ad (iv). We have f ∈F -1 S ,f ⊆ I by definition of the sets S ,f . It thus remains to show I ⊆ f ∈F -1 S ,f . As a consequence of A |= ψ 13 there is a unique partial mapping g a : I -1 → {0, 1} for every a ∈ I such that for every b ∈ I -1 we have A |= J( , a, b, g a (b)) if and only if g a is defined for b. Because of A |= χ 2 , we know that g a must be total.

For every a ∈ I where g a (e A -1 ) = 0 we have g a ∈ F -1 and thus also a ∈ S ,ga . Because of A |= ψ 5 ∧ ψ 11 ∧ ψ 12 we know that A |= MaxIdx( , e ) and that e A is the only element e ∈ I for which we have A |= J( , e, e -1 , 1). It remains to show that for every b ∈ I -1 with b = e A -1 we have A |= J( , e , b, 0). But this is a consequence of (iii) and the fact that the total function f * mapping all elements b in I -1 but e A -1 to f * (b) = 0 belongs to F -1 , and thus S ,f * is nonempty. In particular, S ,f * = {e A }. Consequently, I cannot contain any elements that do not lie in f ∈F -1 S ,f . Ad (v). Consider any set S ,f . By virtue of (iii), S ,f contains at least one element. Suppose we are given two elements a, a in S ,f . By virtue of Lemma 5.3.19, this means a ∼ a . Because of A |= χ 3 , there are two elements a, a ∈ I for which (i) entails a ∼ a and a ∼ a . By symmetry and transitivity of ∼ , we have a ∼ a . Hence, we observe

A |= ∀ i. L( -1, i) → J( , a, i, 0) ↔ J( , a , i, 0) .
Consequently, A |= χ 3 leads to a = a .

Ad (vi).

As we have seen in the proof of Lemma 5.3.21, we can define a bijective mapping ρ that maps the functions in F -1 to bit strings of length µ that either have a 0 as most significant bit or correspond to 10 . . . 0. Let p := 2 |I -1 |-1 + 1. By virtue of Lemma 5.3.21, we can uniquely construct a chain

f 1 -1 f 2 -1 . . . -1 f p comprising all functions in F -1 .
Properties (iv) and (v) together yield that I = {a 1 , . . . , a p } where a k ∈ S ,f k for every k = 1, . . . , p . Lemma 5.3.18 says that for any a k , a k with a k ≺ a k we observe f k -1 f k . By definition of -1 and the fact that all the f k , f k are distinct,

f k -1 f k implies k = k + 1 and 1 ≤ k < k ≤ p . Hence, a k ≺ a k can only hold if k = k + 1 and 1 ≤ k < k ≤ p .
Consider any element a ∈ I for which A |= J( , a, e -1 , 0). By A |= ψ 16 , we know that there are elements a, a ∈ I such that a ≺ a and A, [j →a, j → a] |= eq j, j . By (i), the latter translates to a ∼ a.

Let g, g be functions such that a ∈ S ,g and a ∈ S , g . Such functions exist by virtue of (iv). However, a ∼ a entails g = g, by Lemma 5.3.20. Moreover, (v) leads to a = a. Consequently, we have a ≺ a . By (v), this means that all but one element in I must have a successor in I and all but one element in I are successor in I . Hence, we obtain the chain a 1 ≺ a 2 ≺ . . . ≺ a p -1 ≺ a p where a 1 = d A and a p = e A .

Formalizing a Tiling of a Torus

In order to formalize a given domino system D = D, H, V and an initial condition D, we introduce the following constant symbols and predicate symbols:

H(x, y, x , y )

x , y is the horizontal neighbor of x, y , i.e. x = x + 1 (mod 2 ↑κ (µ -1) + 1) and y = y, V (x, y, x , y )

x , y is the vertical neighbor of x, y , D(x, y)

x, y is tiled with D ∈ D, f 1 , . . . , f |D| constant symbols addressing the points 0, 0 , . . . , |D| -1, 0 . With the ideas we have used to formalize the index hierarchy in the previous section, it is now fairly simple to formalize the torus. The following sentences encode a given domino system D := D, H, V plus an initial condition D, which is a finite word over D. We try to make as many sentences as possible equivalent to Horn sentences. Brief descriptions of the intended meaning are added for selected parts.

η 1 := ∀xyx y . H(x, y, x , y ) → L(κ, x) ∧ L(κ, y) ∧ L(κ, x ) ∧ L(κ, y ) ∧ y ≈ y η 2 := ∀xyx y i. H(x, y, x , y ) ∧ MaxIdx(κ -1, i) ∧ J(κ, x, i, 0) → Succ(κ, x, x ) η 3 := ∀xyi. L(κ, x) ∧ L(κ, y) ∧ MaxIdx(κ -1, i) ∧ J(κ, x, i, 0) → ∃ x. eq κ x, x ∧ ∃ y. eq κ y, y ∧ D∈D D(x, y) ↔ D( x, y) ∧ ∃ x . H( x, y, x , y)
η 3 ensures that every point not on the horizontal "edge" of the torus has a horizontal neighbor. η 4 to η 6 establish the points 2 ↑κ (µ -1) + 1, y and 0, y as horizontal neighbors for every y.

η 7 := ∀xyx y . V (x, y, x , y ) → L(κ, x) ∧ L(κ, y) ∧ L(κ, x ) ∧ L(κ, y ) ∧ x ≈ x η 8 := ∀xyx y . V (x, y, x , y ) ∧ MaxIdx(κ -1, i) ∧ J(κ, y, i, 0) → Succ(κ, y, y ) η 9 := ∀xyi. L(κ, x) ∧ L(κ, y) ∧ MaxIdx(κ -1, i) ∧ J(κ, y, i, 0) → ∃ x. eq κ x, x ∧ ∃ y. eq κ y, y ∧ D∈D D(x, y) ↔ D( x, y) ∧ ∃ y . V ( x, y, x, y )
η 9 ensures that every point not on the vertical "edge" of the torus has a vertical neighbor.

η 10 := ∀xyy . MaxIdx(κ, y) ∧ MinIdx(κ, y ) → V (x, y, x, y ) η 11 := ∀xx yy . V (x, y, x , y ) ∧ MaxIdx(κ, y) → MinIdx(κ, y ) η 12 := ∀xx yy . V (x, y, x , y ) ∧ MinIdx(κ, y ) → MaxIdx(κ, y)
η 10 to η 12 establish the points x, 2 ↑κ (µ -1) + 1 and x, 0 as vertical neighbors for every x. η 15 and η 16 ensure that the rules of the domino system D are obeyed. These are the only essentially non-Horn sentences among η 1 to η 28 .

η 17 := ∀z. MinIdx(κ, z) → f 1 ≈ z ∧ n-1 i=1 H(f i , z, f i+1 , z) η 18 := ∀z. MinIdx(κ, z) → n i=1 D i (f i , z)
η 17 and η 18 express the initial condition D, i.e. the lower left domino tiles are predefined to be

the sequence D = D 1 . . . D n .
Regarding the length of the sentences η 1 , . . . , η 18 , we observe the following: len(η 1 ), len(η 2 ), len(η 4 ), . . . , len(η 8 ), len(η 10 ), . . . , len(η 12 ) ∈ O(log κ),

len(η 3 ), len(η 9 ) ∈ O κ log κ + µ(log κ + log µ) + |D| log |D| , len(η 13 ) ∈ O |D|(log |D| + log κ) , len(η 14 ) ∈ O |D| 2 log |D| , len(η 15 ) ∈ O |H| log |D| = O |D| 2 log |D| , len(η 16 ) ∈ O |V| log |D| = O |D| 2 log |D| , len(η 17 ) ∈ O log κ + n log n , len(η 18 ) ∈ O log κ + n(log n + log |D|) .
In total, the length of η 1 ∧ . . . ∧ η 18 lies in O n log n , where n := max{κ, µ, n, |D| 2 }.

Next, we show correctness of the formalization. More concretely, we aim to prove that any model of ψ 1 ∧ . . . ∧ ψ 16 ∧ χ 1 ∧ χ 2 ∧ χ 3 ∧ η 1 ∧ . . . ∧ η 18 induces a tiling τ of Z 2 r for r := 2 ↑κ (µ -1) + 1 and with initial condition D := D 1 , . . . , D n . This will be the statement of Lemma 5.3.27.

For the remainder of this subsection we assume that A A indeed satisfies the sentence ψ 1 ∧ . . . ∧ ψ 16 ∧ χ 1 ∧ χ 2 ∧ χ 3 ∧ η 1 ∧ . . . ∧ η 18 . Moreover, we take over the notation from Lemma 5.3.14 and Definition 5.3.15, e.g. I , ≺ , and ∼ . I , ≺ , ∼

In addition, we define the following relations:

≺ H ≺ H ⊆ I 2 κ × I 2 κ such that a, b ≺ H a , b if and only if A |= H(a, b, a , b ); ≺ V ≺ V ⊆ I 2 κ × I 2 κ such that a, b ≺ V a , b if and only if A |= V (a, b, a , b ).
Roughly speaking, we will show in Lemmas 5.3.24 and 5.3.25 that I κ × I κ together with the horizontal and vertical neighborhood relations is isomorphic to the torus Z 2 r for r = 2 ↑κ (µ -1) + 1. Lemma 5.3.26 states that under A for each pair in a, b ∈ I κ × I κ there is exactly one tile D ∈ D assigned to a, b . Finally, Lemma 5.3.27 states that A induces a tiling which starts from the initial condition D. Properties (iv) to (vi) can be proved analogously to the first three properties using A |= η 7 ∧ . . . ∧ η 12 .

Lemma 5.3.25. Let r := 2 ↑κ (µ -1) + 1. There is a bijective mapping ρ :

Z 2 r → I 2 κ ρ such that ρ(0, 0) = d A κ , d A
κ and for every pair s, t ∈ Z 2 r we have ρ(s, t) ≺ H ρ(s + 1, t) and ρ(s, t) ≺ V ρ(s, t + 1) where + stands for addition modulo r.

Proof. By Lemma 5.3.23 we know that there is a unique chain a 1 ≺ κ . . . ≺ κ a r comprising all elements in I κ . Notice that a k , a k with k = k are distinct. We define ρ so that ρ(s, t) := a s+1 , a t+1 for all s, t ∈ Z r = {0, . . . r -1}.

Obviously, ρ is bijective. Since a 1 is the only element in I κ for which there is no b in the above chain with b

≺ κ a 1 , A |= ψ 2 ∧ ψ 3 enforces a 1 = d A κ . Hence, ρ(0, 0) = d A κ , d A κ .
Since a r is the only element in I κ for which there is no b in the above chain with a r ≺ κ b , A |= ψ 4 ∧ ψ 5 enforces a r = e A κ . Hence, Lemma 5.3.24(ii) entails ρ(r -1, t) ≺ H ρ(0, t) for every t ∈ Z r . Moreover, the existence of the above chain together with Lemma 5.3.24(iii) leads to ρ(s, t) ≺ H ρ(s + 1, t) for every s ∈ Z r \ {r -1} and every t ∈ Z r . Consequently, we observe ρ(s, t) ≺ H ρ(s + 1, t) -modulo r -for every pair s, t ∈ Z 2 r . By similar arguments, we infer ρ(s, t) ≺ V ρ(s, t + 1) for every pair s, t ∈ Z 2 r .

Lemma Consequently, the mapping τ constitutes a proper tiling of Z 2 r .

Replacing the Equality Predicate

Since SF can express reflexivity, symmetry, transitivity, and compatibility with predicates, it is easy to formulate an SF sentence without equality that is equisatisfiable to ψ 1 ∧ . . . ∧ ψ 16 ∧ χ 1 ∧ χ 2 ∧ χ 3 ∧ η 1 ∧ . . . ∧ η 18 and uses atoms E(s, t) instead of s ≈ t for any terms s, t. In addition to replacing equational atoms as indicated, we conjoin the necessary axioms concerning the fresh predicate symbol E. More precisely, we add the equivalence axioms

ψ 1 := ∀j. E(j, j) ,
ψ 2 := ∀jj . E(j, j ) → E(j , j) ,

ψ 3 := ∀jj j . E(j, j ) ∧ E(j , j ) → E(j, j ) ,
and congruence axioms, such as

ψ 4 := ∀jj ii . κ =0 E(j, j ) ∧ E(i, i ) ∧ J( , j, i, 0) → J( , j , i , 0) ∧ E(j, j) ∧ E(i, i ) ∧ J( , j, i, 1) → J( , j , i , 1)
and

ψ 5 := ∀xyx y . D∈D E(x, x ) ∧ E(y, y ) ∧ D(x, y) → D(x , y ) .
Overall, the additional formulas have a length that lies in O κ log κ + |D| log |D| . All in all, the encoding of domino problems on large tori that we have devised for SF with equality can also be done in SF without equality. Moreover, notice that all the additional subformulas can be transformed into equivalent Horn sentences.

Chapter 6 Interpolation

In the present chapter we show that several of the decidable first-order fragments introduced in Chapter 3 are closed under interpolation. Craig's interpolation theorem [START_REF] Craig | Linear Reasoning. A New Form of the Herbrand-Gentzen Theorem[END_REF][START_REF] Craig | Three Uses of the Herbrand-Gentzen Theorem in Relating Model Theory and Proof Theory[END_REF] is an important result that has found numerous applications. It is treated in several standard textbooks both from a proof-theoretic perspective, e.g. [START_REF] Troelstra | Basic Proof Theory[END_REF], and a model-theoretic point of view, e.g. [START_REF] Chung | Model Theory[END_REF]. Moreover, Craig's interpolation theorem is often treated together with Beth's definability theorem and Robinson's joint consistency theorem, as the latter two can be elegantly proven using the former, see, e.g. [START_REF] Chung | Model Theory[END_REF][START_REF] Fitting | First-Order Logic and Automated Theorem Proving[END_REF][START_REF] Boolos | Computability and Logic[END_REF]. Historical notes about the early development of interpolation for first-order logic can be found in [START_REF] Troelstra | Basic Proof Theory[END_REF], Section 4.6.3. The PhD thesis of Hoogland provides a comprehensive model-theoretically minded introduction to interpolation, see Section 2.3 in [START_REF] Hoogland | Definability and Interpolation: Model-theoretic investigations[END_REF]. A recent survey regarding systems for interpolant extraction in the context of verification can be found in [START_REF] Bonacina | Interpolation Systems for Ground Proofs in Automated Deduction: a Survey[END_REF]. Proposition 6.0.1 (Craig's interpolation theorem [START_REF] Craig | Linear Reasoning. A New Form of the Herbrand-Gentzen Theorem[END_REF][START_REF] Craig | Three Uses of the Herbrand-Gentzen Theorem in Relating Model Theory and Proof Theory[END_REF]). Let ϕ and ψ be two firstorder sentences. If ϕ |= ψ, then there exists a first-order sentence χ such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol, function symbol, or constant symbol that occurs in χ also occurs in ϕ and in ψ.

The sentence χ is called a Craig interpolant of ϕ and ψ.

Constructive proofs of Craig's interpolation theorem have been given based on several kinds of proof systems, most prominently sequent calculi, see, e.g. [START_REF] Baaz | Methods of Cut-Elimination[END_REF], Section 8.2, or [START_REF] Smullyan | First-Order Logic[END_REF], Chapter XV. A constructive proof based on semantic tableaux is given in [START_REF] Fitting | First-Order Logic and Automated Theorem Proving[END_REF], Section 8.12. An early approach towards a practically useful method to extract interpolants from resolution and paramodulation refutations is due to Huang [START_REF] Huang | Constructing Craig Interpolation Formulas[END_REF]. More recent methods intended for practical use can be found in [START_REF] Bonacina | On Interpolation in Automated Theorem Proving[END_REF][START_REF] Kovács | First-Order Interpolation and Interpolating Proof Systems[END_REF].

Craig's interpolation theorem has been extended and refined in various ways. For instance, there are variants that say more about the syntactic structure of interpolants than just proclaiming the presence or absence of predicate or function symbols. Two such results are due to Lyndon [START_REF] Lyndon | An interpolation theorem in the predicate calculus[END_REF] and Schulte-Mönting [START_REF] Schulte-Mönting | Interpolation formulae for predicates and terms which carry their own history[END_REF]. We shall treat the former in more detail below. The result by Schulte-Mönting stipulates that terms t only occur in an interpolant if t corresponds to sufficiently similar terms s 1 and s 2 that occur in the interpolated formulas. The following example is given in [START_REF] Schulte-Mönting | Interpolation formulae for predicates and terms which carry their own history[END_REF] where C denotes an interpolant of two sentences A and B, i.e. we have A |= B and A |= C and C |= B: "Let f be a unary function symbol and let g(λ), h(λ ) be terms starting with different function symbols g, h. If f occurs in A only in the term f (g(λ)) and in B only in the term f (h(λ )) then f can occur in C only in terms f (y) where y is a bound variable." [START_REF] Schulte-Mönting | Interpolation formulae for predicates and terms which carry their own history[END_REF], page 159.

In contrast to Craig's theorem, Lyndon's interpolation theorem holds only for relational sentences. Consider any formula ϕ. We treat subformulas ϕ 1 → ϕ 2 of ϕ as abbreviations for ¬ϕ 1 ∨ ϕ 2 and subformulas ϕ 1 ↔ ϕ 2 are treated as abbreviations for (¬ϕ 1 ∨ ϕ 2 ) ∧ (¬ϕ 2 ∨ ϕ 1 ). We say that a predicate symbol P occurs positively in ϕ if there is an occurrence of some atom P (. . .) in ϕ that lies within the scope of an even number of negation signs. Analogously, we say that a predicate symbol P occurs negatively in ϕ if there is an occurrence of some atom P (. . .) in ϕ that lies within the scope of an odd number of negation signs. Proposition 6.0.2 (Lyndon's interpolation theorem [START_REF] Lyndon | An interpolation theorem in the predicate calculus[END_REF]). Let ϕ and ψ be two relational first-order sentences. If ϕ |= ψ, then there exists a relational first-order sentence χ, called a Craig-Lyndon interpolant of ϕ and ψ, such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol P occurs positively (negatively) in χ only if it occurs positively (negatively) in ϕ and in ψ.

Otto [Ott00] strengthened Lyndon's theorem for the case that the interpolated formulas are restricted to quantification that is relativized with unary predicates. More precisely, given some set U of unary predicate symbols, a quantified (sub)formula is U -relativized if it is of the form ∀x. P (x) → ϕ or ∃y. P (y) ∧ ϕ for some P ∈ U . Then, any two formulas in which all quantified subformulas are U -relativized have a Craig-Lyndon interpolant in which every quantified subformula is U -relativized as well. Otto emphasizes the multi-sorted reading of this interpolation result, when we regard the unary predicates in U as sort predicates.

Viewed from a different angle, the theorem also entails that the class of U -relativized first-order formulas is closed under Craig-Lyndon interpolation. In this context, the theorem could be considered as a first step towards showing closedness of GF under Craig-Lyndon interpolation. However, this direction has been proven to (almost) be a dead end. It is known that there are pairs of GF sentences that satisfy the requirements of Craig's theorem but do not have an interpolant from GF [START_REF] Hoogland | Beth Definability for the Guarded Fragment[END_REF][START_REF] Hoogland | Interpolation and Definability in Guarded Fragments[END_REF]. The same has been shown for LGF [START_REF] Hoogland | Interpolation in Guarded Fragments[END_REF][START_REF] Hoogland | Interpolation and Definability in Guarded Fragments[END_REF].

However, if the requirements towards interpolants are slightly weakened, closedness of the class of GF sentences with respect to the weaker interpolation property can be recovered. To neatly formulate the result, one needs to distinguish between occurrences of predicate symbols in guards and in positions that are not part of guards (non-guard predicate symbols).

"[T]he guards in the interpolant need not be in the common language but they do occur as a guard in either ϕ or ψ. [...] [T]he non-guards in the interpolant are only required to occur in ϕ and ψ: not necessarily as non-guards."

[HM02], page 389.

By Lemma 3.10.5 and its variant for SGF, this has immediate consequences for SGF and SLGF.

Proposition 6.0.3. SGF and SLGF are not closed under Craig interpolation.

On the other, both fragments are closed under the weaker form of interpolation mentioned above.

Regarding closedness under interpolation, there is good news for GNFO: the class of GNFO sentences is closed under Craig interpolation [START_REF] Bárány | Rewriting Guarded Negation Queries[END_REF]. In [START_REF] Benedikt | Effective Interpolation and Preservation in Guarded Logics[END_REF] effective methods for deriving interpolants for GNFO are given: Craig-Lyndon-style interpolation and also relativized interpolation [START_REF] Otto | An interpolation theorem[END_REF]. By Lemma 3.11.4, this entails closedness under interpolation for SGNFO. Proposition 6.0.4. The class of SGNFO sentences is closed under Craig-Lyndon interpolation.

In the following two sections, we intend to show that the Bernays-Schönfinkel fragment and the Ackermann fragment are both closed under Craig-Lyndon interpolation. As in the case of SGNFO, it follows that SF and GBSR without equality, and GAF have the same interpolation property. Our methods will be of a proof-theoretical nature.

Interpolation for SF and GBSR

In the present, we argue that, given two SF or GBSR sentences ϕ and ψ without equality such that ϕ |= ψ, there is a Craig-Lyndon interpolant χ with ϕ |= χ and χ |= ψ that belongs to the Bernays-Schönfinkel fragment (BS). As both SF and GBSR contain BS, the interpolant χ belongs to SF and GBSR as well. In order to proof this result, we use the fact that SF and GBSR sentences without equality can be translated into equivalent BS sentences (cf. Lemmas 3.2.5 and 3.5.2) and thus reduce the problem to interpolation in BS. Lemma 6.1.9 states that BS is indeed closed under Craig-Lyndon interpolation. The proof describes how interpolants can be constructed using Bachmair and Ganzinger's ordered resolution with selection [BG01] as a proof system. But before we start proving the lemma, we briefly present the used calculus and the required technical notions. Definition 6.1.2 (Lexicographic path ordering, taken over from [START_REF] Baader | Term Rewriting and All That[END_REF]). Let Σ be a finite vocabulary and let be a total strict order on the symbols in Σ, called Σ-precedence. The lexicographic path ordering (LPO) lpo on the set of terms over the vocabulary Σ and Var induced by is defined as follows. For any terms s, t we have s lpo t if and only if

(1) t ∈ vars(s) and s = t, or (2) s = f (s 1 , . . . , s m ), t = g(t 1 , . . . , t n ) with m, n ≥ 0, and (2.1) there exists i, 1 ≤ i ≤ m, with s i lpo t, or (2.2) f g and s lpo t j for all j, 1 ≤ j ≤ n, or (2.3) f = g, s t j for all j, 1 ≤ j ≤ n, and there exists some i, 1 ≤ i ≤ m, such that s 1 = t 1 , . . . , s i-1 = t i-1 and s i lpo t i . Proposition 6.1.3. For any Σ-precedence , the induced LPO lpo satisfies the following properties.

(i) lpo is well-founded, i.e. all chains t 1 lpo t 2 lpo . . . are finite.

(ii) For all terms t, t , every m-ary function symbol f , all terms s 1 , . . . , s m , and every i,

1 ≤ i ≤ m,
we have that t lpo t entails f (s 1 , . . . , s i-1 , t, s i+1 , . . . , s m ) lpo f (s 1 , . . . , s i-1 , t , s i+1 , . . . , s m ) .

(iii) For all terms t 1 , t 2 and every substitution σ we have that t 1 lpo t 2 entails t 1 σ lpo t 2 σ.

(iv) For every term t and every term t that is proper a subterm of t we have t lpo t .

Proof. See Theorems 5.4.8 and 5.4.14 in [START_REF] Baader | Term Rewriting and All That[END_REF].

On the set of ground terms, i.e. terms without variables, any lpo constitutes a total ordering. We lift this total ordering on ground terms to a partial ordering on non-ground terms by stipulating s lpo t if and only if for every substitution σ for which sσ and tσ are ground we have sσ lpo tσ. Moreover, we extend lpo to atoms over the vocabulary Σ and Var by treating predicate symbols like function symbols and atoms like terms. Finally, literals are ordered such that P (. . .) lpo ¬R(. . .) lpo R(. . .) whenever the precedence says P R. Definition 6.1.4 (unifier, mgu). A substitution σ is at least as general as a substitution σ if there exists some substitution τ such that for all variables x we have (xσ)τ = xσ . Given two terms s, t, a unifier of s and t is a substitution σ for which sσ = tσ. A unifier θ is a most general unifier (mgu) of s and t, if θ is a unifier of s and t and if θ is at least as general as any other unifier for s and t. Two terms s and t are called unifiable, if there exists a unifier for s and t. Proposition 6.1.5. If two terms are unifiable, then there exists an mgu θ for s and t.

Proof. By Theorem 4.5.8 in [START_REF] Baader | Term Rewriting and All That[END_REF]. In the context of ordered resolution, we treat clauses as multisets. In particular, the order in which literals occur in clauses does not play a role. Hence, the notation C ∨ L does not mean that the literal L occurs as the right disjunct in a disjunction. It merely denotes a clause in which L may occur in any position, but must occur at least once.

The calculus O S from [START_REF] Bachmair | Resolution Theorem Proving[END_REF] has recently been formalized with the help of the Isabelle proof assistant [START_REF] Schlichtkrull | Formalizing Bachmair and Ganzinger's Ordered Resolution Prover[END_REF]. (i) Suppose that E is the result of applying the binary resolution rule from Definition 6.1.6 using the clauses C, D as premises. Then, we have (∀x. C) ∧ (∀ȳ. D) |= (∀z. E).

(ii) Suppose that D is the result of applying the positive factorization rule from Definition 6.1.6 using the clause C as premise. Then, we have (∀x. C) |= (∀z. D).

We call a clause set N saturated saturated clause set with respect to a given term ordering lpo and a given selection function sel if any application of the rules from Definition 6.1.6 to any clauses from N results in a clause C that is an instance of some clause D in N . Proposition 6.1.8 (Refutational completeness of O S , [START_REF] Bachmair | Resolution Theorem Proving[END_REF][START_REF] Schlichtkrull | Formalizing Bachmair and Ganzinger's Ordered Resolution Prover[END_REF]). Let lpo be an LPO and let sel be a selection function. Let denote the empty clause, which can, in addition, be understood as logical falsity. Consider a clause set N that is saturated with respect to lpo and sel. We have ∈ N if and only if N is unsatisfiable, i.e. N |= false.

We now have the necessary notions and results at hand to show that BS is closed under Craig-Lyndon interpolation. The general idea of using ordered resolution to prove Craig's interpolation theorem goes back to Harald Ganzinger. In his lecture notes "Logic in Computer Science" (summer term 2002), he outlined the idea for the case of propositional logic. The proof of the following theorem was inspired by Ganzinger's proof sketch. In addition to the ordering constraints, we will make use of selection to achieve a Lyndon-style interpolation property. Additional care has to be taken in order to control the quantifier prefix of interpolants. This applies even more to the closely related proof of Lemma 6.2.5 in the subsequent section. Lemma 6.1.9. Let ϕ and ψ be relational BS sentences (without equality). If ϕ |= ψ, then there exists a relational BS sentence χ such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol P occurs positively (negatively) in χ only if it occurs positively (negatively) in ϕ and in ψ.

Proof sketch. In the degenerate cases where ϕ is unsatisfiable, i.e. ϕ |= false, or where ψ is a tautology, i.e. true |= ψ, we set χ := false and χ := true, respectively. In all other cases we proceed as follows.

Let ϕ and ψ be quantifier-free formulas and let ū, v, x, ȳ be tuples of first-order variables such that ϕ = ∃ȳ∀x. ϕ and ψ = ∃v∀ū. ψ . Without loss of generality, we assume that ū, v, x, ȳ are pairwise disjoint and that ϕ := i ϕ i ϕ , ψ and ψ := j ψ j are in conjunctive normal form. Let Π 1 Π i be the set of all predicate symbols that occur in ϕ but not in ψ , let Π 2 be the set of all predicate symbols that occur positively in ϕ but not positively in ψ and that do not belong to Π 1 , let Π 3 be the set of all predicate symbols that occur negatively in ϕ but not negatively in ψ and that do not belong to Π 1 ∪ Π 2 , let Π 4 be the set of all predicate symbols that occur in ϕ and in ψ but do not belong to Π 1 ∪ Π 2 ∪ Π 3 . We construct the formulas ϕ and ψ from ϕ and ψ , respectively, by simultaneously replacing every literal ¬P (s) with P (s) and every literal P (s) with ¬P (s) for every P ∈ Π 2 . Hence, every P ∈ Π 2 occurs negatively in ϕ ϕ , ψ but not negatively in ψ , and there are no predicate symbols that occur positively in ϕ but only negatively in ψ . Moreover, we observe that the above transformation preserves (un)satisfiability of ϕ, ¬ψ, and ϕ ∧ ¬ψ. Let N N be a clause set corresponding to ϕ Sk such that every P occurring positively (negatively) in N also occurs positively (negatively) in ϕ Sk -we define N to be the set containing all the implicitly universally quantified clauses ϕ i from ϕ Sk whose variables are renamed so that the clauses in N are pairwise variable disjoint. Analogously, let M M be the clause set corresponding to ψ Sk such that every P occurring positively (negatively) in M occurs positively (negatively) in ψ Sk and, hence, negatively (positively) in ψ .

We exhaustively apply ordered resolution with selection to N until the clause set is saturated and call the result N * N *

. As underlying term ordering we apply an LPO satisfying the following conditions. For all ground literals P (. . .), R(. . .), and ¬R(. . .) we require P (. . .) ¬R(. . .) R(. . .) whenever P ∈ Π 1 and R ∈ Π 1 . In order to achieve this, we use a precedence for which P R f c for every P ∈ Π 1 , R ∈ Π 1 , every Skolem function f occurring in ψ Sk , and every Skolem constant c occurring in ϕ Sk . We lift the resulting total ordering on ground terms to a (partial) ordering on non-ground terms, atoms, and literals as described below Proposition 6.1.3 on page 169. The selection function sel that we use shall select exactly the literals ¬P (s ) with P ∈ Π 2 ∪ Π 3 in clauses that contain such literals. In all other clauses nothing shall be selected. Let M * M * be the result of saturating M in the same way as we have saturated N to obtain N * .

Note that N * may be infinite, but may only contain clauses whose literals are instances of the literals in N where variables are either instantiated with variables or with constant symbols c i . Since ϕ (and thus also ϕ Sk ) is satisfiable and since ordered resolution with selection is sound, N * does not contain the empty clause. The set M * may also be infinite. Due to our assumption that ψ is not valid, ¬ψ (and thus also ψ Sk ) must be satisfiable. Hence, M * does not contain the empty clause either.

As our assumption ϕ |= ψ is equivalent to ϕ∧¬ψ |= false and to ϕ Sk ∧ ψ Sk |= false, refutational completeness of ordered resolution with selection entails that there is a (finite) derivation D D of the empty clause (which at the same stands for logical falsity) from the unsatisfiable set of clauses N * ∪ M * . We assume that D is based on the same calculus and the same term ordering that we have used to saturate N * and M * . Let N * N * be the set of clauses from N * whose instances are used as premises in this derivation. Since N * and M * are both saturated and neither of them contains the empty clause, D must indeed make use of clauses from N * , and, hence, N * is not empty. Since N * is finite, we can define the sentence χ Sk := ∀z. C∈N * C χ Sk

, where we set z := vars(N * ). We observe the following properties for χ Sk and the underlying clause set N * :

( Since χ Sk contains exclusively constant symbols c i , we can easily construct χ χ , χ , χ from χ Sk 's matrix by de-Skolemization, i.e. χ Sk = ∀z. χ y 1 /c 1 , . . . , y |ȳ| /c |ȳ| . Furthermore, we construct the formula χ from χ by simultaneously replacing every literal ¬P (s ) by P (s ) and every literal P (s ) by ¬P (s ) for every P ∈ Π 2 . Finally, we set χ := ∃ȳ ∀z. χ .

It remains to prove the following properties:

(4) ϕ |= χ and

(5) χ ∧ ¬ψ |= false. Due to (3) and due to the way χ is constructed from N * , every positive occurrence of a predicate symbol P in χ entails the existence of a negative occurrence of P in ¬ψ, and every negative occurrence of a predicate symbol P in χ entails the existence of a positive occurrence of P in ¬ψ. Consequently, χ satisfies Requirement (ii) as well.

Ad (4). For every model

Interpolation for GAF

After having shown that SF and GBSR without equality are closed under Craig-Lyndon interpolation, we now develop the analogous result for GAF. More precisely, we argue that any two GAF sentences ϕ and ψ with ϕ |= ψ have a Craig-Lyndon interpolant χ with ϕ |= χ and χ |= ψ that belongs to the Ackermann fragment (AF). As GAF contains AF, the interpolant χ is also a GAF sentence.

Theorem 6.2.1 (Craig-Lyndon interpolation for GAF). Let ϕ and ψ be GAF sentences. If ϕ |= ψ, then there exists an AF sentence χ such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol P occurs positively (negatively) in χ only if it occurs positively (negatively) in ϕ and in ψ.

As for the SF and GBSR case, we use the fact that GAF sentences can be translated into equivalent AF sentences (cf. Lemma 3.8.4). This reduces the problem to interpolation in AF. Again, we use the fact that interpolants can be constructed using Bachmair and Ganzinger's ordered resolution with selection (Definition 6.1.6). This time, however, this yields only an intermediate form of interpolants that we cannot immediately de-Skolemize into AF sentences. At this point, we employ known techniques to replace terms with quantified variables (cf. [START_REF] Baaz | Methods of Cut-Elimination[END_REF], Section 8.2), if the terms start with function symbols that do not belong to the common vocabulary of the interpolated formulas. This replacement preserves the logical entailments between the interpolant and the interpolated formulas. As we shall argue about the soundness of the replacement method using a certain sequent calculus, we introduce its derivation rules before we get started proving the interpolation result. Definition 6.2.2 (Modified sequent calculus LK, adapted from [START_REF] Baaz | Methods of Cut-Elimination[END_REF]). The following set of derivation rules defines a slightly modified variant of the calculus LK, that we shall refer to as LK ⊥ .1 Axioms:

A A true false

where A may be any non-equational firstorder atom.

Introduction of ∧:

ϕ, Γ ∆ ∧ : l 1 (ϕ ∧ ψ), Γ ∆ ψ, Γ ∆ ∧ : l 2 (ϕ ∧ ψ), Γ ∆ Γ ∆, ϕ Γ ∆, ψ ∧ : r Γ ∆, (ϕ ∧ ψ) Introduction of ∨: ϕ, Γ ∆ ψ, Γ ∆ ∨ : l (ϕ ∨ ψ), Γ ∆ Γ ∆, ϕ ∨ : r 1 Γ ∆, (ϕ ∨ ψ) Γ ∆, ψ ∨ : r 2 Γ ∆, (ϕ ∨ ψ) Introduction of ¬: Γ ∆, ϕ ¬ : l ¬ϕ, Γ ∆ ϕ, Γ ∆ ¬ : r Γ ∆, ¬ϕ
Introduction of ∀:

ϕ x/t , Γ ∆ ∀ : l ∀x. ϕ, Γ ∆ Γ ∆, ϕ ∀ : r Γ ∆, ∀x. ϕ
where t may be any term whose variables are free in ϕ x/t .

where the variable x may not occur in Γ, ∆.

Introduction of ∃: ϕ, Γ ∆ ∃ : l ∃y. ϕ, Γ ∆ Γ ∆, ϕ y/t ∃ : r Γ ∆, ∃y. ϕ
where the variable y may not occur in Γ, ∆.

where t may be any term whose variables are free in ϕ y/t . Permutation:

Γ ∆ p Γ ∆
where the sequence Γ is a permutation of Γ and the sequence ∆ is a permutation of ∆.

Weakening:

Γ ∆ w : l ϕ, Γ ∆ Γ ∆ w : r Γ ∆, ϕ Contraction: ϕ, ϕ, Γ ∆ c : l ϕ, Γ ∆ Γ ∆, ϕ, ϕ c : r Γ ∆, ϕ Cut: Γ ∆, ϕ ϕ, Γ ∆ cut(ϕ)
Γ, Γ ∆, ∆ Proposition 6.2.3 (Soundness and completeness of LK ⊥ for first-order sentences without equality). Let ϕ, ψ be two first-order sentences without equality. We have ϕ |= ψ if and only if ϕ ψ is derivable in LK ⊥ .

Proposition 6.2.4 (Cut-elimination for LK ⊥ , cf. Theorem 5.2.3 in [START_REF] Baaz | Methods of Cut-Elimination[END_REF]). Let ϕ, ψ be two first-order sentences without equality. If ϕ ψ is derivable in LK ⊥ , then it is also derivable using the rule cut(χ) only for atomic χ.

This gives us the necessary tools at hand to show that AF is closed under Craig-Lyndon interpolation. Compared to the BS case, we have to take extra steps to ensure that the quantifier prefix of interpolants fits the requirements of AF. This is the point where the proof system LK ⊥ enters the stage. Lemma 6.2.5. Let ϕ and ψ be AF sentences (without equality) in which the only Boolean connectives are ∧, ∨, ¬. If ϕ |= ψ, then there exists a relational AF sentence χ without equality such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol P occurs positively (negatively) in χ only if it occurs positively (negatively) in ϕ and in ψ.

Proof sketch. In the degenerate cases where ϕ is unsatisfiable, i.e. ϕ |= false, or where ψ is a tautology, i.e. true |= ψ, we set χ := false and χ := true, respectively. In all other cases we proceed as follows.

Let ϕ and ψ ϕ , ψ be quantifier-free formulas and let ū, w, ȳ, z be tuples of variables such that ϕ = ∃ū∀v∃ w. ϕ (ū, v, w) and ψ = ∃ȳ∀x∃z. ψ (ȳ, x, z). Without loss of generality, we assume that ū, {v}, w, ȳ, {x}, z are pairwise disjoint and that ϕ := i ϕ i and ψ := j ψ j are in conjunctive normal form.

We define the sets Π 1 , Π 2 , Π 3 , Π 4 Π i like in the proof of Lemma 6.1.9. We construct the formulas ϕ and ψ ϕ , ψ from ϕ and ψ , respectively, by simultaneously replacing every literal ¬P (s ) by P (s ) and every literal P (s ) by ¬P (s ) for every P ∈ Π 2 . Hence, every P ∈ Π 2 occurs negatively in ϕ but not negatively in ψ , and there are no predicate symbols that occur positively in ϕ but only negatively in ψ . Moreover, we observe that the above transformation preserves (un)satisfiability of ϕ, ¬ψ, and ϕ ∧ ¬ψ. More precisely, we have Let N N be a clause set corresponding to ϕ Sk such that every P occurring positively (negatively) in N also occurs positively (negatively) in ϕ Sk -we define N to be the set containing all the implicitly universally quantified clauses ϕ i from ϕ Sk whose variables are renamed so that the clauses in N are pairwise variable disjoint. Analogously, let M M be the clause set corresponding to ψ Sk such that every P occurring positively (negatively) in M occurs positively (negatively) in ψ Sk and negatively (positively) in ψ .

We exhaustively apply ordered resolution with selection to N until the clause set is saturated and call the result N * N *

. As underlying term ordering we apply an ordering defined like in the proof of Lemma 6.1.9 based on an LPO induced by a precedence for which P R f c for any

P ∈ Π 1 , R ∈ Π 1 ,
χ Sk := C(x)∈N * C(v) ,
where v is a fresh variable not occurring in N * . Like in the proof of Lemma 6.1.9, we observe the following properties for χ Sk and the underlying clause set N * :

(1) ϕ Sk |= χ Sk ,

(2) χ Sk ∧ ψ Sk |= false,

(3) for every C ∈ N * we have (3.1) for every literal P (s 1 , . . . , s m ) in C there is a clause D ∈ M that contains some literal ¬P (t 1 , . . . , t m ), and

(3.2) for every literal ¬P (s 1 , . . . , s m ) in C there is a clause D ∈ M that contains some literal P (t 1 , . . . , t m ).

Claim II: From the sentence χ Sk we can construct a relational sentence χ := ∃ȳ ∀v∃z . χ with quantifier-free χ χ, χ such that ϕ Sk |= χ and χ ∧ ψ Sk |= false.

Proof sketch: If χ Sk is relational, we are done. Suppose it is not. Then, χ Sk and ¬ ψ Sk do not share any function symbols. We argue by using a construction due to Baaz and Leitsch (proof of Lemma 8.2.2 in [START_REF] Baaz | Methods of Cut-Elimination[END_REF]). The construction relies on the sequent calculus LK ⊥ given in Definition 6.2.2. We use a part of the construction here with several adjustments that are required to properly deal with the leading universal quantifier in χ Sk .

By completeness of LK ⊥ (Proposition 6.2.3), there is some derivation π 0 π 0 , π 1 , π 2 of the form

π 1 ϕ Sk ∀v. χ Sk π 2 ∀v. χ Sk ¬ ψ Sk cut ∀v. χ Sk ϕ Sk ψ Sk
where π 1 and π 2 are certain subderivations. By Proposition 6.2.4, we may assume π 1 , π 2 to be free of non-atomic cuts.

In these subderivations the following subderivations π 1 and π 2 π 1 , π 2 must occur, respectively:

π 1 : π 1 Γ 1 ∆ 1 , χ Sk ∀ : r Γ 1 ∆ 1 , ∀v. χ Sk π 2 : π 2 Γ 2 , χ Sk v/t ∆ 2 ∀ : l Γ 2 , ∀v. χ Sk ∆ 2
We may assume without loss of generality that π 2 contains exactly one subderivation of the form that π 2 exhibits. We can do this, because ¬ ψ Sk and χ Sk do not share any function symbols. If there are more than one such subderivations, then π 2 must merge all the resulting subformulas ∀v. χ Sk into one by contraction steps. But then, π 2 can be rewritten so that all of these contraction steps are done before the introduction of ∀v in front of χ Sk . Moreover, any cut over atoms containing function symbols from χ Sk can be done before introduction of ∀v. Hence, we can in fact assume the following.

Claim III: Γ 2 and ∆ 2 in π 2 do not contain any function symbol occurring in χ Sk .

We modify π 1 and π 2 in such a way that every occurrence of subderivations of the form π 1 or π 2 are replaced by the derivations ρ 1 and ρ 2 ρ 1 , ρ 2 shown below:

ρ 1 : π 1 Γ 1 ∆ 1 , χ Sk ∃ : r Γ 1 ∆ 1 , ∃z 1 . χ Sk s 1 /z 1 . . . Γ 1 ∆ 1 , ∃z k-1 . . . z 1 . χ Sk s 1 /z 1 . . . s k-1 /z k-1 ∃ : r Γ 1 ∆ 1 , ∃z k z k-1 . . . z 1 . χ Sk s 1 /z 1 . . . s k-1 /z k-1 s k /z k ∀ : r Γ 1 ∆ 1 , ∀v∃z k z k-1 . . . z 1 . χ Sk s 1 /z 1 . . . s k-1 /z k-1 s k /z k ∃ : r Γ 1 ∆ 1 , ∃y 1 ∀v∃z k z k-1 . . . z 1 . χ Sk s 1 /z 1 . . . s k-1 /z k-1 s k /z k t 1 /y 1 . . . Γ 1 ∆ 1 , ∃y -1 . . . y 1 ∀v∃z k . . . z 1 . χ Sk s 1 /z 1 . . . s k /z k t 1 /y 1 . . . t -1 /y -1 ∃ : r Γ 1 ∆ 1 , ∃y . . . y 1 ∀v∃z k . . . z 1 . χ Sk s 1 /z 1 . . . s k /z k t 1 /y 1 . . . t /y ρ 2 : π 2 Γ 2 , χ Sk v/t ∆ 2 ∃ : l Γ 2 , ∃z 1 . χ Sk v/t ∆ 2 . . . Γ 2 , ∃z k-1 . . . z 1 . χ Sk v/t ∆ 2 ∃ : l Γ 2 , ∃z k . . . z 1 . χ Sk v/t ∆ 2 ∀ : l Γ 2 , ∀v∃z k . . . z 1 . χ Sk ∆ 2 ∃ : l Γ 2 , ∃y 1 ∀v∃z k . . . z 1 . χ Sk ∆ 2 . . . Γ 2 , ∃y -1 . . . y 1 ∀v∃z k . . . z 1 . χ Sk ∆ 2 ∃ : l Γ 2 , ∃y . . . y 1 ∀v∃z k . . . z 1 . χ Sk ∆ 2
where π 2 and χ Sk and the terms s 1 , . . . , s k , t 1 , . . . , t are defined as follows. The terms s 1 , . . . , s k s i constitute an enumeration of all distinct non-ground terms that occur as arguments in atoms P (. . . , s i , . . .) in χ Sk and that contain at least one function symbol (a unary Skolem function from ϕ Sk ). We assume that s 1 , . . . , s k are listed in descending order regarding their length, i.e. len(s i ) ≥ len(s i+1 ). Notice that, by Claim I, every s i contains the variable v, only unary function symbols, and no constant symbols. Similarly, t 1 , . . . , t t i constitutes an enumeration of all distinct ground terms (in descending order regarding term length) that occur as arguments in atoms in χ Sk . Furthermore, we assume the variables y 1 , . . . , y , z 1 , . . . , z k to be pairwise distinct, to be distinct from u, v, and to not occur in ϕ Sk , χ Sk , ψ Sk , Γ 1 , Γ 2 , ∆ 1 , ∆ 2 . The notation η s/t is used to denote replacement of every occurrence of the term s by the term t in the formula η. We also use it to denote consistent replacement in derivations. Based on this notation, we define the formula χ Sk χ Sk to be

χ Sk := χ Sk s 1 /z 1 . . . s k /z k t 1 /y 1 . . . t /y .
Notice that all occurrences of v in χ Sk that are an argument of a predicate symbol remain untouched. The derivation π 2 π 2 results from π 2 by replacing all occurrences of terms s i [v/t] in π 2 with z i and by replacing all occurrences of terms t j with y j . The replacements are performed in the order s 1 [v/t], . . . , s k [v/t], t 1 , . . . , t (from left to right), i.e. we have

π 2 := π 2 s 1 [v/t]/z 1 . . . s k [v/t]/z k t 1 /y 1 . . . t /y .
Notice that all occurrences of t in π 2 that are an argument of a predicate symbol remain untouched.

As, by Claim III, the terms s i , s i [v/t], and t i do not share any function or constant symbols with terms occurring in Γ 2 , ∆ 2 that are important for the derivation of ¬ ψ Sk , replacing these terms with (free) variables in π 2 does not influence the parts of π 2 that are important for deriving ¬ ψ Sk in the end. The new derivation steps in ρ 2 using the rules introducing existential quantification on the left are sound, as Γ 2 and ∆ 2 do not contain the variables y i and z i (which replace s i and t i , which in turn do not occur in Γ 2 , ∆ 2 ). Moreover, the new derivation steps in ρ 1 using the rules introducing existential quantification on the right are sound, as the terms s i only contain variables that do not occur bound in the antecedents.

We denote by ρ 1 ρ 1 , ρ 2 the result of replacing occurrences of π 1 in π 1 with appropriate occurrences of ρ 1 and adapting the remaining proof parts accordingly (by replacing terms s i by z i and t i by y i wherever necessary). Similarly, the new version of π 2 is denoted by ρ 2 . Let χ := χ Sk . χ Then, we can put the new derivations together to obtain Recall that χ = ∃ȳ ∀v∃z . χ . We construct the formula χ χ from χ by simultaneously replacing every literal ¬P (s ) by P (s ) and every literal P (s ) by ¬P (s ) for every P ∈ Π 2 . Finally, we set χ := ∃ȳ ∀v∃z . χ . χ It remains to prove the following properties:

(4) ϕ |= χ, and

(5) χ ∧ ¬ψ |= false.

= x -y ≤ 1 (green), B(x, y) = 1 2 x + y ≥ 2 (blue), C(x, y) := 1 3 x -y ≥ 1 3 (red).
then the solution spaces for A(r, y) and B(r, y) with respect to the variable y are (supersets of) unbounded intervals, respectively, such that their union covers the complete rational axis. This entails that there cannot be any s such that Q |= ¬A(r, s ) ∧ ¬B(r, s ) ∧ C(r, s ). This peculiarity of linear-arithmetic atoms severely restricts the fingerprints that can possibly occur. We shall derive an upper bound on the number of distinct fingerprints that is doubly exponential in the number of occurring variables in Lemma 7.1.5. In order to do so, we will leverage methods and results from the field of quantifier elimination. But before we develop the formal argument, Figures 7.2-7.5 informally describe some more intuitions about fingerprints for linear rational arithmetic while suggesting a more suitable notation for linear-arithmetic fingerprints.

y 3 t 1 t 2 t 3 t 4 A B C ν 3 (r, s, t 1 ) = {C} ν 3 (r, s, t 2 ) = {A, C} ν 3 (r, s, t 3 ) = {A} ν 3 (r, s, t 4 ) = {A, B} Figure 7
.2: Illustration of the solution set of three linear-arithmetic atoms A(y 1 , y 2 , y 3 ) (in green), B(y 1 , y 2 , y 3 ) (in blue), and C(y 1 , y 2 , y 3 ) (in red) for certain fixed values r for y 1 and s for y 2 . The thin vertical lines mark values yielding the four possible fingerprints ν 3 (r, s, t) for any rational t ∈ Q that is assigned to y 3 . The overall fingerprint ν 2 (r, s) is represented by the sequence {C}|{A}{C}{B}. Intuitively, we construct ν 2 (r, s) = S 0 |S 1 S 2 S 3 as follows. Traversing the y 3 -axis from -∞ to +∞ for fixed y 1 = r, y 2 = s, we start in a situation where C but neither A nor B are satisfied under Q. Hence, we set S 0 := {C}. On our traversal of the axis, we first encounter some point at which A changes its truth value -it becomes true (and will stay so for the rest of our journey along the y 3 -axis). Since exclusively the truth value of A changes at this point, we append the set S 1 := {A}. Going on in this direction, we next encounter a point where the truth value of C changes from true to false. Since A and B keep their respective truth values, we append the set S 2 := {C}. Like for A, the truth value of C will remain unchanged for the rest of our traversal of the axis. Finally, we reach some point at which the truth value of B flips from false to true. Therefore, we append S 3 := {B}. As nothing will change when traversing the rest of the y 3 -axis, the construction of ν 2 (r, s) is complete.

y 3 y 2 s 7 s 6 s 5 s 4 s 3 s 2 s 1 A B C ν 2 (r, s 7 ) = {C}|{A}{C}{B} ν 2 (r, s 6 ) = {C}|{A, C}{B} ν 2 (r, s 5 ) = {C}|{C}{A}{B} ν 2 (r, s 4 ) = {C}|{C}{A, B} ν 2 (r, s 3 ) = {C}|{C}{B}{A} ν 2 (r, s 2 ) = {C}|{B, C}{A} ν 2 (r, s 1 ) = {C}|{B}{C}{A} Figure 7
.3: Illustration of the solution set of three linear-arithmetic atoms A(y 1 , y 2 , y 3 ) (in green), B(y 1 , y 2 , y 3 ) (in blue), and C(y 1 , y 2 , y 3 ) (in red) for some fixed value r for y 1 . The thin horizontal lines mark values yielding the seven possible fingerprints ν 2 (r, s) for any rational s ∈ Q that is assigned to y 2 . The overall fingerprint ν 1 (r) is represented by the sequence {C}|{B}{C}{A} {B, C}{A, B}{A, C}, where the initial subsequence {C}|{B}{C}{A} describes the fingerprint at y 3 = s 1 and the sets {B, C}, {A, B}, {A, C} originate from the three intersection points of the hyperplanes represented by A, B, C, respectively, when the relation symbols in A, B, C are replaced with equality. When traversing the y 2 -axis from -∞ to +∞, we meet the intersection points {B, C} at y 2 = s 2 , {A, B} at y 2 = s 4 , and {A, C} at y 2 = s 6 . is linear in the length of the original. For example, every negative literal ¬ s ≤ t can be replaced by the positive s > t; the relation symbol " =" is treated as first-class citizen, i.e. s = t is not an abbreviation for ¬ s = t. Let At At be a finite set of LRA atoms of the form a 1 z 1 + . . . a n z n b where the a i and b are rational coefficients, the z i are first-order variables, and ∈ {<, ≤, =, =, ≥, >}. For every z i the elimination set Elim zi (At) Elim z (At)

is the smallest set of formal terms satisfying the following properties:

(i) -∞ ∈ Elim zi (At).

(ii) For every atom (a 1 z 1 + . . . + a n z n b) ∈ At with a i = 0 we set

t := 1 ai b -a 1 z 1 + . . . + a i-1 z i-1 + a i+1 z i+1 + . . . + a n z n . We require that if a i > 0 and ∈ {=, ≥}, then t ∈ Elim zi (At), if a i < 0 and ∈ {=, ≤}, then t ∈ Elim zi (At), if a i > 0 and ∈ { =, >}, then (t + ε) ∈ Elim zi (At), if a i < 0 and ∈ { =, <}, then (t + ε) ∈ Elim zi (At).
The symbol ε is used as a "dummy symbol for [. . . ] a positive infinitesimal" [START_REF] Loos | Applying Linear Quantifier Elimination[END_REF], page 454. Notice that for any z i the number of testpoints in Elim zi (At) is at most linear in the number of atoms that belong to At. Moreover, only atoms contribute to Elim zi (At) in which z i occurs with a non-zero coefficient and that entail some kind of lower bound for z i . We could, dually, restrict our attention to upper bounds instead of lower bounds [START_REF] Loos | Applying Linear Quantifier Elimination[END_REF][START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF].

Given any testpoint t, the application of the virtual substitution operator z i / /t A z/ /t to LRA atoms is defined as follows. Consider any atom A(z 1 , . . . , z n ) of the form a 1 z 1 + . . . + a n z n b with a i = 0. Then, we set A[z i / /t] := A. Consider any atom A(z 1 , . . . , z n ) that is equivalent to z i s for some LRA expression s of the form s := 1 ai ba 1 z 1 + . . . + a i-1 z i-1 + a i+1 z i+1 + . . . + a n z n with a i = 0 and where ∈ {<, ≤, =, =, ≥, >}. We then define A z i / /t := t s if t = -∞ and t = t + ε for any t ,

A z i / / -∞ := true if ∈ {<, ≤, =}, false if ∈ {=, ≥, >}, A z i / /t + ε :=          t < s if ∈ {<, ≤}, t ≥ s if ∈ {≥, >}, false if ∈ {=}, true if ∈ { =}.
For technical reasons, we assume that necessary normalization steps are done implicitly, i.e. in order to apply the operator z/ /t to any LRA atom A, the atom need not be in the form

a 1 z 1 + . . . + a n z n b.
It is only required that A has an equivalent in this syntactic form. This is certainly true for the atoms true and false, for example, as the former is equivalent to 0z 1 + . . . + 0z n ≤ 0 and the latter is equivalent to 0z 1 + . . . + 0z n < 0. For compound LRA formulas the virtual substitution operator shall behave like the usual operator for syntactic substitution. Loos and Weispfenning have shown that virtual substitution can be used to eliminate existential quantifiers from LRA formulas.

Proposition 7.1.3 ([LW93], Theorem 3.5). Consider any positive LRA formula ∃z i . ψ(z) with quantifier-free ψ(z). Let At be the set of all atoms that occur in ψ(z) normalized so that each has the form a 1 z 1 + . . . a n z n b. Then, we have

Q |= ∃z i . ψ(z) ←→ t ∈ Elimz i (At) ψ z i / /t .
The quantifier elimination technique in Proposition 7.1.3 makes use of the fact that existential quantification can be conceived as a disjunction over all domain elements. Innermost existential quantifiers are replaced by finite (syntactic) disjunction over a finite set of elimination terms. This is done in a way that implicitly constructs a Skolem function using only specific terms that can be derived from the formula at hand. This implicit Skolem function includes an unspecific case split: one of the "proposed" solutions will work. An explicitly formulated function, however, would be more specific about which solution has to be used in what case.

In what follows, we use Proposition 7.1.3 and our observations regarding elimination sets to formally derive an upper bound regarding the number of fingerprints that appear with respect to a given LRA sentence. The missing link between the two concepts of fingerprints and quantifier elimination by means of virtual substitution is a representation of fingerprints by first-order sentences. Let At be a finite set of LRA atoms of the form a 1 z 1 + . . . + a n z n b where the a i and b are rational coefficients and ∈ {<, ≤, =, =, ≥, >}. Let Ψ n Ψ i be the set of all formulas of the form ∃z n . A∈At [¬]A(z 1 , . . . , z n ), where [¬]ψ stands as placeholder for a negated or non-negated formula. For every i with 1 ≤ i < n let Ψ i be the set of all formulas of the form ∃z i . ψ∈Ψi+1 [¬]ψ(z 1 , . . . , z i ). Then, every set Ψ i contains 2 ↑n-i+1 (|At|) formulas. In each of these formulas the variables z 1 , . . . , z i-1 occur freely.

Remark 7.1.4. It is easy to see that any formula ψ(z 1 , . . . , z i-1 ) in any Ψ i represents exactly one possible fingerprint for tuples r 1 , . . . , r i-1 of rationals. The formula sets Ψ i emphasize the close relationship between the notion of fingerprint and the standard model-theoretic notion of type. 1 In model theory types are usually used to investigate expressiveness of full first-order logic with respect to certain structures. Hence, the atoms from which types are built are often only restricted by the considered vocabulary, the variables that may occur freely, and limits imposed on the quantifier rank. The sets Ψ i , on the other hand, are limited to certain forms of atoms, namely the ones given in At. Hence, it may happen that an atom P (x 1 , x 2 , x 3 ) plays a role in Ψ i and P (x 1 , x 1 , x 1 ) does not. In the present text such fine-grained distinctions make sense, since they allow us to focus on the expressiveness of concrete sentences -e.g. with respect to dependences between quantified variables -rather than expressiveness of the whole language of first-order logic over a given vocabulary. Such fine-grained considerations do not seem to be common practice in (finite) model theory.

Let At

At, A be the set At := At ∪ A A ∈ At , where the atom A is the converse of A, e.g. (s ≤ t) = (s > t), (s = t) = (s = t), (s < t) = (s ≥ t). Let At -zj ,...,zn At -zj ,...,zn be the result of eliminating z n , z n-1 , . . . , z j one after the other from the atoms in At by means of virtual substitution. Formally, At -zj ,...,zn is defined as follows:

At -zn := A z n / /t , A z n / /t A ∈ At and t ∈ Elim zn At , and At -zi,...,zn := A z i / /t , A z i / /t A ∈ At -zi+1,...,zn and t ∈ Elim zi At -zi+1,...,zn .

Since we know that the number of testpoints in any elimination set Elim zi (S) is at most linear in the cardinality of S, there must be some positive constant c such that we observe

At -zn ≤ 2c • | At| 2 , At -zn-1,zn ≤ 2c • 2c • | At| 2 2 , . . . At -zi,...,zn ≤ (2c) 2 n-i+1 • | At| 2 n-i+1 ≤ 2 (log 2c)•2 n-i+1 • 2 (log |At|)•2 n-i+1 = 2 (log 2c+log |At|)•2 n-i+1 .
For every i, 1 ≤ i ≤ n, and any sequence r := r 1 , . . . , r i-1 of rationals let the set Ψ i (r) Ψ i (r) be the set of formulas ψ(z 1 , . . . , z i-1 ) ∈ Ψ i for which we have Q |= ψ(r). In the beginning of the present section we explained intuitively why the set of actually occurring fingerprints with respect to LRA formulas is very limited compared to the general case. The next lemma will show a similar discrepancy between the sets Ψ i and Ψ i (r). More precisely, only comparatively few formulas from Ψ i are satisfied under Q for certain tuples r of rationals. We shall then link these two observations in Lemma 7.1.8. Lemma 7.1.5. For any fixed sequence r := r 1 , . . . , r i-1 of rationals we have Ψ i (r) ∈ O 2 (d+log |At|)•2 n-i for some positive constant d.

Proof. Let β := [z 1 →r 1 , . . . , z i-1 →r i-1 ].
Claim I: For any two distinct formulas ∃z i . ψ 1 (z 1 , . . . , z i ) and ∃z i . ψ 2 (z 1 , . . . , z i ) from Ψ i (r) and all distinct rationals q i , q i we observe that

Q, β[z i →q i ] |= ψ 1 (z 1 , . . . , z i ) together with Q, β[z i →q i ] |= ψ 2 (z 1 , . . . , z i ) entails q i = q i .
Proof: By definition of Ψ i , ψ 1 and ψ 2 are conjunctions of formulas (∃z i . . . .) such that, without loss of generality, ψ 1 contains at least one conjunct ¬ϕ with ϕ ∈ Ψ i+1 while ψ 2 contains the conjunct ϕ. But then, we have

Q, β[z i →q i ] |= ¬ϕ(z 1 , . . . , z i ) and Q, β[z i →q i ] |= ϕ(z 1 , . . . , z i ),
which entails q i = q i . ♦

Consider any two distinct formulas ∃z i . ψ 1 (z 1 , . . . , z i ) and ∃z i . ψ 2 (z 1 , . . . , z i ) from Ψ i (r). Let

ψ 1 ψ 1 , ψ 2
be the result of first transforming ψ 1 into negation normal form and then replacing every atom ¬A by its converse A. Let ψ 2 be defined analogously, starting from ψ 2 . Then, ψ 1 and ψ 2 are positive formulas and Q-equivalent to ψ 1 and ψ 2 , respectively. Moreover, all atoms occurring in ψ 1 and ψ 2 belong to At. Using virtual substitution, all existential quantifiers in the formulas ψ 1 (z 1 , . . . , z i ) and ψ 2 (z 1 , . . . , z i ) can be eliminated, yielding quantifier-free formulas

ψ 1 (z 1 , . . . , z i ) ψ 1 , ψ 2
and ψ 2 (z 1 , . . . , z i ) over the atoms in At -zi+1,...,zn that are Q-equivalent to ψ 1 and ψ 2 , respectively. With another application of virtual substitution, the existential quantifier ∃z i in both ∃z i . ψ 1 (z 1 , . . . , z i ) and ∃z i . ψ 2 (z 1 , . . . , z i ) can be eliminated, using only a subset of the testpoints from Elim zi At -zi+1,...,zn , which is a set of size Elim zi At -zi+1,...,zn ∈ O 2 (d+log |At|)•2 n-i for some positive constant d. Put more precisely,

∃z i . ψ 1 (z 1 , . . . , z i ) is Q-equivalent to t ∈ Elimz i ( At -z i+1 ,...,zn ) ψ 1 z i / /t and ∃z n . ψ 2 (z 1 , . . . , z n ) is Q-equivalent to t ∈ Elimz i ( At -z i+1 ,...,zn ) ψ 2 z i / /t .
By virtue of Claim I, for every testpoint t ∈ Elim zi At -zi+1,...,zn we have that Q, β |= ψ 1 z i / /t entails Q, β |= ψ 2 z i / /t . Consequently, for every ∃z i . ψ in Ψ i (r) and ψ's quantifier-free equivalent ψ (obtained by means of virtual substitution) there is at least one testpoint t ∈ Elim zi At -zi+1,...,zn such that Q, β |= ψ z i / /t and Q, β |= ϕ z i / /t for every ∃z i . ϕ in Ψ i (r) with ϕ = ψ and ϕ's quantifier-free equivalent ϕ . This entails Ψ i (r) ≤ Elim zi At -zi+1,...,zn ∈ O 2 (d+log |At|)•2 n-i for some positive constant d.

Corollary 7.1.6. The number of sentences in Ψ 1 that are satisfied under Q is at most doubly exponential in n and at most polynomial in the number of atoms in At.

The lemma follows by Lemma 7.1.5 and Claim I, which establishes the one-to-one correspondence between fingerprints in µ i-1 (r) and the formulas in Ψ x i (r) for every i, 1 ≤ i ≤ n, and every r ∈ Q i-1 . It follows by Lemmas 4.2.7 and 7.1.8 that, if the LRA sentence ϕ is valid in Q, then there is a µ-uniform satisfying strategy σ (in a sense analogous to Definitions 4.2.2 and 4.2.6) whose target set

T σ T σ := 1≤k≤n q ∈ Q there is some tuple r ∈ Q k such that σ k (r) = q contains at most n k=0 k j=0 max r∈Q j |µ j (r)| ≤ (n + 1) • c • 2 (d+log |Atx|)•2 n (n+1) = 2 log(n+1) • 2 (n+1)•log c • 2 (n+1)•(d+log |Atx|)•2 n = 2 log(n+1)+(n+1)•log c+d•(n+1)•2 n +(n+1)•log |Atx|•2 n ≤ 2 e•n•log |Atx|•2 n .
elements for certain positive constants c, d, e. Notice that this is a slight improvement compared to the non-separated case, where the number of testpoints that need to be considered is in the worst case doubly exponential in 2n rather than n. Although this hardly changes the asymptotic behavior, it can make a difference in practice.

It is known that proving validity of a given LRA sentence under Q by means of virtual substitution requires worst-case computing time that is "polynomial in the length of the input formula, exponential in the number of quantified variables, and doubly exponential in the number of quantifier blocks" [START_REF] Loos | Applying Linear Quantifier Elimination[END_REF], page 1. Hence, the problem of checking validity of LRA sentences with a bounded number of quantifier alternations lies in ExpTime. When we consider any LRA sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifier-free ψ in which universally and existentially quantified variables are separated, we obtain a similar result, if we bound the degree of interaction of existential and also universal variables by one. In other words, we require that the sets x1 , . . . , xn , ȳ1 , . . . , ȳn are all pairwise separated in ϕ. This separateness condition is even stricter than the one for the strongly separated fragment (cf. Definition 3.2.3). Then, by a straightforward adaptation of the proof of Lemma 3.2.5, we can argue that ϕ is equivalent to some LRA sentence ϕ that is a Boolean combination of sentences of the form ∀x i . χ k (x i ) or ∃ȳ i . η (ȳ i ) for certain quantifier-free formulas χ k and η which exclusively contain atoms that stem from the original ϕ. Since there are only exponentially many such subformulas (up to equivalence), the length of ϕ needs to be at most exponential in the length of ϕ. In order to decide whether ϕ is satisfied under Q, we can eliminate all quantifiers in the subsentences ∀x i . χ k (x i ) and ∃ȳ i . η (ȳ i ), treating each subsentence individually. Each such exhaustive elimination step can be done deterministically in at most exponential time in the length of the quantifier prefix and in polynomial time in the length of the subsentence. Therefore, deciding Q |= ϕ lies in ExpTime and the same hold for deciding Q |= ϕ.

Proposition 7.1.9. Let BSF-LRA be the class of block-separated LRA sentences which we define to be the class of LRA sentences of the form ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifier-free ψ in which the sets x1 , . . . , xn , ȳ1 , . . . , ȳn are all pairwise separated. The problem of checking whether any given BSF-LRA sentence is satisfied under Q lies in ExpTime.

Skolemization Policies Taking Weak Dependences into Account

Beyond the applicability to the classical decision problem, discovering that existential variables are only weakly depending on or entirely independent of universal variables has also implications for proof complexity and automated reasoning. It is folklore in automated reasoning that shifting existential quantifiers inwards before applying Skolemization is beneficial in most cases. If there is potential for reducing the arity of Skolem functions, this potential may be used to reduce the length of shortest proofs or to substantially reduce the search space that theorem provers have to explore for finding proofs. The equivalences in Proposition 1.0.1 enable the formulation of certain strategies for quantifier shifting known as, e.g., miniscoping [START_REF] Nonnengart | Computing Small Clause Normal Forms[END_REF] or anti-prenexing [START_REF] Egly | On the Value of Antiprenexing[END_REF], that have turned out to be very useful in automated reasoning. Moreover, for first-order logic non-standard Skolemization techniques have been considered that lead to Skolem functions with smaller arity, see [START_REF] Baaz | Normal Form Transformations[END_REF][START_REF] Nonnengart | Computing Small Clause Normal Forms[END_REF] for an overview. In terms of proof complexity, choosing an unsuitable Skolemization technique can make shortest proofs exponentially or even non-elementarily longer in the worst case [Egl94, BL94, BFL94].

Remark 7.2.1. In the fields of QBF solving and CSP2 solving so-called dependency schemes have been developed that help to exploit Boolean structure to optimize the arity of Skolem functions [Sam08, SS09, Lon12, BB16]. For QBF sentence it is clear that an analysis based on separateness of (propositional) variables yields only trivial results, as every atom can contain at most one such variable. However, the fact that QBF solvers strongly benefit from the optimization techniques based on dependency schemes, one could hope for a significant impact in first-order reasoning as well. It seems to be promising to lift QBF dependency schemes to first-order logic and then combine them with analysis techniques based on separateness -see also Section 3.6 for the combined analysis of separateness and Boolean structure.

There has been work on exploiting certain forms of independence in first-order logic as well. Notably, any work that tries to improve the results of Skolemization does, at least implicitly, long for the minimization of dependencies between existentially and universally quantified variables. Examples of improved Skolemization policies can be found in [START_REF] Baaz | Normal Form Transformations[END_REF][START_REF] Nonnengart | Computing Small Clause Normal Forms[END_REF]. Goubault-Larrecq [START_REF] Goubault | A BDD-Based Simplification and Skolemization Procedure[END_REF] has analyzed dependencies in first-order logic, using first-order BDDs as a tool.

To the best of the present author's knowledge, currently used techniques in automated reasoning do not detect and exploit weak dependences, as defined and investigated in Chapter 4. On the syntactic level, we introduced Lemma 3.2.4 in Section 3.2 as a tool for shifting existential quantifiers ∃y also into certain conjunctions although the bound variable y may occur in each conjunct. The price that has to be paid is a potentially exponential blowup of the formula. What we possibly gain are smaller arities of Skolem functions. In the extreme case of GBSR sentences, we even get Skolem constants in the end, which, in terms of small arities of Skolem functions, is clearly the best result we could possibly achieve. On the other hand, reducing the arity of Skolem functions comes at the price of an increasing number of Skolem functions (with smaller arity). This trade-off situation -formula length vs. arities of Skolem functions vs. number of Skolem functions -has to be dealt with gracefully. It seems to be an interesting direction for future research to find out when exactly automated reasoning benefits from quantifier shifting in the spirit of Lemma 3.2.4 and when the additional cost outweighs the potential gain. This is even more interesting as the described ideas are not limited in scope to pure uninterpreted first-order logic. Some of the employed proof methods are completely oblivious to predicate symbols or function symbols with a-priori-fixed interpretations.

Example 7.2.2. Consider the open formula ϕ := ∀z∀x∃y. P (x) ∨ R(y, z) ∧ Q(y, y). Standard quantifier shifting cannot move the ∃y inwards any further. Naive Skolemization yields ϕ := ∀z∀x.

P (x) ∨ R(f y (z, x), z) ∧ Q(f y (z, x), f y (z, x)).
On the other hand, applying a simplified variant of Lemma 3.2.4 to ϕ and removing redundant subformulas results in ∀z∀x. ∃y 2 . Q(y 2 , y 2 ) ∧ P (x) ∨ ∃y 3 . R(y 3 , z) ∧ Q(y 3 , y 3 ) . Since universal quantifiers distribute over conjunctions, we can now apply standard quantifier shifting to move the quantifiers ∀z∀x inwards and obtain ∃y 2 . Q(y 2 , y 2 ) ∧ ∀x. P (x) ∨ ∀z∃y 3 . R(y 3 , z) ∧ Q(y 3 , y 3 ) .

Skolemization of this result leads to

ϕ := Q(c y2 , c y2 ) ∧ ∀x. P (x) ∨ ∀z. R(f y3 (z), z) ∧ Q(f y3 (z), f y3 (z)) .
Comparing ϕ and ϕ , we see that we trade a sentence with a single Skolem term f y (z, x) and three distinct atoms for a sentence with two Skolem terms c y2 and f y3 (z) and four distinct atoms.

The following considerations constitute a first step towards Skolemization methods that are sensitive to weak dependences. But before we start, one more remark is in order concerning the relation to known concepts of quantification that include explicit dependence information.

Remark 7.2.3. In [Hen61] Henkin introduced a generalized form of existential quantifiers, to which we shall refer as Henkin quantifiers, but they are sometimes also called finite partially ordered quantifiers or branching quantifiers or nonlinear quantifiers (see [START_REF]Henkin Quantifiers[END_REF] for a broader overview.) Henkin quantifiers can explicitly express dependence of existentially quantified variables on universally quantified ones. For instance, in the sentence ψ := ∀z∀x∃ z y. Q(z, y) ↔ P (x) the value of y may depend on the value of z but has to be independent from x's value. This sentence is equivalent to the second-order formula ψ Sk := ∃f y . ∀z∀x. Q(z, f y (z)) ↔ P (x) for some Skolem function f y . One could say that Henkin quantifiers make independence explicit by not listing certain universally quantified variables as a subscript.

The patterns of weak vs. strong dependence induced by separateness of variables are more subtle than a strict classification into full dependence vs. full independence as encouraged by Henkinstyle quantification. For example, the slightly modified sentence ϕ := ∀z∀x∃y. Q(z, y) ↔ P (x) is equivalent to ϕ := ∀z∃y 1 y 2 ∀x. Q(z, y 1 ) → P (x) ∧ P (x) → Q(z, y 2 ) , where the weakness of the dependence of y on x in ϕ becomes evident. Using second-order quantifiers, we can make this explicit:

ϕ := ∃g 1 g 2 . ∀x. i∈{1,2} ∀z. Q(z, g i (z)) ↔ P (x) , which is again equivalent to ϕ.

Altogether, the example illustrates that separateness of existentially quantified and universally quantified variables leads to a certain degree of independence, but it does not reach the level of independence Henkin quantifiers can guarantee. This is not at all surprising, because Henkin quantifiers increase the expressiveness of first-order logic significantly.

In recent years concepts of dependence and independence in first-order logic have been studied that are much more sophisticated than Henking quantifiers. This has recently become an active field of research. Introductory material and further references can be found in [START_REF] Jouko | Dependence Logic -A New Approach to Independence Friendly Logic[END_REF][START_REF] Grädel | Logics for Dependence and Independence (Dagstuhl Seminar 15261)[END_REF][START_REF]Dependence Logic, Theory and Applications[END_REF]. Possible relations to the notion of weak dependence studied in Chapter 4 and the present section remain to be investigated. 3The transformations outlined in Example 7.2.2 have been done more systematically in the proof of Lemma 2.0.3 and 2.0.4 (Chapter 2). Moreover, this approach was central to the numerous translation procedures devised in Chapter 3, e.g. for translating GBSR into BSR, GAF into AF, and so on. Schematically, the technique can be stated as follows: Consider a relational first-order sentence ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ in standard form. A basic formula basic formulas is any atom A, any negated atom ¬A, and any formula Qv. χ with Q ∈ {∃, ∀}. An occurrence of a basic formula η in a formula ψ is considered maximal, if the occurrence is not a proper part of an occurrence of another basic formula. We start by setting k := 0 and ψ 0 := ψ:

(1) Transform ψ k into a disjunction of conjunctions of basic formulas (maximal occurrences of basic formulas in ψ k are treated as indivisible units) by application of the laws of Boolean algebra.

(2) Set ψ k := ∃ȳ n-k . ψ k and shift the leading existential quantifiers inwards as far as possible.

We do not rename bound variables and thus the result may contain multiple occurrences of quantifiers with the same variable name.

(3) Transform ψ k into a conjunction of disjunctions of basic formulas (maximal occurrences of basic formulas in ψ k are treated as indivisible units) by application of the laws of Boolean algebra.

(4) Set ψ k+1 := ∀x n-k . ψ k and shift the leading universal quantifiers inwards as far as possible. Again, we do not rename bound variables.

(5) Stop if k = n -1, otherwise increment k by one and continue at Step (1).

In the previous sections we have often assumed that certain sets of variables are separated and have then shown that after applying the above scheme there is no quantifier Qv whose scope contains variables from two separated sets. We now proceed in the other direction and devise an overapproximation of the variables captured in the scopes of quantifiers in ψ n . The analysis will be based on ϕ and we will be using reasonably simple syntactic criteria. Let x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn . Moreover, let At be the set of all atoms occurring in ϕ. In this section, we need a refinement of the notion of the index of a variable. Definition 7.2.4 (Extended upward closure of captured quantified variables). The block index of a variable v ∈ x ∪ ȳ is denoted by bidx ϕ (v) bidx ϕ (v) and defined such that

bidx ϕ (v) := 2k -1 if v ∈ xk , 2k if v ∈ ȳk .
Let ϕ v ϕ v be the smallest reflexive and transitive relation over the variables in ϕ such that v ϕ v whenever bidx ϕ (v) ≤ bidx ϕ (v ) and there is some atom in ϕ in which v and v co-occur. For every variable v in ϕ the upward closure

V v ϕ V v ϕ , V v ϕ is the set {v ∈ vars(ϕ) | v ϕ v }. The extended upward closure V v ϕ
is the smallest set satisfying the following properties:

(a) V v ϕ ⊆ V v ϕ , and (b) for all v , v with bidx ϕ (v) ≤ bidx ϕ (v ) ≤ bidx ϕ (v ) and v ∈ V v ϕ ∩ V v ϕ we have V v ϕ ⊆ V v ϕ .
For all of the above notations we omit the subscript ϕ if the respective ϕ is clear from the context.

Intuitively, for any quantifier Qv in ϕ the set V ≺v overapproxiamtes the set of all bound variables that occur in the scope of Qv during and after finishing the procedure described above. We leave it to the reader to prove this intuition formally. Lemma 7.2.5. Let u, v ∈ vars(ϕ) be any two variables in ϕ.

(i) If bidx(u) = bidx(v), then we either have V u = V v or V u ∩ V v = ∅. (ii) If bidx(u) < bidx(v), then we either have V v V u or V v ∩ V u = ∅.
Proof. We start by proving the following auxiliary results: Claim I: Let w, z be two variables in ϕ with bidx(w) ≥ bidx(z). Then,

V w ⊆ V z entails V w ⊆ V z .
Proof: For every w ∈ V w there is some chain of variables w 1 , w 1 , . . . , w m , w m such that bidx(w) ≤ bidx(w i ) ≤ bidx(w i ) for every i, and

w 1 ∈ V w ∩ V w 1 , w 2 ∈ V w 1 ∩ V w 2 , . . . w m ∈ V w m-1 ∩ V w m , w ∈ V w m .
By definition of V z , our assumption V w ⊆ V z entails that the existence of the chain w 1 , w 1 , . . . , w m , w m leads to V w i ⊆ V z for every w i . Hence, w ∈ V z . In other words, we have V w ⊆ V z . ♦

Claim II: Let w, z be two variables in ϕ with bidx(w) ≥ bidx(z). If there is some variable x with

x ∈ V w ∩ V z , then V w ⊆ V z .
Proof: Because of x ∈ V w we have bidx(x ) ≥ bidx(w) and there is some chain of variables w 1 , w 1 , . . . , w m , w m such that bidx(z) ≤ bidx(w) ≤ bidx(w i ) ≤ bidx(w i ) for every i, and

w 1 ∈ V w ∩ V w 1 , w 2 ∈ V w 1 ∩ V w 2 , . . . w m ∈ V w m-1 ∩ V w m , x ∈ V w m .
Because of x ∈ V z we have bidx(x ) ≥ bidx(z) and there is some chain of variables z 1 , z 1 , . . . , z q , z q such that bidx(z) ≤ bidx(z j ) ≤ bidx(z j ) for every j, and

z 1 ∈ V z ∩ V z 1 , z 2 ∈ V z 1 ∩ V z 2 , . . . z q ∈ V z q-1 ∩ V z q , x ∈ V z q .
By definition of V z , we get V z j ⊆ V z for every z j (following the chain V z V z 1 . . . V z q ) and V w i ⊆ V z for every w i (following the chain V w m . . . V w 1 V w ) and V w ⊆ V z . By virtue of Claim I, the last observation entails

V w ⊆ V z . ♦ Assume bidx(u) = bidx(v) and suppose that V u ∩ V v contains at least one variable w. By virtue of Claim II, we get V u ⊆ V v and V v ⊆ V u . Therefore, V u = V v .
Now assume bidx(u) < bidx(v) and suppose that V u ∩ V v contains at least one variable w. By virtue of Claim II, we get V v ⊆ V u . Moreover, we have u ∈ V u ⊆ V u on the one hand but u ∈ V v on the other hand. The latter holds as for every z ∈

V v we have bidx(z) ≥ bidx(v). Consequently, V u V v .
For any set V ⊆ vars(ϕ) we denote by At ϕ (V ) At ϕ (V ) the set of all atoms occurring in ϕ that contain at least one variable from V . The following lemma follows immediately from Lemma 7.2.5. Lemma 7.2.6. Let u, v ∈ vars(ϕ) be two variables for which bidx(u) ≤ bidx(v) and v ∈ V u . Then, At ϕ ( V u ) ∩ At ϕ ( V v ) = ∅ and, hence, the sets V u and V v are separated in ϕ.

It is now our aim to show that any existentially quantified variable y * in ϕ depends only weakly on any universally quantified v if there is no z such that V z contains both y * and v. Moreover, we intend to exploit this insight when Skolemizing any of the existentially quantified variables in ϕ. We start with a syntactic approach. A semantically-minded alternative will follow later.

Theorem 7.2.7. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be a first-order sentence in standard form with quantifier-free ψ. Consider any k, 1 ≤ k ≤ n, and let y * be some variable in ȳk . Let W W be the union of all sets V v ϕ that contain y * and let x * be a tuple containing exactly the variables x from (x 1 ∪ . . . ∪ xk ) ∩ W . Then, there is some positive integer m such that ϕ is equivalent to some sentence of the form

ϕ := ∃f 1 . . . f m . ∀x 1 ∃ȳ 1 . . . ∀x k ∃ ȳk \{y * } . 1≤j≤m ψ y * /f j (x * ) .
Moreover, every atom in ψ is a copy of some atom from ψ where bound variables are possibly renamed after shifting quantifiers.

Proof sketch. Let W W be the complement of W , i.e. W := vars(ϕ) \ W . By Lemmas 7.2.5 and 7.2.6, we observe the following properties for all u ∈ W and v ∈ W :

(a) V u ϕ ∩ V v ϕ = ∅, (b) V u ϕ ⊆ W and V v ϕ ⊆ W , and (c) the sets V u ϕ , V v ϕ are separated in ϕ.
It follows that the sets W and W are separated in ϕ.

Let ūi , vi , wi , zi with i = 1, 2 be tuples of variables defined as follows: Then, the sets ū1 ∪ ū2 ∪ v1 ∪ v2 and w1 ∪ w2 ∪ {y * } ∪z 1 ∪z 2 are separated in ϕ. Using the techniques from the proofs of Lemmas 2.0.3 and 2.0.4, we can transform ϕ into an equivalent sentence ϕ ϕ of the form

ϕ := ∀x 1 ∃ȳ 1 . . . ∀x k ∃ ȳk \{y * } ∃y * . i∈I χ i (ū 1 , v1 ) ∧ η i ( w1 , y * , z1 ) ,
where I is some finite set of indices, the quantifiers for the variables in ū2 ∪ v2 have been shifted into the subformulas χ i (ū 1 , v1 ), and the quantifiers for the variables in w2 ∪ z2 have been shifted into the subformulas η i ( w1 , y * , z1 ). Next, we show that ϕ is equivalent to some sentence ϕ ϕ that has the form

ϕ := ∃f 1 . . . f m . ∀x 1 ∃ȳ 1 . . . ∀x k ∃(ȳ k \{y * }). 1≤k≤m i∈I χ i (ū 1 , v1 ) ∧ η i ( w1 , y * , z1 ) y * /f k ( w1 ) .
In the rest of the proof, we use ū1 , v1 , w1 , z1 without superscripts, i.e. we write ū, v, w, z instead.

Any model of ϕ is certainly a model of ϕ , i.e. we have ϕ |= ϕ . Let A be any model of ϕ . Then, there are mappings σ v :

A |ū| × A | w| → A |v| , σ y * : A |ū| × A | w| → A, and σ z : A |ū| × A | w| → A |z|
that resemble parts of some satisfying strategy that exists for ϕ . More precisely, we have

A |= i∈I χ i ā, σ v(ā, c) ∧ η i c, σ y * (ā, c), σ z(ā,
A |= i∈I χ i ā, σ v(ā, c) ∧ ∃y * . η i c, y * , σ z(ā, c) holds if and only if S ā,σv(ā,c) ∩ T c,σz(ā,c) is not empty.
For every c there is a smallest integer m c and two lists ā1 , . . . , āmc and T 1 , . . . , T mc of tuples āk ∈ A |ū| and of sets T k ⊆ I that satisfy the following properties.

(a) For every k we have

T k = T c,σz(ā k ,c) .
(b) For every ā the set S ā,σv(ā,c) shares at least one element with at least one of the T k .

Hence, there exist mappings τ z :

A |ū| × A | w| → A |z| and τ y * : A |ū| × A | w| → A such that for every ā (i) there is some k such that τ z(ā, c) = σ z(ā k , c), (ii) T c,τz(ā,c)
∩ S ā,σv(ā,c) contains at least one index j, and

(iii) τ y * is defined such that A |= η j c, τ y * (ā, c), τ z(ā, c) for some j ∈ S ā,σv(ā,c) . This entails A |= i∈I χ i ā, σ v(ā, c) ∧ η i c, τ y * (ā, c), τ z(ā, c) . Let m := max{m c | c ∈ A | w| }. Notice that m ≤ |I|. Let τ 1 , .
. . , τ m be mappings with the signature τ k : A | w| → A such that for every c and every k, 1 ≤ k ≤ m c, we set τ k (c) := τ y * (ā k , c)for k > m c we can define τ k (c) arbitrarily. Then, we observe

A |= i∈I χ i ā, σ v(ā, c) ∧ 1≤k≤m η i c, τ k (c), τ z(ā, c) |=| 1≤k≤m i∈I χ i ā, σ v(ā, c) ∧ η i c, τ k (c), τ z(ā, c) .
This entails that A satisfies ϕ , which finishes the proof.

Notice that we used a quite different notion of fingerprint in the proof of Theorem 7.2.7 than we have used before. This approach is encouraged by the special syntactic form of the matrix of ϕ .

Theorem 7.2.7 is somewhat unsatisfactory, because the shape of the formula ψ can only be determined by following the scheme described earlier (page 192), which in general requires a lot of syntactic transformations. It seems to be much more appealing to find a purely semantic argument (or a way of gracefully undoing the syntactic transformations), which in the end gives us a non-standard Skolemization technique that requires only straightforward replacement of subformulas. In the rest of the present section we shall make such an attempt and show the following result.

Theorem 7.2.8. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be a first-order sentence in standard form with quantifier-free ψ. Consider any k, 1 ≤ k ≤ n, and let y * be some variable in ȳk . Let W W be the union of all sets V v ϕ that contain y * and let x * be a tuple containing exactly the variables x from (x 1 ∪ . . . ∪ xk ) ∩ W . Then, there is some positive integer m such that ϕ is equivalent to the sentence

ϕ := ∃f 1 . . . f m . ∀x 1 ∃ȳ 1 . . . ∀x k ∃(ȳ k \ {y * }). 1≤i≤m ∀x k+1 ∃x k+1 . . . ∀x n ∃ȳ n . ψ y * /f i (x * ) . T 2i-1 ∈ im σ (ξ i ) and T 2i ∈ im σ (ξ i ) for every i, and T 2k-1 ∈ T 2k-2 ∈ . . . ∈ T 1 .
We associate with each such pair S 1 . . . S 2k-1 , T 1 . . . T 2k-1 one mapping ρ j k ρ j k and set

ρ j k ( b1 , . . . , bk ) := σ 2 k (ā 1 , b1 , . . . , āk , bk )
for all sequences b1 , . . . , bk for which there exists a sequence ā1 , . . . , āk with ν k (ā 1 , b1 , . . . , āk , bk ) = S 1 . . . S 2k-1 , T 1 . . . T 2k-1 . For all other b1 , . . . , bk , ρ j k shall be undefined. By ν-ξ-uniformity of σ, the ρ j k are well defined. It is now easy to see that we can set τ 1 k := σ 1 k and τ 2 k := σ 2 k for every k.

Now consider again the two sentences ϕ = ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ and

ϕ := ∃f 1 . . . f m . ∀x 1 ∃ȳ 1 . . . ∀x k ∃(ȳ k \ {y * }). 1≤i≤m ∀x k+1 ∃x k+1 . . . ∀x n ∃ȳ n . ψ y * /f i (x * )
from Theorem 7.2.8, where we use m := m k with m k being defined like in the proof of Lemma 7.2.12 as the number of pairs S 1 . . . S 2k-1 , T 1 . . . T 2k-1 for which we have

S 2i-1 ∈ im σ (ν i ) and S 2i ∈ im σ (ν i ) for every i, and S 2k-1 ∈ S 2k-2 ∈ . . . ∈ S 1 , T 2i-1 ∈ im σ (ξ i ) and T 2i ∈ im σ (ξ i ) for every i, and T 2k-1 ∈ T 2k-2 ∈ . . . ∈ T 1 .
It is easy to see that we have ϕ |= ϕ.

Let A be a model of ϕ. Then, there exists a strategy σ that is satisfying for ϕ under A. Applying Lemma 7.2.12, we can assume that σ is ν-ξ-uniform. In particular, there are mappings ρ 1 , . . . , ρ m with ρ j :

A |x 2 1 | × . . . × A |x 2 k | → ȳ2
k that exhibit the following properties. For all sequences ā1 , . . . , āk , b1 , . . . , bk there is some j for which we have

A, [x 1 1 →ā 1 , x2 1 → b1 , . . . , x1 k →ā k , x2 k → bk , ȳ1 1 →σ 1 1 (ā 1 , b1 ), . . . , ȳ1 k-1 →σ 1 k-1 (ā 1 , b1 , . . . , āk-1 , bk-1 ), ȳ2
1 →σ 2 1 (ā 1 , b1 ), . . . , ȳ2 k-1 →σ 2 k-1 (ā 1 , b1 , . . . , āk-1 , bk-1 ), ȳ2 k →ρ j ( b1 , . . . , bk )] |= ∀x k+1 ∃ȳ k+1 . . . ∀x n ∃ȳ n . ψ .

Since x * = (x 1 ∪ . . . ∪ xk ) ∩ W coincides with x2 1 , . . . , x2 k and because of y * ∈ ȳk ∩ W = ȳ2 k , this implies that A |= ϕ . Therefore, we have ϕ |= ϕ .
This finishes the proof of Theorem 7.2.8.

Notice that Theorem 7.2.8 does not subsume the results that we have obtained for GBSR and GAF in Chapter 4. Even in the setting of SF the theorem would not suffice to show decidability. Some dependences can still be removed and the theorem strengthened. For a more fine-grained analysis of dependences, it might make sense to define W differently -see the conjecture below. As already mentioned earlier, the set V v overapproximates the set of variables that must lie in the scope of the quantifier Qv. For example, in the sentence ∀u∀v∃y. P (u, v) ∧ R(u, y) we have V u = {u, v, y}, V v = {v}, and V y = {y}. Evidently, y could very well be outside of the scope of ∀v, although V u does not indicate this; however, V v does indicate it. In contrast to the setting of Theorem 7.2.8, there is no neat partition of the set of atoms into one part that exclusively contains variables y only weakly depends on and a disjoint part collecting the variables having strong ties with y.

Compared to Theorem 7.2.7, Theorem 7.2.8 can already be considered an advance. Nevertheless, it leaves plenty of room for improvement. Using more sophisticated arguments, one should be able to proof the following strengthening.

Conjecture 7.2.13. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ be a first-order sentence in standard form with quantifier-free ψ. Consider any k, 1 ≤ k ≤ n, and let y * be some variable in ȳk . Let x * be a tuple containing exactly the variables x from x1 ∪ . . . ∪ xk for which we have y * ∈ V x . Then, there is some positive integer m such that ϕ is equivalent to the sentence

ϕ := ∃f 1 . . . f m . ∀x 1 ∃ȳ 1 . . . ∀x k ∃(ȳ k \{y * }). 1≤i≤m ∀x k+1 ∃x k+1 . . . ∀x n ∃ȳ n . ψ y * /f i (x * ) .
Intuitively, the conjecture states that the existentially quantified y * cannot depend strongly on any universally quantified variable v with y * ∈ V v . Moreover, in such cases we replace y * with several, though finitely many, Skolem terms that need not have v as an argument.

Further room for improvement may be provided when taking Boolean structure into account, either similarly to the approach outlined in Section 3.6 or in a yet-to-be developed way.

Elimination of Second-Order Quantifiers in Second-Order SF

Elimination of second-order quantifiers can be conceived as a generalization of the satisfiability problem of first-order logic. Consider any relational first-order sentence ϕ and let P 1 , . . . , P n be an enumeration of all the predicate symbols occurring in ϕ. Now consider the second-order sentence ∃P 1 . . . P n . ϕ. Elimination of all second-order quantifiers in ∃P 1 . . . P n . ϕ yields an equivalent firstorder sentence ψ in which the equality sign is the only predicate symbol. In other words, ψ is an MFO ≈ sentence over the empty vocabulary. Therefore, we can decide satisfiability of ψ. In summary, any procedure that can eliminate all second-order quantifiers in ∃P 1 . . . P n . ϕ can be turned into a decision procedure for the first-order sentence ϕ.

Second-order quantifier elimination has a number of applications in knowledge representation and automated reasoning, see, e.g., [START_REF] Gabbay | Second-Order Quantifier Elimination: Foundations, Computational Aspects and Applications[END_REF][START_REF] Wernhard | Second-Order Quantifier Elimination on Relational Monadic Formulas -A Basic Method and Some Less Expected Applications[END_REF][START_REF] Heinrich | Behmann's Contributions to Second-Order Quantifier Elimination from the View of Computational Logic[END_REF][START_REF]Proceedings of the Workshop on Second-Order Quantifier Elimination and Related Topics[END_REF]. It is a classical result that the monadic fragment of second-order logic (MSO) admits elimination of second-order quantifiers. This was discovered by Löwenheim [START_REF] Löwenheim | Über Möglichkeiten im Relativkalkül[END_REF], Skolem [START_REF] Skolem | Untersuchungen über die Axiome des Klassenkalküls und über Produktations-und Summationsprobleme welche gewisse Klassen von Aussagen betreffen[END_REF], and Behmann [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF]. As almost all of the novel fragments we introduced in Section 3 generalize MFO while retaining a decidable satisfiability problem, it is natural to ask whether second-order versions of these fragments admit elimination of second-order quantifiers. We shall only sketch a preliminary answer to this questions for the simplest fragment and, hence, focus on SF in the present section. Interestingly, already Ackermann gave a counterexample. In an article from 1935 [START_REF] Ackermann | Untersuchungen über das Eliminationsproblem der mathematischen Logik[END_REF], Ackermann argued that the quantifier ∃P in the following formula cannot be eliminated: ∃P. P (x) ∧ ¬P (y) ∧ ∀uv. ¬P (u) ∨ P (v) ∨ ¬N (u, v). The only atom in this formula that could potentially break the separateness condition is N (u, v). But since both variables u and v are universally quantified, universal variables are separated from existential variables and the sentence is in SF. Although Ackermann's observation seems to be discouraging, it only means that there is, apparently, no straight-forward way of extending the quantifier-elimination techniques that work for MSO to a second-order version of SF. In the following we shall present certain syntactic restrictions that allow the elimination of existentially quantified unary predicate symbols in separated formulas. To emphasize it again: the presented results are of a preliminary character and are not yet fully developed. They provide only a first hint at some directions that might be worth following in future work.

Our starting point will be the equivalence-preserving transformation from SF into BSR, which we need to adapt only slightly to the needs of second-order quantifier elimination.

Lemma 7.3.1. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ(x, ȳ, z) be a relational first-order formula in standard form with quantifier-free ψ. We set x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn and we assume that every variable in the quantifier prefix also occurs in the matrix. Let x 1 , . . . , x m1 ⊆ x and y 1 , . . . , y m2 ⊆ ȳ be partitions of the sets x and ȳ, respectively, such that the x 1 , . . . , x m1 , y 1 , . . . , y m2 are nonempty, pairwise disjoint, and pairwise separated in ϕ. Then, ϕ is equivalent to a finite disjunction of formulas of the form

k ∀ x k . K k ( x k , z) ∧ i ∃ y i . j L ij ( y i , z) ,
where the K k and the L ij are literals whose atoms are renamed variants of atoms that occur in ϕ. Moreover, any two sets x k1 , x k2 with k 1 = k 2 , y i1 , y i2 with i 1 = i 2 , and x k , y i are separated in the resulting formula.

Proof. For convenience, we pretend that z is empty. The argument works for nonempty z as well.

We transform ϕ into an equivalent CNF formula of the form

∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . i∈I χ i (x) ∨ k∈Ji L k (ȳ)
where I I, J i , L k and the J i are finite, pairwise disjoint sets of indices, the subformulas χ i are disjunctions of literals, and the L k are literals. By Lemma 3.2.4, we can construct an equivalent formula of the form

ϕ ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n . S⊆I S =∅ i∈S χ i (x) ∨ f ∈F ∃ȳ n . i∈S η f (i) (ȳ)
where F is the set of all selection functions over the index sets J i , i ∈ I. We shift the universal quantifier block ∀x n inwards and thus obtain

ϕ ϕ := ∀x 1 ∃ȳ 1 . . . ∃ȳ n-1 . S⊆I S =∅ ∀x n . i∈S χ i (x) ∨ f ∈F ∃ȳ n . i∈S η f (i) (ȳ) .
We now iterate these two steps in an alternating fashion until all quantifier blocks have been shifted inwards in the described way. The constituents of the result ϕ (3) ϕ (3) := q χ

(3) q ∨ p η

(3) qp of this process have the form

χ (3) q χ (3) q = ∀x 1 . 1 ∀x 2 . 2 . . . n-1 ∀x n . i∈S 1 ,..., n-1 χ i (x) . . .
where the S 1,..., n -1 are certain subsets of I and the χ i are still disjunctions of literals, and

η (3) qp η (3) qp = ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 ∃ȳ n . k∈J 1 ,..., n-1 L k (ȳ) . . .
where the J 1,..., n-1 are certain subsets of i∈I J i .

By definition of the sets x 1 , . . . , x m1 , which are pairwise separated in the χ

(3) q , we can rewrite every χ

(3) q into the following form by regrouping the inner disjuncts:

χ (4) q χ (4) q = ∀x 1 . 1 ∀x 2 . 2 . . . n-1 ∀x n . 1≤i ≤m1 χ ¯ i ( x i ) . . .
where the χ ¯ i are (possibly empty) disjunctions of literals. Analogously, we rewrite every η

(3) qp into the form

η (4) qp η (4) qp = ∃ȳ 1 . 1 ∃ȳ 2 . 2 . . . n-1 ∃ȳ n . 1≤j ≤m2 η ¯ j ( y j ) . . .
where the η ¯ j are (possibly empty) conjunctions of literals.

We then observe the following equivalences, starting from χ (4) q : ∀x 1 .

1 ∀x 2 . 2 . . . n-1 ∀x n . 1≤i ≤m1 χ ¯ i ( x i ) . . . |=| ∀x 1 . 1 ∀x 2 . 2 . . . n-1 1≤i ≤m1 ∀(x n ∩ x i ). χ ¯ i ( x i ) . . . |=| ∀x 1 . 1 ∀x 2 . 2 . . . 1≤i ≤m1 n-1 ∀(x n ∩ x i ). χ ¯ i ( x i ) . . . . . . |=| 1≤i ≤m1 ∀(x 1 ∩ x i ). 1 ∀(x 2 ∩ x i ). 2 . . . n-1 ∀(x n ∩ x i ). χ ¯ i ( x i ) . . . |=| 1≤i ≤m1 ∀ x i . χ i ( x i ) ,
where the χ i are disjunctions of literals. Before shifting universal quantifiers outwards in the last step of the above transformation, bound variables are renamed so that all quantifiers bind pairwise distinct variables. Analogously, we have

η (4) qp |=| 1≤j ≤m2 ∃ y j . η j ( y j ) ,
where the η j are conjunctions of literals.

Consequently, we have rewritten ϕ (3) = q χ

(3)

q ∨ p η (3) qp into an equivalent formula ϕ (4) of the form ϕ (4) ϕ (4) = q 1≤i ≤m1 ∀ x i . χ qi ( x i ) ∨ p 1≤j ≤m2
∃ y j . η qpj ( y j ) .

After renaming bound variables again in such a way that all quantifiers bind pairwise distinct variables, we transform ϕ (4) into an equivalent formula that is a disjunction of formulas of the form

k ∀ x k . K k ( x k ) ∧ i ∃ y i . j L ij ( y i ) .
Lemma 7.3.1 provides the syntactic transformations for eliminating second-order quantifiers that occur in a separated formula under certain conditions.

Example 7.3.2. Consider the SF sentence ϕ := ∀x 1 ∃y 1 ∀x 2 ∃y 2 . R(x 1 , x 2 ) ↔ Q(y 1 , y 2 ). Nested alternating quantifiers can be transformed away, as indicated by Lemma 7.3.1. An intermediate result of this process is

∀x 1 ∃y 1 . ∀x 2 . R(x 1 , x 2 ) ∨ ∃y 2 . ¬Q(y 1 , y 2 ) ∧ ∀x 2 . ¬R(x 1 , x 2 ) ∨ ∃y 2 . Q(y 1 , y 2 ) .
Continuing the transformation, we eventually obtain

∃y 1 y 2 y 3 . Q(y 1 , y 2 ) ∧ ¬Q(y 1 , y 3 ) ∨ ∀x 1 x 2 . R(x 1 , x 2 ) ∧ ∃y 1 y 2 . Q(y 1 , y 2 ) ∨ ∀x 1 x 2 . ¬R(x 1 , x 2 ) ∧ ∃y 1 y 2 . ¬Q(y 1 , y 2 ) ∨ ∀x 1 x 2 x 3 . R(x 1 , x 2 ) ∨ ¬R(x 1 , x 3 ) ∧ ∃y 1 y 2 . Q(y 1 , y 2 ) ∧ ∃y 3 y 4 . ¬Q(y 3 , y 4 ) ,
which is equivalent to ϕ but does not contain any quantifier alternation.

Next, we formulate syntactic restrictions that enable the elimination of second-order quantifiers over unary predicates from sentences that belong to a second-order variant of SF. Again, separateness of sets of variables in a formula plays a central role in our criterion. However, this time it is not only of interest that universally quantified and existentially quantified variables are separated. In addition, it is important that within each set of non-separated variables there is at most one variable that occurs as the argument of the predicate symbol that is bound by the second-order quantifier we intend to eliminate.

Lemma 7.3.3. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ(x, ȳ, z) be a relational first-order formula in which ψ is quantifier free and the sets x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn are separated. We assume that every variable occurring in the quantifier prefix and in z also occurs in the matrix ψ.

Let x 1 , . . . , x m1 ⊆ x and y 1 , . . . , y m2 ⊆ ȳ be partitions of the sets x and ȳ, respectively, such that the x 1 , . . . , x m1 , y 1 , . . . , y m2 are nonempty, pairwise disjoint, and pairwise separated in ϕ. Let P be a unary predicate symbol satisfying the following conditions:

(1) For every set x i , 1 ≤ i ≤ m 1 , there is at most one variable x * i ∈ x i for which ϕ contains atoms P (x * i ).

(2) For every set y i , 1 ≤ i ≤ m 2 , there is at most one variable y * i ∈ y i for which ϕ contains atoms P (y * i ).

Then, ∃P. ϕ is equivalent to a finite disjunction of formulas of the form

θ(z) ∧ ∃P. k1 ∀ x k1 . χ k1 ( x k1 , z) ∨ P (x * k1 ) ∧ k2 ∀ x k2 . χ k2 ( x k2 , z) ∨ ¬P (x * k2 ) ∧ i1 ∃ y i1 . η i1 ( y i1 , z) ∧ P (y * i1 ) ∧ i2 ∃ y i2 . η i2 ( y i2 , z) ∧ ¬P (y * i2 ) ∧ 1 P (z * 1 ) ∧ 2 ¬P (z * 2 ) ,
where (a) the χ k1 and the χ k2 are disjunctions of literals and the η i1 and the η i2 are conjunctions of literals, (b) all the atoms in θ and in the χ k1 , χ k2 , η i1 , and η i2 are renamed variants of atoms that occur in ϕ and do not contain the predicate symbol P , and (c) the variables z * 1 , z * 2 are pairwise distinct and stem from z.

Proof. By Lemma 7.3.1, we know that ϕ can be rewritten into an equivalent formula that is a finite disjunction of formulas in which no universal quantifier lies within the scope of an existential quantifier and vice versa. We apply this transformation to ϕ and obtain a formula as described in Lemma 7.3.1. In the next step, we isolate atoms that exclusively contain variables from z, shift first-order quantifiers inwards so that these atoms are not within their scopes anymore, and transform the result into a formula ϕ that is a disjunction of formulas of the form

k ∀ x k . K k ( x k , z) ∧ i ∃ y i . j L ij ( y i , z) ∧ r M r (z) ,
where the K k and the L ij are literals whose atoms are renamed variants of atoms from ϕ and contain at least one variable from some x k or y i . The M r are literals whose atoms occur in ϕ and contain exclusively variables from z. Moreover, any two sets x k1 , x k2 with k 1 = k 2 , y i1 , y i2 with i 1 = i 2 , and x k , y i are separated in ϕ . By inspection of the transformations performed in the proof of Lemma 7.3.1, we observe that Conditions (1) and ( 2) are preserved such that they also apply to the sets x k and y i with respect to variables x * k and y * i , respectively. This enables us to regroup the disjunctions and conjunctions in the constituents of ϕ so that each of these disjuncts has the form

k ∀ x k . K k ( x k , z) ∨ [¬]P (x * k ) ∧ i ∃ y i . j L i j ( y i , z) ∧ [¬]P (y * i ) ∧ r M r (z) ∧ q [¬]P (z * q ) ,
where the literals K k , L i j , and M r do not contain the predicate symbol P . The variables z * q stem from z. Moreover, we replace disjuncts (conjuncts) which contain two literals P (v) and ¬P (v) with the logical constant true (false). Having this, it only remains to regroup conjuncts and distribute the second-order quantifier ∃P over the topmost disjunction, in order to obtain the formula advertised in the lemma.

The formula resulting from Lemma 7.3.3 gives us the right starting point for the elimination of the second-order quantifier ∃P . Before we elaborate on this, we present the Basic Elimination Lemma that we shall employ for elimination. Proposition 7.3.4 (Basic Elimination Lemma, see [START_REF] Heinrich | Behmann's Contributions to Second-Order Quantifier Elimination from the View of Computational Logic[END_REF], Lemma 3, and [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF]). Let P be a unary predicate symbol and let χ, η be first-order formulas in which P does not occur. Then, ∃P. ∀x. χ ∨ P (x) ∧ ∀x. η ∨ ¬P (x) is semantically equivalent to ∀x. χ ∨ η.

Consider any formula ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ(x, ȳ, z) satisfying the prerequisites of Lemma 7.3.3. Moreover, let there be sets x 1 , . . . , x m1 and y 1 , . . . , y m2 and a unary predicate symbol P as described in the lemma. Then, Lemma 7.3.3 stipulates the existence of a formula equivalent to ϕ that is a disjunction of formulas of the form

θ(z) ∧ ∃P. k1 ∀ x k1 . χ k1 ( x k1 , z) ∨ P (x * k1 ) ∧ k2 ∀ x k2 . χ k2 ( x k2 , z) ∨ ¬P (x * k2 ) ∧ i1 ∃ y i1 . η i1 ( y i1 , z) ∧ P (y * i1 ) ∧ i2 ∃ y i2 . η i2 ( y i2 , z) ∧ ¬P (y * i2 ) ∧ 1 P (z * 1 ) ∧ 2 ¬P (z * 2 ) ,
in which we can eliminate the quantifier ∃P as follows. The shape of the above formula is very similar to what Behmann called "Eliminationshauptform" in [START_REF] Behmann | Beiträge zur Algebra der Logik, insbesondere zum Entscheidungsproblem[END_REF] (see [START_REF] Heinrich | Behmann's Contributions to Second-Order Quantifier Elimination from the View of Computational Logic[END_REF] for a modern exposition of Behmann's results related to quantifier elimination). With the next two transformation steps we come closer to the syntactic shape of the "Eliminationshauptform". First, we shift the first-order quantifiers inwards that do not bind variables x * k or y * i :

θ(z) ∧ ∃P. k1 ∀x * k1 . ∀( x k1 \{x * k1 }). χ k1 ( x k1 , z) =: χ * k 1 ∨ P (x * k1 ) ∧ k2 ∀x * k2 . ∀( x k2 \{x * k2 }). χ k2 ( x k2 , z) =: χ * k 2 ∨ ¬P (x * k2 ) ∧ i1 ∃y * i1 . ∃( y i1 \{y * i1 }). η i1 ( y i1 , z) =: η * i 1 ∧ P (y * i1 ) ∧ i2 ∃y * i2 . ∃( y i2 \{y * i2 }). η i2 ( y i2 , z) =: η * i 2 ∧ ¬P (y * i2 ) ∧ 1 P (z * 1 ) ∧ 2 ¬P (z * 2 ) .
Next, we treat the subformulas χ * k and η * i as indivisible units, shift universal quantifiers outwards (over k1 and k2 ) that occur in different conjuncts (and merge them while doing so), shift first-order existential quantifiers outwards (over i1 and i2 ; without merging them), and rename the variables that are bound by the shifted quantifiers. Moreover, we reorder the conjunctions in the scope of the quantifier blocks ∃ū and ∃v:

θ(z) ∧ ∃P. ∀x. k1 χ * k1 x * k1 /x =: χ * 1 (x,z) ∨ P (x) ∧ ∀x. k2 χ * k2 x * k2 /x =: χ * 2 (x,z) ∨ ¬P (x) ∧ ∃ū. i1 η * i1 y * i1 /u i1 =: η * 1 (ū,z) ∧ i1 P (u i1 ) ∧ ∃v. i2 η * i2 y * i2 /v i2 =: η * 2 (v,z) ∧ i2 ¬P (v i2 ) ∧ 1 P (z * 1 ) ∧ 2 ¬P (z * 2 ) .
In what follows we treat the χ * 1 , χ * 2 and η * 1 , η * 2 as indivisible units. One more step remains to establish a kind of "Eliminationshauptform". We shift the quantifier blocks ∃ū and ∃v outwards over the second-order quantifier ∃P , reorder the conjuncts within the scope of ∃P , and shift ∃P inwards so that its scope does not contain the η * 1 , η * 2 anymore. Moreover, we make use of Proposition 3.3.6 and turn the literals P (u i1 ) into subformulas ∀x. x ≈ u i1 → P (x). We proceed analogously with the literals ¬P (v i2 ), P (z * 1 ), and ¬P (z * 2 ):

θ(z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ ∃P. ∀x. χ * 1 (x, z) ∨ P (x) ∧ ∀x. χ * 2 (x, z) ∨ ¬P (x) ∧ ∀x. i1 x ≈ u i1 → P (x) ∧ ∀x. i2 x ≈ v i2 → ¬P (x) ∧ ∀x. 1 x ≈ z * 1 → P (x) ∧ ∀x. 2 x ≈ z * 2 → ¬P (x) .
At this point, the subformula staring with ∃P is almost in "Eliminationshauptform". After converting the implications into disjunctions and factoring out the [¬]P (x), we arrive at a formula from which the second-order quantifier ∃P can be eliminated immediately via the basic elimination lemma:

θ(z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ ∃P. ∀x. χ * 1 (x, z) ∧ i1 x ≈ u i1 ∧ 1 x ≈ z * 1 ∨ P (x) ∧ ∀x. χ * 2 (x, z) ∧ i2 x ≈ v i2 ∧ 2 x ≈ z * 2 ∨ ¬P (x) .
Using Proposition 7.3.4, we eliminate the quantifier ∃P and obtain

θ(z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ ∀x. χ * 1 (x, z) ∧ i1 x ≈ u i1 ∧ 1 x ≈ z * 1 ∨ χ * 2 (x, z) ∧ i2 x ≈ v i2 ∧ 2 x ≈ z * 2 .
In order to convert this result into a somewhat nicer form, we proceed as described in the proof of Lemma 19 in [START_REF] Heinrich | Behmann's Contributions to Second-Order Quantifier Elimination from the View of Computational Logic[END_REF]. In particular, we remove the disequations x ≈ y, where x is a universally quantified variable. To this end, we first distribute disjunction over conjunction within the scope of the quantifier ∀x:

θ(z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ ∀x. χ * 1 (x, z) ∨ χ * 2 (x, z) ∧ i2 x ≈ v i2 ∧ 2 x ≈ z * 2 ∨ χ * 1 (x, z) ∧ i1 x ≈ u i1 ∧ 1 x ≈ z * 1 ∨ χ * 2 (x, z) ∧ i1 x ≈ u i1 ∧ 1 x ≈ z * 1 ∨ i2 x ≈ v i2 ∧ 2 x ≈ z * 2 .
Next, we factor the subformulas χ * 1 , χ * 2 , and i2 x ≈ v i2 ∧ 2 x ≈ z * 2 into the conjunctions with which they are disjunctively connected, respectively. Moreover, we turn the resulting disjunctions into implications:

θ(z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ ∀x. χ * 1 (x, z) ∨ χ * 2 (x, z) ∧ i2 x ≈ v i2 → χ * 1 (x, z) ∧ 2 x ≈ z * 2 → χ * 1 (x, z) ∧ i1 x ≈ u i1 → χ * 2 (x, z) ∧ 1 x ≈ z * 1 → χ * 2 (x, z) ∧ i1 x ≈ u i1 → i2 x ≈ v i2 ∧ 2 x ≈ z * 2 ∧ 1 x ≈ z * 1 → i2 x ≈ v i2 ∧ 2 x ≈ z * 2 .
Finally, we apply Proposition 3.3.6 in a reverse fashion to remove the universal variable x from some of the subformulas:

θ(z) ∧ ∀x. χ * 1 (x, z) ∨ χ * 2 (x, z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ i2 χ * 1 (v i2 , z) ∧ 2 χ * 1 (z * 2 , z) ∧ i1 χ * 2 (u i1 , z) ∧ 1 χ * 2 (z * 1 , z) ∧ i1 i2 u i1 ≈ v i2 ∧ i1 2 u i1 ≈ z * 2 ∧ 1 i2 z * 1 ≈ v i2 ∧ 1 2 z * 1 ≈ z * 2 .
Consequently, we get the following result.

Theorem 7.3.5. Let ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ(x, ȳ, z) be a relational first-order formula in which ψ is quantifier free and the sets x := x1 ∪ . . . ∪ xn and ȳ := ȳ1 ∪ . . . ∪ ȳn are separated. We assume that every variable occurring in the quantifier prefix and in z also occurs in the matrix ψ. Let x 1 , . . . , x m1 ⊆ x and y 1 , . . . , y m2 ⊆ ȳ be partitions of the sets x and ȳ, respectively, such that the x 1 , . . . , x m1 , y 1 , . . . , y m2 are nonempty, pairwise disjoint, and pairwise separated in ϕ. Let P be a unary predicate symbol satisfying the following conditions:

(1) For every set x i , 1 ≤ i ≤ m 1 , there is at most one variable x * i ∈ x i for which ϕ contains atoms P (x * i ).

(2) For every set y i , 1 ≤ i ≤ m 2 , there is at most one variable y * i ∈ y i for which ϕ contains atoms P (y * i ). Then, ∃P. ϕ is equivalent to some first-order formula ϕ that is a finite disjunction of formulas of the form

θ(z) ∧ ∀x. χ * 1 (x, z) ∨ χ * 2 (x, z) ∧ ∃ūv. η * 1 (ū, z) ∧ η * 2 (v, z) ∧ i2 χ * 1 (v i2 , z) ∧ 2 χ * 1 (z * 2 , z) ∧ i1 χ * 2 (u i1 , z) ∧ 1 χ * 2 (z * 1 , z) ∧ i1 i2 u i1 ≈ v i2 ∧ i1 2 u i1 ≈ z * 2 ∧ 1 i2 z * 1 ≈ v i2 ∧ 1 2 z * 1 ≈ z * 2 .
Moreover, all the u i1 are variables from ū, the v i2 are from v, and the z * 1 and z * 2 are free variables from z.

Example 7.3.6. Consider the sentence ϕ := ∃P. ∀x 1 ∃y∀x 2 . R(x 1 , x 2 ) ↔ P (y). We transform it into the equivalent sentence

∃P. ∀x 1 x 2 x 3 . R(x 1 , x 2 ) ∨ ¬R(x 1 , x 3 ) ∧ ∀x 1 x 2 . R(x 1 , x 2 ) ∨ ∃y. ¬P (y)
∧ ∀x 1 x 2 . ¬R(x 1 , x 2 ) ∨ ∃y. P (y) .

For the sake of simplicity, we shift ∃P inwards so that its scope only stretches over the last two conjuncts, which we thereafter transform into a disjunction of conjunctions. This yields

∀x 1 x 2 x 3 . R(x 1 , x 2 ) ∨ ¬R(x 1 , x 3 ) ∧ ∃P. ∀x 1 x 2 . R(x 1 , x 2 ) ∧ ∃y. P (y) ∨ ∀x 1 x 2 . ¬R(x 1 , x 2 ) ∧ ∃y. ¬P (y)
∨ ∃y. P (y) ∧ ∃y. ¬P (y) .

Since we can distribute the quantifier ∃P over disjunction, it is enough to eliminate ∃P in the following three formulas:

(

∨ P (x) ∧ ∀x. x ≈ y 2 ∨ ¬P (x) |=| ∃y 1 y 2 ∀x. x ≈ y 1 ∨ x ≈ y 2 |=| ∃y 1 y 2 . y 1 ≈ y 2
Hence, ϕ is semantically equivalent to

∀x 1 x 2 x 3 . R(x 1 , x 2 ) ∨ ¬R(x 1 , x 3 ) ∧ ∀x 1 x 2 . R(x 1 , x 2 ) ∨ ∀x 1 x 2 . ¬R(x 1 , x 2 ) ∨ ∃y 1 y 2 . y 1 ≈ y 2 .
Remark 7.3.7. Several remarks regrading the shape of the resulting formulas in Theorem 7.3.5 are in order. (a) Although the elimination of ∃P potentially introduces new (dis)equations, these only involve existentially quantified and free variables. This means, the separation conditions are not violated by these newly introduced equations. Hence, the introduction of such atoms in one elimination step does not pose an obstacle to the iterated elimination of multiple existential second-order quantifiers. (b) As the subformulas χ * 1 (v i2 , z) may contain universal quantifiers ∀w and atoms R(. . . w . . . v i2 . . .), the separateness condition regarding universally and existentially quantified variables might be violated when introducing the subformulas χ * 1 (v i2 , z) and, similarly, the subformulas χ * 2 (u i1 , z). (c) Perhaps more severely, the introduction of atoms R(. . . w . . . v i2 . . .) may create co-occurrences of variables from the sets x k and y i , if w ∈ x k and v i2 ∈ y i . Then, the sets x k and y i are not separated anymore in formulas that contain the new atom. Similar effects might affect pairs x k , x k and y i , y i . Hence, if we were to predict whether elimination of the two second-order quantifiers in a formula ∃Q∃P. ϕ is possible using the methods outlined above, we would need to predict which sets of variables will be separated after the elimination of ∃P .

The above observations seem to indicate that it is not straightforward to formulate a version of Theorem 7.3.5 that neatly facilitates iterative elimination of multiple quantifiers in second-order SF. On the other hand, it might be worthwhile to base the theorem on a second-order variant of GBSR instead, as Observation (b) might cause fewer troubles in the GBSR setting. Another interesting aspect is that the symmetry regarding the two Conditions (1) and (2) in Theorem 7.3.5 is perhaps more restrictive than necessary. It seems that Condition (2) is obsolete, as the resulting formula in Lemma 7.3.3 could be generalized in such a way that the restriction imposed by (2) is not satisfied but second-order quantifiers can still be eliminated. Altogether, it is subject to future investigations whether Theorem 7.3.5 can be enhanced to facilitate iterative elimination of multiple quantifiers.

The presented result can only be a first step towards the formulation of a novel fragment of second-order logic that (i) extends the monadic second-order fragment, (ii) is based on the concept of separateness, (iii) admits elimination of second-order quantifiers, also in an iterated fashion. Remark 7.3.7 already makes clear that a lot remains to be done, in order to achieve this goal. Furthermore, there seems to be no good reason to confine ourselves to the elimination of quantifiers over unary predicates only, but aim for higher arities as well. Moreover, the requirements regarding separateness of variables could be weakened by taking boolean structure into account instead of only concentrating on the atoms in a given formula, compare also Section 3.6. For example, the formula ∃P. ∀xy. P (x) ∧ P (y) ∨ R(x, y) does not satisfy the prerequisites of Theorem 7.3.5, as {x} and {y} are not separated and the set {x, y} contains two variables that occur as arguments of P . However, the theorem can be applied to the equivalent formula ∃P. ∀x 1 x 2 y. P (x 1 ) ∧ P (y) ∨ R(x 2 , y) , as the sets {x 1 } and {x 2 , y} are separated and x 2 does not occur as argument of P . As a third possible improvement, equations between universal and existential variables should be allowed in a less restrictive way than they are at the moment. To this end, some of the methods that are used to handle equations during quantifier elimination in the monadic second-order fragment might be applicable in the more general setting as well.

In the outlined approach we concentrated on transforming the input formulas syntactically until the Basic Elimination Lemma (Proposition 7.3.4) is applicable. In future work, it is of course advisable to also try other known approaches, such as the ones described in [START_REF] Gabbay | Second-Order Quantifier Elimination: Foundations, Computational Aspects and Applications[END_REF], e.g. the SCAN algorithm, the DLS* algorithm, hierarchical theorem proving, or variations thereof. The unmodifed DLS algorithm, as presented in [START_REF] Gabbay | Second-Order Quantifier Elimination: Foundations, Computational Aspects and Applications[END_REF], fails on the logic fragment described in Theorem 7.3.5. In particular, the preprocessing phase is not always able to transform the input into the required form, although this would be possible in principle. This is already true for monadic sentences such as ϕ := ∃P. ∀x∃y. ¬P (x) ∨ P (y) ∧ P (x) ∨ ¬P (y) , which is equivalent to ∃P. ∀x∃y. P (x) ↔ P (y). Conradie gave a necessary and sufficient condition regarding the syntax of formulas in which DLS can successfully eliminate an existential second-order quantifier [START_REF] Conradie | On the strength and scope of DLS[END_REF]. It turns out that the occurrences of P in ϕ violate Conradie's condition in many ways -every occurrence of P is in malignant conjunctions and disjunctions and inside a ∀∃-scope. Nonetheless, it is not hard to see that there is a first-order formula that is equivalent to ϕ, namely true. A slight modification of the DLS preprocessing step in the spirit of Lemma 3.2.4 might already solve this particular issue.

Part II

First-Order Linear Arithmetic with Uninterpreted Predicates Chapter 8

Linear Arithmetic with Uninterpreted Predicates

In Part I of the present thesis we have mainly treated first-order logic where only the distinguished equality predicate had a fixed semantics. The semantics of all other predicate symbols and function symbols was open to interpretation and only determined by the structures that we considered. In the literature, such symbols are sometimes referred to as uninterpreted, meaning that their interpretation is not fixed a priori. In Part II we will be interested in first-order languages where the vocabulary contains uninterpreted predicate and function symbols alongside interpreted symbols. Moreover, parts of the domain are fixed and other parts are not predetermined, i.e. we technically have a sorted setting. In particular, we shall be considering fragments of the language of linear arithmetic over the rationals or integers with additional uninterpreted predicate symbols and ask whether the associated satisfiability problems are decidable.

We have already encountered two well-known decidable arithmetic theories1 in Chapter 2 (pages 20-22) and in Section 7.1: Presburger arithmetic -the first-order theory of the integers2 with addition and the usual ordering -and linear rational arithmetic -the first-order theory of linear sentences over the rational numbers with the usual ordering. Both fragments admit quantifier elimination, first elimination procedures were devised by Presburger [START_REF] Presburger | Über die Vollständigkeit eines gewissen Systems der Arithmetik ganzer Zahlen, in welchem die Addition als einzige Operation hervortritt[END_REF] (see [START_REF] Stansifer | Presburger's Article on Integer Arithmetic: Remarks and Translation[END_REF] for an English translation and [START_REF] Herbert | A mathematical introduction to logic[END_REF] for a textbook exposition) and Tarski [START_REF] Tarski | A Decision Method for Elementary Algebra and Geometry[END_REF], respectively. In 1974 the computational time complexity of deciding membership in the theory of Presburger arithmetic was shown to be doubly exponential by Fischer and Rabin [START_REF] Michael | Super-Exponential Complexity of Presburger Arithmetic[END_REF], and a more precise lower bound was later derived by Berman [START_REF] Berman | The Complexitiy of Logical Theories[END_REF]. The computational complexity of deciding validity in linear rational arithmetic is at least exponential, as follows from results in [START_REF] Michael | Super-Exponential Complexity of Presburger Arithmetic[END_REF], see also Section 7.4 in [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF]. Weispfenning has shown that quantifier elimination in linear rational arithmetic requires at least doubly exponential time [START_REF] Volker | The Complexity of Linear Problems in Fields[END_REF]. A very recent account of the history and the current state of affairs regarding Presburger arithmetic can be found in [START_REF] Haase | A Survival Guide to Presburger Arithmetic[END_REF]. For a survey of the recent developments regarding quantifier elimination in real closed fields and some historical background see [START_REF] Sturm | A Survey of Some Methods for Real Quantifier Elimination, Decision, and Satisfiability and Their Applications[END_REF][START_REF] Sturm | Thirty Years of Virtual Substitution: Foundations, Techniques, Applications[END_REF]; these methods also work for rational arithmetic formulas as long as they are linear. Both arithmetic languages found numerous applications. For a textbook introduction to linear arithmetic over the rationals or over the integers in the context of automated reasoning and verification see, e.g., Chapters 7 and 8 in [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF] and Chapter 5 in [START_REF] Kroening | Decision Procedures[END_REF].

Undecidability of First-Order Arithmetic with Uninterpreted Predicate Symbols

It has been discovered more than half a century ago that the addition of a single uninterpreted unary predicate symbol to Presburger arithmetic renders the associated satisfiability problem (and also the associated validity problem) undecidable. In 1957 Putnam [START_REF] Putnam | Decidability and Essential Undecidability[END_REF] discussed this theory as one example of an undecidable first-order theory that is somewhat stronger than the decidable first-order theory of natural numbers with the successor function and a single uninterpreted unary predicate symbol. 3 Lifshits mentioned in a note [START_REF] Lifshits | Some Reduction Classes and Undecidable Theories[END_REF] (without giving a proof) that the addition of one uninterpreted predicate symbol -of unspecified arity -to Presburger arithmetic leads to undecidability. In the technical report [Dow72] Downey gave an encoding of two-counter machines 4 and their halting problem in the Horn fragment of Presburger arithmetic with a single unary predicate symbol that is uninterpreted. Moreover, undecidability is also implied by a general result due to Garfunkel and Schmerl [START_REF] Garfunkel | The undecidability of theories of groupoids with an extra predicate[END_REF] published in 1974. Seventeen years later Halpern [START_REF] Joseph | Presburger Arithmetic with Unary Predicates is Π 1 1 Complete[END_REF] strengthened the undecidability result for Presburger arithmetic with a single uninterpreted unary predicate symbol in that he proved Π 1 1 -completeness of the associated validity problem, which, given that the considered language is closed under negation, entails Σ 1 1 -completeness of satisfiability. 5 Only recently, Speranski [START_REF] Stanislav | A note on definability in fragments of arithmetic with free unary predicates[END_REF] gave an alternative characterization of the analytical hierarchy that is based on a reduction of Π 1 n -formulas with multiplication to Π 1 n -formulas without multiplication but with an uninterpreted unary predicate symbol. Halpern's Π 1 1 -completeness can be conceived as a special case of this more general point of view. We shall add some results to this line of contributions in Chapter 11. As a starter, we will give simple encodings of the halting problem for two-counter machines based on ∃ * ∀ * sentences with a very restricted arithmetic language and a single uninterpreted predicate symbol whose arity is greater than one. On the arithmetic side we get along with one of the following fragments where c ∈ Q and ranges over the relations <, ≤, =, =, ≥, >: difference constraints xy c, additive constraints x + y c, quotient constraints x c • y, and multiplicative constraints x • y c. The details of the encodings can be found in Section 11.1. In the rest of Chapter 11, we will focus on the universal fragment of Presburger arithmetic plus a single unary uninterpreted predicate symbol. We shall devise a novel encoding of two-counter machines and investigate several variants of it. Our results will shed more light on the border between decidability and undecidability in this context. We will also see that allowing for a ∀∃ quantifier alternation even leads to Σ 1 1 -completeness (of satisfiability). Furthermore, we shall assess the relevance of the undecidability results for a number of verification frameworks. The mentioned results will not change substantially when we use the rationals as underlying domain instead of the integers.

Decidable First-Order Arithmetic Fragments with Uninterpreted Predicate Symbols

All of the above said leads to one conclusion: In order to obtain decidable subfragments of the combination of linear arithmetic with uninterpreted predicate symbols, the arithmetic part needs to be restricted considerably. 6 We shall explore the decidable side in Chapter 10 and investigate two decidable fragments. Both will be an extension of the Bernays-Schönfinkel-Ramsey fragment (BSR) with a restricted form of linear-arithmetic constraints. For notational convenience, we use the notation Λ ∧ Γ → ∆ for BSR clauses with arithmetic constraints, where Λ and Γ are conjunctions of atoms, respectively, and ∆ is a disjunction of atoms. The part Λ contains exclusively arithmetic atoms and no uninterpreted symbols. The parts Γ and ∆, on the other hand, only contain atoms that are either (a) relational atoms with some uninterpreted predicate symbol or (b) non-arithmetic equations u ≈ v, where u and v are implicitly universally quantified first-order variables of a sort that is not pre-determined, i.e. of an uninterpreted sort. We extend BSR in two ways with linear-arithmetic expressions and call the obtained clause fragments BSR with simple linear rational 3 Büchi [START_REF] Büchi | Weak second-order arithmetic and finite automata[END_REF][START_REF] Büchi | On a decision method in restricted second order arithmetic[END_REF] and Rabin [START_REF] Michael | Decidability of Second-Order Theories and Automata on Infinite Trees[END_REF] proved that the theory remains decidable, if an arbitrary number of uninterpreted unary predicate symbols is admitted.

4 Two-counter machines are a special case of Minsky machines, see [START_REF] Lee | Computation: finite and infinite machines[END_REF], Sections 11 and 14. See also Section 11.1 of the present thesis.

5 For the definition of the analytical hierarchy and the sets Π 1 1 and Σ 1 1 , see, e.g., Chapter IV.2 in [START_REF] Odifreddi | Classical Recursion Theory[END_REF] or Chapter 16 in [START_REF] Rogers | Theory of recursive functions and effective computability[END_REF].

6 There are still alternatives. One possibility could be to consider sentences in CNF and restrict the occurrences of variables as arguments of uninterpreted predicate symbols in clauses, as is done in certain decidable clause classes (cf. Chapter 3, pages 27-28). This was pointed out by Christoph Weidenbach in a discussion in January 2019. We shall not consider this approach any further in the present thesis.

constraints -BSR(SLR) -and BSR with bounded difference constraints -BSR(BD).

In the first clause class BSR(SLR) , which we shall treat in detail in Section 10.2, we allow arithmetic atoms of the form s t, x t, and x y in the Λ-part of clauses, where x and y are rationalvalued variables that are implicitly universally quantified, s and t are linear arithmetic terms that are variable free (ground), and ranges over <, ≤, =, =, ≥, >. The ground terms s and t may contain uninterpreted constant symbols of sort Q. Since their value is not predetermined, they can be conceived as being existentially quantified. An exemplary BSR(SLR) clause is

d > 0 ∧ c -1 ≤ x ∧ x < c + 2d ∧ y < x ∧ Q(y) → P (x, y).
Remark 8.0.1. The arithmetic atoms admitted in BSR(SLR) are similar to the kind of arithmetic atoms that appear in the context of the array property fragment [BMS06, Bra07] and extensions thereof (see, e.g., [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF][START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF]). 7 The array property fragment can be used in the context of verification to specify certain properties of array data structures (see [START_REF] Kroening | Decision Procedures[END_REF], Chapter 7 or [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF],

Chapter 11 for an introduction and examples). Apart from the fact that we concentrate on the rational domain instead of the integers in Section 10.2, the main difference is that we allow strict inequalities and disequations between universally quantified variables. In the presence of uninterpreted non-constant function symbols, strict inequality or disequations can be used to assert that some uninterpreted function f is injective. This expressiveness prevents certain instantiationbased approaches to satisfiability checking from being applicable, e.g. the methods in [START_REF] Bradley | What's Decidable About Arrays? In Verification, Model Checking, and Abstract Interpretation[END_REF][START_REF] Bradley | Safety Analysis of Systems[END_REF].

In the context of the array property fragment, this expressiveness even leads to undecidability, see, e.g. Section 2.4 in [START_REF] Bradley | Safety Analysis of Systems[END_REF], or Theorem 11.16 in [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF].

A close relative of the array property fragment is the hashtable property fragment presented in [START_REF] Bradley | Safety Analysis of Systems[END_REF], see also [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF], Section 11.3. It admits the same syntax for arithmetic atoms.

In the BSR(BD) clause class BSR(BD) , treated in Section 10.4, we allow arithmetic atoms of the form x c, x y, and xy c in the Λ-part of clauses, where x and y are rational-valued variables, c could be any rational number, and ranges over <, ≤, =, =, ≥, > again. We refer to atoms of the form xy c as difference constraints. An exemplary BSR(BD) clause is

x -y < 1 ∧ -2 ≤ x ∧ x ≤ 2 ∧ -1 ≤ y ∧ y ≤ 3 ∧ y < z ∧ Q(y, z) → P (x, y) ∨ P (y, x).
Remark 8.0.2. Already in the seventies, Pratt identified difference constraints and Boolean combinations thereof as an important tool for the formalization of verification conditions [START_REF] Vaughan | Two Easy Theories Whose Combination is Hard[END_REF]. 8Applications include the verification of timed systems and scheduling problems (see, e.g. [Pra77, NMA + 02, TSSP04, dMB11], the textbook [KS16] (Section 5.7), the handbook article [START_REF] Barrett | Satisfiability Modulo Theories[END_REF] (Section 11.4.5), and Mahfoudh's PhD thesis [START_REF] Mahfoudh | Sur la Vérification de la Satisfaction pour la Logique des Différences[END_REF] for references). Dedicated decision procedures for Boolean combinations of difference constraints have been devised, see, e.g. [SSB02, MNAM02, CAMN04, ACGM04, NO05, CM06, WGG06] and the references therein.

As unrestricted combinations of uninterpreted predicate symbols with difference constraints lead to an undecidable satisfiability problem (once more, two-counter machines and their halting problem can be encoded, see Sections 11.1 and 11.4), we have to further confine the language. We require that every difference constraint xy c has to be conjoined with four additional constraints c x ≤ x, x ≤ d x , c y ≤ y, y ≤ d y , where c x , d x , c y , d y are rationals. This restriction seems to weaken expressiveness severely. Indeed, it has to, since we aim for a decidable satisfiability problem. Yet, we show in Section 10.5 that BSR(BD) clause sets are expressive enough to formulate the reachability problem for timed automata, for instance.

The main result of Chapter 10 is that the satisfiability problems associated with BSR(SLR) and BSR(BD) are decidable (cf. Theorems 10.2.14 and 10.4.10). Both results have a very similar proof outline, which, roughly speaking, proceeds as follows. Given some satisfiable sentence ϕ := ∃z∀x. i C i (z, x), where the C i are clauses adhering to the syntactic restrictions of BSR(SLR) or BSR(BD), and given any model A |= ϕ, we define a suitable equivalence relation ∼ over tuples of rationals such that ∼-equivalent tuples cannot be distinguished by the arithmetic constraints occurring in ϕ. We can formulate this property more precisely as follows. Let x be the restriction of x to rational-valued variables. Moreover, let ā be a tuple of elements from A's domain such that A |= ∀x. ϕ(ā, x) -notice that apart from rationals ā may also contain elements from some uninterpreted sort. For any two ∼-equivalent tuples r, s ∈ Q |x | we require for all conjunctions of constraints Λ(z, x ) in ϕ that Q |= Λ(ā, r) if and only if Q |= Λ(ā, s). The key to decidability is that we choose ∼ so that it induces only finitely many equivalence classes. Based on A, ā, and ∼, we then construct a model B |= ϕ that interprets the uninterpreted sorts with finite sets and whose interpretations of uninterpreted predicate symbols do not distinguish ∼-equivalent tuples of rational numbers. We call structures of this form uniform with respect to ∼. The proof of B's existence is partially based on basic methods from Ramsey theory. If A contains a certain collection Q of finite sets Q 1 , . . . , Q k ⊆ Q such that any two ∼-equivalent tuples over elements from Q are indistinguishable under A, ā , then B treats any tuple r over Q like the ∼-equivalent tuples q over Q. For this approach to work, it is essential that Q covers all ∼-equivalence classes over Q and each Q i contains a critical mass of rational numbers. Ramsey theory provides the right methods to show that such sets exist for any pair A, ā with A |= ∀x. i C i (ā, x). The guaranteed existence of models that are uniform with respect to an equivalence relation ∼ inducing only a finite number of equivalence classes is similar to the finite model property in entirely uninterpreted settings and it immediately implies decidability.

Example 8.0.3. Consider the following BSR(SLR) sentence ϕ 1 and the BSR(BD) sentence ϕ 2 (we use convenient notation that could easily be converted into syntax that adheres to the restrictions posed by BSR(SLR) and BSR(BD)):

ϕ 1 := ∃z 1 z 2 ∀xy. 3 < z 1 < z 2 < 31 5 ∧ 3 ≤ x < z 1 ∧ 3 < y < z 2 → P (x, y) ∧ z 1 ≤ x < y ∧ y < 31 5 → P (x, y)
and

ϕ 2 := ∀xy. -2 < x -y < 0 ∧ -2 ≤ x ≤ 2 ∧ -2 ≤ y ≤ 2 → P (x, y) ∧ x ≤ -2 ∧ -2 < y < 0 → P (x, y) ∧ 1 ≤ x ∧ 1 < y < 2 → P (x, y) .
Figure 8.1 illustrates suitable equivalence relations ∼ 1 and ∼ 2 for dimension two (we only have two universally quantified variables per sentence and per clause). Moreover, satisfying uniform interpretations are depicted for the predicate symbol P in ϕ 1 and ϕ 2 , respectively. Decidability of the associated satisfiability problem follows from the fact that ∼ 1 and ∼ 2 induce only finitely many equivalence classes.

The outlined approach to proving decidability is quite general. For a given language combining linear rational arithmetic with uninterpreted predicate symbols we just have to find a suitable equivalence relation ∼ and the rest can be developed along the same lines as outlined above. Hence, the outlined approach may turn out to be applicable to other fragments as well. Moreover, in the light of the insights we have gained in Chapter 3 it is possible to generalize the decidability results for BSR(SLR) and BSR(BD) to SF and GBSR variants of the two fragments, cf. Theorem 10.3.2 and Corollary 10.3.4.

More on Related Work

We have already elaborated on undecidable fragments of first-order arithmetic with uninterpreted predicate symbols. There is also a number of works describing decidable fragments of first-order logic in which linear rational or integer arithmetic is mixed with uninterpreted function or predicate symbols. However, the results seem to be scattered across the literature. We shall report on a few such results in what follows. An early result can be found in [START_REF] Putnam | Decidability and Essential Undecidability[END_REF]: the first-order theory of the natural numbers with the successor function plus a single uninterpreted unary predicate symbol is decidable. This result is subsumed by results due to Büchi [START_REF] Büchi | Weak second-order arithmetic and finite automata[END_REF][START_REF] Büchi | On a decision method in restricted second order arithmetic[END_REF], later extended by Rabin [START_REF] Michael | Decidability of Second-Order Theories and Automata on Infinite Trees[END_REF], who show that the monadic second-order theory of the natural numbers with the successor function (today also known as the monadic second-order theory of one successor (S1S))

3 s 1 s 2 31 5 3 s 1 s 2 31 5 -2 -1 0 1 2 -2 -1 0 1 2 Figure 8
.1: Left: Partition of the two-dimensional rational plane into ∼ 1 -equivalence classes with respect to two rational values s 1 , s 2 assigned to z 1 , z 2 in ϕ 1 , respectively. Right: Partition of the two-dimensional rational plane into ∼ 2 -equivalence classes with respect to the sentence ϕ 2 . Every dot, line segment, rectangular white area, and triangular white area represents an equivalence class. Moreover, the orange-colored parts represent subsets of the rational plane that represent interpretations of the predicate P (x, y) that are satisfying for ϕ 1 and ϕ 2 , respectively, if we put the x-axis horizontally and the y-axis vertically. These interpretations are uniform in the sense that any of the equivalence classes is either completely contained in the respective subset or it is disjoint from the subset. is decidable. Shelah [START_REF] Shelah | The Monadic Theory of Order[END_REF] reproved some of these results using different methods; the article also contains a historical overview and additional references to related works. Moreover, Shelah showed in the same article that the monadic second-order theory of the usual order over the real numbers is undecidable. Ferrante and Rackoff [START_REF] Ferrante | The computational complexity of logical theories[END_REF] investigated the computational complexity for deciding the monadic first-order theory of one successor with an uninterpreted predicate symbol: they obtain doubly exponential upper and lower bounds.

The satisfiability problem for existential first-order sentences combining linear rational or integer arithmetic with uninterpreted function and predicate symbols can be shown to be decidable using the Nelson-Oppen combination framework (see Section 10.3). Pratt [START_REF] Vaughan | Two Easy Theories Whose Combination is Hard[END_REF] elaborated on the subcase where the arithmetic atoms are restricted to difference constraints, i.e. atoms of the form xy c where c ranges over the integers. This kind of arithmetic atoms will play a major role in Sections 10.4 and 11.4. On the one hand, we show that satisfiability is decidable for a certain first-order fragment combining bounded difference constraints with uninterpreted predicate symbols of arbitrary arity in the former section. In the latter section, on the other hand, we show how the halting problem of two-counter machines can be encoded using only arithmetic atoms of the form xy c where c is an uninterpreted arithmetic constant.

An interesting subcase of the existential first-order fragment of linear integer arithmetic with uninterpreted function symbols with a decidable satisfiability problem is counter logic. This fragment was motivated and investigated in [START_REF] Bryant | Modeling and Verifying Systems Using a Logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions[END_REF] in the context of hardware verification. The arithmetic part is restricted to the positive integers with the successor function and the predecessor function (see Section 11.5.3 for more details). Suitable decision procedures were presented in [BLS02, GHN + 04, ABRS09]. In [ABRS09] also the case of successor and predecessor modulo some fixed integer is treated. Further positive results stem from the field of software verification, where data structures, such as arrays, or memory are often formalized using uninterpreted function symbols and restricted forms of arithmetic over integer indices, partly allowing for universal quantification over indices. See, for example, [BMS06, HIV08, ABRS09, GdM09, KPSW10, Sof14, RIS17, HVW17a] and the references therein. See also the textbooks [BM07, KS16] and the handbook article [START_REF] Barrett | Satisfiability Modulo Theories[END_REF] for further references. We will show in Section 11.5 that little extensions of several of the mentioned fragments lead to undecidable satisfiability problems.

There are also decidability results based on theory combination beyond the Nelson-Oppen case, involving universal quantification. Interesting results in this direction are due to Fontaine and his collaborators [Fon07, Fon09, AF11, CFR14], where component theories are considered that can be expressed in the decidable first-order fragments MFO ≈ , BSR, AF with equality, GF, LGF, or FO 2 (cf. Sections 10.3 and 12.1.1).

Finally, there is the vast field of constraint logic programming (see, for instance, [START_REF] Frühwirth | Essentials of Constraint Programming[END_REF] for an introduction), where one can also find positive results regarding first-order arithmetic with uninterpreted predicate symbols, e.g. [START_REF] Cox | Computational Complexity and Constraint Logic Programming Languages[END_REF][START_REF] Cox | Decision procedures for constraint-based extensions of Datalog[END_REF].

To the best knowledge of the author, the decidability results that come closest to the results developed in Chapter 10 of the present thesis can be found in [GdM09, [START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF][START_REF] Kruglov | Superposition Modulo Theory[END_REF][START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF][START_REF] Fietzke | Labelled Superposition[END_REF]. In [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF] Ge and de Moura presented a very general instantiation approach that is a decision procedure for certain subfragments of linear integer and rational arithmetic with uninterpreted function and predicate symbols. For instance, BSR(SLR) without strict inequalities and without arithmetic disequations can be decided using this instantiation method. It fails, however, in the presence of <, =, > in arithmetic atoms in BSR(SLR) clauses. In [KW12, Kru13] Kruglov and Weidenbach devise a procedure based on hierarchic superposition that decides satisfiability for the existential first-order fragment of arithmetic with uninterpreted predicate symbols. The calculus is not limited to the language of arithmetic though, but also serves as a decision procedure for other background theories. It can even handle universal quantification in Horn clause sets as long as all variables in background-theory terms are existentially quantified. The setting of linear and nonlinear arithmetic with uninterpreted predicate symbols was treated in [AKW09, EKK + 11] in particular. In [START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF][START_REF] Fietzke | Labelled Superposition[END_REF] Fietzke and Weidenbach described an encoding of the reachability problem for timed automata in a fragment of first-order linear arithmetic with uninterpreted predicate symbols whose arity depends on the number of clocks in the input automaton (cf. Section 10.5). Then, they show that Kurglov and Weidenbach's hierarchic superposition calculus modulo linear arithmetic [AKW09, KW12, FW12] can decide (un)satisfiability for the resulting logic fragment. As we have already mentioned above, we prove in Section 10.5 that the reachability problem for timed automata can be formalized using BSR(BD) clause sets. However, the latter does not cover all the clauses that result from the encoding of Fietzke and Weidenbach, called the FOL(LA) encoding of timed automata in Section 10.5 (cf. Definition 10.5.7). The two fragments are syntactically incomparable: while the FOL(LA) encoding of timed automata results in Horn clause sets and contains essentially arithmetic atoms of the form uv = xy, BSR(BD) is not restricted to Horn clauses and does not admit arithmetic atoms uv = xy. We shall show in Section 10.5 that this form of atoms is not required to capture the reachability problem for timed automata.

One direction to look for new decidable fragments is to draw inspiration from similar encodings of extensions of the timed automaton formalism. There are numerous kinds of extensions of timed automata that have been proposed and might be worthwhile targets for such an approach, see, e.g. the handbook articles [BFL + 18, DFPP18] for references. Another source of inspiration might come from metric temporal logic (MTL), a family of extensions of linear-time temporal logic (LTL). In MTL the usual temporal operators of LTL, e.g. eventually and until, are enhanced in such a way that certain quantitative timing constraint can be expressed. An overview and more references can be found in [OW08, HOD17, BLM + 17], for example.

Chapter 9 Additional Technical Preliminaries

We take over and reuse the basic notions and notation introduced in Part I, in particular in Chapter 1. In Part II we mainly consider many-sorted first-order logic with equality and a mixture of interpreted and uninterpreted predicate and function symbols. Some of the terminology we shall use is borrowed from the framework of hierarchic combinations of uninterpreted first-order logic with background theories due to Bachmair, Ganzinger, and Waldmann, see [START_REF] Bachmair | Refutational Theorem Proving for Hierarchic First-Order Theories[END_REF][START_REF] Baumgartner | Hierarchic superposition with weak abstraction[END_REF][START_REF] Baumgartner | Hierarchic Superposition: Completeness without Compactness[END_REF]. In particular, in order to simplify terminology and definitions, we take over the neat distinction of the interpreted part of the considered language, ambiguously referred to as background theory or base theory (together with background/base sorts), from the uninterpreted part. The latter comprises uninterpreted sorts and uninterpreted predicate and function symbols, all of which have to be assigned a meaning in terms of structures. Although this is technically not necessary, we mostly restrict our attention to single-sorted background theories, such as linear rational or linear integer arithmetic with the base sorts Q and Z, respectively.1 Similarly, we most of the time only consider a single uninterpreted sort S (we sometimes also use the term free sort). This sort needs to be interpreted with some nonempty domain, as usual. We continue to use the symbol ≈ ≈, = to denote the built-in equality predicate for sort S -for the arithmetic sort we use the sign = to denote the identity relation.

In accordance with this division, we use pairwise-disjoint, countably infinite sets of variables Var Q , Var Z , Var S of the respective sorts. Moreover, vocabularies now come equipped with sort information. An uninterpreted predicate symbol P , for instance, can have a mixed-sort signature P : ξ 1 × . . . × ξ m , where the ξ i can be any of the sorts Q, Z, S. To avoid confusion, we tacitly assume that no predicate or function symbol is overloaded, i.e. each of them has a unique sort.

Recall the definition of linear rational arithmetic (LRA) terms and formulas from Section 7.1. The underlying vocabulary is Σ LRA := {<, ≤, =, =, ≥, >}, Q∪{+, •} Σ LRA , where Q is the only occurring sort. LRA terms LRA terms are all Σ LRA -terms in which multiplication only occurs in (sub)terms of the form r • x where r is a rational coefficient and x is a first-order variable of sort Q. Variables of other sorts are not admitted in LRA terms. For convenience, we use abbreviations such as -1 2 xy for the formal expression -1 2 • x + (-1) • y and the like. LRA formulas are all first-order Σ LRA -formulas in which all terms are LRA terms. The terms of Presburger arithmetic PA terms , called PA terms, are defined to be the terms over the vocabulary Σ PA := {<, ≤, =, =, ≥, >}, {0, 1,+,Σ PA , where the only sort is Z. We also use convenient abbreviations for PA terms, such as -3x + 2y for the formal expression 0 -(x + x + x) + y + y. 2 In Chapter 11 we shall consider the extended language of PA+P terms PA+P terms and PA+P formulas which is based on the vocabulary Σ PA+P Σ PA+P := {<, ≤, =, =, P }, {0, 1, +, -} where P is an uninterpreted unary predicate symbol of sort Z. Furthermore, we shall also consider a second extended language: LRA+P N terms LRA+P N terms, Σ LRA+P N and LRA+P N formulas. Both are based on the vocabulary Σ LRA+P N := {<, ≤, =, =, P, N }, {0, 1, +, -} with P, N being uninterpreted unary predicate symbols of sort Q.

Throughout the following chapters we shall concentrate on clauses (disjunctions of literals) and sets of clauses. Occasionally, we treat sets N of clauses as if they were sentences. Then, we consider any variables that occur in N as implicitly universally quantified. More precisely, given any clause set N that is finite, it can be conceived as a sentence ϕ N := ∀x. C(x)∈N C(x), where x is a tuple collecting all variables occurring in N . Existentially quantified variables are represented by uninterpreted constant symbols, called Skolem constants, of the respective sort, but their value is not predetermined. This means, we implicitly restrict our attention to the ∃ * ∀ * prefix class, if not explicitly stated otherwise. Given any clause C, we use the following notation: the set of all constant symbols occurring in C is denoted by consts(C) consts(C) -this includes rational numbers or integers. Similar notation is used for other syntactic objects, e.g. clause sets.

For finite clause sets N we define len(N ) := C∈N len(C) len(N ), N

and N := C∈N C . Since the vocabulary underlying any formula ϕ cannot be assumed to be finite if ϕ contains LRA terms, the encoding length ϕ of such formulas can in general not be expressed in terms of len(ϕ) alone. Instead, the bit length of the rational numbers occurring in ϕ has to be taken into account as well. Therefore, we redefine our notion of encoding length accordingly. Henceforth, we assume that ϕ ∈ O len(ϕ) • log(|Π| + |Ω| + |vars| + κ) where Π and Ω are the sets of predicate and function symbols occurring in ϕ and κ is the smallest integer that is larger than the absolute value of any numerator and denominator occurring in any rational number in ϕ (represented by an equivalent irreducible fraction). The same applies to clause sets containing LRA terms.

In the following chapters a Bernays-Schönfinkel-Ramsey clause (BSR clause) BSR clause is understood to be a disjunction of literals that may contain constant symbols but no function symbols of positive arity. In order to denote BSR clauses that contain arithmetic constraints alongside with uninterpreted symbols, we use the notation

Λ ∧ Γ → ∆ Λ ∧ Γ → ∆
, where Λ and Γ are conjunctions of atoms, respectively, and ∆ is a disjunction of atoms. Since ∧ and ∨ bind stronger than →, explicitly putting the implicit parentheses yields (Λ ∧ Γ) → (∆). The part Λ contains exclusively arithmetic atoms and no uninterpreted symbols. The parts Γ and ∆, on the other hand, only contain atoms that are either (a) relational atoms with some uninterpreted predicate symbol or (b) non-arithmetic equations u ≈ v, where u and v are first-order variables of a sort that is not pre-determined, i.e. of an uninterpreted sort. Requiring the parts Γ and ∆ of clauses to not contain any arithmetic terms apart from variables does not limit expressiveness. First of all, for every implication Λ ∧ Γ → ∆ ∨ s t where ∈ {<, ≤, =, =, ≥, >} there is an equivalent implication s t ∧ Λ ∧ Γ → ∆ where ∈ {<, ≤, =, =, ≥, >} is the negated counterpart of . Hence, every clause is equivalent to some clause in which all purely arithmetic atoms occur in the Λ part. Moreover, every arithmetic term t in Γ or ∆ that is not a variable and that is not part of a purely arithmetic atom can be safely replaced with a fresh base-sort variable x t when an arithmetic constraint x t = t is added to the Λ part of the clause (a process known as purification purification or abstraction [START_REF] Bachmair | Refutational Theorem Proving for Hierarchic First-Order Theories[END_REF][START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF]).

Concerning semantics, we adhere to the definitions given in Chapter 1. However, we tacitly assume that all structures that we shall consider in the following chapters interpret the arithmetic function and predicate symbols in the usual way, unless explicitly stated otherwise. Notice that this also affects notions such as semantic entailment and semantic equivalence, which are implicitly re-defined based on the restriction to the mentioned class of structures. Given any clause set N , we occasionally write A |= N A |= N if we have A |= ϕ N for the associated sentence ϕ N := ∀x. C(x)∈N C(x), where x is a tuple collecting all variables occurring in N . This notation takes into account that all variables in N are implicitly considered to be universally quantified. Similarly, we extend the notions A satisfies N and A is a model of N to clause sets, if we actually mean "A satisfies ϕ N " or "A is a model of ϕ N " for the associated sentence ϕ N . Furthermore, we tacitly assume that all considered variable assignments and substitutions respect sorts, i.e. given any first-order variable x of sort Q (or Z), any variable assignment β, and any substitution σ, we assume that β(x) is a value from Q (or Z) and that the term σ(x) has the sort Q (or Z). We assume the same for any first-order variable that is of any uninterpreted sort S (in the context of a given structure A that interprets S with some nonempty set S A ).

For any two sets R, Q ⊆ Q we write R < Q R < Q if r < q holds for all r ∈ R and q ∈ Q. Given any real or rational number r, we denote the integral part of r by r r , fr(r) , i.e. r is the largest integer with r ≤ r. Dually, r addresses the smallest integer with r ≥ r. By fr(r) we denote the fractional part of r, i.e. fr(r) := rr . Notice that fr(r) is always nonnegative, e.g. fr(3.71) = 0.71, whereas fr(-3.71) = 0.29. Given any tuple r of reals or rationals, we write fr(r) to address the corresponding tuple of fractional parts, i.e. fr r 1 , . . . , r µ := fr(r 1 ), . . . , fr(r µ ) . We use the notation r and r in a component-wise fashion as well. Throughout Part II we shall use the usual notation for intervals of the number line: for example, with respect to the rational numbers (-∞, r] denotes the set {q ∈ Q | q ≤ r} and [r, s) denotes the set {q ∈ Q | r ≤ q < s}. It will always be clear from the current context what the underlying domain is. Finally, Q ≥0 , R ≥0 , and

Z ≥0 Q ≥0 , R ≥0 , Z ≥0
address the sets of all nonnegative rational numbers, real numbers, and integers, respectively.

Chapter 10

Decidable Fragments of Linear Rational Arithmetic with Uninterpreted Predicate Symbols

We have emphasized in Chapter 8 that the syntax of decidable first-order fragments combining arithmetic with uninterpreted predicate symbols has to be restricted considerably on both sides, the arithmetic part as well as the uninterpreted part. In the present chapter, we shall introduce and investigate two subfragments with a decidable satisfiability problem, both based on the Bernays-Schönfinkel-Ramsey fragment: BSR with simple linear rational constraints -BSR(SLR) -and BSR with bounded difference constraints -BSR(BD). We have already sketched the definitions in Chapter 8. The formal definitions are as follows.

Definition 10.0.1 (BSR with simple linear rational constraints -BSR(SLR)). A BSR(SLR) clause has the form Λ ∧ Γ → ∆, where the conjunctions Λ, Γ and the disjunction ∆ satisfy the following conditions:

(i) Every atom in Λ is an LRA atom of the form s t or x t or x y where s, t are ground (i.e. variable-free) LRA terms, x, y ∈ Var Q , and ∈ {<, ≤, =, =, ≥, >}.

(ii) Every atom in Γ and ∆ is either an equation s ≈ s over free-sort variables and constant symbols, or a non-equational atom P (s 1 , . . . , s m ) that is well sorted and where the s i range over base-sort variables, free-sort variables, and free-sort constant symbols. Limiting the right-hand sides of arithmetic atoms in BSR(BD) clauses to integers instead of rational numbers simplifies their treatment. This restriction does not severely restrict expressiveness, as long as we are only interested in the satisfiability problem. We could multiply all rational numbers in a BSR(BD) clause set with the least common multiple of their denominators and thus obtain an equisatisfiable clause set in which only integers occur.

In Chapter 9 we have argued that requiring the parts Γ and ∆ of clauses to not contain any arithmetic terms apart from variables does not limit expressiveness. In order to simplify syntax even further, we often restrict our attention to clause sets in the following normal forms.

Definition 10.0.3 (BSR(SLR) normal form for clauses and clause sets). A BSR(SLR) clause Λ ∧ Γ → ∆ is in BSR(SLR) normal form if every variable that occurs in Λ also occurs in Γ or in ∆.

A BSR(SLR) clause set N is in BSR(SLR) normal form if the following conditions are met. All clauses in N are in normal form and pairwise variable disjoint. Moreover, N can be divided into two parts N Q and N BSR such that (a) every clause in N Q has the form Λ → false, i.e. the parts Γ and ∆ are empty, and (b) for every clause Λ ∧ Γ → ∆ in N BSR either Γ or ∆ is nonempty and any LRA atom s t in Λ is such that s and t are either base-sort variables or Skolem constants, respectively.

Moreover, we assume that N BSR contains at least one free-sort constant symbol.

Definition 10.0.4 (BSR(BD) normal form for clauses and clause sets). A BSR(BD) clause Λ ∧ Γ → ∆ is in BSR(BD) normal form if every variable that occurs in Λ also occurs in Γ or in ∆.

A BSR(BD) clause set N is in BSR(BD) normal form if all clauses in N are in normal form and pairwise variable disjoint. Moreover, we assume that N contains at least one free-sort constant symbol.

We have already seen exemplary clause sets for both fragments in Example 8.0.3. The requirement that (implicitly universally quantified) variables in the Λ-part of a clause Λ ∧ Γ → ∆ have to occur in Γ or ∆ or in both can be established by any procedure for eliminating existentially quantified variables in conjunctions of LRA atoms. Establishing the other requirements in Definitions 10.0.3 and 10.0.4 is straightforward. We shall postpone the proof of this claim for a little while (cf. Lemma 10.0.7), and first derive an auxiliary result that will be useful to analyze the blowup that we incur during the normal form transformation.

The following is standard methodology in the area of difference logic, see, e.g. Section 5.7 in [START_REF] Kroening | Decision Procedures[END_REF], Section 2.1 in [START_REF] Cotton | Fast and Flexible Difference Constraint Propagation for DPLL(T)[END_REF], or Section 11.4.5 in [START_REF] Barrett | Satisfiability Modulo Theories[END_REF]. Let m m, x be any positive integer. Let x be any m-tuple of pairwise-distinct first-order variables x 1 , . . . , x m x 0 , x i of sort Q and let x 0 be any first-order variable of sort Q that does not occur in x. Let Λ(x 0 , x) := x 0 = 0 ∧ Λ (x 0 , x) Λ(x 0 , x) be a conjunction where Λ (x 0 , x) is a conjunction of atoms of the form xy ≤ c or xy < c with x, y ∈ x ∪ {x 0 } and c ∈ Z.

Definition 10.0.5 (Difference constraint graph G Λ , cf. Definition 5.17 and Excercise 5.16 in [START_REF] Kroening | Decision Procedures[END_REF]).

The difference constraint graph G(Λ) G(Λ) is a weighted directed graph V, E with V = {x 0 , x 1 , . . . , x m } and E ⊆ V × V × Q such that x, x, 0 ∈ E for all x ∈ V ,
x, y, c ∈ E if and only if Λ contains the constraint xy ≤ c, and x, y, cδ ∈ E if and only if Λ contains the constraint xy < c, where we set δ := 1 2 (m + 1) -1 . A path π in G Λ is any finite, nonempty sequence x i1 , x i2 , c 1 x i2 , x i3 , c 2 . . . x i -1 , x i , c of edges from G Λ . We call π simple, if the indices i 1 , . . . , i -1 are pairwise distinct, i.e. π traverses every vertex in G Λ at most once, except for the end point which may coincide with the starting point but does not have to. A simple cycle in G Λ is any simple path whose start and end point coincide. The length of a path in G Λ is the sum of the weights associated with the edges the path traverses. Notice that δ in Definition 10.0.5 is chosen such that the following property is satisfied. Let π be any simple path in G Λ . Let c 1 , . . . , c be the weights associated with the edges π traverses. We have

1≤i≤ c i -1 < 1≤i≤ c i ≤ 1≤i≤ c i .
Proposition 10.0.6 (cf. Theorem 1 in [START_REF] Cotton | Fast and Flexible Difference Constraint Propagation for DPLL(T)[END_REF]). Consider the difference constraint graph G Λ and suppose that we have Q |= ∃x 0 x. Λ(x 0 , x). Then, for every pair x, y ∈ x ∪ {x 0 } and every rational number r we have In fact, a variant of Proposition 10.0.6 yields a deterministic decision procedure for the sentence ψ := ∃x 0 x. Λ(x 0 , x) under Q that runs in polynomial time [START_REF] Kroening | Decision Procedures[END_REF][START_REF] Barrett | Satisfiability Modulo Theories[END_REF]: ψ is satisfied by Q if and only if there is some simple cycle in G Λ that has a negative length. In other words, we then have

Q |= ∀x 0 x. Λ(x 0 , x) → x -x ≤ -1 for some x ∈ x ∪ {x 0 }.
Next, we prove the existence of BSR(SLR) and BSR(BD) normal forms. (d.4) the absolute value of any integer in N is linear in κ • λ, where κ is the smallest positive integer that is larger than the absolute value of any integer occurring in N , and λ is the smallest positive integer that is larger than the maximal number of universally quantified variables occurring in any clause in N .

Proof sketch. We start with the BSR(SLR) case. First, we show how make sure that every base-sort variable that occurs in Λ in a clause Λ ∧ Γ → ∆ also occurs in Γ or in ∆. Consider any BSR(SLR) clause Λ ∧ Γ → ∆ Λ ∧ Γ → ∆, x and let x be some nonempty tuple of base-sort variables that occur in Λ but neither in Γ nor in ∆. Recall that all variables in clauses are implicitly universally quantified. We observe that ∀x. (Λ ∧ Γ → ∆) is equivalent to (∃x. Λ) ∧ Γ → ∆. Since Λ is a conjunction of LRA atoms, we may apply virtual substitution (cf. Section 7.1, page 185) to eliminate the quantifier block ∃x and compute some disjunction of conjunctions of LRA atoms i Λ i Λ i that is Q-equivalent to ∃x. Λ. Then, the clause (∃x. Λ) ∧ Γ → ∆ is equivalent to the conjunction of clauses i (Λ i ∧ Γ → ∆). The length of i (Λ i ∧ Γ → ∆) is at most exponential in the length of Λ ∧ Γ → ∆ (cf. Theorem 3.7 in [START_REF] Loos | Applying Linear Quantifier Elimination[END_REF]), the length of each Λ i is at most linear in the length of Λ, and the set of variables occurring in any Λ i is a subset of the variables occurring freely in ∃x. Λ. In BSR(SLR) clauses the used elimination sets contain only testpoints of the form t, t + ε, or -∞, where t is some LRA term occurring in N in some atom x t. Virtually substituting such a testpoint in any arithmetic atom that is admitted in BSR(SLR) yields again an atom admitted in BSR(SLR).

Next, we describe how to modify N in such a way that it can be partitioned into N Q and N BSR as required in Definition 10.0.3. Clauses of the form s t ∧ Λ ∧ Γ → ∆, where t is neither a variable nor a Skolem constant, are replaced -under preservation of (un)satisfiability -with two clauses t = c → false (which is equivalent to t = c) and s c ∧ Λ ∧ Γ → ∆ for some fresh uninterpreted constant symbol c of sort Q. Doing this exhaustively for all clauses with nonempty part Γ or ∆ leads to the desired partition of N in N Q and N BSR . Now we treat the BSR(BD) case. Again, we first show how to make sure that every basesort variable that occurs in Λ in a clause Λ ∧ Γ → ∆ also occurs in Γ or in ∆. Clauses of the form s = t ∧ Λ ∧ Γ → ∆ are equivalently replaced with two clauses s < t ∧ Λ ∧ Γ → ∆ and s > t ∧ Λ ∧ Γ → ∆. We do this exhaustively for all atoms s = t that contain at least one variable not occurring in the Γ or ∆ part of the respective clause. In the worst case, treating a clause in N in this way produces 2 k clauses if the original clause contains k atoms s = t that need to be replaced.

Consider any BSR(BD) clause

C := Λ ∧ Λ ∧ Γ → ∆ C, Λ , Λ, Γ, ∆, x, v
where every atom in Λ contains a variable x that does not occur in Λ, Γ, and ∆. Let x be some tuple listing all these variables exactly once and let v be some tuple listing all the other variables occurring in C. We assume that Λ does not contain any atoms of the from s = t. Moreover, we assume that all atoms s = t in Λ have been replaced with conjunctions s ≤ t ∧ t ≤ s. We observe that ∀x.

(Λ (x, v) ∧ Λ(v) ∧ Γ(v) → ∆(v)) is equivalent to ∃x. Λ (x, v) ∧ Λ(v) ∧ Γ(v) → ∆(v). Since Λ (x, v
) is a conjunction of LRA atoms, we may apply the Fourier-Motzkin elimination procedure to eliminate the variables x in ∃x. Λ (x, v) one by one.

Consider any x ∈ x x . In order to eliminate x from ∃x. Λ (x, v), we proceed as follows. Let Λ 0 , Λ 1 , Λ 2 Λ 0 , Λ 1 , Λ 2 be the shortest conjunctions satisfying the following properties:

(i) every atom from Λ that does not contain x occurs in Λ 0 , (ii) for every atom in Λ that contains x there is a Q-equivalent atom in Λ 1 ∧ Λ 2 , (iii) every atom in Λ 1 has the form s ≤ x or s < x where s is either an integer, a variable, or an LRA term y + c for some variable y ∈ x ∪ v of sort Q and some integer c, and

(iv) every atom in Λ 2 has the form x ≤ t or x < t where t is either an integer, a variable, or an LRA term y + c for some variable y ∈ x ∪ v of sort Q and some integer c.

Let Λ Λ

be the conjunction of the following set of atoms s < t (s 1 x) ∈ Λ 1 and (x 2 t) ∈ Λ 2 where at least one of 1 , 2 is the strict

< ∪ s ≤ t (s ≤ x) ∈ Λ 1 and (x ≤ t) ∈ Λ 2 . Let x := x \ {x} . x
It is well known that the two formulas ∃x. Λ 1 (x, x , v) ∧ Λ 2 (x, x , v) and Λ (x , v) are Q-equivalent (see, e.g. [START_REF] Schrijver | Theory of linear and integer programming[END_REF], Section 12.2). Hence, ∃x. Λ (x, x , v) can be replaced with the Q-equivalent formula Λ 0 (x , v) ∧ Λ (x , v). Concerning the atoms in Λ (x, v) we find that every atom therein can be transformed into an equivalent atom of the form y c, y z, or yz c where y, z ∈ x ∪ v, c is some integer, and ∈ {<, ≤, ≥, >}. As we need to keep at most 4 • |x ∪ v| + 8 • |x ∪ v| 2 of these atoms -at most one atom y c for each pair y, and at most two atoms yz d and zy e for every triple y, z, -, we may assume that the length of Λ (x , v) is at most polynomial in the number of variables in x , v.

We apply the described elimination procedure to eliminate the other variables in x as well, in a variable-by-variable fashion. Hence, the final conjunction Λ (v) Λ (v) contains at most 4 • |v| + 8 • |v| 2 atoms, and we replace the clause C(x, v) in N with the equivalent clause Λ (v)∧Λ(v)∧Γ(v) → ∆(v). In addition, we can bound the absolute value of the integers occurring in Λ as follows. It is easy to verify that we can transform Λ

(x, v) into a Q-equivalent conjunction Λ diff (x, v) Λ diff (x, v)
of difference constraints in the sense of Definition 10.0.5 and Proposition 10.0.6 (see the paragraph preceding Definition 10.0.5). We have mentioned right after Proposition 10.0.6 that we can check in polynomial time whether ∃xv. Λ diff (x, v) is satisfied under Q. In the opposite case, Λ can in fact be replaced by false. Henceforth, we assume that Q |= ∃xv. Λ diff (x, v). Since Λ (v) is the result of applying Fourier-Motzkin elimination to ∃x. Λ (x, v), we observe that for every atom of the form uv ≤ c occurring in Λ (v) we have

Q |= ∀xv. Λ diff (x, v) → u -v ≤ c. Let κ κ
be the smallest positive integer that is larger than the absolute value of any integer occurring in Λ . Then, by Proposition 10.0.6, we observe c ≥ -κ • (|x ∪ v| + 1) and, in addition, that there exists some integer k satisfying the following properties:

(1) -κ • (|x ∪ v| + 1) ≤ k ≤ κ • (|x ∪ v| + 1), and

(2)

Q |= ∀xv. Λ (x, v) → u -v k.
This means, if c > κ • (|x ∪ v| + 1), then we can replace uv ≤ c in Λ with the atom uv ≤ k, which subsumes the former. Using similar arguments we can show the same for other atoms occurring in Λ . Consequently, we may assume that Λ contains only integers whose absolute value is linear in κ • (|x ∪ v| + 1).

The main result of the present Chapter is that satisfiability of finite BSR(SLR) clause sets and finite BSR(BD) clause sets is decidable, respectively (Theorems 10.2.14 and 10.4.10). The proof technique is very similar for the two fragments. It is partially based on methods from Ramsey theory, which will be briefly introduced in the following section.

Basic Tools from Ramsey Theory

In the present section we establish two technical results based on methods usually applied in Ramsey theory. We shall use these results later on to prove the existence of models of a particular kind for finite and satisfiable BSR(SLR) or BSR(BD) clause sets. These models meet certain uniformity conditions. In order to construct them, we rely on the existence of certain finite subsets of Q that are used to construct prototypical tuples of rational numbers. These finite subsets, in turn, have to behave nicely as well, since rational tuples that are not distinguishable by BSR(SLR) or BSR(BD) clauses are required to have certain uniformity properties.

A tuple r 1 , . . . , r m ∈ Q m is called ascending ascending tuples, coloring if r 1 < . . . < r m . A coloring is a mapping χ : S → C for any set S and any finite set C. For the most basic result of this section (Lemma 10.1.1), we consider an arbitrary coloring χ of m-tuples of rational numbers and stipulate the existence of a finite subset Q ⊆ Q of a given cardinality n such that all ascending m-tuples of elements from Q are assigned the same color by χ. We call such a set Q uniformly colored uniformly colored sets .

Lemma 10.1.1. Let n, m > 0 be positive integers. Let χ : Q m → C be any coloring. There is some positive integer n such that for every set R ⊆ Q with |R| ≥ n -i.e. R needs to be sufficiently large -there exists a subset Q ⊆ R of cardinality n such that all ascending tuples r 1 , . . . , r m ∈ Q m are assigned the same color by χ.

Proof. This proof is an adaptation of the proof of Ramsey's Theorem on page 7 in [START_REF] Graham | A Wiley-Interscience publication[END_REF]. For n < m the lemma is trivially satisfied, since in this case Q m cannot contain any ascending tuple. Hence, we assume n ≥ m. In order to avoid technical difficulties when defining the sequence of elements s m-1 , s m , s m+1 , . . . below, we assume for the rest of the proof that R is finite but sufficiently large. This assumption does not pose a restriction, as we could always consider a sufficiently large finite subset of R, if R were to be infinite. We proceed by induction on m ≥ 1. The base case m = 1 is easy, since χ can assign only finitely many colors to elements in R and thus some color must be assigned at least |R| |C| times. Hence, if R contains at least n|C| elements, we find a uniformly colored subset Q of size n. Suppose m > 1. At first, we pick the m -2 smallest rational numbers s 1 < . . . < s m-2 s 1 , . . . , s m-2 from R and set S m-2 := R \ {s 1 , . . . , s m-2 } S m-2 . Thereafter, we simultaneously construct two sufficiently long but finite sequences s m-1 , s m , s m+1 , . . . and S m-1 , S m , S m+1 , . . . as follows: Given S i , we define s i+1 s i+1 to be the smallest rational number in S i . Given S i and the element s i+1 , we define an equivalence relation ∼ i ∼ i , S i on the set S i := S i \ {s i+1 } so that s ∼ i s holds if and only if for every sequence of indices j 1 , . . . , j m-1 with 1 ≤ j 1 < . . . < j m-1 ≤ i + 1, we have χ(s j1 , . . . , s jm-1 , s) = χ(s j1 , . . . , s jm-1 , s ). This equivalence relation partitions S i into at most |C| ( i+1 m-1 ) equivalence classes. We choose one such class with largest cardinality to be S i+1 S i+1

. By construction of the sequence s 1 , s 2 , s 3 , . . ., we must have χ(s j1 , . . . , s jm-1 , s K ) = χ(s j1 , . . . , s jm-1 , s K ) for every sequence of indices j 1 < . . . < j m-1 and all indices K, K ≥ j m-1 + 1. Notice that this covers all ascending m-tuples in {s 1 , s 2 , s 3 , . . .} m starting with s j1 , . . . , s jm-1 , i.e. they all share the same color. We now define a new coloring χ : {s 1 , s 2 , s 3 , . . .} m-1 → C χ so that χ (s j1 , . . . , s jm-1 ) := χ(s j1 , . . . , s jm-1 , s jm-1+1 ) for every sequence of indices j 1 < . . . < j m-1 (in case of j m-1 being the index of the last element in the sequence s 1 , s 2 , s 3 , . . ., χ (s j1 , . . . , s jm-1 ) shall be an arbitrary color from C). By induction, there exists a subset Q ⊆ {s 1 , s 2 , s 3 , . . .} Q of cardinality n, such that every ascending (m -1)-tuple r ∈ Q m-1 is colored the same by χ . The definition of χ entails that now all ascending m-tuples r ∈ Q m are colored the same by χ. Hence, Q is the sought set.

Based on Lemma 10.1.1, one can derive similar results for more structured ways of coloring tuples of rational numbers. We shall employ such a structured coloring when proving that the satisfiability problem for finite BSR(SLR) clause sets is decidable. More precisely, the proof of Lemma 10.2.9 will rely on such a result, namely Lemma 10.1.4. But before we formulate and prove this lemma, we present two auxiliary results.

Lemma 10.1.2. Let n, m, p > 0 be positive integers and let χ : Q mp → C be an arbitrary coloring. Let R 1 , . . . , R p be sufficiently large but finite subsets of Q. There exist subsets Q 1 ⊆ R 1 , . . . , Q p ⊆ R p , each of cardinality n and there is some color C ∈ C, such that for all ascending m-tuples r1 ∈ Q m 1 , . . . , rp ∈ Q m p we have χ(r 1 , . . . , rp ) = C. Proof. This proof is an adaptation of the proof of Theorem 5 on page 113 in [START_REF] Graham | A Wiley-Interscience publication[END_REF]. As in the proof of Lemma 10.1.1, we assume n ≥ m. We proceed by induction on p ≥ 1. The case p = 1 is covered by Lemma 10.1.1. Suppose p > 1. We define an equivalence relation ∼ p over the set R m p so that s ∼ p s holds if and only if for all ascending tuples r1 ∈ R m 1 , . . . , rp-1 ∈ R m p-1 the colors χ r1 , . . . , rp-1 , s and χ r1 , . . . , rp-1 , s are identical. This equivalence relation induces at most

|C| ( |R 1 | m )•...•( |R p-1 | m
) equivalence classes over R m p . It thus induces a coloring of χ : R m p → C p where C p contains one color for each of these equivalence classes. By virtue of Lemma 10.1.1, we can construct a subset Q p ⊆ R p with n elements such that all ascending m-tuples r ∈ Q m p are colored identically by χ . Let the coloring χ be defined by χ (r 1 , . . . , rp-1 ) := χ(r 1 , . . . , rp-1 , s) for some fixed ascending m-tuple s ∈ Q m p . By induction, we find subsets Q 1 ⊆ R 1 , . . . , Q p-1 ⊆ R p-1 , each containing n elements, such that for all ascending m-tuples r1 ∈ R m 1 , . . . , rp-1 ∈ R m p-1 the colors χ (r 1 , . . . , rp-1 ) are identical. But then, the definition of χ and χ entail that the sets Q 1 , . . . , Q p satisfy the requirements posed by the lemma.

Recall that we write [K] to address the set {1, . . . , K} for any positive integer K > 0.

Lemma 10.1.3. Let n, m, p > 0 be positive integers, let K ≥ 0 be a nonnegative integer and let χ : Q m → C be an arbitrary coloring. Let R 1 , . . . , R p be sufficiently large but finite subsets of Q. Let q 1 , . . . , q K be fixed rational numbers. Let ρ : [m] → [p + K] × [m] be some mapping such that ρ(i) = K, with K > p implies = 1.

There exist subsets Q 1 ⊆ R 1 , . . . , Q p ⊆ R p , each of cardinality n, and there exists some color C ∈ C such that for all ascending tuples

r1 = r 1,1 , . . . , r 1,m ∈ Q m 1 . . . rp = r p,1 , . . . , r p,m ∈ Q m p rp+1 = r p+1,1 := q 1 . . . rp+K = r p+K,1 := q K
occurrence of an atom P (t 1 , . . . , t m ) can be replaced with P (t 1 , . . . , t m , v, . . . , v) for some fresh first-order variable v that is added sufficiently often as argument.

Given the BSR(SLR) clause set N , every structure A induces a partition of Q into finitely many intervals: the rational numbers occurring in N together with the interpretations of all the Skolem constants c occurring in N yield point intervals that are interspersed with and enclosed by open intervals.

Definition 10.2.1 (A-induced partition of Q). Let A be any structure and let r 1 , . . . , r k be an enumeration of all the values in the set {c A | c ∈ consts(N ) is of sort Q} in ascending order. By J A J A we denote the following partition of Q: J A := (-∞, r 1 ), {r 1 }, (r 1 , r 2 ), {r 2 }, . . . , (r k-1 , r k ), {r k }, (r k , +∞) , where the sets {r i } represent point intervals, i.e. closed intervals containing exactly one value r i .

The idea underlying the following equivalence relation is that equivalent tuples are indistinguishable with respect to the arithmetic atoms that we allow in the BSR(SLR) clause set N .

Definition 10.2.2 (J A -equivalence, ∼ J A ). Let A be any structure and let k be any positive integer. We call two k-tuples r, q ∈ Q k J A -equivalent if and only if (i) for every i, 1 ≤ i ≤ k, and every interval J ∈ J A we have r i ∈ J if and only if q i ∈ J and (ii) for all i, j, 1 ≤ i, j ≤ k we have r i < r j if and only if q i < q j . The induced equivalence relation over tuples of positive length is denoted by ∼ J A ∼ J A .

For every positive k the relation ∼ J A induces only finitely many equivalence classes over the set of all k-tuples over the rationals.

Example 10.2.3. Consider an exhaustively Skolemized variant of the sentence ϕ 1 from Example 8.0.3:

ϕ Sk := ∀xy. 3 < c 1 < c 2 < 31 5 ∧ 3 ≤ x < c 1 ∧ 3 < y < c 2 → P (x, y) ∧ c 1 ≤ x < y ∧ y < 31 5 → P (x, y) .
Although we use convenient notation, the sentence essentially meets the syntax of BSR(SLR). Let A be any structure satisfying 3 < c A 1 < c A 2 < 31 5 . Then, the partition J A of Q is given by

J A = (-∞, 3), {3}, (3, c A 1 ), {c A 1 }, (c A 1 , c A 2 ), {c A 2 }, (c A 2 , 31 5
), { 31 5 }, ( 31 5 , +∞) .

Figure 10.1 illustrates the equivalence relation ∼ J A induced by J A over the two-dimensional rational plane.

Obviously, the number of equivalence classes is finite: there are 91 classes in the quotient set

Q 2 / ∼ J A .
Proposition 10.2.4. Any equivalence relation ∼ J A in accordance with Definition 10.2.2 induces finitely many equivalence classes over the set Q k .

Proof. Given any k-tuple r, every component belongs to exactly one of the intervals in J A , and if multiple such components stem from the same interval, there are only finitely many possibilities for their ordering relative to one another.

We intend to show that, if N is satisfiable, then there is some model A for N which does not distinguish between different J A -equivalent tuples. First, we need some notion that reflects how the structure A treats a given tuple r ∈ Q m . This role will be taken by the coloring χ A , which maps r to a set of expressions of the form P ā, where P is some predicate symbol occurring in N and ā is an m -tuple of domain elements from S A . The presence of P ā in the set χ A (r) indicates that A interprets P in such a way that P A contains the tuple ā, r . In this sense, χ A (r) comprises all the relevant information that A contains regarding the tuple r. Definition 10.2.5 (A-coloring χ A ). Let c 1 , . . . , c n be an enumeration of all constant symbols of sort S that occur in N . Given any structure A, let S := {a ∈ S A | a = c A i for some c i }. An A-color A-color is any set of expressions of the form P ā where P is some uninterpreted predicate symbol occurring in N and ā is some m -tuple over the set S. The A-coloring of Q m is the mapping χ A assigning A-colors to m-tuples of rationals such that for every r ∈ Q m we have P ā ∈ χ A (r) if and only if ā, r ∈ P A .

Having the coloring χ A at hand, it is easy to formulate a uniformity property for any given structure A. Two tuples r, r ∈ Q m are treated uniformly by A, if the colors χ A (r) and χ A (r ) agree. Put differently, A does not distinguish r from r . Definition 10.2.6 (J A -uniformity). A structure A is J A -uniform if χ A colors each and every ∼ J A -equivalence class uniformly, i.e. for all ∼ J A -equivalent tuples r, r we have χ A (r) = χ A (r ).

We next show that there exists a J A -uniform model A of N , if N is satisfiable. Since such a model does not distinguish between J A -equivalent m-tuples, and as there are only finitely many equivalence classes induced by ∼ J A , only a finite amount of information is required to describe the structure A. This insight will give rise to a decision procedure that nondeterministically guesses how each and every equivalence class shall be treated by the uniform model.

Given some model A of N , the following lemma assumes the existence of certain finite sets Q i with a fixed finite cardinality which are subsets of the open intervals in J A . All J A -equivalent m-tuples that can be constructed from the rationals belonging to the Q i are required to be colored identically by χ A . The existence of the sets Q i is stipulated (and proved) in Lemma 10.2.9.

Lemma 10.2.7. Let λ λ be the maximal number of distinct base-sort variables in any single clause in N . In case of λ < m we set λ := m. Let A be a model of N . Let J 0 , {r 1 }, J 1 , . . . , {r κ }, J κ J i , r i be an enumeration of all intervals in J A sorted in ascending order with the J i being the open intervals. Suppose we are given a collection of finite sets Q 0 , . . . , Q κ Q i possessing the following properties:

(i) Q i ⊆ J i and |Q i | = λ for every i. (ii) Let Q := i Q i ∪ {r 1 , . . . , r κ } Q . For all J A -equivalent m-tuples q, q ∈ Q m we have χ A (q) = χ A (q ).
Then, we can construct a model B of N that is J B -uniform and that interprets the free sort S with a finite set. Moreover, B interprets all constant symbols in N in the same way A does.

Proof.

Claim I: Let µ be any positive integer with 1 ≤ µ ≤ λ. For each of the finitely many equivalence classes in Q µ / ∼ J A we find a representative lying in Q µ .

Proof: Given any equivalence class [r] ∼ J A ∈ Q µ / ∼ J A , we define the following ascending sequences for every i, 0 ≤ i ≤ κ: s i,1 < . . . < s i,ki enumerating in ascending order all the values occurring in r that stem from J i , and q i,1 < . . . < q i,λ comprising all rationals from Q i in ascending order.

In every Q i ⊆ J i we find λ ≥ µ ≥ k i distinct rationals.

We can now construct a tuple q ∈ [r] ∼ J A ∩ Q µ by setting q := c A if r = c A for some c ∈ consts(N ) of sort Q, q i,j if r = s i,j for some i, 0 ≤ i ≤ κ, and some j, 1 ≤ j ≤ k i , for every , 1 ≤ ≤ µ. Clearly, r and q are J A -equivalent. ♦

Let c 1 , . . . , c n c i , S be an enumeration of all constant symbols of sort S that occur in N and let S denote the set {a ∈ S A | a = c A i for some c i }. We construct the structure B B as follows. We set S B := S, and for every constant symbol c occurring in N we set c B := c A . Moreover, for every uninterpreted predicate symbol P occurring in N and for all tuples ā ∈ S m and r ∈ Q m we pick some tuple q ∈ Q m which is J A -equivalent to r, and we define P B so that ā, r ∈ P B if and only if ā, q ∈ P A .

Claim II: The structure B is J B -uniform.

Proof: By construction of B and by Requirement (ii). ♦

We next show B |= N . Consider any clause C = Λ ∧ Γ → ∆ in N and let β be any variable assignment ranging over S B ∪ Q. Starting from β, we derive a special variable assignment γ C as follows. Let x 1 , . . . , x λ C be an enumeration of all base-sort variables occurring in C. By Claim I, there is some tuple q 1 , . . . , q λ C ∈ Q λ C such that q 1 , . . . , q λ C ∼ J A β(x 1 ), . . . , β(x λ C ) . We define γ C (x i ) := q i for every i, 1 ≤ i ≤ λ C . For all other base-sort variables, γ C can be defined arbitrarily. For every free-sort variable u we set γ C (u) := β(u). We observe For the following variant of Lemma 10.2.7 we make an exception for the sentences ϕ NBSR and η and treat <, ≤ as uninterpreted predicate symbols and consider both sentences without sorts.

β(x 1 ), . . . , β(x λ C ) ∼ J B γ C (x 1 ), . . . , γ C (x λ C ) . ( 10
Lemma 10.2.11. Let be any total preorder over the constant symbols c 1 , . . . , c k . Suppose there is a model A |= ϕ NBSR ∧ η with a single-sorted domain and in which <, ≤ are treated as uninterpreted predicate symbols. Assume that A's domain is minimal, i.e. A does not contain any substructure that also satisfies ϕ NBSR ∧ η -notice that this entails that A is finite. Furthermore, assume that for all m-tuples q, q of elements from Rat A which are J A -equivalent2 we have χ A (q) = χ A (q ).

Then, we can construct a model B of N BSR that is J B -uniform, contains the rational numbers as subdomain, interprets the predicate symbols <, ≤ as the usual relations over the rationals, and interprets the free sort S with some finite set. Moreover, we have B |= c i < c j if and only if

A |= c i < c j if and only if c i ≺ c j .
The proof of Lemma 10.2.11 proceeds along the same lines as the proof of Lemma 10.2.7 does. We only need to switch from the setting of N BSR mixing interpreted arithmetic relations over the rationals with uninterpreted predicate symbols to the point of view of the purely uninterpreted setting of ϕ NBSR ∧ η . Moreover, Corollary 10.2.10 guarantees the existence of a model A as described in Lemma 10.2.11 whenever N BSR is satisfiable (in the arithmetic setting).

Proposition 10.2.12. If N has a model B, then there is some total preorder over the base-sort Skolem constant symbols c 1 , . . . , c k occurring in N and a J A -uniform3 model A |= ϕ NBSR ∧ η with a finite domain. Moreover, we have B |= c i < c j if and only if A |= c i < c j if and only if c i ≺ c j . Now we have all pieces together to devise a nondeterministic decision procedure for finite BSR(SLR) clause sets in normal form. Consider such a clause set N . Recall that since N is in normal form, we can divide N into two disjoint parts N Q and N BSR such that N BSR does neither contain any rational numbers nor any arithmetic operators (except for the predicate symbols <, ≤). Our previous observations lead to the following nondeterministic decision procedure: (II) Check whether the clause set N Q ∪ N is satisfiable under Q, that is, check whether there is some assignment γ :

{c 1 , . . . , c k } → Q such that Q |= N Q ∪ N c 1 /γ(c 1 ), . . . , c k /γ(c k ) where N Q ∪ N c 1 /γ(c 1 ), . . . , c k /γ(c k ) denotes the syntactic replacement of every c i with γ(c i ) in N Q ∪ N .
(III) Check whether the (single-sorted) BSR sentence ϕ NBSR ∧ η -transformed into prenex normal form with a ∃ * ∀ * quantifier prefix -is satisfied by some model A that is J A -uniform.

(IV) If both Step (II) and Step (III) succeed, then N is satisfiable.

Step (II) relies on the fact that N Q ∪ N is variable free and that the existential fragment of linear rational arithmetic is decidable (cf. Proposition 10.2.13). Notice also that Steps (II) and (III) could be done in any order. By Lemma 10.2.11 and Proposition 10.2.12, the procedure is a correct and complete decision procedure for the satisfiability of finite BSR(SLR) clause sets in normal form. Next, we investigate the time complexity of the outlined decision procedure. To this end, we first argue that Step (II) can be done in nondeterministic polynomial time.

Proposition 10.2.13 plus the modified variant of Proposition 5.0.1 (see above), Steps (I) to (IV) can still be done nondeterministically in time that is at most exponential in the length of the original clause set N .

Corollary 10.2.15. The satisfiability problem for finite BSR(SLR) clause sets is NExpTimecomplete.

10.3 Shifting Perspective: BSR(SLR) from the Viewpoint of Combinations of Theories

In automated reasoning there are often specialized decision procedures tailored towards specific theories, such as (fragments of) arithmetic over the rationals or integers, equality over uninterpreted function symbols, and theories concerning data structures such as arrays, bit vectors, pointers, and strings. In applications originating from verification of software systems, for instance, it is often necessary to be able to reason about formulas that are based on more than one of these theories. In such applications, one mostly considers existentially quantified formulas and universal quantification is not allowed. Indeed, such syntactic restrictions are one possible way to make certain satisfiability problems decidable which would be undecidable otherwise. From an engineering perspective it is then desirable to combine several decision procedures, each capable of reasoning in one component theory, into a procedure that can handle the combined theory. It turns out that this is a non-trivial task, which can, however, be solved in a satisfying way in certain practically relevant cases. Two basic approaches for solving this challenge were presented by Nelson . The latter is a calculus for reasoning about first-order logic modulo background theories, which aims at a tight integration of firstorder theorem proving with solvers for the considered background theories. For further references, see [START_REF] Kruglov | Superposition Modulo Theory[END_REF], in particular the related-works section in Chapter 1, and also [START_REF] Ganzinger | Superposition Modulo a Shostak Theory[END_REF][START_REF] Sofronie-Stokkermans | Hierarchical Reasoning in Local Theory Extensions and Applications[END_REF], for instance.

The method by Nelson and Oppen was originally designed for combining theories whose vocabularies are disjoint and which are stably infinite (see below). Often, it is attempted to relax the mentioned restrictions towards the to-be-combined theories (disjointness of vocabularies and stable infiniteness). The general setup of the framework is the following. We consider a first-order sentence ∃v. ψ 1 (v) ∧ ψ 2 (v) where ψ 1 and ψ 2 are formulas over disjoint vocabularies Σ 1 , Σ 2 that may contain uninterpreted or interpreted function and predicate symbols. Hence, the only non-logical symbols common to ψ 1 and ψ 2 are the equality sign ≈ and the variables from v. In contrast to the rest of the chapter, the interpreted part of the vocabularies Σ 1 , Σ 2 is not limited to arithmetic. Usually, ψ 1 and ψ 2 are restricted to existential formulas, i.e. they are required to be equivalent to some ∃ * prefix formula. Then, the only means of exchanging information between the parts ψ 1 and ψ 2 is, in essence, equations v ≈ v and disequations v ≈ v with v, v ∈ v. Given decision procedures DP 1 , DP 2 DP 1 , DP 2 that can decide satisfiability of ∃v. ψ 1 (v) ∧ η(v) and of ∃v. ψ 2 (v) ∧ η(v), respectively, where η is any conjunction of (dis)equations [¬]v ≈ v , the Nelson-Oppen approach combines the two into one decision procedure for ∃v. ψ 1 (v) ∧ ψ 2 (v) as follows.

(1) Nondeterministically construct an equivalence relation ∼ ∼ over the variables in v. Let η ∼ be the formula

η ∼ (v) η ∼ (v) := v∼v v ≈ v ∧ v ∼v v ≈ v .
(2) Use DP 1 to check whether ∃v. ψ 1 (v) ∧ η ∼ (v) is satisfiable with respect to the fixed semantics of the interpreted parts of Σ 1 .

(3) Use DP 2 to check whether ∃v. ψ 2 (v) ∧ η ∼ (v) is satisfiable with respect to the fixed semantics of the interpreted parts of Σ 2 .

(4) If both Steps 2 and Step 3 succeed, then ∃v. ψ 1 (v) ∧ ψ 2 (v) is satisfiable with respect to the fixed semantics of the interpreted parts of Σ 1 ∪ Σ 2 .

The outlined decision procedure is correct and complete provided that the semantic restrictions underlying Σ 1 , Σ 2 are such that whenever ∃v. ψ 1 (v) ∧ η ∼ (v) and ∃v. ψ 2 (v) ∧ η ∼ (v) are satisfiable, then there are (single-sorted) models

A 1 |= ∃v. ψ 1 (v) ∧ η ∼ (v) and A 2 |= ∃v. ψ 2 (v) ∧ η ∼ (v)
that have infinite domains. This property is referred to as stable infiniteness stable infiniteness . The decision procedure that we have developed for finite BSR(SLR) clause sets shows great similarities with the Nelson-Oppen approach to combining decision procedures. In what follows we shall abstract from the BSR(SLR) syntax (in normal form) to a certain extent and generalize the results we have obtained to far.

Consider a sentence ϕ := ∃v. ϕ 1 (v)∧∃ȳ∀z. ϕ 2 (v, ȳ, z) ϕ, ϕ 1 , ϕ 2 with the following properties. The conjunct ϕ 1 is a formula over the language of rational arithmetic (without uninterpreted constant symbols). The conjunct ϕ 2 is a relational quantifier-free formula that does neither contain rational numbers nor any arithmetic operators except for <, ≤. However, ϕ 2 may contain uninterpreted predicate symbols. Notice that the BSR(SLR) normal form falls into the syntactic category of ϕ. The syntax of ϕ emphasizes the loose connection that ϕ establishes between the arithmetic part and the non-arithmetic predicates via the order relations <, ≤. While in the classical Nelson-Oppen setting the only information the two procedures DP 1 , DP 2 need to exchange are equations v ≈ v over existentially quantified variables v, v , in the case considered here, component decision procedures need to exchange information about the order relations <, ≤ that are common to the two parts ϕ 1 and ϕ 2 . More precisely, only the relative positions of the shared variables from v with respect to < need to be exchanged. This leads to the following adapted decision procedure, which is based on the one for finite BSR(SLR) clause sets from Section 10.2:

(1) Nondeterministically choose a total preorder over the set of all variables from v -there are at most 2 |v| 2 different choices for . We write v i ≺ v j if and only if we have v i v j and v j v i . Let v j1 ≺ . . . ≺ v j k be a maximal ≺-chain. Define the formula

η (v) η (v) := v≺v v < v ∧ v v ∧ v v v = v .
(2) Find a tuple r ∈ Q |v| such that Q |= ϕ 1 (r) ∧ η (r).

(3) Check whether the BSR sentence ∃vȳ∀z. ϕ 2 (v, ȳ, z) ∧ η (v) (with a mixture of interpreted and uninterpreted function and predicate symbols) is satisfiable, using the methods from Section 10.2, Lemma 10.2.11 in particular. If the answer is positive, construct a model

A |= ∃vȳ∀z. ϕ 2 (v, ȳ, z) ∧ η (v).
(4) If both Steps (2) and Step (3) succeed, then ϕ is satisfiable. More precisely, we then get

A |= ϕ 1 (r) ∧ ∃ȳ∀z. ϕ 2 (r, ȳ, z) ∧ η (r).
Notice that in this scheme the Steps (2) and (3) are independent of each other and only linked by the formula η , which is based on the nondeterministically constructed preorder . From the perspective of ϕ 2 , the variables in v are constants whose exact values are unknown and not important. In fact, most parts of the structure Q are not important for constructing a model for ϕ 2 . However, in general we have to make sure that any cardinality constraints that might be imposed by ϕ 2 are not in conflict with the fact that < and ≤ under Q are dense linear orders without endpoints. For example, a BSR sentence of the form χ := ∀z 1 z 2 . z 1 = z 2 → n i=1 P i (z 1 ) ↔ ¬P i (z 2 ) limits the domain to 2 n elements. In this case, using the rational numbers as (sub)domain is not possible. Such cardinality conflicts are resolved in Lemma 10.2.11 by (a) conjoining the formulas ψ and η (defined on pages 239 and 239) and (b) requiring J A -uniformity of the model A. In case of χ, this means that A |= η entails the existence of two distinct domain elements a, b with a < A b that are indistinguishable with respect to their belonging to the sets P A i , i.e. A |= i P i (a) ↔ P i (b) . Hence, we get A |= χ.

Remark 10.3.1. The combination approach outlined so far allows for a neat black-box-style integration of arithmetic solving with theorem proving for purely uninterpreted first-order logic, in particular for BSR. From a practical point of view, the combined decision procedure suffers from the drawback that the (nondeterministic) search for a suitable preorder does not take the information into account that the decision procedures employed in Steps (2) and (3) gather while trying to solve the two parts ∃v. ϕ 1 (v) ∧ η (v) and ∃vȳ∀z. ϕ 2 (v, ȳ, z) ∧ η (v) individually. If we aim at combined decision procedures that are more efficient in practice, then a tighter cooperation of the component decision procedures is desirable, which could lead to a more directed search for the preorder .

Consider again the sentence ϕ = ∃v. ϕ 1 (v) ∧ ∃ȳ∀z. ϕ 2 (v, ȳ, z). In the light of the above said, it becomes clear that the constituent ϕ 1 (v) does not necessarily have to be a linear-arithmetic sentence without quantifiers. In fact, the only requirement that is necessary for the described combination approach to work is the availability of a procedure that is able to provide us with a solution r for the variables v such that ϕ 1 (r) is a valid arithmetic statement. Indeed, there are such procedures available for formulas ϕ 1 (v) over the language of linear rational arithmetic with additional quantifiers and, more generally, for linear arithmetic over ordered fields. We have met one such a procedure based on quantifier elimination, namely virtual substitution [START_REF] Volker | The Complexity of Linear Problems in Fields[END_REF][START_REF] Loos | Applying Linear Quantifier Elimination[END_REF] in Section 7.1. When we consider the reals as domain, we could even allow polynomials instead of linear terms only -in this case, we are restricted to the model class of real closed fields. 5 For this language there are also quantifier-elimination procedures known that generalize the ones for the linear case, see [START_REF] Sturm | A Survey of Some Methods for Real Quantifier Elimination, Decision, and Satisfiability and Their Applications[END_REF] for an overview. Regarding the second constituent ∃ȳ∀z. ϕ 2 (v, ȳ, z) of ϕ, we have focused on BSR sentences until now. But in the light of our insights gained in Chapter 3, in particular in Sections 3.2 and 3.5, it becomes clear that we could also use SF or GBSR formulas here.

Theorem 10.3.2. Consider the class of first-order sentences of the form ϕ = ∃v. ϕ 1 (v) ∧ ϕ 2 (v) that satisfy the following properties.

(a) ϕ 1 (v) is a formula over the language of real arithmetic based on the vocabulary {<, ≤, =, =, ≥, >}, Q ∪ {+, •} . Then, all terms in ϕ 1 (v) are polynomials over real-valued variables with rational coefficients.

(b) ∃v. ϕ 2 (v) is a two-sorted GBSR sentence over the sort R and the uninterpreted sort S. The underlying vocabulary contains the interpreted predicate symbols <, ≤, =, =, ≥, > over the sort R and may also contain uninterpreted predicate symbols with signatures mixing the sorts R and S. On the other hand, rational numbers or arithmetic operations such as +, -, • are not admitted in ϕ 2 (v).

The satisfiability problem for the described class is decidable.

Proof sketch. The theorem follows from the fact that ∃v. ϕ 2 (v) can be transformed into an equivalent BSR sentence (cf. Lemma 3.5.2) and the availability of first-order quantifier-elimination procedures for ∃v. ϕ 1 (v) ∧ η (v) for any preorder on the variables in v. Together with these two components, the combined decision procedure described earlier suffices to solve the decision problem posed in the theorem.

As explained above, the theorem is also valid if we replace R with Q under the restriction that all arithmetic terms in the constituent ϕ 1 (v) are linear arithmetic terms.

By virtue of Theorem 10.3.2 and an adapted variant of Lemma 10.0.7, the following generalization of BSR(SLR) has a decidable satisfiability problem.

Definition 10.3.3 (GBSR with simple linear rational constraints -GBSR(SLR)). A GBSR(SLR) sentence is any sentence of the form ϕ := ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ with quantifier-free ψ that adheres to Definition 3.4.1 and may contain LRA atoms that are subject to the following restriction. Every LRA atom in ϕ has the form s t or x t or x x where x, x ∈ (x 1 ∪ . . . ∪ xn ) ∩ Var Q and s, t are LRA terms that do not contain any variable from x1 ∪ . . . ∪ xn but may contain variables from (ȳ 1 ∪ . . . ∪ ȳn ) ∩ Var Q . Every non-arithmetic atom in ϕ is either an equation s ≈ s over variables from Var S , or a non-equational atom P (s 1 , . . . , s m ) that is well sorted and where the s i range over base-sort variables and free-sort variables.

Corollary 10.3.4. The satisfiability problem for the class of GBSR(SLR) sentences is decidable.

The Bernays-Schönfinkel-Ramsey Fragment with Bounded Difference Constraints is Decidable

Similarly to the previous section, we fix some finite BSR(BD) clause set N N in BSR(BD) normal form, and we assume that all uninterpreted predicate symbols P occurring in N have the sort P : S m × Q m for two fixed nonnegative integers m, m m, m . Moreover, we assume that all rational numbers in N are in fact integers. This does not lead to a loss of generality, as we could multiply all rational numbers with the least common multiple of their denominators to obtain an equisatisfiable clause set in which only integers occur. We could even allow Skolem constants, if we were to add clauses stipulating that every such constant is assigned a value that is (a) an integer and (b) is bounded from above and below by some integer bounds. Dropping any of these two restrictions renders the satisfiability problem undecidable, cf. Chapter 11, Sections 11.2 and 11.4 in particular. For the sake of simplicity, we do not consider Skolem constants in this section.

Our general approach to proving decidability of the satisfiability problem for finite BSR(BD) clause sets is very similar to the route taken for BSR(SLR) in the previous section. However, due to the nature of the LRA atoms in BSR(BD) clause sets, the employed equivalence relation characterizing indistinguishable tuples has to be different from the one tailor-made for BSR(SLR). In fact, we use one equivalence relation κ over the unbounded space Q m and another equivalence relation κ over the bounded subspace (-κ -1, κ + 1) m for some positive integer κ. Our definition of the relations κ and κ is inspired by the notion of clock equivalence used in the context of timed automata (see, e.g., [START_REF] Alur | A Theory of Timed Automata[END_REF][START_REF] Baier | Principles of model checking[END_REF], and Section 10.5 of the present thesis).

Definition 10.4.1 (bounded region equivalence κ ). Let κ be any positive integer. We define the equivalence relation κ κ on (-κ -1, κ + 1) m such that we get r 1 , . . . , r m κ s 1 , . . . , s m if and only if the following conditions are met: (i) For every i we have r i = s i , and fr(r i ) = 0 if and only if fr(s i ) = 0. (ii) For all i, j we have fr(r i ) ≤ fr(r j ) if and only if fr(s i ) ≤ fr(s j ).

The relation κ induces only a finite number of equivalence classes over (-κ -1, κ + 1) m . Over Q m , on the other hand, an analogous equivalence relation ∞ would lead to infinitely many equivalence classes. In order to overcome this problem and obtain an equivalence relation over Q m that induces only a finite number of equivalence classes, we use the following compromise.

Definition 10.4.2 (unbounded region equivalence κ ). Let κ be any positive integer. We define the equivalence relation κ κ on Q m in such a way that we have r 1 , . . . , r m κ s 1 , . . . , s m if and only if (i) for every i either r i > κ and s i > κ, or r i < -κ and s i < -κ, or the following conditions are met:

(i.i) r i = s i and (i.ii) fr(r i ) = 0 if and only if fr(s i ) = 0, and (ii) for all i, j (ii.i) if r i , r j > κ or r i , r j < -κ, then r i ≤ r j if and only if s i ≤ s j , (ii.ii) if -κ ≤ r i , r j ≤ κ, then fr(r i ) ≤ fr(r j ) if and only if fr(s i ) ≤ fr(s j ).

Obviously, the equivalence relations κ and κ coincide on the subspace (-κ, κ) m . Over (-κ -1, κ + 1) m the relation κ constitutes a proper refinement of κ . Figure 10.2 depicts the equivalence classes induced by κ and κ in a two-dimensional setting for κ = 1. We will need both relations in our approach. Definition 10.4.3 ( κ -uniform and κ -uniform structures). Let κ be any positive integer. We call any structure A κ -uniform if its corresponding coloring χ A (cf. Definition 10.2.5) colors each κ -equivalence class over (-κ -1, κ + 1) m uniformly, i.e. for all tuples q, q ∈ (-κ -1, κ + 1) m with q κ q we require χ A (q) = χ A (q ). We call A κ -uniform if χ A colors each κ -equivalence class over Q m uniformly.

The parameter κ will be determined by the rational number in N with the largest absolute value. If κ is defined in this way, one can show that the LRA atoms occurring in N cannot distinguish between two κ -equivalent m-tuples of rationals. This observation will be crucial for the proof of Lemma 10.4.4, where we will prove the existence of κ -uniform models for satisfiable finite BSR(BD) clause sets N . To this end, we start from some model A of N and rely on the existence of a certain finite set Q ⊆ [0, 1) of fractional parts. This set Q can be expanded to a set Q ⊆ (-κ -1, κ + 1) by addition of the fractional parts in Q with integral parts k from the range -κ-1 ≤ k ≤ κ. Hence, Q contains 2(κ+1)•|Q| rational numbers. We assume that all κ -equivalent tuples s, s from Q m are treated uniformly by A. Put differently, we require χ A (s) = χ A (s ). We choose to formulate this requirement with respect to κ because of the more regular structure of its equivalence classes, which facilitates a more convenient way of invoking Lemma 10.1.1. Due to the fact that κ constitutes a refinement of κ on the subspace (-κ -1, κ + 1) m , and since for every κ -equivalence class S over Q m there is some κ -equivalence class S ⊆ (-κ -1, κ + 1) m such that S ⊆ S, we can use the color χ A (r) of representative m-tuples r constructed from Q to serve as a blueprint when constructing a κ -uniform model B.

Lemma 10.4.4. Let λ λ, A, κ be the maximal number of distinct base-sort variables in any single clause in N ; in case of λ < m, we set λ := m. Suppose that N is satisfiable and let A be any model of N . Let κ be the smallest positive integer that is larger than the absolute value of any rational number occurring in N . Suppose we are given a finite set Q ⊆ [0, 1) Q of cardinality λ + 1 such that 0 ∈ Q and for all tuples r, s ∈ Q m , r κ s entails χ A (r) = χ A (s), where Q Q := q + k q ∈ Q and k is any integer with -κ -1 ≤ k ≤ κ . Then, we can construct a model B of N that is κ -uniform and that interprets the free sort S with some finite set.

Proof. The construction of B from A is similar to the construction of uniform models outlined in the proof of Lemma 10.2.7.

Claim I: Let µ be any positive integer with 1 ≤ µ ≤ λ. For each of the finitely many equivalence classes S ∈ Q µ / κ and every r ∈ S r , there is some q ∈ S ∩ Q µ such that r κ q and for all i 1 , i 2 , i 3 with r i1 < -κ and r i2 > κ and -κ ≤ r i3 ≤ κ and fr(r i3 ) > 0 we have fr(q i1 ) < fr(q i2 ) < fr(q i3 ).

Proof: Let i 1 , i 2 , . . . i j , j be all the indices from {1, . . . , µ} for which we have r ij > κ for every j. Analogously, let 1 , 2 , . . . be all the indices from {1, . . . , µ} such that r j < -κ holds for every j. We define the rational number δ := min fr(r i ) -κ ≤ r i ≤ κ and fr(r i ) > 0 and 1

≤ i ≤ m ∪ 1 2
. δ There must be some integer t for which we get -1 2 δ < 1 t r j < 0 < 1 t r i j < 1 2 δ for all j, j . Let r be the tuple that we obtain from r by replacing every r ij with 1 t r ij + 1 2 δ + κ and every r j with 1 t r j + 1 2 δκ -1. By construction, we observe r ∈ (-κ -1, κ + 1) µ and r κ r . Moreover, we have 0 < fr(r j ) < 1 2 δ < fr(r i j ) < δ ≤ fr(r k ) for all j, j and every r k with -κ ≤ r k ≤ κ and fr(r k ) > 0.

Next, we define the following ascending sequences s 0 < s 1 < . . . < s k , where s 0 = 0 and the values s j with j ≥ 1 are the strictly positive fractional parts in ascending order that occur in fr(r ), and q 0 < q 1 < . . . < q λ , which comprises all rationals in Q in ascending order, including q 0 = 0.

We now construct a tuple q ∈ S ∩ Q µ q by setting q := r + q j for j such that fr(r ) = s j .

Clearly, r and q are κ -equivalent. Since κ is a refinement of κ over the subspace (-κ -1, κ + 1) µ , this entails r κ q. ♦ Let c 1 , . . . , c be an enumeration of all constant symbols in N that are of the sort S. Let S S, B denote the set {a ∈ S A | a = c A i for some c i }. We construct the structure B as follows. We set S B := S, and for every constant symbol c occurring in N we set c B := c A . Furthermore, for every uninterpreted predicate symbol P occurring in N and for all tuples ā ∈ S m and r ∈ Q m we pick some tuple q ∈ Q m in accordance with Claim I -i.e. q satisfies r κ q -and define P B in such a way that ā, r ∈ P B if and only if ā, q ∈ P A .

Claim II: The structure B is κ -uniform.

Proof: Let r1 , r2 ∈ Q m r1 , r2 , q1 , q2 be two κ -equivalent tuples. By Claim I, there exist two tuples q1 , q2 ∈ Q m such that q1 κ r1 and q2 κ r2 . By transitivity and symmetry of κ , we have q1 κ q2 . Even stronger, we can infer q1 κ q2 as follows. Suppose, q1 κ q2 . We observe the following properties, which follow from q1 κ q2 and the fact that q1 , q2 ∈ (-κ -1, κ + 1) m :

(i) q1 = q2 and q1 = q2 .

(ii) For all i, j for which -κ ≤ q 1 i , q 1 j ≤ κ we have fr(q 1 i ) ≤ fr(q 1 j ) if and only if fr(q 2 i ) ≤ fr(q 2 j ). (iii) For all i, j for which q 1 i , q 1 j < -κ or κ < q 1 i , q 1 j we have q 1 i ≤ q 1 j if and only if q 2 i ≤ q 2 j . Because of q1 , q2 ∈ (-κ -1, κ + 1) m , we even obtain fr(q 1 i ) ≤ fr(q 1 j ) if and only if fr(q 2 i ) ≤ fr(q 2 j ).

Hence, our assumption q1 κ q2 entails that there are two indices i, j such that fr(q 1 i ) ≤ fr(q 1 j ) and fr(q 2 i ) > fr(q 2 j ) (or fr(q 1 i ) < fr(q 1 j ) and fr(q 2 i ) ≥ fr(q 2 j )), and one of the following cases applies:

(1) κ < q 1 i , q 2 i and -κ ≤ q 1 j , q 2 j ≤ κ, or (2) κ < q 1 i , q 2 i and q 1 j , q 2 j < -κ, or

(3) -κ ≤ q 1 i , q 2 i ≤ κ and κ < q 1 j , q 2 j , or (4) -κ ≤ q 1 i , q 2 i ≤ κ and q 1 j , q 2 j < -κ, or (5) q 1 i , q 2 i < -κ and -κ ≤ q 1 j , q 2 j ≤ κ, or (6) q 1 i , q 2 i < -κ and κ < q 1 j , q 2 j .

Ad (1). By Claim I, we have fr(q 1 i ) < fr(q 1 j ) and fr(q 2 i ) < fr(q 2 j ). Ad (2). By Claim I, we have fr(q 1 i ) > fr(q 1 j ) and fr(q 2 i ) > fr(q 2 j ). Ad (3). By Claim I, we have fr(q 1 i ) > fr(q 1 j ) and fr(q 2 i ) > fr(q 2 j ). Ad (4). By Claim I, we have fr(q 1 i ) > fr(q 1 j ) and fr(q 2 i ) > fr(q 2 j ). Ad (5). By Claim I, we have fr(q 1 i ) < fr(q 1 j ) and fr(q 2 i ) < fr(q 2 j ). Ad (6). By Claim I, we have fr(q 1 i ) < fr(q 1 j ) and fr(q 2 i ) < fr(q 2 j ).

Since all cases yield a contradiction, we must have q1 κ q2 .

Because of q1 , q2 ∈ Q m and due to our assumptions regarding Q and Q m , we have χ A (q 1 ) = χ A (q 2 ). Moreover, by construction of B, we have χ B (r 1 ) = χ A (q 1 ) and χ B (r 2 ) = χ A (q 2 ). Consequently, χ B (r

1 ) = χ B (r 2 ). ♦ We next show B |= N . Consider any clause C = Λ ∧ Γ → ∆ C = Λ∧Γ → ∆ β
in N and let β be any variable assignment ranging over S B ∪ Q. Starting from β, we derive a special variable assignment γ C as follows. Let x 1 , . . . , x be an enumeration of all base-sort variables in C. By Claim I, there exists some tuple q := q 1 , . . . , q such that q 1 , . . . , q κ β(x 1 ), . . . , β(x ) and q ∈ Q . We define γ C (x i ) := q i γ C for every i. Hence, we have

γ C (x) -γ C (y) = γ C (x) -γ C (y) + fr(γ C (x)) -fr(γ C (y)) = β(x) -β(y) + fr(β(x)) -fr(β(y)) = β(x) -β(y)
Because of s, s ∈ Q m , we know that q 1 , . . . , q m ∈ Q m and q 1 , . . . , q m ∈ Q m . Then, χ( q 1 , . . . , q m ) = χ( q 1 , . . . , q m ) entails χ A (s) = χ A q ρj (1) + σ j (1), . . . , q ρj (m) + σ j (m) = χ A q ρj (1) + σ j (1), . . . , q ρj (m) + σ j (m) = χ A (s ) .

Lemmas 10.4.4 and 10.4.6 together entail the existence of κ -uniform models for finite satisfiable BSR(BD) clause sets, where κ is defined like in Lemma 10.4.4.

Corollary 10.4.7. Let κ be the smallest positive integer that is larger than the absolute value of any rational number occurring in N . If N is satisfiable, then it has a model A that is κ -uniform and whose interpretation of the sort S is some finite set.

Similarly to the BSR(SLR) case, Lemma 10.4.4 and Corollary 10.4.7 do not immediately lend themselves to constructing a decision procedure for finite BSR(BD) clause sets. We need results that are easier to handle computationally. To this end, we reuse some ideas that we have already presented in the context of BSR(SLR). Let κ κ, λ be the smallest positive integer that is larger than the absolute value of any rational number occurring in N . Let λ be the maximal number of distinct base-sort variables in any single clause in N ; in case of λ < m we set λ := m. Let Var κ Var κ be a set of first-order variables defined by Var κ := z qi+k where q i + k is a formal term for any pair of integers i, k with 0 ≤ i ≤ λ and -κ -1 ≤ k ≤ κ .

Then, Var κ contains (λ + 1) • (2κ + 2) variables, each of which is intended to represent one value from the set Q, defined in Lemma 10.4.4. Let z z be a tuple listing all variables from Var κ is any order. Moreover, let d 1 , . . . , d d j be an enumeration of all free-sort constant symbols occurring in N . We construct a formula η κ (z) η κ (z) (also containing the constant symbols d 1 , . . . , d ) that has the following properties:

(a) η κ (z) contains the axioms of (strict) linear orders for <, ≤ (treated as uninterpreted predicate symbols), (b) η κ (z) introduces two fresh unary uninterpreted predicate symbols Rat and Free to represent the sorts Q and S, respectively, and makes sure that the constant symbols d j are assigned to sort S and that the variables in z are assigned to sort Q, and (c) η κ (z) introduces fresh binary uninterpreted predicate symbols P x-y k with -κ -1 ≤ k ≤ κ and ∈ {<, ≤, =, =, ≥, >} which are intended to represent the predicates xy k by uninterpreted predicate symbols, and η κ (z) makes sure that the P x-y k are defined in the intended way over the elements represented by the variables in z.

Formally, we define η κ as follows:

η κ (z) := ∀v. Rat(v) ↔ ¬Free(v) ∧ ∀xy. x < y ∨ x ≤ y → Rat(x) ∧ Rat(y) ∧ -κ-1≤k≤κ ∈{<,≤,=, =,≥,>} ∀xy. P x-y k (x, y) → Rat(x) ∧ Rat(y) ∧ z∈z Rat(z) ∧ 1≤j≤ Free(d j ) ∧ ∀xyw. Rat(x) ∧ Rat(y) ∧ Rat(w) -→ ¬x < x ∧ x < y ∧ y < w → x < w ∧ x ≈ y ∨ x < y ∨ x < y ∧ x ≤ y ↔ x ≈ y ∨ x < y ∧ -κ-1≤k≤κ 0≤j≤λ-1 z qj +k < z qj+1+k ∧ z q λ +k < z q0+k+1 .
The length of η κ is polynomial in the number of variables in Var κ , in κ and λ, and in the number of free-sort constant symbols occurring in N . In addition to η κ , we define η κ (z) η κ (z) to be a first-order formula stipulating the order axioms for the fresh predicate symbols P x-y k . That is, η κ (z) in conjunction with η κ (z) satisfies the following properties for all i, j, j , k, k with -κ ≤ i ≤ κ and 0 ≤ j, j ≤ λ and -κ -1 ≤ k, k ≤ κ : η κ (z) ∧ η κ (z) |= P x-y=i (z qj +k , z q j +k ) if and only if kk = i and j = j , η κ (z) ∧ η κ (z) |= P x-y<i (z qj +k , z q j +k ) if and only if kk < i or kk = i and j < j , η κ (z) ∧ η κ (z) |= P x-y>i (z qj +k , z q j +k ) if and only if kk > i or kk = i and j > j , η κ (z) ∧ η κ (z) |= P x-y≤i (z qj +k , z q j +k ) if and only if η κ (z) ∧ η κ (z) |= P x-y<i (z qj +k , z q j +k ) or η κ (z) ∧ η κ (z) |= P x-y=i (z qj +k , z q j +k ), η κ (z) ∧ η κ (z) |= P x-y≥i (z qj +k , z q j +k ) if and only if η κ (z) ∧ η κ (z) |= P x-y>i (z qj +k , z q j +k ) or η κ (z) ∧ η κ (z) |= P x-y=i (z qj +k , z q j +k ), η κ (z) ∧ η κ (z) |= P x-y =i (z qj +k , z q j +k ) if and only if η κ (z) ∧ η κ (z) |= P x-y<i (z qj +k , z q j +k ) or η κ (z) ∧ η κ (z) |= P x-y>i (z qj +k , z q j +k ), where all predicate symbols in η κ (z) ∧ η κ (z) are treated as uninterpreted in the current context. The length of η κ is at most polynomial in |Var κ | and κ -we could simply specify for every quadruple z qj +k , z q j +k , , i whether P x-y i (z qj +k , z q j +k ) is satisfied or not. We assume, without loss of generality, that none of the predicate symbols Rat, Free, and P x-y k occur in N . Moreover, we assume that none of the variables from Var κ occur in N . Let ū be some tuple listing all variables from vars(N ) ∩ Var S and let x be some tuple listing all variables from vars(N ) ∩ Var Q . Recall that we assume that all rational numbers in the BSR(BD) clause set N are integers. Let N N be the result of replacing every integer k in N with the variable z q0+k . We now define the sentence

ϕ N,κ ϕ N,κ := ∃z. η κ (z) ∧ η κ (z) ∧ ∀ūx. u∈ū Free(u) ∧ x∈x Rat(x) → C(z,ū,x)∈N C(z, ū, x) ,
which is evidently equivalent to some BSR sentence. Furthermore, we observe that the length of ϕ N,κ is polynomial in κ, λ, and the length of N . For the following variant of Lemma 10.4.4 we again make an exception for the sentences ϕ N,κ and treat <, ≤ as uninterpreted predicate symbols and consider the sentence without sorts.

Lemma 10.4.8. Suppose there is a model A |= ϕ N,κ with a single-sorted domain and in which <, ≤ and the P x-y k are treated as uninterpreted predicate symbols. Assume that A's domain is minimal, i.e. A does not contain any substructure that also satisfies ϕ N,κ -notice that this entails that A is finite. Furthermore, assume that for all m-tuples q, q of elements from Rat A that are κ -equivalent6 we have χ A (q) = χ A (q ). Then, we can construct a model B of N that is κ -uniform, constains the rational numbers as subdomain, interprets the predicate symbols <, ≤ as the usual relations over the rationals, and interprets the free sort S with some finite set.

The proof of Lemma 10.4.8 proceeds along the same lines as the proof of Lemma 10.4.4 does. We only need to switch from the setting of N mixing interpreted arithmetic relations and difference constraints over the rationals with uninterpreted predicate symbols to the point of view of the purely uninterpreted setting of ϕ N,κ . Moreover, Corollary 10.4.7 guarantees the existence of a model A as described in Lemma 10.4.8 whenever N is satisfiable (in the arithmetic setting).

Proposition 10.4.9. If N has a model B, then there is a κ -uniform7 model A |= ϕ N,κ with a finite domain.

Finally, we have all pieces together to devise a nondeterministic decision procedure for finite BSR(BD) clause sets N that proceeds as follows:

(I) Construct the sentence ϕ N,κ corresponding to N and transform it into prenex normal form with some ∃ * ∀ * quantifier prefix. Suppose the result is of the form ∃v∀ w. ψ(v, w) with quantifier-free ψ(v, w). In what follows we treat all predicate symbols in this sentence as if they were uninterpreted.

(II) Nondeterministically construct a candidate model A such that (a) A's domain is minimal: we do not introduce more domain elements than necessary to assign suitable values to v and the constant symbols occurring in ϕ N,κ , and (b) A is κ -uniform8 with respect to the elements in Rat A .

(III) Check whether A is indeed a model of ϕ N,κ .

By Lemma 10.4.8 and Proposition 10.4.9, the procedure is a correct and complete decision procedure for the satisfiability problem for finite BSR(BD) clause sets. Concerning computational complexity, we observe the following: Step (I) can certainly be done in polynomial time with respect to κ and the length of N . As we may assume that the integers in N are encoded in binary, the dependence on κ leads to a runtime bound that is polynomial in 2 N . Proposition 3.1.6 together with a modified variant of Proposition 5.0.1 -compare the discussion right before Theorem 10.2.14 on page 241 -entails that Steps (II) and (III) together can be done nondeterministically in time p n k • len(ϕ N,κ ) where p is some polynomial in a single argument, n := |z| + |consts(ϕ N,κ )| n, k , and k denotes the number of universal quantifiers in ϕ N,κ , which we may assume to be linear in the maximal number of variables in any clause in N . Since n is linear in 2 N , k is linear in len(N ), and len(ϕ N,κ ) is polynomial in κ, λ and len(N ) and, hence, polynomial in 2 N , we in the end get that the satisfiability problem for finite BSR(BD) clause sets lies in NExpTime. It is even NExpTime-complete, since the subproblem BSR-Sat is already NExpTime-hard.

Theorem 10.4.10. Satisfiability of finite BSR(BD) clause sets is decidable, and for clause sets in BSR(BD) normal form the problem is NExpTime-complete.

By virtue of Lemma 10.0.7, transforming any finite BSR(BD) clause set N into an equisatisfiable finite clause set N in BSR(BD) normal form leads to a blowup that is such that (a) the length of N is at most exponential in the length of N , (b) for any clause C in N the number of variables occurring in C is not larger than the number of variables occurring in any clause in N , (c) every free-sort Skolem constant occurring in N also occurs in N , and (d) the absolute value of any integer in N is linear in κ N • λ N , where κ N is the smallest positive integer that is larger than the absolute value of any integer occurring in N and λ N is the maximal number of variables occurring in any clause in N . Let n be the number of existentially quantified variables plus the number of constant symbols occurring in ϕ N ,κ . Then, we observe that n is polynomial in κ N • λ N and len(N ) and, hence, n is polynomial in 2 N . Let k be the number of universal quantifiers occurring in ϕ N ,κ . Then, k is linear in λ N , which in turn is smaller than len(N ). Consequently, satisfiability of N can be checked nondeterministically in time that is bounded from above by p 2 (len(N )) d +1 for some polynomial p and some positive integer constant d.

Corollary 10.4.11. The satisfiability problem for finite BSR(BD) clause sets is NExpTimecomplete.

An Application: Formalizing Reachability for Timed

Automata in BSR(BD)

Timed automata (cf. Definition 10.5.3), introduced in the 1990s [AD90, AD94, Lew90, HNSY94], and extensions thereof are a well-established and widely-used formalism for modeling behavior of state-based real-time systems. See [START_REF] Baier | Principles of model checking[END_REF] for a gentle textbook exposition and see the very recent handbook articles [BFL + 18, DFPP18] for comprehensive surveys. In the present section, we consider the reachability problem for timed automata, which poses the question whether one can reach a certain set of states from the initial state, possibly under timing restrictions. The involved concepts will be defined below (Definitions 10.5.2-10.5.4). Our goal is to show that this problem can be formalized using finite BSR(BD) clause sets. The encoding we shall use will be a variant of an encoding devised by Fietzke and Weidenbach [START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF]. The central idea underlying the modification is that time progress does not have to be modeled as precisely as done in the original encoding. It is well known that the clock constraints in any given timed automaton induce finitely many regions in the space of clock valuations. We shall refer to these regions as TA regions (cf. Definition 10.5.5). If two clock valuations belong to one and the same TA region, they are indistinguishable by the automaton and its clock constraints. This leads to a more abstract point of view where only the reachability of TA regions matters. As we adopt this point of view, passage of time can be modeled as a movement from one TA region into reachable regions rather than the movement of a single point in the space of clock valuations to a ray of reachable points (cf. Figure 10.4 on page 257). It turns out that difference constraints are sufficient to formalize time progress in terms of TA regions. This approach will be made precise in Lemmas 10.5.9 and 10.5.10. Furthermore, it not hard to see that it is sufficient to consider a bounded subspace of the space Q m ≥0 , if we intend to decide reachability for a timed automaton with m clocks (cf. Proposition 10.5.6). For every such automaton there exists a computable integer κ, depending on m and the integers occurring in clock constraints, such that any valuation r of the clocks can be projected to some valuation r that is indistinguishable from r by the occurring clock constraints and that lies inside of the space [0, κ + 1) m . This is the reason why bounded difference constraints suffice to formalize reachability.

Remark 10.5.1. In [NMA + 02] an encoding of the reachability problem for timed automata in difference logic (Boolean combinations of difference constraints without uninterpreted predicate symbols) is given, which facilitates deciding bounded reachability for timed automata, i.e. the problem of reaching a given set of states within a bounded number of transition steps. When using BSR(BD) as a modeling language, we do not have to fix an upper bound on the number of steps a priori.

There are also other encodings of the reachability problem for timed automata and related formalisms into linear arithmetic known, for instance [START_REF] Quaas | Revisiting reachability in timed automata[END_REF] (based on mixtures of Presburger arithmetic and linear rational arithmetic) and [CJ98, CJ99] (based on the additive theory of rationals or integers).

We shall use the standard definitions for timed automata and related notions (see, e.g. [AD94, BK08, BFL + 18]). In what follows, we fix a positive integer m m, x and a finite tuple x of length m containing pairwise-distinct first-order variables that have sort Q, called clock variables clock variables or clocks for short. Definition 10.5.2 (Clock constraints). An atomic clock constraint over x is an atom of the form true, x c, or xy c, where x, y ∈ x, ∈ {<, ≤, =, ≥, >}, and c ≥ 0 is a nonnegative integer. By ACC(x) ACC(x)

we denote the set of all atomic clock constraints over x. A clock constraint over x is a finite conjunction ϕ = ϕ 1 ∧ . . . ∧ ϕ k of atomic clock constraints ϕ 1 , . . . , ϕ k ∈ ACC(x) for some k ≥ 1. We denote the set of all clock constraints over x by CC(x) CC(x) .

Definition 10.5.3 (Timed automaton). A timed automaton is a tuple A := Loc, 0 , x, inv (x) ∈Loc , T where Loc is a finite set of locations (i.e. control states); 0 ∈ Loc is the initial location; x is a tuple of clock variables; inv (x) ∈ CC(x) is a clock constraint describing the location invariant of location ; T ⊆ Loc × CC(x) × P(x) × Loc is the location transition relation of the automaton, including transition guards with respect to clocks and the set of clocks that are being reset to zero whenever the transition is taken. In addition, we assume Q |= inv 0 ( 0) and, moreover, we assume that every clock constraint ψ(x) occurring in a timed automaton over x is satisfiable under Q, i.e. we have Q |= ∃x. ψ(x).

The latter property can be checked in polynomial time, as already mentioned right after Proposition 10.0.6. Since we will be concerned with the reachability problem only, we do not consider an alphabet of actions that could provide additional labels for transitions. Hence, we implicitly assume a one-letter alphabet, but the obtained results could easily be transferred to richer alphabets.

Notice that we allow atoms xy c in clock constraints. Such constraints are often referred to as diagonal constraints in the timed-automata literature. It is known that they do not add expressiveness to the formalism, as any timed automaton with diagonal constraints can be transformed into an equivalent timed automaton that does not contain any diagonal constraints (see [START_REF] Bérard | Characterization of the Expressive Power of Silent Transitions in Timed Automata[END_REF], Section 4.2). Two timed automata are considered to be equivalent, if they accept the same (timed) language ([BPDG98], Section 2.2).

Although the control flow of any timed automaton can be described by finite means, the fact that clocks can assume infinitely many values yields an infinite state space. Formally, the semantics of a timed automaton is given by an infinite transition system. Definition 10.5.4 (Semantic transition system of a timed automaton). The semantics of a timed automaton A := Loc, 0 , x, inv (x) ∈Loc , T is given by an infinite state transition system TS(A) := S, s 0 , → TS(A) with the following components:

S := Loc × Q m ≥0 = , r ∈ Loc and r ∈ Q m ≥0
is the state space consisting of locations paired with clock valuations clock valuations -such a valuation is a total mapping x → Q m ≥0 assigning nonnegative reals to m clock variables; s 0 := 0 , 0 is the initial state, where 0 denotes the tuple of length m containing all zeros; → ⊆ S × S is the transition relation containing two kinds of transitions: delay transitions , r → , r ∈ Loc and there is some t ≥ 0 such that r := r + t and Q |= inv (r ) ; location transitions , r → , r there is some , ψ(x), Z, ∈ T such that Q |= ψ(r), r := r[Z →0], and Q |= inv (r ), where r + t is the tuple r 1 + t, . . . , r m + t and r[Z →0] stands for the tuple r with

r i := 0 if x i ∈ Z, ri if x i ∈ Z for every index i. We denote the reflexive transitive closure of → by → * → * . Any pair , r ∈ Loc × Q m is called reachable in A reachable in A , if we have s 0 → * , r .
Consider any timed automaton A := Loc, 0 , x, inv (x) ∈Loc , T . It is easy to verify that every clock constraint occurring in A -be it as the initial condition, as transition invariant, or as transition guard -can be transformed into an equivalent conjunction ψ of difference constraints in the sense of Definition 10.0.5 and Proposition 10.0.6 (see the paragraph preceding Definition 10.0.5). Let κ κ be the smallest positive integer that is larger than the absolute value of any integer occurring in any clock constraint in A. Let µ := κ • m µ . 9 Since we assume all clock constraints in timed automata to be satisfiable under Q, Proposition 10.0.6 entails that none of the clock constraints in A can distinguish two clock valuations r, r ∈ 0, µ + 1 m that are µ -equivalent. On the one hand, the following equivalence relation ∼ A over Q ≥0 is a refinement of µ over Q ≥0 and, on the other hand, µ constitutes a refinement of ∼ A over [0, µ + 1 m .

Definition 10.5.5 (∼ A , TA regions). Let A := Loc, 0 , x, inv (x) ∈Loc , T be a timed automaton. Let κ be the smallest positive integer that is larger than the absolute value of any integer occurring in any clock constraint in A and let µ := κ • m. We define the equivalence relation

∼ A ∼ A on Q m ≥0
such that r ∼ A s holds if and only if (i) for every i we either have r i = s i , or r i > µ and s i > µ, and (ii) for all i, j we either have r ir j = s is j , or r ir j > µ and s is j > µ, or r ir j < -µ and s is j < -µ.

We call the equivalence classes induced by ∼ A over Q m ≥0 the TA regions of A. Proposition 10.5.6. Let A := Loc, 0 , x, inv (x) ∈Loc , T be any timed automaton and consider the transition system TS(A) := S, s 0 , → associated with A. Given two clock valuations r, s ∈ Q m ≥0 with r ∼ A s and any location ∈ Loc, we have s 0 → * , r if and only if s 0 → * , s .

Proof. This is an immediate consequence of the definition of TS(A) and the observation that the clock constraints in A cannot distinguish ∼ A -equivalent clock valuations. The latter results from Proposition 10.0.6. Fietzke and Weidenbach have presented an encoding of the semantic transition system of a given timed automaton A into a first-order clause set with linear arithmetic constraints [START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF]. We shall use this encoding as a starting point.

Definition 10.5.7 (FOL(LA) encoding of a timed automaton, [START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF]). Let A := Loc, 0 , x, inv (x) ∈Loc , T be a timed automaton. The FOL(LA) encoding of A is the set N A N A containing the following clauses, where Reach is a (m + 1)-ary predicate symbol of sort Loc × Q × . . . × Q, the ∈ Loc are reused as free-sort constant symbols, x is some m-tuple of pairwise-distinct clock variables, and z is one more first-order variable (we assume x, x , and {z} to be pairwise disjoint):

the initial clause xi∈x x i = 0 ∧ inv 0 (x) → Reach( 0 , x); delay clauses z ≥ 0 ∧ xi∈x x i = x i + z ∧ inv (x ) ∧ Reach( , x) → Reach( , x ) for every location ∈ Loc; transition clauses ψ(x) ∧ xi∈Z x i = 0 ∧ xi∈x\Z x i = x i ∧ inv (x ) ∧ Reach( , x)
→ Reach( , x ) for every location transition , ψ(x), Z, ∈ T .

Proposition 10.5.8 (Corollary 4.3 and Proposition 4.4 in [START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF]).

Let A := Loc, 0 , x, inv (x) ∈Loc , T be a timed automaton, let TS(A) = S, s 0 , → be its semantic transition system, and let N A be its FOL(LA) encoding.

(i) Let A be a model of N A . For every location ∈ Loc and every tuple r ∈ Q m ≥0 , we have A |= Reach( , r) if and only if s 0 → * , r .

(ii) Let ψ(x) ∈ CC(x) be some clock constraint describing the set S := r ∈ Q m ≥0 | Q |= ψ(r) of clock valuations. Moreover, let ∈ Loc be some location in A. Any pair , r with r ∈ S is reachable in the transition system TS(A) if and only if the clause set N A ∪ ψ(x) ∧ Reach( , x) → false does not have a model.

In the FOL(LA) encoding described in Definition 10.5.7 the passage of time is formalized in a synchronous fashion in delay clauses. This is done by adding the constraint z ≥ 0∧ xi∈x x i = x i +z to the premise of the delay clause, where z is implicitly universally quantified (with respect to the whole clause). Since z does not occur in the rest of the delay clause, we could equivalently use the constraint

x 1 ≤ x 1 ∧ xi∈x x 1 -x i = x 1 -x i instead.
Next, we argue that the passage of time does not have to be formalized as a synchronous progression of all clocks. Instead, it is sufficient to require that clocks progress in such a way that their valuations do not drift apart excessively. Although this weakens the semantics slightly, reachability remains unaffected. Figure 10.4 illustrates the underlying idea. We first prove an Right-hand side: Asynchronous progress of time illustrated for one starting valuation. The dashed blue lines mark the boundaries within which drifting of clocks does not affect reachability. In both cases the light green area depicts the union of TA regions that is reachable from the TA region containing the starting valuations.

auxiliary result.

Lemma 10.5.9. Let µ be any positive integer and let S ∈ [0, µ + 1) m / µ be any equivalence class with respect to µ . We define the two sets T 1 , T 2 T 1 , T 2 as follows:

T 1 := q ∈ [0, µ + 1) m there is some q ∈ S such that for every i, 1 ≤ i ≤ m, we have q i ≤ q i and q 1q i = q 1q i , and

T 2 := q ∈ [0, µ + 1) m
there is some q ∈ S such that for all i 1 , i 2 , 1 ≤ i 1 , i 2 ≤ m, q i1 ≤ q i1 and for every integer k, -µ ≤ k ≤ µ, we have q i1q i2 ≤ k if and only if q i1q i2 ≤ k, and

q i1 -q i2 ≥ k if and only if q i1 -q i2 ≥ k .
Then, we observe T 1 = T 2 .

Proof. We obviously have T 1 ⊆ T 2 . In order to prove T 2 ⊆ T 1 , consider any q ∈ T 2 . q , s Pick some s ∈ S for which s i ≤ q i for every i. Such an s must exist because of S ⊆ T 2 . By construction of T 2 , we observe s is j = q iq j and s is j = q iq j for all i, j.

Claim I: For all indices i, j, 1 ≤ i, j ≤ m, we have fr(s i ) = fr(s j ) if and only if fr(q i ) = fr(q j ).

Proof: For all rational numbers r, t we have fr(r) = fr(t) if and only if rt = rt . Using this fact, we get that fr(s i ) = fr(s j ) entails q iq j = s is j = s is j = q iq j which in turn implies fr(q i ) = fr(q j ). Symmetrically, fr(q i ) = fr(q j ) entails fr(s i ) = fr(s j ). ♦

Claim II: Let k 1 , . . . , k m be some enumeration of the indices in {1, . . . , m} such that fr(s k1 ) ≤ . . . ≤ fr(s km ). There is some such that fr(q k +1 ) ≤ . . . ≤ fr(q km ) ≤ fr(q k1 ) ≤ . . . ≤ fr(q k ).

Proof: Suppose Claim II does not hold, while Claim I is satisfied. More precisely, suppose there are indices j 1 , j 2 , j 3 such that fr(s j1 ) < fr(s j2 ) < fr(s j3 ) and fr(q j3 ) < fr(q j2 ) < fr(q j1 ) (or fr(q j2 ) < fr(q j1 ) < fr(q j3 ) or fr(q j1 ) < fr(q j3 ) < fr(q j2 ) -these cases can be treated in an analogous fashion).

For all rational numbers r, t we have rt = rt + fr(r)fr(t) , where fr(r)fr(t) = 0 if fr(r) ≥ fr(t) -1 if fr(r) < fr(t).

Hence, we get the following system of equations:

s j1 -s j2 -1 = s j1 -s j2 = q j1 -q j2 = q j1 -q j2 s j1 -s j3 -1 = s j1 -s j3 = q j1 -q j3 = q j1 -q j3 s j2 -s j3 -1 = s j2 -s j3 = q j2 -q j3 = q j2 -q j3
As this system entails 0 = 1, we obtain a contradiction. ♦ It remains to prove the existence of some tuple q ∈ S that satisfies the following requirements:

(i) q = s and q = s .

(ii) q iq j = s is j = q iq j and q iq j = s is j = q iq j for all i, j.

(iii) q 1q i = q 1q i for every i.

(iv) q i ≤ q i for every i.

The existence of such a q would immediately entail q ∈ T 1 . Notice that Requirement (ii) is entailed by Requirement (iii) and the definition of T 2 . Consider any i with 1 ≤ i ≤ m. Requirement (i) entails that q must satisfy q i = s i + fr(q i ). Therefore, we set q j := s j q j for every j. This entails q j ≤ q j for every j.

(10.4) Moreover, it follows that q 1 -q i = s 1 +fr(q 1 )-s i -fr(q i ) and q 1 -q i = q 1 +fr(q 1 )-q i -fr(q i ). Hence, Condition (iii) requires s 1s i + fr(q 1 )fr(q i ) = q 1q i + fr(q 1 )fr(q i ), which is equivalent to fr(q 1 )fr(q i ) = ( q 1q i ) -( s 1s i ) + fr(q 1 )fr(q i ) .

(10.5)

We distinguish several cases:

If q ∈ S, we simply set q := q . Then, Requirements (i)-(iv) are satisfied.

If there is some j such that s j = s j , then, by Requirement (i), q j must satisfy fr(q j ) = 0 and, therefore, for every , fr(q ) is determined by (10.5). Then, Conditions (i)-(iii) are satisfied.

As we have q j = q j (10.4) ≤ q j ≤ q j , Condition (iii) entails q ≤ q for every . Hence, Condition (iv) is satisfied as well.

If fr(s 1 ) = . . . = fr(s m ), we observe q jq = s js = s js = q jq for all j, .

Hence, we have q 1q j = q 1q j , which implies fr(q 1 ) = fr(q j ) for every j. As this entails q 1q j = q 1q j = s 1s j = s 1s j , Requirements (i)-(iii) are satisfied if we set q := s. Recall that we have chosen s such that s j ≤ q j for every j. Hence, Condition (iv) is satisfied because of q = s.

If none of the above cases apply, we have s i = s i -1 for every i. Moreover, there must be indices i 1 , i 2 such that fr(s i1 ) < fr(s i2 ).

Let k 1 , . . . , k m k j be some enumeration of the indices in {1, . . . , m} such that fr(s k1 ) ≤ . . . ≤ fr(s km ) .

(10.6)

Notice that fr(s k1 ) < fr(s km ) holds due to fr(s i1 ) < fr(s i2 ). By Claim II, there is some such that fr(q k +1 ) ≤ . . . ≤ fr(q km ) ≤ fr(q k1 ) ≤ . . . ≤ fr(q k ) .

(10.7) If = 0, i.e. fr(q k1 ) ≤ . . . ≤ fr(q m ), we set fr(q) := fr(q ). Then, by Equation (10.4), Requirement (iv) is satisfied. Claim I together with fr(q k1 ) ≤ . . . ≤ fr(q m ) entails that we have fr(s 1 )fr(s j ) = fr(q 1 )fr(q j ) for every j. Consequently, s 1s j + fr(s 1 )fr(s j ) = s 1s j = q 1q j = q 1q j + fr(q 1 )fr(q j ) entails s 1s j = q 1q j for every j. This means we have q 1q j = q 1q 1 + fr(q j )fr(q j ) = s 1s j + fr(q 1 )fr(q j ) = q 1q j + fr(q 1 )fr(q j ) = q 1q j for every j. In other words, Requirements (i)-(iv) are met.

If > 0, then Claim I together with fr(s k1 ) < fr(s km ) entails that fr(q km ) is strictly smaller than fr(q k1 ). In this case, we define a rational number ε := 1 2 fr(q k1 )fr(q km ) ε . For every j ≤ we set fr(q kj ) := ε + fr(q kj )fr(q k1 ) .

fr(q kj ) For every j ≥ + 1 we set fr(q kj ) := ε + 1fr(q k1 )fr(q kj ) .

Claim III: We get 0 < fr(q k1 ) ≤ . . . ≤ fr(q k ) ≤ fr(q k +1 ) ≤ . . . ≤ fr(q km ) < 1.

Proof:

We observe the following:

• fr(q k1 ) = ε + fr(q k1 )fr(q k1 ) = ε > 0.

• fr(q km ) = ε + 1fr(q k1 )fr(q km ) = 1 2 fr(q k1 )fr(q km ) + 1fr(q k1 )fr(q km ) = 1 -1 2 fr(q k1 )fr(q km ) < 1. • Because of fr(q k ) ∈ [0, 1) and fr(q k +1 ) ∈ [0, 1), we obtain fr(q k ) ≤ fr(q k +1 ) + 1.

Hence, we get fr(q k ) = ε + fr(q k )fr(q k1 ) ≤ ε + fr(q k +1 ) + 1fr(q k1 ) = ε + 1fr(q k1 )fr(q k +1 ) = fr(q k +1 ).

The above observations entail 0 < fr(q k1 ), fr(q k ) ≤ fr(q k +1 ), and fr(q km ) < 1. By definition of the fr(q kj ) and our assumptions fr(q k1 ) ≤ . . . ≤ fr(q k ) and fr(q k +1 ) ≤ . . . ≤ fr(q km ), these observations imply Claim III. ♦

Claim IV: For every j we have s k1 + fr(q k1 )s kj + fr(q kj ) = q k1q kj .

Proof: If 1 ≤ j ≤ , then we have s k1 + fr(q k1 )s kj + fr(q kj ) = s k1 + ε + fr(q k1 )fr(q k1 )s kjεfr(q kj )fr(q k1 ) = s k1s kj + fr(q k1 )fr(q kj ) = s k1s kj + δ + fr(q k1 )fr(q kj ) = q k1q kj + δ + fr(q k1 )fr(q kj ) = q k1q kj + fr(q k1 )fr(q kj ) = q k1q kj , where δ := 0 if fr(q k1 ) = fr(q kj ) or fr(s k1 ) = fr(s kj ), and 1 if fr(q k1 ) < fr(q kj ) or fr(s k1 ) < fr(s kj )

(recall that we have fr(q k1 ) ≤ fr(q kj ) and fr(s k1 ) ≤ fr(s kj ) and that Claim I entails that fr(q k1 ) = fr(q kj ) if and only if fr(s k1 ) = fr(s kj ), hence, δ is well defined).

If + 1 ≤ j ≤ m, then we have s k1 + fr(q k1 )s kj + fr(q kj ) = s k1 + ε + fr(q k1 )fr(q k1 )s kjε -1 + fr(q k1 )fr(q kj ) = s k1s kj + fr(q k1 )fr(q kj ) -1 .

Since fr(q km ) is strictly smaller than fr(q k1 ), we get fr(q kj ) < fr(q k1 ). Moreover, Claim I together with fr(s k1 ) ≤ fr(s kj ) entails fr(s k1 ) < fr(s kj ). Hence, s k1s kj = s k1s kj -1 and q k1q kj = q k1q kj . Consequently, we get s k1s kj + fr(q k1 )fr(q kj ) -1 = s k1s kj + 1 + fr(q k1 )fr(q kj ) -1 = q k1q kj + fr(q k1 )fr(q kj ) = q k1q kj + fr(q k1 )fr(q kj ) = q k1q kj . ♦ Claim V: For every j we have s kj + fr(q kj ) ≤ q kj . Proof: As we assume q ∈ S, there is at least one i such that q ki > s ki . This entails q ki ≥ q ki > s ki + fr(q ki ). One consequence of Claim IV is that we have s ki + fr(q ki )s kj + fr(q kj ) = q kiq kj for every j. This can be rewritten into the equivalent equation q kjs kj + fr(q kj ) = q kis ki + fr(q ki ) . Combined with q ki > s ki + fr(q ki ), this entails q kj > s kj + fr(q kj ) for every j. ♦

This means, if we set q kj := s kj + fr(q kj ) q kj for every j, then Requirements (i)-(iv) are satisfied. Now we have all necessary tools at hand to show that, if we are only interested in reachability analysis for timed automata, progress of time does not need to be synchronized over all clocks. Much rather is it sufficient to formalize the requirement that time progress is never negative and that clocks must not drift apart excessively.

Lemma 10.5.10. Consider any delay clause x ) that belongs to the FOL(LA) encoding of any timed automaton A := Loc, 0 , x, inv (x) ∈Loc , T . Let µ be any positive integer. Let M (x, x ) be a finite clause set corresponding to the following formula

C(x, x , z) := z ≥ 0 ∧ xi∈x x i = x i + z ∧ inv (x ) ∧ Reach( , x) → Reach( ,
ϕ(x, x ) := xi,xj ∈x -µ≤k≤µ x i -x j ≤ k ↔ x i -x j ≤ k ∧ x i -x j ≥ k ↔ x i -x j ≥ k ∧ xi∈x x i ≥ x i ∧ inv (x ) ∧ Reach( , x) -→ Reach( , x ) .
For every µ -uniform structure A we have A |= ∀z. C(r, r , z) for all tuples r, r ∈ [0, µ + 1) m if and only if A |= M (q, q ) holds for all tuples q, q ∈ [0, µ + 1) m .

Proof. We first show that the clause C is equivalent to the clause

C (x, x ) := xi∈x x i ≤ x i ∧ xi∈x x 1 -x i = x 1 -x i ∧ inv (x ) ∧ Reach( , x) → Reach( , x ) .
Since the variable z in C occurs only in the premise, ∀z. C(x, x , z) is equivalent to

(∃z. z ≥ 0 ∧ xi∈x x i -x i = z) ∧ inv (x ) ∧ Reach( , x) → Reach( , x ) .
For the part ∃z. z ≥ 0 ∧ xi∈x x ix i = z in the latter formula we observe

∃z. z ≥ 0 ∧ xi∈x x i -x i = z |=| xi∈x x i ≤ x i ∧ xi,xj ∈x x i -x i = x j -x j |=| xi∈x x i ≤ x i ∧ xi∈x x 1 -x 1 = x i -x i |=| xi∈x x i ≤ x i ∧ xi∈x x 1 -x i = x 1 -x i .
Consequently, the formulas ∀z. C(x, x , z) and C (x, x ) are equivalent.

Let A be any µ -uniform structure.

Claim I: For every equivalence class S ⊆ [0, µ + 1) m with respect to µ we have that, if A |= Reach( , r) holds for one r ∈ S, then A |= Reach( , q) holds for every q ∈ S.

Proof: By µ -uniformity of A.

Now suppose A |= C (r, r ) holds for all tuples r, r ∈ [0, µ + 1) m . Moreover, suppose there is some pair of tuples q, q ∈ [0, µ + 1) m such that A |= ϕ(q, q ). In other words, A, [x →q, x →q ] satisfies the premise of ϕ -among them inv (x ) -but does not satisfy the consequent Reach( , x ). Let S := [q] µ S be the equivalence class with respect to µ to which q belongs. As we have

A |= xi,xj ∈x -µ≤k≤µ q i -q j ≤ k ↔ q i -q j ≤ k ∧ q i -q j ≥ k ↔ q i -q j ≥ k ∧ xi∈x q i ≥ q i ,
we conclude that q ∈ T 2 , where T 2 T 2 is defined like in Lemma 10.5.9, based on S. Moreover, we know that A |= Reach( , s) for every s ∈ S, as A is µ -uniform. The fact that A |= C (r, r ) holds for all tuples r, r ∈ [0, µ + 1) m entails A |= Reach( , s ) for every s ∈ T 1 for which Q |= inv (s ), where T 1 T 1 is defined like in Lemma 10.5.9, based on S. Hence, Lemma 10.5.9 entails A |= Reach( , s ) for every s ∈ T 2 for which Q |= inv (s ), in particular for s = q . This contradiction implies that A |= ϕ(q, q ) holds for all tuples q, q ∈ [0, µ + 1) m .

The opposite direction can be argued analogously. Consequently, we have A |= ∀z. C(r, r , z) for all tuples r, r ∈ [0, µ + 1) m if and only if A |= ϕ(q, q ) holds for all tuples q, q ∈ [0, µ + 1) m .

Consider any timed automaton

A := Loc, 0 , x, inv (x) ∈Loc , T A, κ, µ
, let κ be the smallest positive integer that is larger than the absolute value of any integer occurring in any clock constraint in A, and let µ := κ • m (recall that m = |x|). In order to decide for A which states , r are reachable, Proposition 10.5.6 entails that it is sufficient to consider a bounded subspace of Q m . More precisely, any valuation r ∈ Q m ≥0 of A's clocks can be projected to some ∼ A -equivalent valuation r ∈ [0, µ + 1) m that A cannot distinguish from r. In the subspace [0, µ + 1) m , A's TA regions coincide with (finite unions of) equivalence classes with respect to µ (cf. Definition 10.4.1). In fact, the quotient [0, µ + 1) m / µ , i.e. the partition of [0, µ + 1) m into finitely many equivalence classes induced by µ , constitutes a refinement of the division of [0, µ + 1) m into TA regions with respect to ∼ A . That is, for every set S ∈ [0, µ + 1) m / µ there is some set T ∈ [0, µ + 1) m / ∼ A such that S ⊆ T . Conversely, for every set T ∈ [0, µ + 1) m / ∼ A there is a finite collection of sets S 1 , . . . , S k ∈ [0, µ + 1) m / µ such that T = S 1 ∪ . . . ∪ S k . Since, by Proposition 10.5.6, every pair , r with r ∈ R for some TA region R ∈ Q m ≥0 / ∼ A is reachable if and only if all pairs , r with r ∈ R are reachable, any minimal model A of the FOL(LA) encoding N A is µ -uniform (where minimality of A refers to the minimality of the set Reach A with respect to set inclusion ⊆). This is why it is sufficient that Lemma 10.5.10 focuses on µ -uniform structures.

Given the FOL(LA) encoding N A of A, we obtain a BSR(BD) encoding N A of reachability with respect to A in the following two steps:

(1) Replace every delay clause in N A (x, x , z) with the clauses from the finite set M (x, x ) constructed in Lemma 10.5.10, where we use µ := κ • m.

(2) Conjoin the formula 0 ≤ y ∧ y < µ + 1 to every Λ-part of clauses in which a base-sort variable y occurs.

Since any µ+1 -uniform model of N A is µ -uniform over the subspace (-µ-1, µ+1) m , Lemma 10.5.10 entails that N A faithfully encodes reachability for A.

Theorem 10.5.11. The reachability problem for a given timed automaton can be expressed in terms of satisfiability of a finite BSR(BD) clause set.

Chapter 11

Undecidable Fragments of Linear Arithmetic with Uninterpreted Predicate Symbols

In Chapter 8 we have already discussed that adding uninterpreted predicate symbols to the language of Presburger arithmetic renders the associated satisfiability problem undecidable. Indeed, already the availability of a single uninterpreted unary predicate symbol P -recall that we have baptized this language PA+P in Chapter 9 -results in a satisfiability problem that is not even semi-decidable. The latter was observed by Halpern in 1991 [START_REF] Joseph | Presburger Arithmetic with Unary Predicates is Π 1 1 Complete[END_REF]. Halpern's proof rests on a result by Harel, Pnueli, and Stavi (Proposition 5.1 in [START_REF] Harel | Propositional dynamic logic of nonregular programs[END_REF]), which states that the set of Gödel numbers of recurring Turing machines is Σ1 1 -complete. 1 A nondeterministic Turing machine is considered to be recurring recurring Turing machine if, started on an empty input tape, it is able to perform a nonterminating computation in which it infinitely often reaches its initial state (but not necessarily its initial configuration). The encoding of recurring Turing machines that Halpern employs in his proof results in formulas with two quantifier alternations. More precisely, the used sentences start with a ∀ * ∃ * ∀ * -prefix of first-order quantifiers when written in prenex normal form. However, this pattern of quantifier alternations can be simplified to ∀ * ∃ * , as pointed out by Speranski in [START_REF] Stanislav | Collapsing probabilistic hierarchies[END_REF]. Formally, Downey's encoding of two-counter machines in [START_REF] Peter | Undecidability of Presburger Arithmetic with a Single Monadic Predicate Letter[END_REF] exhibits a ∀∃ alternation as well. However, suitable modifications lead to an encoding that does not require existential quantification at all, see Section 11.2.4.

In the present chapter we develop refined undecidability results that restrict the used language even further, e.g. by considering only the universal subfragment, or by allowing only very simple arithmetic atoms. Most of the presented results will be based on a novel encoding of the runs of two-counter machines that we shall reuse multiple times in slightly different variants. A crucial difference between Downey's encoding and ours is that the former concentrates on reachability of configurations, while the latter also considers the temporal order in which configurations are reached. One consequence is that our encoding facilitates the formalization of recurrence for nondeterministic two-counter machines. This requires some chronological information regarding the configurations that occur in a run, which goes beyond reachability.

In Section 11.1 we will give some basic definitions and first undecidability results based on fairly simple and straightforward encodings of two-counter machines. More complicated encodings under stronger syntatic restrictions will follow in the subsequent sections. In Sections 11.1 and 11.2 we shall restrict the admitted language so that only universal first-order quantifiers may be used (in prenex sentences). Yet, the associated validity and satisfiability problems remain undecidable. To be more precise, we show Σ 0 1 -completeness of the set of unsatisfiable sentences from the universal fragment of PA+P (cf. Theorems 11.2.2 and 11.3.3). As it turns out, this result is still valid when we use the rationals or reals as the underlying domain (Theorem 11.2.6). Our proof proceeds by a reduction of the (negated) halting problem for two-counter machines (cf. [START_REF] Lee | Computation: finite and infinite machines[END_REF]) to the satisfiability problem in the described language. A run of such a machine, started with a certain input, can be represented by a potentially infinite sequence of configurations , c 1 , c 2 -triples of natural numbers -, where denotes the current control state of the machine and c 1 , c 2 are the current values of the machine's counters. It is not very hard to imagine that such a sequence of configurations can be encoded by a potentially infinite sequence of bits. On the other hand, we can conceive any interpretation of a unary predicate P over the natural numbers as a bit sequence. Given this basic idea, it remains to devise a translation of the program of an arbitrary two-counter machine into a suitable sentence from the universal fragment of PA+P . Suitable in this case means that any model of the resulting sentence interprets P such that it faithfully represents a run of the given machine on the given input.

In Section 11.3 we will relax our language restrictions a bit and show that allowing one quantifier alternation entails a high degree of undecidability. More precisely, the set of satisfiable ∀ * ∃-Σ PA+P -sentences is Σ 1 1 -complete. The proof rests on a lemma that is due to Alur and Henzinger [START_REF] Alur | A Really Temporal Logic[END_REF] and that rephrases Harel et al.'s Σ 1 1 -hardness result for recurring Turing machines in terms of recurring two-counter machines. In order to apply this lemma, we will have to adapt the encoding presented in Section 11.2 only slightly. All we need to do is to add the possibility of nondeterministic branching of the control flow and to replace the check for the reachability of the halt instruction by a condition that formalizes the recurrence property. Moreover, we will observe that our undecidability and Σ 1 1 -hardness results in the integer setting can be transfered to corresponding results in the realm of rational and real numbers. We will do so at the end of Sections 11.2 and 11.3, respectively.

In Section 11.4 we shall develop an encoding of two-counter machines that only uses difference constraints and where the interpretation of the occurring uninterpreted predicate symbols can be restricted to finite subsets of the rational interval [0, 1]. In the presence of a ∃∀ quantifier alternation, the associated satisfiability problem is undecidable. This nicely contrasts our findings from Section 10.4, where we have shown that satisfiability of finite BSR(BD) clause sets is decidable.

Finally, we will discuss the relevance of our findings to the field of verification in Section 11.5. In particular, we will derive undecidability results for quantified fragments of separation logic (Section 11.5.1), the theory of arrays (Section 11.5.2), and combinations of the theory of equality over uninterpreted functions with restricted forms of integer arithmetic (Sections 11.5.3 and 11.5.4). In certain cases, our results even imply the absence of sound and complete deductive calculi.

It should be stressed once again that most of the results outlined above are obtained based on refinements of the encoding of two-counter machines presented in Section 11.2. To the author's knowledge, a similarly general applicability is not documented for any other encoding of undecidable problems in the language of Presburger arithmetic augmented with uninterpreted predicate symbols.

Minsky's Two-Counter Machines, the Universal fragment of Presburger Arithmetic, and Simple Encodings

In Chapter 9 we have defined the language of Presburger arithmetic to comprise all first-order formulas with equality over the vocabulary Σ PA = {<, ≤, =, =}, {0, 1, +, -} , where the only sort is Z. The universal fragment of Presburger arithmetic universal Presburger arithmetic confines the language of Presburger arithmetic to sentences in prenex normal form in which only universal quantification is allowed and existential quantification may not occur. Analogously, we say that the universal fragment of PA+P universal fragment of PA+P is the set of all prenex Σ PA+P -sentences without existential quantifiers, where Σ PA+P is the vocabulary {<, ≤, =, =, P }, {0, 1, +, -} with the uninterpreted unary predicate symbol P of sort Z, as we have defined it in Chapter 9.

Minsky has introduced the two-counter machine as a Turing-complete model of computation (Theorem 14.1-1 in [START_REF] Lee | Computation: finite and infinite machines[END_REF]). We shall only briefly recap the basic architecture of this kind of computing device. We tacitly assume that the last program line, i.e. line K, of any two-counter machine contains the halt instruction and that there is no other line containing halt. This assumption is not a restriction, as the goto instruction is available. In the initial state of a given two-counter machine the input is stored in the two counters. The computation of the machine starts at the first program line, labeled 0. We occasionally refer to the initial and last program line as init init , halt and halt , respectively.

A run of a two-counter machine M is a possibly infinite sequence of triples , c 1 , c 2 , also called configurations, with three nonnegative integer values each, where denotes the current program line -to be executed in the next step -and c 1 , c 2 denote the current values of the two counters C 1 , C 2 , respectively. The first triple in a run has the form 0, m, n , where m, n constitutes the input. Given two successive triples , c 1 , c 2 and , c 1 , c 2 in a run, the latter is the result of applying program line to the configuration , c 1 , c 2 . For instance, the successor of , c 1 , c 2 is + 1, c 1 , c 2 + 1 if the -th program line of M is inc(C 2 ). Only finite runs contain a triple K, c 1 , c 2 where K is the program line containing the halt instruction, and then K, c 1 , c 2 is the very last triple in the sequence.

Notice that the described machine model describes deterministic computation processes. Since the machine model is strong enough to simulate any deterministic Turing machine, the halting problem for two-counter machines is undecidable.

Proposition 11.1.2 (Corollary of Theorem 14.1-1 from [START_REF] Lee | Computation: finite and infinite machines[END_REF]). It is impossible to devise an algorithm that is able to decide for every two-counter machine M and every input m, n ∈ N × N whether M ever reaches a program line containing the halt instruction when started on m, n .

It turns out that two-counter machines can be encoded easily even when only a very restricted syntax is allowed for arithmetic atoms. In what follows we shall take a look at several simple encodings where uninterpreted predicate symbols of arity greater than one are used and the arithmetic atoms are restricted to one of four categories: (1) difference constraints xy c, (2) additive constraints x + y c, (3) quotient constraints x c • y (which could equivalently be written x y c, hence the name), and (4) multiplicative constraints2 In case of quotient and multiplicative constraints one could also use the rational or integer domain and formulate an encoding in such a way that imposing lower and upper bounds on the used variables does not result in a decidable fragment -which would be the case if we were using variables over the integers. We shall devise such an encoding below and, based on a fragment only containing difference constraints, in Section 11.4.

We start with difference constraints. We use the predicate symbol M : Z × Z × Z × Z to address the state of the two-counter machine as follows: M (u, x, y, z) stands for a machine at instruction u with counter values c 1 = xz -1 and c 2 = yz -1, where the last argument z keeps track of an offset relative to which x and y store the values of the counters. Following this principle, the increment instruction for the first counter C 1 is realized by adding 1 to the x-component of M (u, x, y, z) and leaving the offset z untouched. Decrementing the first counter then amounts to adding 1 to the y-and z-component of M (u, x, y, z), i.e. relative to the offset stored in the z-component the value of the x-component is reduced by one, while the value in the y-component keeps its distance to the offset in z. Moreover, we use the relative distance of 1 between a counter and the offset to encode zero. Hence, the initial state is set to M ( init , 1, 1, 0), i.e. the offset (last argument) starts at 0, while the second and third components start at 1, which is intended to represent the counter values zero. In this way, we make sure that it is sufficient to use only the constant 1 in all the difference constraints. The offset is an appropriate tool that allows us to have a uniform syntactic structure for all atomic constraints. It is due to the offset encoding that we can easily use a difference constraint when checking whether a counter is zero or not.

In Table 11.1 we give prototypical encodings of the instructions of two-counter machines. The encoding is only given for counter C 1 ; the encoding for counter C 2 can be done analogously. The symbols , , init , halt are placeholders for concrete nonnegative integers that are used as labels for program statements. Whenever we write + 1, we mean the natural number that is the result of incrementing and not the formal term " + 1". The symbols m, n stand for concrete integers that constitute the input.

Operation

Encoding

: inc(C 1 ) ∀xyzx . x -x = 1 ∧ M ( , x, y, z) → M ( + 1, x , y, z) : test&dec(C 1 , ) ∀xyzx y z . x -z > 1 ∧ y -y = 1 ∧ z -z = 1 ∧ M ( , x, y, z) → M ( + 1, x, y , z ) ∧ ∀xyz. x -z = 1 ∧ M ( , x, y, z) → M ( , x, y, z)
: goto( ) ∀xyz. M ( , x, y, z) → M ( , x, y, z)

halt : halt ∀xyz. M ( halt , x, y, z) → M ( halt , 0, 0, 0)

Initial condition: M ( init , m, n, 0) Halting condition: M ( halt , 0, 0, 0) Table 11.1: Encoding of the basic two-counter-machine instructions using difference constraints.

Lemma 11.1.3. Suppose we are given a sentence ϕ M encoding the behavior of a two-counter machine M as described above, then the sentence M ( init , m, n, 0) ∧ ϕ M ∧ ¬M ( halt , 0, 0, 0) is unsatisfiable if and only if M halts when started on any given input m, n .

Notice that the sentence in Lemma 11.1.3 could also be transformed into a Horn sentence. Hence, by Proposition 11.1.2, it follows that satisfiability for Presburger arithmetic sentences restricted to difference constraints (requiring only the constant 1 besides the input) plus a single 4-ary uninterpreted predicate symbol is undecidable.

Encoding two-counter machines using quotient constraints works very similarly. We only need to change the representation of counter values in a state M ( , x, y, z) as follows:

c 1 = log 2 ( x 2z ) = log 2 (x) -log 2 (z) -1 and c 2 = log 2 ( y 2z ) = log 2 (y) -log 2 (z) -1.
Incrementing the first counter is encoded by the sentence ∀xyzx . x = 2 • x ∧ M ( , x, y, z) → M ( + 1, x , y, z), and the conditional decrement instruction for the first counter is encoded by

∀xyzy z . x > 2 • z ∧ y = 2 • y ∧ z = 2 • z ∧ M ( , x, y, z) → M ( + 1, x, y , z ) ∧ ∀xyz. x = 2 • z ∧ M ( , x, y, z) → M ( , x, y, z) .
Analogous to the case of difference constraints, we thus infer undecidability of the satisfiability problem for Presburger arithmetic restricted to quotient constraints (requiring only the constant 2) and a single uninterpreted 4-ary predicate symbol. In this encoding incrementing a counter amounts to multiplying the corresponding component of M by two.

If we leave the realm of the integers and go to the rational numbers or the reals, we could represent an increment operation with division by two. This means that we actually do not have to leave the unit interval and still represent arbitrarily large counter values. More technically, the current value of counter C 1 would be c

1 = -log 2 ( 2x z ) = -log 2 (x) + log 2 (z) -1. Then, incrementing C 1 is encoded by the sentence ∀xyzx . 2 • x = x ∧ M ( , x, y, z) → M ( + 1, x , y, z), and test&dec(C 1 , ) is encoded by ∀xyzy z . 2 • x < z ∧ 2 • y = y ∧ 2 • z = z ∧ M ( , x, y, z) → M ( + 1, x, y , z ) ∧ ∀xyz. 2 • x = z ∧ M ( , x, y, z) → M ( , x, y, z) .
In this encoding, we can limit the range of the last three components of M to the rational or real unit interval [0, 1), i.e. they are bounded from below and above. Nevertheless, the associated satisfiability problem is undecidable.

Having additive constraints of the form x + y c at hand, we can simulate subtraction by defining the additive inverse using an atom x + x -= 0. To keep track of inverses, we adjust the arity of M accordingly and add the side condition

∀xx -yy -zz -. M ( , x, x -, y, y -, z, z -) → x + x -= 0 ∧ y + y -= 0 ∧ z + z -= 0 .
Counter values are represented in the same way as we have done for difference constraints. The increment instruction for the first counter is thus encoded by the sentence

∀xx -yy -zz -x x -. x + x -= 1 ∧ x + x -= 0 ∧ M ( , x, x -, y, y -, z, z -) → M ( + 1, x , x -, y, y -, z, z -) .
It is now straightforward to come up with the encoding of the conditional decrement. Hence, satisfiability for Presburger arithmetic restricted to additive constraints and a single free predicate symbol of arity 7 is undecidable. However, this time we need two constants, namely 1 and 0.

In order to complete the picture, we leave the realm of linear arithmetic for a little while and consider multiplicative constraints of the form x • y c. These relate to quotient constraints like additive constraints relate to difference constraints. Hence, combining the previously used ideas of offsets and inverses, we can encode two-counter machines also with multiplicative constraints:

∀xx -1 yy -1 zz -1 x x -1 . x • x -1 = 2 ∧ x • x -1 = 1 ∧ M ( , x, x -1 , y, y -1 , z, z -1 ) → M ( + 1, x , x -1 , y, y -1 , z, z -1 )
encodes the increment instruction on the first counter, for instance, using the rationals or reals as domain. As in the case of quotient constraints, we could restrict the range of variables to (0, 1]. Consequently, this yields another fragment of Rational arithmetic with uninterpreted predicate symbols for which the satisfiability problem is undecidable.

Theorem 11.1.4. The satisfiability problem associated with Presburger arithmetic plus uninterpreted predicate symbols is undecidable, even if we restrict arithmetic atoms to difference constraints, additive constraints, or quotient constraints. Over the domain of rational or real numbers, we have the same undecidability results for the same fragments, plus the fragment with multiplicative constraints (which is nonlinear). In addition, in the case of quotient and multiplicative constraints, the result still holds if we restrict the domain to the rational or real unit interval.

Encoding Two-Counter Machine Computations Using a Single Unary Predicate

It turns out that it is sufficient to add a single uninterpreted unary predicate symbol P to the vocabulary of Presburger arithmetic to facilitate encodings of two-counter machines, their computations, and the associated halting problem. As soon as we have constructed a Σ PA+Psentence ϕ that encodes the behavior of a given machine M together on a given input pair m, n , we are interested in the (un)satisfiability of ϕ. Hence, we pose the question: Is there a Σ PA+P -structure A (extending the integers with addition, subtraction, and order relations) with P A ⊆ Z such that A |= ϕ, or is there no such structure? For the sake of simplicity, we shall restrict the domain we consider to N = Z ≥0 most of the time, if not explicitly stated otherwise. We shall first give an informal description in the next section, and then we will get more formal in Section 11.2.2. Sections 11.2.3 and 11.2.4 are devoted to encoding variants that use a minimal number of quantifiers. In Section 11.2.5, we shall transfer our undecidability result to the rational domain, and in Section 11.2.6 we will discuss the case where P is replaced with an uninterpreted function symbol.

Informal Description of the Encoding

Since any interpretation P A of the predicate symbol P is a subset of the natural numbers, we can conceive P A as an infinite sequence of bits b 0 b 1 b 2 . . ., where for every n ∈ N we have

b n := 0 if n ∈ P A , 1 if n ∈ P A .
Given a two-counter machine M with K + 1 program lines, labeled 0, . . . , K, and two input values m, n, we shall represent in P A all the configurations that occur during the run of M when started on input m, n . One such configuration consists of the label of the program line that is to be executed in the next step, the current value c 1 of the first counter C 1 , and the current value c 2 of the second counter C 2 . We divide the bit sequence P A into chunks of growing length, each delimited by the bit sequence 001011. Such a chunk is divided into three subchunks, using the bit sequence 0011 as a delimiter. where is the label of the program line to be executed next, c 1 is the value currently stored in counter C 1 , and c 2 is the value currently stored in counter C 2 . The subsequences 1 , 1 c1 and 1 c2 are followed by blocks of zeros that fill up the gap before the next 0011 delimiter (indicating the start of the subsequent subchunk) or the next 001011 delimiter (indicating the beginning of the successor configuration).

We devise the encoding in such a way that the length of each chunk and its subchunks increases with the number of computation steps that have already been performed. This makes sure that there is always enough space available to store the current counter values, which may thus become arbitrarily large. Of course, we have to provide sufficient space in the beginning such that the label of any program line and the initial counter values m and n may be stored. In order to achieve this, we define the constant d := max{K, m, n} + 6 and require that the leftmost chunk starts at position d, i.e. there is a 001011 delimiter starting at position d but none starting left of d. 3The first three subchunks have length d each. Thus, the second chunk starts at position 4d. The subchunks of the second chunk, however, shall have a length of 4d each. 4 Hence, the total length of the second chunk is 12d. This scheme shall continue indefinitely, i.e. the starting points of the chunks in the bit sequence are d, 4d, 16d, 64d, 256d, and so on. Consequently, all the chunks are large enough to store all possibly occurring counter values, as these can increase by at most one in every step of the computation. Figure 11 First of all, we set up the general structure of the predicate P . Let d denote the integer with the value d := max{K + 6, m + 4, n + 4}. We use d as the starting point of our encoding.

ϕ 1 ϕ 1 := ψ 001011 (d) (11.1) ∧ ∀x. x < d -→ ¬P (x) (11.2) ∧ ∀x. ψ 001011 (x) -→ ψ 0011 (2x) ∧ ψ 0011 (3x) ∧ ψ 001011 (4x) (11.3) ∧ ∀xy. ψ 001011 (x) ∧ ψ 001011 (y) ∧ x ≤ y ∧ y < 4x -→ x = y (11.4) ∧ ∀xy. ψ 001011 (x) ∧ ψ 0011 (y) ∧ x ≤ y -→ y ≥ 2x (11.5) ∧ ∀xy. ψ 001011 (x) ∧ ψ 0011 (y) ∧ 2x < y -→ y ≥ 3x (11.6) ∧ ∀xy. ψ 001011 (x) ∧ ψ 0011 (y) ∧ 3x < y -→ y ≥ 4x (11.7)
∧ ∀xy. ψ 001011 (x) ∧ ψ 01 (y) ∧ x + 5 < y ∧ y < 4x -→ ψ 0011 (y -1) (11.8) Subformula (11.1) sets the first 001011 delimiter at position d and Subformula (11.2) ensures that this is indeed the leftmost such delimiter. Subormula (11.3) sets up all the other delimiters and Subformulas (11.4) to (11.7) guarantee that there are no spurious delimiters in between them. Subformula (11.8) stipulates that every 01 subsequence is part of one of the delimiters, i.e. there cannot be a subsequence 01 that lies outside of a 001011 or 0011 delimiter. This does also entail that between one delimiter (001011 or 0011) and the subsequent one there is exactly one subsequence 10, possibly overlapping with the last or first bit of one of the delimiters. Hence, this subsequence uniquely marks the end of the number encoded in the respective subchunk.

The following formula sets the initial values of the counters. Moreover, it sets the initial program line, which we assume to be zero:

ϕ m,n 2 ϕ m,n 2 := χ 0 (d) ∧ ψ 10 (2d + 3 + m) ∧ ψ 10 (3d + 3 + n) .
Regarding the encoding of program lines, we have to enforce that the current program line never exceeds K. This is easily done with the formula

ϕ K 3 ϕ K 3 := ∀xy. ψ 001011 (x) ∧ ψ 10 (y) ∧ x + 5 ≤ y ∧ y ≤ 2x -→ y ≤ x + 5 + K .
The previous formulas already ensure that exactly one label of a program line is encoded in every chunk.

Next we encode the control flow of M. We assume that the following instructions occur in program line for some ∈ {0, . . . , K}.

Encoding of the instruction : inc(C 1 ):

∀xyz. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (6x + y + 1) ∧ ψ 10 (9x + z) ∧ χ +1 (4x)
The subfomula ψ 001011 (x) in the premise of the implication states that the chunk encoding the currently regarded configuration starts at position x. The other preconditions make clear that y and z correspond to the positions at which we find 10 subsequences in the two subchunks storing the current counter values: Since the subsequent chunk starts at position 4x and its second and third subchunks start at positions 8x and 12x, respectively, we know that there must be one 10 subsequence at position 8x + 3 + c 1 + 1 = 6x + y + 1 -the first counter is incremented by 1 -and one 10 subsequence must be at position 12x + 3 + c 2 = 9x + z -the value of the second counter remains unchanged. Moreover, the machine currently executes program line and is to continue at program line + 1. Therefore, we put the formula χ (x) in the premise and the formula χ +1 (4x) into the consequent of the implication.

x 2x y 3x z ↓ ↓ ↓ ↓ ↓ 001011
Encoding of the instruction : inc(C 2 ):

∀xyz. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (6x + y) ∧ ψ 10 (9x + z + 1) ∧ χ +1 (4x) .
Encoding of the instruction : test&dec(C 1 , ):

The case of C 1 storing 0:

∀xyz. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) ∧ y = 2x + 3 -→ ψ 10 (6x + y) ∧ ψ 10 (9x + z) ∧ χ (4x) .
The condition y = 2x + 3 ensures that the first counter stores the value 0.

4 i d + 1, 4 i d + 3, 2 • 4 i d + 1, 3 • 4 i d + 1 .
(d) Suppose there are integers i, r, q ∈ N such that 4 i d + 5 ≤ r, q < 2 • 4 i d. If we have A |= ψ 10 (r) and A |= ψ 10 (q), then it follows that r = q.

(e) Suppose there are integers i, r, q ∈ N such that 2•4 i d+3 ≤ r, q < 3•4 i d. If we have A |= ψ 10 (r) and A |= ψ 10 (q), then it follows that r = q.

(f) Suppose there are integers i, r, q ∈ N such that 3•4 i d+3 ≤ r, q < 4 i+1 d. If we have A |= ψ 10 (r) and A |= ψ 10 (q), then it follows that r = q.

(g) For every integer i ∈ N there are integers r 1 , r 2 , r 3 ∈ N such that

• 4 i d + 5 ≤ r 1 < 2 • 4 i d and A |= ψ 10 (r 1 ), • 2 • 4 i d + 3 ≤ r 2 < 3 • 4 i d and A |= ψ 10 (r 2 ), and
• 3 • 4 i d + 3 ≤ r 3 < 4 i+1 d and A |= ψ 10 (r 3 ).
Due to the above observations, it is clear that any model A of ϕ 1 interprets P in such a way that it uniquely represents an infinite sequence of triples of nonnegative integers encoded in unary, just as we have described it earlier (cf. Figure 11.1). If, in addition, A satisfies ϕ m,n 2 and ϕ K 3 , then the first triple of the sequence has the form 0, m, n and the first component of every triple in the sequence does not exceed K. Then, for any model A |= ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M the interpretation P A of P does not only represent a sequence of triples of integers but also establishes relations between the triples in the sequence, such that they mimic M's behavior. The only technical difference is that whenever M enters a configuration , c 1 , c 2 such that program line contains halt, then all later configurations have the form K, c 1 , c 2 . All in all, P A is a faithful encoding of some run of M starting from the input m, n .

On the other hand, since M is deterministic, there is a unique sequence

τ := init , m, n 1 , c 1,1 , c 2,1 2 , c 1,2 , c 2,2 3 , c 1,3 , c 2,3 . . .
of configurations that represents the run of M started on input m, n . If τ is finite and thus contains a halting configuration , c 1 , c 2 as its last triple, we concatenate the infinite sequence K, c 1 , c 2 K, c 1 , c 2 . . . and thus obtain an infinite sequence again. This infinite sequence (be it originally infinite or made so artificially) can be translated into a structure A τ such that

A τ |= ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M . So far, we have seen that ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K
3 ∧ ϕ M is satisfiable and that every model represents the unique run τ of M started on input m, n . Then, we observe for any model

A |= ϕ 1 ∧ϕ m,n 2 ∧ϕ K 3 ∧ϕ M that A |= ϕ K 4 holds if and only if τ does not contain a triple K, c 1 , c 2 for any c 1 , c 2 ∈ N. Hence, ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M ∧ ϕ K
4 is unsatisfiable if and only if M reaches the halt instruction when started on the input m, n .

Together with the fact that the halting problem for two-counter machines is undecidable (cf. Proposition 11.1.2), we get the following theorem.

Theorem 11.2.2. (Un)satisfiability of the universal fragment of PA+P is undecidable.

Reducing the Number of Variables to Two

We can formulate the encoding with at most two variables per subformula. All we have to do are little modifications of the encodings of the two-counter machine instructions.

Modified encoding of the instruction : inc(C 1 ):

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) -→ ψ 10 (6x + y + 1) ∧ χ +1 (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (9x + z)
For this instruction and most of the others we split the encoding formula into two parts: the first formula realizes the y-part of the original encoding and the second formula realizes the z-part.

Modified encoding of the instruction : inc(C 2 ):

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) -→ ψ 10 (6x + y) ∧ χ +1 (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (9x + z + 1)
Modified encoding of the instruction : test&dec(C 1 , ):

The case of C 1 storing 0:

∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) ∧ ψ 10 (2x + 3) -→ ψ 10 (8x + 3) ∧ ψ 10 (9x + z) ∧ χ (4x)
The subformula ψ 10 (2x + 3) in the premise ensures that the counter C 1 currently stores a 0 and the subformula ψ 10 (8x + 3) requires that C 1 still stores 0 in the next step. Notice that we do not need a variable y to address the corresponding bit positions, since we can directly compute these positions from x.

The case of C 1 storing a value greater than 0:

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) ∧ y > 2x + 3 -→ ψ 10 (6x + y -1) ∧ χ +1 (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) ∧ ¬ψ 10 (2x + 3) -→ ψ 10 (9x + z)
In the first sentence y > 2x + 3 ensures that the value of C 1 is greater than zero. In the second sentence C 1 's exact value is not important and thus ¬ψ 10 (2x + 3) is sufficient for ensuring that C 1 's value is strictly positive.

Modified encoding of the instruction : test&dec(C 2 , ):

The case of C 2 storing 0:

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) ∧ ψ 10 (3x + 3) -→ ψ 10 (6x + y) ∧ ψ 10 (12x + 3) ∧ χ (4x)
The case of C 2 storing a value greater than 0:

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) ∧ ¬ψ 10 (3x + 3) -→ ψ 10 (6x + y) ∧ χ +1 (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) ∧ z > 3x + 3 -→ ψ 10 (9x + z -1)
Modified encoding of the instruction : goto( ):

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) -→ ψ 10 (6x + y) ∧ χ (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (9x + z)
Modified encoding of the instruction : halt:

∀xy. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ χ (x) -→ ψ 10 (6x + y) ∧ χ K (4x) ∀xz. ψ 001011 (x) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (9x + z)
Theorem 11.2.3. (Un)satisfiability of the universal fragment of PA+P is undecidable, if we allow at least two quantifiers.

Undecidability with One Variable Only Using Another Encoding

It is not obvious how to refine the encoding from the previous section in such a way that a single variable would suffice. However, the result of Theorem 11.2.3 can be improved, if we use a different approach. The following is an adaptation of Downey's encoding [START_REF] Peter | Undecidability of Presburger Arithmetic with a Single Monadic Predicate Letter[END_REF]. It results in a sentence that could easily be transformed into one containing only a single quantifier. Let p 1 , . . . , p K+4 be the K + 4 smallest prime numbers. In the following sentences, we shall address them by q t , q C1 , q C2 , q 0 , q 1 , . . . , q K and use them as prime factors. A configuration of the encoded two-counter machine is described by a single natural number with the prime factorization (q t ) t • q • (q C1 ) c1 • (q C2 ) c2 , where t denotes the current time stamp, is the current program line, which is to be executed next, and c 1 , c 2 are the current values of the two counters C 1 , C 2 , respectively. The sentences entail that P contains every reachable configuration. Initial condition: P q t • q init • q m C1 • q n C2 . The sentence stipulates that the initial configuration 1, init , n, m can be reached.

Encoding of the instruction : inc(C 1 ): ∀x. P (q • x) → P (q t • q +1 • q C1 • x).

If the machine can reach any configuration t, , c 1 , c 2 , then the machine can also reach the configuration t + 1, + 1, c 1 + 1, c 2 .

Encoding of the instruction : inc(C 2 ): ∀x. P (q • x) → P (q t • q +1 • q C2 • x).

Encoding of the instruction : test&dec(C 1 , ):

∀x. q C 1 -1 i=1 P q • (q C1 • x + i) → P q t • q • (q C1 • x + i) ∧ ∀x. P (q • q C1 • x) → P (q t • q +1 • x) .
The first part of the sentence stipulates that, if the machine can reach any configuration t, , 0, c 2 where the counter C 1 is zero, then it can also reach t + 1, , 0, c 2 . Notice that any natural number q C1 • x + i with 1 ≤ i ≤ q C1 -1 is not divisible by q C1 . Conversely, for every natural number y > 0 that is not divisible by q C1 there are natural numbers x ≥ 0 and i ≥ 1 such that y = q C1 • x + i and 1 ≤ i ≤ q C1 -1. The second part says that, if the machine can reach any configuration t, , c 1 , c 2 with c 1 > 0, then it can also reach the configuration

t + 1, + 1, c 1 -1, c 2 .
Encoding of the instruction : test&dec(C 2 , ):

∀x.

q C 2 -1 i=1 P q • (q C2 • x + i) → P q t • q • (q C2 • x + i) ∧ ∀x. P (q • q C2 • x) → P (q t • q +1 • x) .
Encoding of the instruction : goto( ): ∀x. P (q • x) → P (q t • q • x).

If the machine can reach any configuration t, , c 1 , c 2 , then it can also reach t + 1, , c 1 , c 2 .

Encoding of the instruction : halt: ∀x. P (q • x) → P (q t • q • x).

If the machine can reach any configuration t, , c 1 , c 2 , then the machine will loop forever while staying at program line , which contains the instruction halt.

For any two-counter machine M with a program containing K + 1 ≥ 2 lines the computation of M on the input m, n can be formalized using the above encoding. Then, for any model A of the encoding, we have A |= P q t t • q • q c1 C1 • q c2 C2 if and only if M reaches the configuration t, , c 1 , c 2 at the t-th step of its run. Let ϕ M,m,n be the sentence resulting from the encoding. Then, we observe that the sentence ϕ M,m,n ∧ ∀x. ¬P (q halt • x) is satisfiable if and only if M does not halt when started on the input m, n. Notice that this sentence can be converted into an equivalent PA+P sentence in conjunctive normal form that is Horn and Krom and contains exactly one universal quantifier.

Theorem 11.2.4. (Un)satisfiability of the universal fragment of PA+P is undecidable, even if we restrict the language to sentences that are Horn and Krom and contain only a single first-order variable.

We have not yet explained why we have introduced the time stamps to the configurations. This allows keeping track of the sequence of configurations. In the context of the halting problem, this is not utterly important, as one is merely concerned with the reachability of the program line containing halt. However, in the context of the recurrence problem, this ability is crucial. The sentence ϕ M,0,0 ∧ ∀x∃y. x < y ∧ P (q init • y) is satisfiable if and only if M's run is recurring when started on the input m = 0, n = 0, i.e. if it reaches the program line init infinitely often.

Proposition 11.2.5. The recurrence problem for deterministic two-counter machines can be expressed in the Horn-Krom fragment of PA+P using a single ∀∃ quantifier alternation and at most two variables per clause.

The recurrence problem will be of importance in Section 11.3, where we shall use it to show that the satisfiability problem for PA+P with a single quantifier alternation is Σ 1 1 -hard.

Using the Rationals or Reals as Underlying Domain

Presburger arithmetic is defined on the integers and we have shown that adding a single uninterpreted unary predicate symbol yields an undecidable satisfiability problem. We can directly use the encoding that we have presented for the integers in order to show undecidability over the rational and real domains. The crucial point is that we have encoded the reachability of the halt instruction in a negative fashion. If the machine M reaches a halt instruction, then we cannot find a model of the encoding sentence

ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M ∧ ϕ K 4
, since any structure that faithfully represents the run of M on the given input must violate the condition ¬χ K (j) for some integer j for which ψ 001011 (j) is true. We have used this observation to prove Lemma 11.2.1. The described conflict does not vanish when we assume a larger domain. If, on the other hand, the machine M does not reach a halt instruction, then there is a model of ϕ

1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M ∧ ϕ K 4 .
In particular, there is a model in which P is interpreted such that it exclusively contains integers and no reals at all. Hence, the fact that we are dealing with an extended domain does not affect the circumstances under which the encoding sentence is unsatisfiable or not. Consequently, we have the following undecidability result. Theorem 11.2.6. (Un)satisfiability of the universal fragment of linear arithmetic over the rationals or reals with a single uninterpreted unary predicate symbol is undecidable.

Unary Function Symbols and the Horn Fragment

The uninterpreted unary predicate symbol P in our encoding of two-counter machines can be replaced with an uninterpreted unary function symbol f : N → N over the natural numbers. We simply add the assertion ∀x. f (x) ≤ 1 and substitute every negative literal ¬P (t) with f (t) = 0 and every positive literal P (t) with f (t) = 1, where t is any term. (Implicitly, we exploit the fact that f is interpreted by a total function f A in any structure A.) After this substitution, transforming the encoding formula set from Section 11.2.2 into conjunctive normal form (CNF) yields a sentence that can easily be transformed into a Horn sentence, i.e. every clause contains at most one positive literal. The reason is that we can use negation very liberally: ¬P (t) corresponds to f (t) = 0 and, at the same time, to ¬f (t) = 1; P (t) corresponds to f (t) = 1 and, at the same time, to ¬f (t) = 0. By this line of argument we obtain the following theorem.

Theorem 11.2.7. (Un)satisfiability of the universal Horn fragment of Presburger arithmetic with a single uninterpreted unary function symbol is undecidable.

Over the domain of the reals, we can replace the predicate symbol P in the same spirit, yet in a slightly different way. For one thing, we add the assertion ∀x. 0 ≤ f (x) ∧ f (x) ≤ 1 to the encoding, which also introduces an explicit lower bound to the values of f . As this assertion alone does not guarantee that in any model the image of f : R → R contains at most two values, we replace any occurrence of ¬P (t) with f (t) = 0 and any occurrence of P (t) with f (t) > 0. Again, a CNF transformation yields a sentence that can be transformed into a Horn sentence.

Theorem 11.2.8. (Un)satisfiability of the universal Horn fragment of linear arithmetic over the rationals or reals with a single additional uninterpreted unary function symbol is undecidable.

Degrees of Unsolvability

We have shown that the unsatisfiability problem of the universal fragment of PA+P is undecidable. Next, we shall argue that the set of unsatisfiable sentences from this fragment is recursively enumerable. In order to prove this, it suffices to give a sound calculus that, given an unsatisfiable sentence over the language in question, derives false or the empty clause in finitely many steps. This property is known as refutational completeness refutational completeness . In fact, such a calculus would constitute a semi-decision procedure for unsatisfiable sentences.

Indeed, hierarchic superposition [BGW94, BW13b, BW13a] (cf. Section 10.3) is such a refutationally complete calculus for all unsatisfiable hierarchic clause sets that are sufficiently complete, if the considered background theory is compact (cf. Theorem 24 in [START_REF] Bachmair | Refutational Theorem Proving for Hierarchic First-Order Theories[END_REF]). The universal fragment of Presburger arithmetic with uninterpreted predicate symbols can be treated in this framework: We consider finite clause sets over the vocabulary Σ PA enriched with arbitrary uninterpreted predicate symbols. All occurring first-order variables are implicitly universally quantified and we do not consider any uninterpreted constant or function symbols. Presburger arithmetic is conceived as the background theory and, hence, determines the interpretation of all symbols from Σ PA . In this setting, the two requirements -sufficient completeness and compactness of the background theory -are satisfied. Sufficient completeness (cf. Definition 20 in [START_REF] Bachmair | Refutational Theorem Proving for Hierarchic First-Order Theories[END_REF]) concerns uninterpreted constant and function symbols that range over the background sort. Since we do not allow such symbols in our language, all sentences are sufficiently complete. For the same reason, the background theory is compact. This means, every set of first-order sentences over Σ PA that is not satisfied under Z has some finite (even a singleton) subset that is not satisfied under Z. Hence, the following proposition holds.

Proposition 11.3.1. The set of unsatisfiable sentences over the universal fragment of Presburger arithmetic with additional uninterpreted predicate symbols is recursively enumerable.

From the literature on the arithmetical hierarchy (see, e.g. [Rog87, Soa87, Odi92, Soa16]) we get the following. 5One ∀∃ Quantifier Alternation Yields Σ 1 1 -Completeness Halpern has shown that the satisfiability problem for Presburger arithmetic with any choice of additional uninterpreted function symbols and predicate symbols lies in Σ 1 1 in the analytical hierarchy6 (Theorem 3.1 in [START_REF] Joseph | Presburger Arithmetic with Unary Predicates is Π 1 1 Complete[END_REF]). This result is independent of the number of occurring quantifier alternations. In the present section, we show that already a single quantifier alternation suffices to make the problem complete for Σ 1 1 . We leverage the following result, due to Alur and Henzinger.

Proposition 11.3.5 (Lemma 8 in [START_REF] Alur | A Really Temporal Logic[END_REF]). The problem of deciding whether a given nondeterministic two-counter machine has a recurring computation is Σ 1 1 -hard.

A nondeterministic two-counter machine differs from the deterministic model described in Section 11.1 in that it allows nondeterministic branching after a program line has been executed. This means that after the execution of a program line (which does not result in a jump induced by a test&dec instruction) the machine does not necessarily proceed to the ( + 1)-st line, but may have the choice between two specified options.

This kind of nondeterminism can easily be incorporated into the encoding presented in Section 11.2.2. For instance, the nondeterministic version of the instruction : inc(C 1 ) can be represented by the formula

∀xyz. ψ 001011 (x) ∧ 2x ≤ y ∧ y ≤ 3x ∧ ψ 10 (y) ∧ 3x ≤ z ∧ z ≤ 4x ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (6x + y + 1) ∧ ψ 10 (9x + z) ∧ χ (4x) ∨ χ (4x) .
The last conjunct χ (4x) ∨ χ (4x) now offers a choice between program lines and as the ones that are to be executed next.

Consequently, we can reuse major parts of our encoding in order to prove Σ 1 1 -hardness. For any nondeterministic two-counter machine M we write ϕ M to address the encoding of M's program in accordance with Section 11.2.2 and the just described adaptations due to the nondeterministic setting.

A run of a nondeterministic two-counter machine is considered to be recurring if and only if it starts with both counters set to zero and reaches the initial program line (with label 0) infinitely often. This means, we have to remove ϕ 4 from the encoding set of sentences and replace it with a proper formalization of the recurrence condition:

ϕ 5 := ∀x∃y. x ≤ y ∧ ψ 001011 (y) ∧ χ 0 (y) .
This sentence formulates recurrence in a positive fashion by saying that at any point in time program line 0 will be reached eventually. Finally, in order to account for the specific input requirements posed in the definition of recurrence, we construct ϕ 0,0 2 rather than ϕ m,n 2 , i.e. we set m = n = 0. Lemma 11.3.6. The nondeterministic two-counter machine M has a recurring run if and only if

ϕ 1 ∧ ϕ 0,0 2 ∧ ϕ K 3 ∧ ϕ M ∧ ϕ 5 is satisfiable.
By Proposition 11.3.5, this yields Σ 1 1 -hardness. Due to the result by Halpern [START_REF] Joseph | Presburger Arithmetic with Unary Predicates is Π 1 1 Complete[END_REF], we know that the set of satisfiable Presburger arithmetic sentences with additional uninterpreted predicate symbols lies in Σ 1 1 . Hence, we get the following theorem.

Theorem 11.3.7. The set of satisfiable sentences of the (∀ * ∃)-fragment of PA+P is Σ 1 1 -complete and, hence, neither it nor its complement are recursively enumerable.

Notice that the theorem can be reformulated in terms of uninterpreted unary function symbols instead of uninterpreted unary predicate symbols. However, in contrast to Theorem 11.2.7, we lose the property that the encoding results in a Horn sentence when transformed into CNF. The reason is the involved nondeterminism and the way we have encoded nondeterministic branching.

Over the domains of the rationals and reals, we can only show Σ 1 1 -hardness of the satisfiability problem, since Halpern's upper bound only covers the realm of the natural numbers.

Theorem 11.3.8. The set of satisfiable sentences of the (∀ * ∃)-fragment of linear arithmetic over the rationals or reals with a single additional uninterpreted unary predicate symbol is Σ 1 1 -hard and, hence, neither it nor its complement are recursively enumerable.. Moreover, the encoding from Section 11.2.4 can be used to improve Theorem 11.3.7 and show Σ 1 1 -completeness for the (non-Horn) ∀∃-fragment of PA+P , cf. Proposition 11.2.5.

Theorem 11.3.9. The set of satisfiable sentences of the ∀∃-fragment of PA+P is Σ 1 1 -complete and, hence, neither it nor its complement are recursively enumerable.

An Encoding Based on Difference Constraints

We have seen in Section 11.1 that difference constraints together with uninterpreted predicate symbols yield an undecidable satisfiability problem. This contrasts our positive result from Section 10.4 concerning the satisfiability problem for finite BSR(BD) clause sets. To sharpen the contrast even further, we intend to show the following result in the present section. Even when we only consider the rational unit interval [0, 1] as domain, adding arithmetic atoms of the form xy c to BSR(BD) where c is an uninterpreted constant symbol of sort Q, yields an undecidable satisfiability problem. We shall show this in two ways, first via a simple encoding similar to the ones presented in Section 11.1, and then via an adaptation of the encoding from Section 11.2.3 in the language LRA+P N .

We start with a refinement of the simple encoding from Section 11.1. This time, we use a 5-ary uninterpreted predicate symbol M : Q × Q × Q × Q × Q to address the state of the two-counter machine as follows: M (u, t, x, y, z) stands for a machine at instruction u and time step t where x and y store counter values relative to the offset z. We use an uninterpreted constant symbol c to determine the distance between two neighboring counter values.7 For instance, an increment of counter C 1 amounts to adding c to the x-component. Together with the offset construction that we have already used in Section 11.1, this means that the counter values can be reconstructed from x, y, z as follows: c 1 = 1 c (xzc) and c 2 = 1 c (yzc). We use the time stamp t to make sure that the value of c is chosen sufficiently small so as to keep all rationals occurring in the encoding of the run of M between 0 and 1. We stipulate that the halt instruction has to be encountered before time stamp 1 is reached. After reaching halt for the first time, all successive configurations will have the shape M ( halt , t, 0, 0, 0) where the time stamp t will keep on increasing by c until t = 1 is reached. Suppose M halts when started on the input m, n and further suppose that at most L increment operations are applied to any of the two counters. Then, in any model A of the corresponding encoding, c A has to be such that c A > 0 and c A • max(m, n) + L + 1 < 1. Of course, we also have to make sure that the labels for program lines stem from [0, 1].

In Table 11.3 we give prototypical encodings of the instructions concerning counter C 1 ; the encoding for counter C 2 can be done analogously. The side conditions stipulated in ϕ side make sure that (a) c is positive but less than 1, (b) for every time step t there is at most one configuration u, t, x, y, z , and (c) the time difference between any two configurations is at least c. This ensures that there are no spurious configurations and that the run is finite.

Notice that the overall encoding sentence can be transformed into Horn form.

Remark 11.4.1. A semi-decision procedure for finite satisfiable clause sets over the language of BSR(BD) plus the arithmetic atoms xy c with uninterpreted constant symbol c of sort Q that has the form 001011 left delimiter 1 0 d--6 0011 first subdelimiter

1 c1 0 d-c1-4 0011 second subde- limiter 1 c2 0 d-c2-4 ,
where is the address of the program line to be executed, c 1 is the value currently stored in C 1 , and c 2 is the value currently stored in C 2 . The length of the chunks is 3 In contrast to the encoding described in Section 11.2 we this time aim for a finite number of chunks in the sequence, i.e. we only consider finite runs of M. We use the rational number 1 to mark the end of the run: the very last chunk starts at position 1 -3d.

For the sake of clarity, we formulate the encoding without restriction to difference constraints in a first step. Then, in Section 11.4.3, we restate the encoding in the more restricted fragment.

Formal Encoding of Two-Counter Machine Computations

Recall that we assume to be given a two-counter machine M with K + 1 program lines, labeled 0, . . . , K, and two input values m and n. We assume that 0 is the initial program line, that program line K contains the halt instruction, and that there is no other program line containing halt.

We mark a finite subdomain of [0, 1] which will serve as pseudo-integers. The elements of this subdomain shall be uniformly distributed within [0, 1]. To this end, we use the uninterpreted unary predicate symbol N N which shall contain exactly the pseudo-integers in any model. Moreover, we use an uninterpreted constant c c to determine the distance between two pseudo-integers. The following sentence ϕ 0 sets the stage for using the pseudo-integers 0, c, 2c, 3c, . . . , 1 -2c, 1c, 1. The last subformula ensures that P contains only pseudo-integers. Having distinguished the pseudo-integers from the other rationals in [0, 1], we can now use them as a basis for the encoding.

The used abbreviations ψ 001011 , ψ 0011 , etc. have to be adapted as follows: The adapted variants of the sentences ϕ 1 , . . . , ϕ 4 are the following. The sentence ϕ 1 sets up the general structure of the predicate P . Let k again denote the integer k := max{K + 6, m + 4, n + 4}. ∧ ∀xy. ψ 001011 (x) ∧ ψ 01 (y) ∧ x + 6c ≤ y ∧ y < x + 3d → ψ 0011 (yc) (11.17) Subformula (11.10) sets the first 001011-delimiter at position 0 and the two subchunk delimiters 0011 at positions d • c and 2d • c. Moreover, the last 001011-delimiter is set to be at position 1 -3d. Subformulas (11.11) to Formula (11.14) ensure that there are 001011-and 0011-delimiters evenly distributed between positions 0 and 1. Subformulas (11.15) and (11.17) guarantee that there are no spurious delimiters between 0 and 1. Due to the fact that P contains no elements outside of [0, 1], which is entailed by ϕ 0 , there is no 001011-or 0011-delimiter starting at 0, left of 0, at 1, or right of 1. Subformula (11.17) stipulates that every 01 subsequence is part of one of the delimiters, i.e. there cannot be a subsequence 01 that lies outside of a 001011-or 0011-delimiter. This entails that between one delimiter (001011 or 0011) and the subsequent one there is exactly one subsequence 10, possibly overlapping with the last or first bit of one of the delimiters. Hence, this subsequence uniquely marks the end of the number encoded in the respective subchunk.

ψ
The following sentence sets the initial values of the counters. Moreover, it sets the initial program line, which we assume to be the very first one: We also have to encode the condition that the two-counter machine halts at some point in time.

Recall that we assume the halt instruction to exclusively appear in program line K. It remains to encode the control flow of M. We assume that the following instructions occur in program line for some ∈ {0, . . . , K}.

In the following table we give prototypical encodings of the instructions of two-counter machines. The encoding of operations is only given for counter C 1 . The encoding for counter C 2 can be done analogously.

Encoding of the instruction : inc(C 1 ): ∀x. ψ 001011 (x) ∧ χ (x) → χ +1 (x + 3d) ∀xy. ψ 001011 (x) ∧ χ (x) ∧ x + d ≤ y ∧ y ≤ x + 2d ∧ ψ 10 (y) → ψ 10 (y + 3d + c) ∀xz. ψ 001011 (x) ∧ χ (x) ∧ x + 2d ≤ z ∧ z ≤ x + 3d ∧ ψ 10 (z) → ψ 10 (z + 3d) These three sentences encode a transition from a configuration , c 1 , c 2 to the successor configuration + 1, c 1 + 1, c 2 . The first sentence stipulates that the next program line is the one with the label + 1. While the second sentence encodes the increase of counter C 1 by 1, the third sentence makes sure that counter C 2 retains its value.

The subfomula ψ 001011 (x) in the premises of the implications states that the chunk encoding the currently regarded configuration starts at position x. The other preconditions make clear that y and z correspond to the positions at which we find 10 subsequences in the two subchunks storing the current counter values: The sentence stipulates that, if program line K is reached, then only at the end of the computation.

Lemma 11.4.2. Let M be any two-counter machine and let ϕ M be the encoding of its behavior as described above. Then, M halts on the input m, n if and only if there is a model A of the set of LRA+P N sentence ϕ 1 ∧ . . . ∧ ϕ 4 K ∧ ϕ M . Moreover, in that case, P A and N A are finite subsets of the rational unit interval [0, 1].

Theorem 11.4.3. Satisfiability for the ∃ 2 ∀ 2 fragment of LRA+P N is undecidable, even if the arithmetic domain is the rational interval [0, 1] and the interpretations of P and N are restricted to finite subsets of [0, 1].

Restriction to Difference Constraints

As the last step, we now adapt the encoding from the previous section to exclusively use difference constraints vv c with ∈ {<, ≤, =, =, ≥, >}, where c is either a rational number or an uninterpreted constant symbol of sort Q. In addition, we allow the arithmetic atom x 0 = 0.

The sentence ϕ 0 requires only small changes, which yield

ϕ 0 ϕ 0 := ∀x. x -x < c ∧ ∀x 0 x 1 . x 0 = 0 ∧ x 1 -x 0 = 1 → N (x 0 ) ∧ N (x 1 ) ∧ ∀xx 0 . x 0 = 0 ∧ N (x) → 0 ≤ x -x 0 ∧ x -x 0 ≤ 1 ∧ ∀xy. y -x = c ∧ N (x) → N (y)
∧ ∀xy. xy < c ∧ yx < c ∧ N (x) ∧ N (y) → xy = 0 ∧ ∀x. P (x) → N (x) .

In the rest of the encoding, the abbreviations ψ 001011 , ψ 0011 , etc. cannot be used this comfortably anymore, as the following reformulation of ϕ 1 shows. The subformula d ≥ k • c is replaced with

∀x 1 . . . x k+1 . x 2 -x 1 = c ∧ x 3 -x 2 = c ∧ . . . ∧ x k -x k-1 = c ∧ x k+1 -x k = c → x k+1 -x 1 ≤ d .
The subformula ψ 001011 (0) is replaced with ∀x 0 x 1 . . . x 5 . x 0 = 0 ∧ x 1x 0 = c ∧ x 2x 1 = c ∧ . . . ∧ x 5x 4 = c → ¬P (x 0 ) ∧ ¬P (x 1 ) ∧ P (x 2 ) ∧ ¬P (x 3 ) ∧ P (x 4 ) ∧ P (x 5 ) .

The subformula ψ 0011 (d) is replaced with

∀x 0 x 1 . . . x 4 . x 0 = 0 ∧ x 1 -x 0 = d ∧ x 2 -x 1 = c ∧ x 3 -x 2 = c ∧ x 4 -x 3 = c
→ ¬P (x 1 ) ∧ ¬P (x 2 ) ∧ P (x 3 ) ∧ P (x 4 ) .

The subformula ψ 0011 (2d) is replaced with

∀x 0 x 1 . . . x 4 . x 0 = 0 ∧ x 1 -x 0 = d ∧ x 2 -x 1 = d ∧ x 3 -x 2 = c ∧ x 4 -x 3 = c ∧ x 5 -x 4 = c
→ ¬P (x 2 ) ∧ ¬P (x 3 ) ∧ P (x 4 ) ∧ P (x 5 ) .

The subformula ψ 001011 (1 -3d) is replaced with ∀x 0 x 1 . . . x 8 . x 0 = 0

∧ x 1 -x 0 = 1 ∧ x 1 -x 2 = d ∧ x 2 -x 3 = d ∧ x 3 -x 4 = d ∧ x 5 -x 4 = c ∧ x 6 -x 5 = c ∧ x 7 -x 6 = c ∧ x 8 -x 7 = c ∧ ∧ x 9 -x 8 = c
→ ¬P (x 4 ) ∧ ¬P (x 5 ) ∧ P (x 6 ) ∧ ¬P (x 7 ) ∧ P (x 8 ) ∧ P (x 9 ) .

The subformula ∀x. ψ 001011 (x) ∧ x < 3d → x = 0 is replaced with ∀x 0 x 1 . . . x 6 y 1 y 2 y 3 . x 0 = 0

∧ y 1 -x 0 = d ∧ y 2 -y 1 = d ∧ y 3 -y 2 = d ∧ x 2 -x 1 = c ∧ x 3 -x 2 = c ∧ x 4 -x 3 = c ∧ x 5 -x 4 = c ∧ x 6 -x 5 = c
∧ ¬P (x 1 ) ∧ ¬P (x 2 ) ∧ P (x 3 ) ∧ ¬P (x 4 ) ∧ P (x 5 ) ∧ P (x 6 ) ∧ x 1y 3 < 0

→ x 1 -x 0 = 0 .
The other constituents of ϕ 1 and the sentences ϕ 2 m,n , . . . , ϕ 4 K can be modified in the same spirit. Regarding the encoding of M's control flow, we show two examples of how to modify the respective sentences.

Encoding of the instruction : inc(C 1 ):

The subformula ∀xy. ψ 001011 (x) ∧ χ (x) ∧ x + d ≤ y ∧ y ≤ x + 2d ∧ ψ 10 (y) → ψ 10 (y + 3d + c) is replaced with ∀xyx 1 . . . x 5 v 1 . . . v +1 y 1 y 2 u 1 u 2 u 3 u 4 .

x 1x = c ∧ x 2x 1 = c ∧ . . . ∧ x 5x 4 = c ∧ ¬P (x) ∧ ¬P (x 1 ) ∧ P (x 2 ) ∧ ¬P (x 3 ) ∧ P (x 4 ) ∧ P (x 5 )

∧ v 1 -x 5 = c ∧ v 2 -v 1 = c ∧ . . . ∧ v +1 -v = c ∧ P (v ) ∧ ¬P (v +1 ) ∧ y 1 -x = d ∧ y 1 -y ≤ 0 ∧ y -y 1 ≤ d ∧ y 2 -y = c ∧ P (y) ∧ ¬P (y 2 ) ∧ u 1 -y = d ∧ u 2 -u 1 = d ∧ u 3 -u 2 = d ∧ u 4 -u 3 = c ∧ u 5 -u 4 = c → P (u 4 ) ∧ ¬P (u 5 ) .
Encoding of the instruction K : halt: The sentence ∀x. ψ 001011 (x) ∧ χ K (x) → x = 1 -3d is replaced with ∀xx 0 x 1 . . . x 5 v 1 . . . v K+1 z 1 z 2 z 3 z 4 .

x 1x = c ∧ x 2x 1 = c ∧ . . . ∧ x 5x 4 = c ∧ ¬P (x) ∧ ¬P (x 1 ) ∧ P (x 2 ) ∧ ¬P (x 3 ) ∧ P (x 4 ) ∧ P (x 5 )

∧ v 1 -x 5 = c ∧ v 2 -v 1 = c ∧ . . . ∧ v K+1 -v K = c ∧ P (v K ) ∧ ¬P (v K+1 ) ∧ x 0 = 0 ∧ z 1 -x 0 = 1 ∧ z 1 -z 2 = d ∧ z 2 -z 3 = d ∧ z 3 -z 4 = d → x -z 4 = 0 .
Theorem 11.4.4. Satisfiability for the LRA+P N is undecidable, even if arithmetic atoms are restricted to difference constraints plus atoms x 0 = 0, the arithmetic domain is the rational or real interval [0, 1], and the interpretations of P and N are restricted to finite subsets of [0, 1].

Relevance to Verification

Verification of hardware and software is one driving force behind attempts to the combination of theories, such as integer or real arithmetic and the theory of equality over uninterpreted functions (EUF) EUF -EUF is understood to refer to the collection of all logical Σ-theories containing all valid quantifier-free Σ-sentences over a finite vocabulary Σ without predicate symbols. 9 For quantifier-free cases the Nelson-Oppen framework provides a general-purpose approach for the construction of decision procedures (see Section 10.3). Over the course of the last fifteen year numerous approaches have been proposed to go beyond the quantifier-free setting and handle quantification, see e.g. [FJS04, DNS05, GdM09, GBT09, BMR13, RTdM14, RK15, RBF18, Bar17]. Typically, some kind of heuristic is applied to guide instantiation towards equisatisfiable formulas that are quantifier free. Often the methods are incomplete in the sense that unsatisfiable sentences are not necessarily recognized as such. Nevertheless, the proposed methods have been implemented and successfully applied, e.g. in the tools Verifun, Simplify, and the CVC family.

In verification one usually abstracts from some of the limitations that apply to real-world computing devices. In particular, memory is often regarded as an inexhaustible resource in one way or another. This can take the form of infinitely many memory locations -similar to the infinite tape of a Turing machine -or the form of the capability of storing arbitrarily large integers in single memory location -similar to the counters of counter machines. In our encoding of two-counter machines in Sections 11.2 and 11.4 the uninterpreted predicate symbol P serves as a representation of an unbounded memory. As we have pointed out, any interpretation P A ⊆ N can be conceived as an infinite sequence of bits. And these bits can be accessed by integer addresses. We have also pointed out in Section 11.2.6 that the same applies to uninterpreted function symbols over the integers or some co-domain with at least two distinct elements. This means that our results are relevant to all verification approaches in which an infinite memory is modeled and in which there are sufficiently strong means available to access individual memory locations. Such approaches inevitably face undecidability when they allow too liberal syntax. We shall discuss several exemplary settings: separation logic over an integer-indexed heap, logics formalizing integerindexed arrays or similar data structures, logics with restricted forms of linear integer arithmetic. We shall also give reasons why incomplete heuristics is sometimes the best one could hope for.

Separation Logic

In [START_REF] Reynolds | Reasoning in the Bernays-Schönfinkel-Ramsey Fragment of Separation Logic[END_REF] the Bernays-Schönfinkel-Ramsey fragment (∃ * ∀ * -sentences) of separation logic is investigated. The quantifiers range over memory locations. Although the authors also present a refinement of Halpern's undecidability result [START_REF] Joseph | Presburger Arithmetic with Unary Predicates is Π 1 1 Complete[END_REF] for PA+P , their approach differs from our approach in Section 11.2 in an important aspect. In their setting it is sufficient to consider models in which the unary predicate symbol P is interpreted with a finite subset of N. In our setting in Section 11.2 finite subsets do not suffice. It is due to this difference, that their strategy can be used to also show undecidability of the satisfiability problem for ∃ * ∀ * -sentences of separation logic over a heap with finitely many integer-indexed memory locations, each capable of storing one integer of arbitrary size.

Our results in Sections 11.2 and 11.3 have implications for settings with integer-indexed heaps that comprise a countably infinite number of memory locations, each capable of distinguishing at least two values (e.g. 0 and 1) or states (e.g. allocated and not allocated ). However, a slight modification of the encoding in Section 11.2.2 leads to a result that subsumes Theorem 3 in [START_REF] Reynolds | Reasoning in the Bernays-Schönfinkel-Ramsey Fragment of Separation Logic[END_REF] and also entails undecidability of the satisfiability problem for the ∃ * ∀ * -fragment of separation logic with integer-indexed heaps that comprise only finitely many memory locations, each capable of storing at least one bit of information.

Lemma 11.5.1. Let M be a two-counter machine with K + 1 program lines, labeled 0, . . . , K, and let m, n be a pair of nonnegative integers. There is a sentence ϕ from the (∃∀ * )-fragment of PA+P , such that the following statements are equivalent:

(a) ϕ is satisfied by a model A under which P A is a finite subset of N, (b) M reaches the halt instruction when started on the input m, n . Proof sketch. The following is a blend of ideas from Sections 11.2 and 11.4. Let ϕ M be the encoding of M's program in accordance with Section 11.2.2 with the exception that we do not encode the instruction in program line K. Due to our conventions, this program line contains the halt instruction. Let ϕ 1 (z) result from ϕ 1 after replacing the Subformula (11.3) with ∀x. x < z ∧ ψ 001011 (x) -→ ψ 0011 (2x) ∧ ψ 0011 (3x) ∧ ψ 001011 (4x) .

Moreover, let

ϕ 4 K (z) := ψ 001011 (z) ∧ χ K (z) .

Notice that both formulas ϕ 1 (z) and ϕ 4 (z) contain the free variable z. We now set

ϕ := ∃z. ϕ 1 (z) ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ M ∧ ϕ 4 K (z) .
There exists a model A of ϕ if and only if M reaches program line K when started on the input m, n . Due to the modifications in ϕ 1 , the formula ψ 001011 (x) does not have to be satisfied for arbitrarily large values of x. One consequence is that the run of M represented by a model of ϕ can be aborted at the point when program line K is reached. This means, in contrast to the proof of Lemma 11.2.1, we do not have to artificially continue M's run beyond that point. Hence, any model of ϕ can be modified in such a way that from a certain point on the bit sequence represented by the interpretation of P contains only zeros.

Verification of Data Structures

There are undecidability results in the context of verification of programs that use integer-indexed arrays as data structures. Examples can be found in [START_REF] Bradley | What's Decidable About Arrays? In Verification, Model Checking, and Abstract Interpretation[END_REF] (Section 5), [START_REF] Bradley | Safety Analysis of Systems[END_REF] (Sections 2.4 and 2.6.3), [START_REF] Habermehl | What Else Is Decidable about Integer Arrays?[END_REF] (Section 3). The reductions presented therein are based on arrays with infinite co-domains, such as the integers or the reals. Moreover, they typically use at least one quantifier alternation (but face other restrictions of syntax). Usually, several arrays are used for convenience, but could be merged into one. For our proof approach a single array is sufficient as well.

Read operations on integer-indexed arrays can be formalized as uninterpreted function symbols with an integer domain. Hence, our results, Theorems 11.2.7 and 11.2.8 in particular, show that reasoning about integer-or real-indexed arrays over a finite co-domain with at least two elements can lead to undecidability, if constraints on array indices provide the necessary syntactic means. Notice that for the proof it is not necessary to have write operations on arrays. This means, a single integer-indexed read-only array over a Boolean co-domain suffices.

The mentioned results and arguments hold for arrays that comprise an infinite number of elements. However, due to Lemma 11.5.1, undecidability arises also in the context of finite arrays (over finite co-domains), as long as their length is not bounded by a concrete number.

Remark 11.5.2. The above arguments are also applicable to recursively defined data structures, such as lists or trees, as soon as there are sufficiently strong syntactic means available to access the stored information. That is, if one can essentially simulate arrays using a recursive data structure, then our results apply immediately. Examples of such setting are lists where the stored elements can be addressed by integers, or where one can access the sublist starting at the position that is x nodes away from the head (for some integer-sort variable x for which universal quantification is admitted).

Verification Using Counter Arithmetic

In [START_REF] Bryant | Modeling and Verifying Systems Using a Logic of Counter Arithmetic with Lambda Expressions and Uninterpreted Functions[END_REF] the fragment CLU is introduced, which constitutes a strongly restricted fragment of Presburger arithmetic with additional uninterpreted function and predicate symbols. A less syntactically sugared subfragment is treated in [GHN + 04] and in [START_REF] Armando | New Results on Rewrite-Based Satisfiability Procedures[END_REF]. There are only two arithmetic operators available in CLU: the successor operator succ and the predecessor operator pred. There is no interpreted constant symbol available addressing zero or any other concrete integer. On the other hand, some syntactic elements are added for convenience, such as lambda abstraction and an if-then-else operator. The fragment was chosen for its expressiveness and the fact that it facilitates efficient reasoning. Although quantifier-free in its original definition, the authors state about their verification tool UCLID that they "have built some support for quantifiers in CLU using automatic quantifier instantiation heuristics" ([BLS02], Section 7).

In what follows, we consider the extension of CLU with universal quantification for integer variables. We shall refer to this extended language as uCLU. By a result due to Gurevich [START_REF] Gurevich | The Decision Problem for Standard Classes[END_REF] (see also [START_REF] Börger | The Classical Decision Problem[END_REF], Theorems 4.1.8 and 4.1.11), satisfiability of EUF sentences with universal quantification is undecidable. Hence, satisfiability of uCLU sentences is undecidable as well.

Proposition 11.5.3 (Corollary of the Main Theorem in [START_REF] Gurevich | The Decision Problem for Standard Classes[END_REF]). (Un)satisfiability for uCLU sentences is undecidable.

On the other hand, the unsatisfiable sentences of first-order logic without interpreted symbols (and thus also of quantified EUF) are recursively enumerable. We next argue that uCLU does not possess this property.

The encoding of two-counter machines from Section 11.2 and 11.3 cannot immediately be translated into uCLU. First of all, we need to fix a point of reference that serves as zero (CLU does not contain 0 as a built-in constant). Moreover, expressions of the form k • x for any integer k and any integer-sort variable x require a form of addition that is not available as a built-in operation in uCLU. However, with unrestricted universal quantification over integer variables at hand, we can easily define addition as a function. Hence, we only need the following uninterpreted symbols to encode two-counter machines: one constant symbol c 0 serving as zero, one binary function symbol realizing addition, one uninterpreted unary function or predicate symbol serving as memory.

We define the addition function (on nonnegative integers) as follows, where we use c 0 as zero:

∀x. add(x, c 0 ) = x ∀xy. succ(y) > c 0 -→ add x, succ(y) = add succ(x), y ∀xy. succ(y) < c 0 -→ add x, succ(y) = x .

All abbreviations k • x are unfolded into add(x, add(x, . . . add(x, x) . . .)) and all integers that we have used in the encoding from Section 11.2.3 shall be written as succ k (c 0 ) := succ(. . . succ(c 0 ) . . .) instead of just k. Moreover, we add guards x ≥ c 0 → . . . to each sentence for every universally quantified variable x that occurs in that sentence.

As we have seen in Section 11.3, in particular in Theorems 11.3.7 and 11.3.9, ∀∃ quantifier alternations yield (un)satisfiability problems that are not even recursively enumerable. Since CLU allows uninterpreted function symbols, uCLU essentially allows ∀ * ∃ * quantifier prefixes (modulo Skolemization). Hence, we may introduce a fresh unary Skolem function f init and translate the sentence ϕ 5 from Section 11.3 into the uCLU formula ∀x. x ≥ 0 -→ x ≤ f init (x) ∧ ψ 001011 f init (x) ∧ χ 0 f init (x) .

This means, we can transfer Theorem 11.3.9 to uCLU and thus obtain the following result.

Theorem 11.5.4. Neither the set of satisfiable uCLU sentences nor the set of unsatisfiable uCLU sentences is recursively enumerable. In particular, there cannot be any sound and refutationally complete calculus for uCLU.

In [START_REF] Armando | New Results on Rewrite-Based Satisfiability Procedures[END_REF] the authors present a combination result (Theorem 4.6) for the ground theories of integer-offsets (the arithmetic subfragment of CLU embodied by the operators succ and pred), arrays, and/or EUF (as long as the signature of uninterpreted functions does not contain the array sort). The result states that the satisfiability of sentences in such combined theories can be decided using term-rewriting methods. By a similar line of argument that led us to Proposition 11.5.4, it follows that Theorem 4.6 in [ABRS09] cannot be generalized to cases which admit quantification over integer-sort variables. But we do not only lose decidability, we also lose semi-decidability. In other words, it is impossible to devise sound and complete calculi for combinations of EUF and arithmetic -even in such a restricted form as in CLU -if universal quantification of integer variables is admitted.

Almost Uninterpreted Formulas with Offsets

In [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF] Ge and de Moura define the fragment of almost uninterpreted formulas almost uninterpreted fragment . It constitutes a combination of subfragments of first-order logic, EUF, and linear arithmetic over the integers.

Its language admits uninterpreted predicate symbols, function symbols, and constant symbols. Formulas are assumed to be given in CNF. All occurring variables are universally quantified, but may only occur as arguments of uninterpreted function or predicate symbols with the following exceptions. Literals of the form ¬(x ≤ y), ¬(x ≤ t), ¬(x ≥ t), ¬(x = t), ¬(x ≤ y + t), x = t with variables x, y of sort Q are allowed for all ground terms t of the integer sort. Moreover, terms of the form f (. . . , x + t, . . .) and P (. . . , x + t, . . .) are allowed for ground terms t of the integer sort, uninterpreted function symbols f and uninterpreted predicate symbols P . In what follows we shall be more liberal with the syntax than this. However, the formulas that we will present can be rewritten into equivalent ones that obey the above restrictions. Consequently, we will be able to show undecidability of the associated satisfiability problem.

The encoding of two-counter machines given in Section 11.2 requires different syntactic means than the ones available in Ge and de Moura's almost uninterpreted fragment. Hence, a proof of undecidability in the syntax of [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF] needs a slight shift of paradigm similar to the one described in Section 11.4.1. We start from the encoding presented in Section 11.2.3, since it requires at most two integer-sort variables in arithmetic atoms. The length of the chunks storing a single configuration , c 1 , c 2 increases over time. This behavior is necessary to formalize non-terminating runs -and recurring runs in particular -by satisfiable formulas. However, in order to formalize a run that eventually reaches the halt instruction by a satisfiable sentence, it suffices to fix the length of the chunks representing a single configuration to a size that can accommodate all configurations that occur in the run, depending on the machine program and on the given input. In Ge and de Moura's fragment uninterpreted constant symbols are available that can be used for this purpose. In what follows, the uninterpreted constant d is used to determine the length of subchunks, as depicted in Figure 11 bit sequence represented by P . We replace the sentence ϕ 1 (page 269) with the following sentence ϕ 1 . Let k be the result of the expression max(K + 6, m + 4, n + 4), where K is the address of the last program line and m and n are the input values. The purpose of the uninterpreted constant e is to mark the end of the run, as we will see later. The other instructions can be adapted analogously. The only exception is the halt instruction in the last program line which we shall not encode, as in the proof sketch for Lemma 11.5.1. Finally, we also have to modify the condition that the two-counter machine halts at some point in time. We use the uninterpreted constant e for this purpose:

ϕ 4 K ϕ K := χ K (e) .
Consequently, using the fragment given in [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF], we can encode the halting problem of a two-counter machine M on input m, n using only a single uninterpreted unary predicate symbol P (or a single function symbol) plus two uninterpreted constant symbols d, e. More precisely, if M halts on m, n , then there is model A of the encoding sentence such that P A is a finite set of integers.

Theorem 11.5.5. The satisfiability for the almost uninterpreted fragment with integer offsets is undecidable.

The outlined encoding is sufficient for a halting run of a two-counter machine. However, we cannot encode recurring counter machines in this way. Thus, we do not obtain hardness beyond recursive enumerability. Indeed, this is in line with [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF], where a refutationally complete calculus is given for the described fragment.

The realm of recursive enumerability can be left easily. For instance, it is sufficient to allow scalar multiplication combined with addition for integer-sort variables, i.e. expressions of the form 2 • x + y. With this construct, we could encode a progressively increasing chunk length. Moreover, uninterpreted function symbols of positive arity can be used to simulate ∀∃ quantifier alternations. Similarly, it would suffice to admit expressions g(x) + 2, as we can define, e.g., times c (0) = 0 ∧ ∀x. x ≥ 0 → times k (x + 1) = times c (x) + 2 for any positive integer k. With a syntax extended this way, one could realize the encoding from Section 11.2.2. In Part I of the present thesis we have introduced the concept of separateness of (sets of) first-order variables and have examined its potential in the context of the classical decision problem and beyond. Although the notion is easy to state and grasp, it opens the door to a number of discoveries.

We have mainly concentrated on decidable fragments of first-order logic and have only briefly touched other areas of application. One important property of separateness is its being orthogonal to the syntactic properties that characterize many of the known decidable fragments. Even much better, separateness turned out to be an enabler for the definition of significant syntactic extensions of at least nine such fragments. The reason is that suitable conditions based on separateness of first-order variables often allow for more subtlety when formulating syntactic restrictions, which in the end yields relaxed syntactic conditions. Figure 12.1 depicts once again the novel fragments that we have defined and investigated in Chapter 3 (compare also Figure 1 on page 3). Hence, separateness opens a new perspective on the landscape that research activity around the classical decision problem has revealed over the course of the last about one hundred years. It seems likely that separateness could be used to extend more decidable first-order fragments. For instance, the Skolem fragment and Maslov's fragment K may be interesting candidates for being extended, as may be the more recent unary-negation fragment and the uniform one-dimensional fragment. Interestingly, each and every of the novel fragments discussed in Chapter 3 properly contains MFO. The reason is simply that in MFO sentences, by definition, any two disjoint sets of first-order variables are separated. The inclusion of MFO could be conceived as a litmus test concerning the generality of definitions of first-order fragments based on separateness: if MFO is not covered, then the definition is not yet liberal enough. That is to say that, if the definition of a first-order fragment is sufficiently strongly based on separateness, then it will inevitably contain MFO.

Another peculiarity is that every extended fragment exhibits the same expressiveness as the underlying original fragment does, but only at the qualitative level. More precisely, we have devised a translation procedure for every extended fragment, say F , which is capable of transforming any given sentence based on the extended syntax of F into an equivalent sentence that belongs to the original fragment, say G. From this perspective, the syntax of G could be conceived as a kind of normal form with respect to F : there is a procedure bringing any F -sentence into G-normal form, so to speak. Furthermore, we have seen that this translation for several extended fragments inevitably leads to a super-polynomial blowup of the formula length in the worst case -see Table 12.1 for an overview. For the translations SF-to-BSR, GBSR-to-BSR, SGF-to-GF, and SLGF-to-LGF, the incurred cost is even so large that it cannot be bounded using elementary functions alone. This shows that the extension of decidable first-order fragments using separateness of variables provides the ability to express certain logical properties in a significantly more succinct way, much rather than yielding any qualitative improvement regarding expressive power. The presented derivations .1: Schematic overview of the extended fragments (in green) that have been presented in Chapter 3. Notice that MFO is properly contained in all extended fragments. The focus is on the overlaps with MFO and on the proper containment relations between SF and GBSR, GAF and GGKS, and SGF and SLGF. The other depicted overlaps might be unsubstantiated. of lower bounds for such succinctness gaps have one thing in common. In the used classes of particularly succinct sentences quantifier alternations played a key role that were not subject to the characteristic syntactic restrictions of the respective original fragment. For example, for SF versus BSR we used a class of SF sentences where the number of quantifier alternations was unbounded, whereas in BSR at most one quantifier alternation is allowed. In the SLGF-versus-LGF case, the considered class of SLGF sentences (which actually are SGF sentences) contains nested quantifiers of unbounded depth that do not adhere to the guardedness conditions imposed by LGF. Similarly, in the case SF versus the class of Gaifman-normal sentences, the class of sentences used for showing the non-elementary succinctness gap contains quantifier alternations of unbounded depth that are not allowed in first-order sentences in Gaifman normal form. Although the latter case does not fall into the category of extended decidable first-order fragment versus original decidable first-order fragment, it highlights a succinctness gap between a class of sentences whose definition is based on separateness compared to a certain class of first-order sentences with a restricted syntax. Although we have not investigated the succinctness gaps for all extended fragments, this does not mean that the unexamined gaps are only polynomial or smaller. For instance SGNFO versus GNFO seems to be a natural candidate for another non-elementary succinctness gap, like in the case of SLGF versus LGF. The case of SFL versus FL seems to be more tricky, though, as FL-Sat is which immediately entails the same property for SF, GBSR, and GAF. From the research literature we have concluded that SGF and SLGF are not closed under interpolation, while the class of SGNFO sentences enjoys this property. This question is still unanswered for the other newly introduced first-order fragments.

Finally, we have sketched more ideas concerning applications of separateness in Chapter 7, ranging over topics such as investigations of the effects of separateness in interpreted logics, and the elimination of certain occurrences of second-order quantifiers.

In the following sections, we shall elaborate a bit on applications of some of the decidable fragments we have identified in the present thesis and we shall also sketch further ideas for future work.

12.1.1 Potential Applications for the Newly Introduced Decidable First-Order Fragments

In Part I of the present thesis we have concentrated on SF much more than on any other fragment.

The reasons for this focus on SF are manifold: (a) it has been the first novel decidable first-order fragment discovered by the author, (b) its definition is simple and easy to handle technically, (c) it extends BSR, which found many applications, e.g. in verification, and has attracted quite some attention in the automated reasoning community. The Bernays-Schönfinkel-Ramsey fragment has become popular in verification and in automated reasoning because it constitutes a good compromise between expressiveness and simplicity, in particular due to the finiteness of the Herbrand domain associated with any BSR sentence (after exhaustive Skolemization). The fragment is sometimes conceived as an intermediate syntactic step between propositional logic and full first-order logic. Compared to propositional logic, certain logical properties can be expressed exponentially more succinct in BSR. In the automated reasoning and verification communities the term effectively propositional logic, or EPR for short, has been put about as an alternative name for BSR.1 There is, for instance, an EPR division at the annual CADE ATP System Competition (CASC) [START_REF] Sutcliffe | The state of CASC[END_REF][START_REF] Sutcliffe | The 9th IJCAR Automated Theorem Proving System Competition -CASC-J9[END_REF]. The research literature offers a plethora of works based on BSR, extensions thereof, and variants of BSR in settings beyond first-order logic, e.g. [PV07a, PV07b, WPK09, CW10, EKKV10, EKK + 12, PO12, IBI + 13, PV13, BDMMS14, IBI + 14, IBR + 14, KBI + 15, PMP + 16, FMSZ17, RIS17]. In automated reasoning the finiteness of the Herbrand domain associated with BSR sentences is appreciated very much. There are dedicated reasoning approaches making use of this property in one form or another, see, e.g., [START_REF] Antonio | Proof Systems for Effectively Propositional Logic[END_REF][START_REF] Hillenbrand | Superposition and Decision Procedures Back and Forth[END_REF][START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF][START_REF] Piskac | Deciding Effectively Propositional Logic Using DPLL and Substitution Sets[END_REF][START_REF] Hillenbrand | Superposition for Bounded Domains[END_REF][START_REF] Alagi | NRCL -A Model Building Approach to the Bernays-Schönfinkel Fragment[END_REF]. Since these methods work well in practice, it is sometimes even worth to reduce more general first-order problems to BSR in order to apply finite model finders to the resulting formulas, see [START_REF] Baumgartner | Computing finite models by reduction to function-free clause logic[END_REF], for instance.

All of the above said indicates that SF and its larger relative GBSR could be of great interest to the verification and automated reasoning communities, as both extend BSR and offer more syntactic freedom for modeling the behavior of systems and their properties. The formalizations that have been presented in Sections 3.3 and 5.3 are very instructive regarding what can be formalized in SF and GBSR and how.

In Section 10.3 we have discussed the combination of theories in the Nelson-Oppen framework . There is a series of papers by Fontaine and his collaborators [Fon07, Fon09, AF11, CFR14], where component theories are considered that are axiomatized using finite sets of sentences stemming exclusively from MFO ≈ , BSR, AF with equality, GF, LGF, or FO2 . The results by Fontaine et al. state that such theories are gentle ([Fon09], [START_REF] Areces | Combining Theories: The Ackerman and Guarded Fragments[END_REF]), that is, for every set of literals L over T 's vocabulary the spectrum 2 of T ∪L can be computed and is either (a) a finite set of finite cardinalities or (b) the union of a finite set of finite cardinalities and all the (finite and infinite) cardinalities greater than a computable finite cardinality ([Fon09], Definition 3). One of the contributions in [START_REF] Fontaine | Combinations of Theories for Decidable Fragments of First-Order Logic[END_REF] is that satisfiability with respect to two vocabulary-disjoint theories T 1 , T 2 -that is, answering the question whether there is a model of T 1 ∪ T 2 ∪ {ϕ} for any sentence ϕ = ∃z. i∈I L i over the combined vocabulary of T 1 and T 2 -is decidable in the following cases: T 1 is gentle and (i) T 2 is gentle as well, or (ii) T 2 is a finitely axiomatized first-order theory, or (iii) T 2 is a decidable theory that only admits a fixed finite (possibly empty) known set of finite cardinalities for its models, and possibly infinite models ([Fon09], Theorem 3). According to Fontaine, examples for such theories T 2 are real or integer linear arithmetic and certain known theories over array data structures. In [START_REF] Chocron | A Gentle Non-Disjoint Combination of Satisfiability Procedures[END_REF], some of the mentioned results are extended to a setting with theories that are not built over disjoint vocabularies but may share unary predicate symbols.

Since we have shown that (a) SF and GBSR are equivalent to BSR, (b) GAF with equality is equivalent to AF with equality, (c) SGF is equivalent to GF, (d) SLGF is equivalent to LGF, and (e) SFO 2 is equivalent to FO 2 , the combination results obtained by Fontaine et al. are also applicable to theories that are axiomatized using finite sets of sentences exclusively taken from SF, GBSR, GAF, SGF, SLGF, or SFO 2 , respectively.

More about Future Work

There are some obvious omissions in the material covered in the present thesis that are worth being filled in in future investigations. Examples include (a) pinning down the computational complexity of satisfiability for the rest of the introduced decidable fragments, (b) bounding the blowup incurred when translating sentences from the extended fragments to the underlying original fragments, (c) investigating all the new fragments apart from SF, GBSR, and GAF under the semantic lens and taking weakness of dependences into account, e.g. the interplay of weak dependences with guardedness, (d) checking these fragments for closedness under interpolation and checking whether BSR, SF, GBSR, AF, GAF are still closed under interpolation in the presence of equality, and (e) using separateness to extend further decidable first-order fragments such as Maslov's K. Moreover, separateness may turn out to be even more versatile in future investigations. We have already discussed three possible directions in Chapter 7: the effects of separateness in interpreted logics, Skolemization techniques enhanced by a certain sensitivity to weak dependences, and the elimination of certain occurrences of second-order quantifiers. Other topics that we have touched only very briefly and that might be worth further investigation are the interplay between Boolean structure and separateness, see Section 3.6, and the possible connections of weak dependences to the field of dependence logic (broadly construed), including independence-friendly logic, logics with Henkin quantifiers, and other related research fields, see Remark 7.2.3 on page 192 for references. It is also worth pointing out that for most of the decidable fragments we have extended in Chapter 3 there are resolution-based decision procedures known (consult Chapter 3, pages 23-28, for references). It would be interesting to know whether and how existing procedures could be adapted so as to cope with separateness and become decision procedures for the extended fragments as well.

To conclude the present section, we shall sketch one more idea. We have emphasized time and again that, compared to BSR sentences, SF sentences can express certain logical properties much more succinctly. This holds true in particular for properties that exhibit a high degree of structural regularity. An example for such a property is the one described by the family of SF sentences ϕ n n≥1 with ϕ n := ∀x n ∃y n . . . ∀x 1 ∃y 1 . n i=1 P i (x 1 , . . . , x n ) ↔ Q i (y 1 , . . . , y n ) . We have already encountered a variant of this class of sentences in the proof of Theorem 3.2.7. Although the domain size of the following family of models A n n≥1 with A n |= ϕ n for every n grows massively with increasing n, its interpretation of the predicate symbols P i and Q i is given by a rather simple pattern and, hence, each A n is intuitively very regular -the latter is witnessed by the shortness of the following definition of A n :

A n := S plays in the predicates P An i . More generally, consider any logical property π n that is parameterized by some positive integer n and that can be expressed by a (uniform) family of BSR sentences. Let f (n) be the function representing the length of a shortest BSR sentence ψ that describes π n . Let g(n) be the function that denotes the length of a shortest SF sentence describing π n . We know that there are properties π n such that g(n) can be bounded from above by some polynomial but we cannot find any integer k such that f (n) is bounded from above by some k-fold exponential function. In such a case we would say that π n is structurally fairly regular, as we can describe it with an SF sentence of polynomial length. Now imagine a property π n accompanied with corresponding functions f (n) and g (n) for which we have g (n) ∈ Ω f (n) , i.e. the length of shortest SF sentences describing π n is asymptotically of the same order as the length of shortest BSR sentences describing π n . On an intuitive level, this means that the relaxed syntactic conditions of SF do not provide a significant edge over BSR when π n is to be described. For instance, the possibility to use quantifier alternations within the limits of SF does not help to formulate an asymptotically shorter description of π n . It seems that π n requires a more sophisticated and lengthy description than, for instance, π n does, or, viewed from the opposite angle, π n exhibits a lower degree of structural regularity than π n . A possible measure for this lack of regularity might be provided by the gap between f (n) and g (n): the smaller the gap, the higher the structural irregularity of π n .

Instead of the comparison SF versus BSR, one could also use the comparison between SF sentences and equivalent Gaifman-local sentences. Of course, the above said is also relevant to other fragments and not exclusively to SF, for instance, to SLGF versus LGF or to the full class of relational first-order sentences versus relational Gaifman-local sentences. We have already encountered a number of examples of structurally fairly regular properties described by SF sentences in the preceding chapters, e.g. in Section 3.2 in the proof of Theorem 3.2.7 (the property described by the sentence ϕ), during the preparations for the proofs of Theorems 3.3.11 and 3.3.18 in Section 3.3.3 (the property described by the χ m,k on page 43) and in Chapter 5, Section 5.3.1 (the property described by the sentence ψ 1 ∧ . . . ∧ ψ 16 , for instance), which contains the heart of the proof of Theorem 5.3.11.

The general idea of measuring structural regularity by means of the asymptotic length of shortest logical descriptions appears to have some similarity to concepts investigated in the field of algorithmic information theory and Kolmogorov complexity in particular (see, e.g., the textbooks [START_REF] Downey | Algorithmic Randomness and Complexity[END_REF] and [START_REF] Calude | Information and Randomness : An Algorithmic Perspective[END_REF] for introductory material). Potential connections and interrelations remain to be studied.

First-Order Linear Arithmetic with Uninterpreted Predicates

In Part II of the present thesis we have explored the decidability boundary for first-order linear arithmetic with uninterpreted predicate symbols. On the decidable side (Chapter 10) we have mainly focused on the domain of the rational numbers and have introduced two fragments of the language for which the satisfiability problem is decidable: BSR with simple linear rational constraints (BSR(SLR)) and BSR with bounded difference constraints (BSR(BD)). The two can be conceived as extensions of the Bernays-Schönfinkel-Ramsey fragment enhanced with certain linear rational arithmetic expressions. Indeed, we have shown that checking satisfiability is NExpTimecomplete for both fragments. The proof strategy is very similar for both cases. Although a finite model property in the usual sense cannot be established due to the inherent infiniteness of the underlying domain, we have derived a property with a similar flavor. In a first step, we have identified equivalence relations ∼ over Q m that induce only finitely many equivalence classes, each containing m-tuples that are pairwise indistinguishable from the perspective of the the admitted 12.2. FIRST-ORDER LINEAR ARITHMETIC WITH UNINTERPRETED PREDICATES 297 arithmetic atoms. Then, we have proved that it is sufficient to consider only candidate models A that are uniform in the sense that the interpretation of predicate symbols, e.g. P : Q m , does not distinguish ∼-equivalent tuples either: for any two such tuples r1 , r2 we have r1 ∈ P A if and only if r2 ∈ P A . For every satisfiable finite clause set over the language of BSR(SLR) or BSR(BD) there is such a uniform model, and, moreover, this model can be described my finite means. Based on this observation, we have devised computable transformations from finite BSR(SLR) and BSR(BD) clause sets into equisatisfiable finite BSR clause sets without interpreted symbols, except for equality.

On the negative side (Chapter 11) of the decidability boundary, we have identified several fragments with a satisfiability problem that is undecidable or, in some cases, not even semidecidable. We have treated settings over different arithmetic domains: linear arithmetic over the natural numbers, the rationals, and the reals. Moreover, in many cases it has turned out that a single uninterpreted predicate symbol of arity one suffices to encode the halting problem for two-counter machines on given inputs. We have tried to keep the number of quantifier alternations and quantifiers at a minimum. An overview of the most important results is given in 12.2: Summary of the most important undecidability results obtained in Chapter 11. PA+P stands for Presburger arithmetic with an uninterpreted unary predicate symbol P . LRA+P N abbreviates linear rational arithmetic with two uninterpreted unary predicate symbols P, N ; LRA+P stands for the restriction of the latter to only one such predicate symbol. The fragment in the last line is a restricted form of LRA+P N where (a) the domain is restricted to the rational unit interval [0, 1], (b) all arithmetic atoms have the form x 0 = 0 or xy c where x, y are universally quantified variables, c is either a rational number or an uninterpreted constant symbol and ranges over the relations <, ≤, =, =, ≥, >, and (c) the interpretation of the predicate symbols P, N is restricted to finite subsets of [0, 1]. The abbreviation r.e. stands for recursively enumerable, as usual, a synonym for semi-decidable. The terms Unsat and Sat address the set of unsatisfiable sentences and the set of satisfiable sentences from the respective fragment. kind of arithmetic atoms very closely, namely around difference constraints, that is, atoms of the form xy c with universally quantified variables x, y, some integer c, and any relation ∈ {<, ≤, =, =, ≥, >}. On the one hand, we have shown decidability of BSR(BD), where every atom xy c needs to be conjoined with bounds c x ≤ x ∧ x ≤ d x ∧ c y ≤ y ∧ y ≤ d y regarding the range of x and y. On the other hand, we have shown that this fragment becomes undecidable as soon as we either drop the bounds on x and y, or as soon as we allow c to be an uninterpreted constant symbol or an existentially quantified variable.

For some of the undecidable fragments we have been able to show that satisfiability and unsatisfiability are not even semi-decidable (cf. Table 12.2). To this end, we have encoded the recurrence problem for two-counter machines, which required a ∀∃ quantifier alternation. Such a high degree of undecidability, has immediate consequences for automated reasoning. Whenever decision procedures cannot be constructed, then one could still hope for a semi-decision procedure in the form of a sound deductive calculus that is either complete -every logical consequence is derivable -or refutationally completelogical falsity is derivable from any inconsistent set of formulas. However, if a satisfiability problem or an unsatisfiability problem is even not semidecidable, then such calculi cannot exist -they have to be unsound or incomplete or even both. In this situation, the best one could hope for is sound heuristics that perform reasonably well on certain problem instances.

Apart from their theoretical value, such negative results are relevant for several areas of verification where variants and extensions of first-order arithmetic with uninterpreted function or predicate symbols play a role. In Section 11.5 we have elaborated on the implications for the Bernays-Schönfinkel fragment of separation logic, quantified theories of data structures, arrays in particular, and quantified combinations of the theory of equality over uninterpreted functions with fragments of Presburger arithmetic. Moreover, we have argued that in certain settings we cannot even hope for refutationally complete deductive calculi. In such cases we either have to content ourselves with heuristics instead of sound and complete reasoning methods or formulate restricted fragments having less hard (un)satisfiability problems.

Applications for the New Decidable Fragments and Future Work

We have already mentioned that BSR has found many applications, e.g. in the field of verification of hardware and software (cf. Section 12.1.1). Moreover, we have outlined applications for various fragments of first-order arithmetic with or without uninterpreted predicate and function symbols, see Chapter 8, in particular Remarks 8.0.1 and 8.0.2 and the part on related work at the end of the section; see also the beginning of Section 10.5, and Section 11.5. The application areas we have encountered so far include scheduling problems, program analysis, and modeling and verification of data structures and timed systems. In the light of this success, it seems likely that BSR(SLR) and BSR(BD) could turn out to be useful in a broad variety of applications as well. Since difference constraints have been of use in the analysis and verification of timed systems (cf. Remark 8.0.2), the idea suggests itself that BSR(BD) may find applications in this area. Indeed, we have shown in Section 10.5 that reachability for timed automata can be expressed with BSR(BD), although not entirely in a straightforward fashion. To this end, we have slightly relaxed the usual notion of synchronous progression of all clocks. Our modifications do not affect the reachability relation. It is to be expected that BSR(BD) lends itself to even more sophisticated applications in the area of timed systems or other fields. A further potential area of application for BSR(SLR) or BSR(BD) is the representation of temporal precedence in ontologies and, more general, temporal reasoning in knowledge representation. For instance, in [START_REF] Suda | On the Saturation of YAGO[END_REF][START_REF] Wischnewski | Efficient Reasoning Procedures for Complex First-Order Theories[END_REF] the authors have demonstrated that a core of the large ontology named YAGO [SKW08, HSBW13, RSH + 16] can be translated into a subfragment of BSR in a semantic-preserving way. This fragment was chosen, since reasoning procedures are available that work sufficiently well in practice. However, the authors also made clear that temporal information had to be disregarded at that time. Clearly, BSR(SLR) offers ways to encode temporal precedence and invites reasoning about temporal knowledge, if suitable calculi were to be developed and implemented, e.g. based on superposition modulo (linear) rational arithmetic [AKW09, EKK + 11, Kru13]. Very first steps have been proposed in [START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF], Section 5.

In Section 10.3 we have slightly shifted our perception of BSR(SLR) and looked at it from the perspective of the Nelson-Oppen combination framework. The setting then presented itself as a combination of existential linear rational arithmetic with the BSR theory enhanced with a dense linear ordering -notice that density is not finitely axiomatizable in BSR. As the interpreted predicate symbols <, ≤ are shared by the two constituent theories, our setting in fact lies beyond the scope of the Nelson-Oppen framework. Hence, the results we obtained in Section 10.3 constitute a contribution to the field of non-signature-disjoint combination frameworks. This particular point of view made it easy to describe extensions of BSR(SLR) for which satisfiability is still decidable. One such example is GBSR(SLR), which is based on the generalization of BSR presented in Chapter 3 (cf. Definition 10.3.3 and Corollary 10.3.4). Another example is the fragment described in Theorem 10.3.2. By Proposition 3.4.4, this immediately entails that also a combination with SF or MFO yields decidable satisfiability problems. This is one example showing that separateness of first-order variables also facilitates decidable extensions of decidable fragments in interpreted settings. It turns out that also the arithmetic side can be extended. For example, universal 12.2. FIRST-ORDER LINEAR ARITHMETIC WITH UNINTERPRETED PREDICATES 299 quantification can be allowed also on the arithmetic side under certain circumstances. Furthermore, one could consider polynomials over the real numbers (cf. Theorem 10.3.2), where quantifierelimination procedures are available. It seems likely that the combination-of-theories point of view has even more potential, which might be worth exploring further.

Although the case of BSR(BD) is different in the sense that it cannot be re-formulated as a combination of theories in an obvious way, it should be possible to extend it to a GBSR variant as well. On the other hand, it seems to be less clear how to extend the arithmetic side of BSR(BD) significantly so as to get a more expressive decidable fragment. This remains to be investigated in future work. However, this may require more advanced proof techniques. Our approach in Chapter 10 is based on the fact that it is sufficient to consider structures that are uniform with respect to a suitable equivalence relation ∼ that induces only finitely many equivalence classes. It might be necessary to go beyond uniformity. For example, one might consider "ultimately periodic" structures instead of ones that are uniform -an appropriate definition of the former should subsume the latter as a special case, and, more importantly, it should allow a description of the structure by finite means. A set S ⊆ Z is called ultimately periodic with period p if there is some t ∈ N such that for every r ≥ t we have r ∈ S if and only if r + p ∈ S, and for every r ≤ -t we have r ∈ S if and only if rp ∈ S. Such sets capture the expressiveness of Presburger arithmetic: A set of natural numbers is definable in Presburger arithmetic if and only if it is ultimately periodic ([End72], Theorem 32F). In the realm of the rational or real numbers one may have to add a second parameter g ∈ N ≥1 , for granularity, alongside the period and require some uniformity property similar to the following. Every interval q + d g , q + d+1 g with q, d ∈ Z and 0 ≤ d ≤ g -1 either entirely belongs to the periodic set or it is disjoint from the set. No matter how the definition is to be formulated in detail, the key property will be that any sets satisfying the property can be described by finite means with a computable bound regarding the length of the description, just like the uniform structures we have been using for BSR(SLR) and BSR(BD).

Another possible direction for extending BSR(SLR) or BSR(BD) is the addition of uninterpreted function symbols. Steps in this direction have been made, e.g. in [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF][START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF] over the integer domain and essentially for stratified vocabularies (cf. Section 3.14.2). Both approaches yield extensions of the array property fragment (cf. Remark 8.0.1). From that fragment it is known that arithmetic atoms need to be more restricted than in BSR(SLR). For instance, atoms of the form ¬x < y with universally quantified integer variables x, y are not admitted in clauses but ¬x ≤ y is. Not adhering to these restrictions yields an undecidable satisfiability problem, cf. Theorem 2.4.2 in [START_REF] Bradley | Safety Analysis of Systems[END_REF] and Theorem 11.16 in [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF].

Finally, there are plenty of decidable first-order fragments besides BSR and its separated extensions SF and GBSR that might serve as a basis for decidable fragments of first-order arithmetic with uninterpreted predicate or function symbols, see Chapter 3. There is quite some research to be done in this direction.

12.2.2 Automated Reasoning in Practice: Instantiation Methods for BSR(SLR) and BSR(BD)

As the analysis of the computational complexity of decision problems mostly focuses on worst-case scenarios, it hardly comes as a surprise that solving problem instances originating from practical applications does not necessarily need as much time or space as the theoretical worst-case analysis would predict. It is meanwhile a broadly accepted fact that automated reasoning in propositional logic, quantified Boolean logic, the Bernays-Schönfinkel fragment, or combinations of theories, to name a few prominent examples, can be feasible in practice. This is in spite of the fact that the traditional narrative of complexity theory claims that problems beyond the NP-hardness barrier ought to be considered infeasible. Thanks to a great engineering effort over the last decades, we have potent methodologies available today to make automated reasoning work in practice, see [RV01, Bie09, CHVB18, HS18] Instantiation of universally quantified variables is one technique that is being used in automated reasoning tools [KS10, Kor13a, RKK17, Bar17, RBF18], e.g. for reasoning in the Bernays-Schönfinkel-Ramsey fragment or linear arithmetic. Moreover, instantiation is the method of choice to decide satisfiability for the array property fragment in [START_REF] Bradley | What's Decidable About Arrays? In Verification, Model Checking, and Abstract Interpretation[END_REF][START_REF] Bradley | Safety Analysis of Systems[END_REF][START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF], for instance. Independently from these developments, but yet along the same lines, the author of the present thesis and two co-authors have devised improved instantiation methods for close relatives of BSR(SLR) [START_REF] Voigt | Bernays-Schönfinkel-Ramsey with Simple Bounds is NEXPTIME-complete[END_REF][START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF], which is, in turn, related to the array property fragment. The approach should be transferable to BSR(SLR) and BSR(BD) but will most likely get slightly more complicated. We shall outline the key ideas below. A full presentation of the results lies beyond the scope of the present thesis.

We shall concentrate on subfragments of BSR(SLR) over the rational and the integer domain where the main syntactic restriction is the following. In addition to the restrictions imposed by the definition of BSR(SLR) (Definition 10.0.1), we restrict the options for the predicate symbol in arithmetic atoms of the form x y to ≤, =, or ≥, whenever x, y are universally quantified variables of sort Q or Z. The rationale behind this restriction is twofold: simplicity and (practical) efficiency of instantiation. The key difference is that we do not have to handle ∼-equivalent tuples of rationals but it is sufficient to consider individual rational numbers -one-tuples so to say. In the two-dimensional case illustrated in Figure 12.2, this means that we can safely ignore the triangles that emerge around the diagonal and rather only consider a division of the rational plane into bounded and unbounded rectangular regions. It is to be expected that there are also good instantiation techniques for BSR(SLR) without additional syntax restrictions and also for BSR(BD). This direction of research is left for future work. The improved instantiation methods presented in [START_REF] Voigt | Bernays-Schönfinkel-Ramsey with Simple Bounds is NEXPTIME-complete[END_REF][START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF] are based on (i) a detailed analysis of which arguments of predicate symbols are affected by which arithmetic constraints, (ii) optimizations inspired by well-established quantifier-elimination techniques which concern the kind of constraints that need to be taken into account, and (iii) the observation that we can apply different optimizations for sufficiently disconnected argument positions. All in all, one can significantly reduce the number of instances that need to be generated to decide satisfiability, compared to the number of instances less sophisticated instantiation methods produce that are used to decide satisfiability for similar logic fragments, see, for example, [START_REF] Bradley | What's Decidable About Arrays? In Verification, Model Checking, and Abstract Interpretation[END_REF][START_REF] Bradley | Safety Analysis of Systems[END_REF][START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF].

Example 12.2.1. Consider the sentence ϕ := ∃z∀ux 1 x 2 y 1 y 2 . x 2 = 5 ∧ R(x 1 ) → Q(u, x 2 ) ∧ y 1 < 7 ∧ y 2 ≤ 2 → Q(z, y 2 ) ∨ R(y 1 ) where the variables z and u are of an uninterpreted sort and the x i , y i are of sort Z. The results presented in [START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF]

  b∈S ∃y. ηb(v, y) . Finally, we can shift all quantifiers to the front again and thus obtain the sentence ϕ 2 := ∃v S1 . . . v Sm ∃ȳ S1 . . . ȳSm ∀u∀x. S⊆{0,1} n b∈S χb(u, xb) → b∈S ηb(v S , y S, b) ,

  (a) The sets x ∪ x and ȳ ∪ ȳ are strictly separated in ψ . (b) The quantifier alternation caused by the ∀ * ∃ * prefix in ∀x∃ȳ. ψ vanishes in ψ . More precisely, for any subformula χ in ψ of the form Qu. . . . (Q v. . . .) . . . with Q = Q

  unit and, employing distributivity of ∧ over ∨, transform ϕ (5) into a disjunction of conjunctions ϕ (6) := s r1 χ

  with S A,j ∈ S A,j+1 and B answers by picking some b (j) S B,j ∈ S B,j+1 . Hence, in the last round the chosen domain elements a (1) S A,1 and b (1) S B,1 are such that S A,1 and S B,1 are both nonempty subsets of [4n]. Player A wins if and only if

  1 . Hence, we can construct the chain i * ∈ S A,1 ∈ . . . ∈ S A,n , by definition of the allowed moves. This entails A, [x 1 →a (1) S A,1 , . . . , x n →a (n) S A,n ] |= P i * (x 1 , . . . , x n ). On the other hand, we know A, [y 1 →b (1) S B,1 , . . . , y n →b (n) S B,n ] |= Q i * (y 1 , . . . , y n ), because of i * ∈ S B,1 . Hence, A wins and the chosen strategy cannot be a winning strategy for B.

  Claim II: For any of the b (k) S the substructure of A induced by the domain A \ {b (k) S } does not satisfy ϕ.

  x . χ * . Consequently, we can extend A to a model A * A * (over the same domain) of the Skolemized sentence ϕ Sk := ∀x 1 . . . x . χ * y 1 /c 1 , . . . , y m /c m by adding c A * j := c j for j = 1, . . . , m. On the other hand, every model of ϕ Sk is also a model of ϕ * . The vocabulary underlying ϕ Sk comprises exactly the constant symbols c 1 , . . . , c m and does not contain any other function symbols. Suppose m < n k=1 2 ↑k (n). Hence, there is some b (k) S with S ∈ S k such that for every j we have c A * j = b (k) S . By the Substructure Lemma, the following substructure B of A * constitutes a model of ϕ Sk : B

  (a) If τ (x, y) = D and τ (x + 1, y) = D , then D, D ∈ H. (b) If τ (x, y) = D and τ (x, y + 1) = D , then D, D ∈ V.

Figure 3 . 3 :

 33 Figure 3.3: Nesting of quantifier blocks in the formula ϕ (2n) .

Figure 3 . 4 :

 34 Figure3.4: Illustration of the nesting of quantifier blocks in ϕ (2n) after narrowing the scopes of universal quantifiers with respect to the sets V 1 , . . . , V m that are pairwise separated in ϕ (2n) . The sets U j,h denote the intersection X j ∩ V h .

  for every i, 0 ≤ i ≤ k, we have vars(At(k) i ) ⊆ ȳ1 ∪ . . . ∪ ȳi ∪ xi+1 ∪ . . . ∪ xn , and

  ∃ȳ k ∃ū k by setting ūk := ȳk ∩ x∈x U x and ȳk := vk \ ūk . Condition (a) of Definition 3.7.1 is satisfied due to the following observations. By definition of at 0 and the at x we have vars(At 0 ) ∩ x = ∅. By virtue of Claim I(iii) and the above partition of the vk into ȳk and ūk , we have ūk ∩ vars(At 0 ) = ∅ for every k. Hence, vars(At 0 ) ⊆ ȳ1 ∪ . . . ∪ ȳn . Condition (b) of Definition 3.7.1 follows because of the way we partition the vk into ȳk , ūk . Any variable v ∈ v ∩ vars(At x ) with index idx(v) = k belongs to U x if and only if k ≥ idx(x). Hence, we have v ∈ ȳk if and only if k < idx(x), and we have v ∈ ūk otherwise. Moreover, Claim I(ii) states that x is the only variable from x that occurs in At x . Condition (c) of Definition 3.7.1 follows immediately from Claim I(iv) and the fact that ū1 ∪ . . . ∪ ūn = x∈x U x .

  x, ȳ) for some tuple c ∈ D |ȳ| . In other words, we have A, β |= ∀x ∃ȳ. χ j (z, x, ȳ) which entails A, β |= ψ. Hence, we have shown that A, β |= ψ implies A, β |= ψ.

  . The sentence ϕ belongs to the generalized Gödel-Kalmár-Schütte fragment (GGKS) if and only if the following conditions are satisfied.

  in case n is sufficiently large. Let D * ⊆ D D * be the set that comprises exactly those elements. In other words, we have |D * | ≥ 2 2 n and for every b (2) S ∈ D * there is some pair c 1 , c 2 and some tuple b containing b (2)

S

  A,j with S A,j ∈ S A,j+1 and B answers by picking some b (j) S B,j with S B,j ∈ S B,j+1 . Hence, in the last round the chosen domain elements a (1) S A,1 and b (1) S B,1 are such that S A,1 and S B,1 are both nonempty subsets of [4n]. Player A wins if and only if

  a loose guard, there are variables u ∈ ū and v ∈ V and v ∈ V and atoms A , A such that u co-occurs with v in A and u co-occurs with v in A . Because of A, β |= A ∧ A , we must have β vars(A ) ⊆ A a and vars(A ) ⊆ A b . Hence, β(u) ∈ A a ∩ A b . But this contradicts the fact that A a and A b are disjoint.

S

  for exactly one y * ∈ ȳ and for every v ∈ ȳ ∪ z different from y * we have β S (v) ∈ A b \ A b,n . Moreover, we have ( * ) B, β S |= γ S (ȳ, z) ∧ χ S (ȳ, z) and B, β |= γ S (ȳ, z) ∧ χ S (ȳ, z) for every β that differs from β S only in the value assigned to y * . The tuple β S (z) represents a sequence cS cS of domain elements from A b that can be completed to a chain b (1) T1 , . . . , b (n-1) Tn-1 , b

S

  | S ∈ S 2 } can be partitioned into at most 2 κ parts, each containing elements that are indistinguishable by their belonging to the sets R B k . Let D D be the largest of these parts and let S := {S | b (2) S ∈ D}. Hence, for all b, b ∈ D and every k with 1

  there is some S * ∈ S such that for every T ∈ S * there is some S ∈ S \ {S * } with T ∈ S . Claim III follows by definition of D and S. ♦ We fix some S * ∈ S as described in Claim III. S * , B * , J Let B -S * be the substructure of B induced by the domain B * := B\ b

  |= η j (x, y) and B, [x →c, y →d] |= η j (x, y) for every d ∈ B \ {b (2) S * }. Regarding the domain element c, we distinguish two cases. Consider any j ∈ J and any c ∈ B * \ {b (1) S | S ∈ S 1 } for which we have B, [x →c, y →d] |= η j (x, y) for every d ∈ B * . Let S be some set from S that is different from S * and for which c = b (2) S .

S

  | S ∈ S 2 }, including b (2) S * and b (2) S . Since all other nonequational atoms occurring in η j are monadic and because of b (2) S * , b (2) S ∈ D, we conclude the following. For every non-equational atom A occurring in η j we have B, [x →c, y →b (2) S * ] |= A(x, y) if and only if B, [x →c, y →b (2) S ] |= A(x, y). Consider any equation x ≈ y. Because of c ∈ B -S * , we have B |= c ≈ b (2) S * . On the other hand, we also have B -S * |= c ≈ b (2) S . But then, we all in all get B -S * , [x →c, y →b (2)

  S * ] |= A(x, y) and B, [x →b (1) T , y →b (2) S ] |= A(x, y). For every monadic atom A occurring in η j we have B, [x →b (1) T , y →b (2) S * ] |= A if and only if B, [x →b (1) T , y →b (2) S ] |= A . All in all, this leads to B, [x →b (1) T , y →b (2) S * ] |= η j (x, y) if and only if B, [x →b (1) T , y →b (2) S ] |= η j (x, y) . Therefore, we get B -S * , [x →b (1)

  .6. The domain of A shall be A := {a, b, c, d, e}, and we set a A := a and b A := b. The predicate symbols are interpreted by P A := {a, c}, Q A := {b, d}, R A := {c, d, e}. Moreover, we define f A (a, a) := c f A (a, c) := c f A (c, a) := c f A (c, c) := c f A (b, b) := d f A (b, d) := d f A (d, b) := d f A (d, d) := d.

  a: a terms yielding b: b terms yielding c: f (a, a), f (f (a, a), a), f (a, f (a, a)), . . . terms yielding d: f (b, b), f (b, f (b, b)), f (f (b, b), b), . . . terms yielding e: f (a, b), f (b, a), f (a, f (a, b)), . . .

Figure

  Figure 3.6: Illustration of the model A of ϕ from Example 3.14.9.

  xn →ā n , ȳ1 →σ 1 (ā 1 ), . . . , ȳn →σ n (ā 1 , . . . , ān )] |= ψ holds for every choice of tuples ā1 ∈ A |x1| , . . . , ān ∈ A |xn| . For all ā1 , . . . , ān with āi ∈ A |xi| we denote by out σ (ā 1 , . . . , ān ) the set out σ (ā 1 , . . . , ān ) A(x 1 , . . . , xn , ȳ1 , . . . , ȳn ) ∈ At A |= A ā1 , . . . , ān , σ 1 (ā 1 ), . . . , σ n (ā 1 , . . . , ān ) , called the outcome of ā1 , . . . , ān under σ. By Out σ Out σ we denote the set of all possible outcomes under σ, i.e. Out σ := out σ (ā 1 , . . . , ān ) āi ∈ A |xi| .

  Lemma 4.2.3. If a strategy σ is satisfying for ϕ under A, then σ is satisfying for ϕ under A| σ .Proof. It is easy to show by induction on the structure of ϕ that for every variable assignment β over A| σ 's domain A, β |= ϕ implies A| σ , β |= ϕ. Since σ is satisfying for ϕ under A, we have A, [x 1 →ā 1 , . . . , xn →ā n , ȳ1 →σ 1 (ā 1 ), . . . , ȳn →σ n (ā 1 , . . . , ān )] |= ϕ for any choice of tuples ā1 , . . . , ān with āi ∈ (A| σ ) |xi| ⊆ A |xi| . Hence, we get A| σ , [x 1 →ā 1 , . . . , xn →ā n , ȳ1 →σ 1 (ā 1 ), . . . , ȳn →σ n (ā 1 , . . . , ān )] |= ϕ for any choice of ā1 , . . . , ān with āi ∈ (A| σ ) |xi| . In other words, σ is satisfying for ϕ under A| σ .

.

  Having all the representatives α k, S (k) 0 ,...,S (k) k-1 at hand, we inductively construct τ , starting from τ 1 and going to τ n .Let k = 1. For every b1 ∈ A |x1| we set τ 1 ( b1 ) := σ 1 (α 1, S0 ), where S 0 := µ 0,1 b1 .Let k > 1. For all tuples b1 ∈ A |x1| , . . . , bk ∈ A |x k | we set τ k ( b1 , . . . , bk ) := σ k (c 1 , . . . , ck ), where c1 , . . . , ck := α k, S (k) 0 ,...,S = µ 0,j b1 , . . . , bj for every j, 0 < j ≤ k, S

  i, 1 ≤ i ≤ , and all j, j , 1 ≤ j, j ≤ . Hence, we can write c1 , . . . , c instead of c(j) 1 , . . . , c(j) 1 (for any j). Therefore, (b) entails S = µ ,k τ 1 ( b1 ), . . . , τ ( b1 , . . . , b ), b +1 , . . . , bk = µ ,k σ 1 (c 1 ), . . . , σ (c 1 , . . . , c ), b +1 , . . . , bk . Consequently, S ∈ im σ (µ ,k ). ♦

  the last equation follows from ( * )). Due to S 0,k ∈ P n-k+1 At 0 , . . . , S k-2,k ∈ P n-k+1 At k-2 , and S k-1,k ∈ P n-k+1 At k-1 , Condition (ii) of Definition 3.4.1 entails pairwise disjointness of the sets vars(S 0,k ) ∩ x, . . . , vars(S k-2,k ) ∩ x, and vars(S k-1,k ) ∩ x. Consequently, we can define a new tuple d k by setting

  Claim I: Let , k be two integers with 0 ≤ < k < n. For all tuples ā1 , . . . , ā , b +1 , . . . , bk with āi ∈ A |ȳi| and bi ∈ A |xi| for every i we observe that, if vars(At )∩ xk+1 = ∅, then µ ,k (ā 1 , . . . ,ā , b +1 , . . . , bk ) = 1 and, consequently, |im σ (µ ,k )| ≤ |im σ (µ ,k+1 )|. Proof: Suppose there are sets S 1 , S 2 ∈ µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk ) that are distinct. Hence, there are tuples ck+1 , dk+1 ∈ A |x k+1 | such that S 1 = µ ,k+1 (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 ) and S 2 = µ ,k+1 (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 ). But since xk+1 ∩ vars(At ) = ∅, Claim II from the proof of Lemma 4.2.7 entails S 1 = S 2 . This contradicts our assumption that S 1 and S 2 are distinct. Consequently, µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk ) contains at most one set. It remains to show that µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk ) is nonempty.This is easily done by induction on k < n, starting from k = n -1. ♦ Claim II: Let , k be two integers with 0 ≤ < k < n. We have |im σ (µ ,k )| ≤ 2 |imσ(µ ,k+1 )| . Proof: For all tuples b1 , . . . , . . . , bk with bi ∈ A |xi| and for every S ∈ µ ,k (σ 1 ( b1 ), . . . , σ ( b1 , . . . , b ), b +1 , . . . , bk ) we know that S = µ ,k+1 (σ 1 ( b1 ), . . . , σ ( b1 , . . . , b ), b +1 , . . . , bk , ck+1 ) for some tuple ck+1 . Hence, µ ,k (σ 1 ( b1 ), . . . , σ ( b1 , . . . , b ), b +1 , . . . , bk ) ⊆ im σ (µ ,k+1 ). ♦ Due to Claim I and Claim II, we observe that ( * ) for all integers , k with 0 ≤ < k ≤ n we obtain |im σ (µ ,k )| ≤ 2 ↑∂ ∀ (ϕ)+1 (|At |).

Figure 4 . 1 :

 41 Figure 4.1: Illustration of the structure A. An arrow from a to b indicates a, b ∈ R A . The annotated existential quantifiers indicate which elements could be selected by a satisfying strategy. All domain elements above the dotted line belong to Q A , the elements below do not.

  Claim I: Let k be any positive integer with k ≤ n and let b1 , . . . , bk-1 , āk be tuples with bi ∈ A |ȳi| for every i and āk ∈ A |x k | . Let S 1 , . . . , S |x k | := λ k,0 ( b1 , . . . , bk-1 , āk ). Consider any fingerprint T = S 1 , . . . , S |x k | for which we have S i ∈ S i for every i. There exists some tuple ck ∈ A |ū k | such that λ k,k ( b1 , . . . , bk-1 , āk , ck ) = T . Proof: Recall that for every x i in xk = x 1 , . . . , x |x k | we have defined the notation U xi := vars(At xi ) ∩ ū. By definition of the fingerprint functions λ x,0 , for every x i the fact that S i ∈ λ xi,0 ( b1 , . . . , bk-1 , āk ) entails the existence of some tuple cxi ∈ A |ū k | such that λ xi,k ( b1 , . . . , bk-1 , āk , cxi ) = S i . Since we have U xi ∩ U xj = ∅ for all i = j, we can merge the tuples cx1 , . . . , cxx k into one tuple ck of length |ū k | in such a way that λ xi,k ( b1 , . . . , bk-1 , āk , ck ) = S i holds for every x i . Then, ck is the sought tuple. ♦ Claim II: Let k and be positive integers with 1 ≤ k ≤ ≤ n-1. Let b1 , . . . , bk-1 , āk , ck , . . . , c be tuples with bi ∈ A |ȳi| for every i, āk ∈ A |x k | , and cj ∈ A |ūj | for every j. Let S 1 , . . . , S |x k | := λ k, ( b1 , . . . , bk-1 , āk , ck , . . . , c ). Consider any fingerprint T = S 1 , . . . , S |x k | for which we have S i ∈ S i for every i. There exists some tuple c +1 such that λ k, +1 ( b1 , . . . , bk-1 , āk , ck , . . . , c , c +1 ) = T . Proof: Analogous to the proof of Claim I. ♦ For k = 1, . . . , n we define A k as abbreviation of A |x1| × . . . × A |x k | . A k α ...

  Theorem 4.3.5. Every satisfiable relational GAF sentence ϕ := ∀x 1 ∃ȳ 1 ū1 . . . ∀x n ∃ȳ n ūn . ψ in standard form with quantifier-free ψ has a model with at most p(len(ϕ)) 2|x| • 2 ↑n+1 (|At|) 2|x|+2 elements, where p is some polynomial, x := x1 ∪ . . . ∪ xn , ȳ := ȳ1 ∪ . . . ∪ ȳn and where we assume |x| ≥ 1 and |ȳ| ≥ 1.

  Claim I: Consider any positive integer and two tuples b1 , . . . , b ∼ d1 , . . . , d with bi , di ∈ A |xi| . For every k with ≤ k ≤ n and all d +1 , . . . , dk with di ∈ A |xi| we have b1 , . . . , b , d +1 , . . . , dk ∼ d1 , . . . , dk .

  Based on the strategy σ = σ 1 , . . . , σ n , we construct a new strategy τ := τ 1 , . . . , τ n τ = τ 1 , . . . , τ n withτ i : B |x1| × . . . × B |xi| → B |ȳi| × B |ūi| as follows.Consider any tuple ā ∈ B |x1| . Let C := [ā ↓ ] ∼ ⊆ A 1 be the equivalence class to which ā↓ belongs and let c := α C be the distinguished representative in C. We define τ 1 in such a way that(a) τ 1 1 (ā) ↓ = σ 1 1 (c ) and τ 2 1 (ā) ↓ = σ 2 1 (c), (b) every domain element b in the tuple τ 1 1 (ā) belongs to D -1,C,y where y is the variable in ȳ1 to which b corresponds, and (c) for every x ∈ x1 we have that if the corresponding a ∈ ā stems from D i then every element b in the tuple τ 2 1 (ā) that corresponds to some variable u ∈ U x ∩ ū1 is taken from D (i+1 mod 3),C,u . Let k > 1. Consider any sequence of tuples ā1 , . . . , āk with āi ∈ B |xi| . Let C := [ ā↓ 1 , . . . , ā↓ k ] ∼ ⊆ A k be the equivalence class to which ā↓ 1 , . . . , ā↓ k belongs and let c1 , . . . , ck := α C be the distinguished representative in C. We define τ k in such a way that the following conditions are met: (a) τ 1 k (ā 1 , . . . , āk ) ↓ = σ 1 k (c 1 , . . . , ck ) and τ 2 k (ā 1 , . . . , āk ) ↓ = σ 2 k (c 1 , . . . , ck ). (b) Every domain element b in τ 1 k (ā 1 , . . . , āk ) belongs to D -1,C,y , where y is the variable in ȳk to which b corresponds.

(

  I) Consider any two variables y 1 ∈ ȳk1 , y 2 ∈ ȳk2 . By definition of τ , β(y 1 ) = β (y 2 ) entails (a) β(y 1 ) ↓ = β (y 2 ) ↓ , (b) k 1 = k 2 and y 1 = y 2 , (c) ā↓ 1 , . . . , ā↓ k1 ∼ ā 1 ↓ , . . . , ā k1 ↓ , and (d) T i = T i and ci = c i for every i with 1 ≤ i ≤ k 1 .

  we have A, γ |= ψ. Consider any atom A that occurs in ϕ. By definition of B, we have B, β |= A if and only if A, γ |= A. This together with A, γ |= ψ entails B, β |= ψ. Consequently, under B τ is satisfying for ϕ. ♦ Let T τ ⊆ B T τ , T k be the target set of τ , given by T τ := n k=1 T k where T k := b ∈ B there are tuples ā1 , . . . , āk such that τ 1 k (ā 1 , . . . , āk ) = . . . , b, . . . or τ 2 k (ā 1 , . . . , āk ) = . . . , b, . . . . Finiteness of the set T τ follows from the following observations: Let S σ be the set S σ := n k=1 S k where S k := b ∈ A there is some equivalence class C ∈ (A 1 ∪ . . . ∪ A n )/ ∼ and its distinguished representative c1 , . . . , ck := α C such that σ 1 k (c 1 , . . . , ck ) = . . . , b, . . . or σ 2 k (c 1 , . . . , ck ) = . . . , b, . . . . Since the equivalence relation ∼ induces only finitely many equivalence classes C on the set A 1 ∪ . . . ∪ A n , the set S σ is finite. By definition of the mappings τ 1 k and τ 2 k , we have b ↓ ∈ S σ for every b ∈ T τ . The domain of B consists of finitely many subdomains D i , each of which comprises finitely many copies of the original domain A. Hence, there are only finitely many domain elements b ∈ B with b ↓ ∈ S σ . Altogether, this entails that the target set T τ is finite.

Figure 4 . 2 :

 42 Figure 4.2: Illustration of the structure C. The arrows indicate R C , as in Figure 4.1. The annotated existential quantifiers indicate the elements selected by the strategy τ . All elements above the dotted line belong to Q C , the others do not.

  (a) len(ϕ prop ) ≤ len(ϕ) and ϕ prop ≤ ϕ . (b) If ϕ is a Horn formula, then ϕ prop is Horn. (c) If ϕ is a Krom formula, then ϕ prop is Krom.

  (a) every model A of ϕ contains a substructure that can be extended to a model B of ϕ ∧ T (ϕ) over the same domain, (b) from any model B of T (ϕ) we can construct a model A of ϕ whose domain contains at most as many elements as B's domain does, (c) len(T (ϕ)) ∈ O len(ϕ) 3 and T (ϕ) can be computed deterministically in polynomial time, (d) if ϕ is Horn, then T (ϕ) is Horn as well.

  c) , ψ trans := c,d,e ∈ Ω E(c, d) ∧ E(d, e) → E(c, e) . Let ψ cong be the conjunction of all ground formulas of the form E(c 1 , d 1 ) ∧ . . . ∧ E(c m , d m ) ∧ P (c 1 , . . . , c m ) → P (d 1 , . . . , d m ) where c 1 , d 1 , . . . , c m , d m ∈ Ω and P is an m-ary predicate symbol in ϕ Sk . We write ψ cong to denote the restriction of ψ cong to formulas E(c 1 , d 1 ) ∧ . . . ∧ E(c m , d m ) ∧ P (c 1 , . . . , c m ) → P (d 1 , . . . , d m ) whose constituents P (c 1 , . . . , c m ) and P (d 1 , . . . , d m ) actually occur in ϕ Sk (and are distinct). Let ϕ be the result of replacing every equation c ≈ d in ϕ Sk with the atom E(c, d).

c A 1 ,

 1 a 1 , . . . , c A m , a m ∈ E A and B |= P (c 1 , . . . , c m ). Due to ( * ), we know that A |= ϕ still holds. By construction of A, we moreover observe A |= ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong . ♦ We set T (ϕ) := ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong for every ∃FO sentence ϕ. It is easy to see that if ϕ is Horn then T (ϕ) is Horn as well. Moreover, the length of T (ϕ) is bounded from above by k • len(ϕ) + |Ω| 3 + len(ϕ) • |At(ϕ Sk )| 2 for some positive integer k, where At(ϕ Sk ) denotes the set of all non-equational atoms that occur in ϕ Sk . Proposition 5.1.4.

  (i) Satisfiability for ∃FO is NP-complete.

  (a) len(ϕ) ∈ O len(ϕ prop ) and ϕ is computable deterministically in polynomial time. (b) If ϕ prop is a Horn formula, then ϕ is Horn. (c) If ϕ prop is a Krom formula, then ϕ is Krom.

  ∃ * -Krom-SF-Sat without equality

  (a) If τ (x, y) = D and τ (x + 1, y) = D , then D, D ∈ H. (b) If τ (x, y) = D and τ (x, y + 1) = D , then D, D ∈ V.

  (c) τ (i, 0) = D i for i = 0, . . . , n -1.

≺ - 1

 1 b p comprising all elements in I -1 . Moreover, we observe A |= MinIdx( -1, b 1 ) and A |= MaxIdx( -1, b p ). Hence, by Lemma 5.3.21, we can arrange all mappings in F -1 into a sequence f 1 -1 . . . -1 f p where p = 2 p-1 + 1. Clearly, f 1 maps every element b ∈ I -1 to f 1 (b) = 0, and f p maps every element b k with k < p to f p (b k ) = 0 and b p to f p (b p ) = 1. By A |= ψ 3 ∧ ψ 10 , we know that A |= J( , d , b, 0) for every b ∈ I -1 . Hence, d A ∈ S ,f1 .

η 4 :

 4 = ∀xyx . MaxIdx(κ, x) ∧ MinIdx(κ, x ) → H(x, y, x , y) η 5 := ∀xyx y . H(x, y, x , y ) ∧ MaxIdx(κ, x) → MinIdx(κ, x ) η 6 := ∀xyx y . H(x, y, x , y ) ∧ MinIdx(κ, x ) → MaxIdx(κ, x)

η

  13 := D∈D ∀xy. D(x, y) → L(κ, x) ∧ L(κ, y) η 14 := D∈D D ∈D\{D} ∀xy. D(x, y) → ¬D (x, y) η 15 := ∀xx y. H(x, y, x , y) → D,D ∈H D(x, y) ∧ D (x , y) η 16 := ∀xyy . V (x, y, x, y ) → D,D ∈V D(x, y) ∧ D (x, y )

  Lemma 5.3.24. For all pairs a, b , a , b ∈ I 2 κ we observe the following properties. (i) a, b ≺ H a , b entails that b = b and that either a ≺ κ a , or a = e A κ and a = d A κ . (ii) a = e A κ and a = d A κ entails a, b ≺ H a , b for every b ∈ I κ . (iii) a ≺ κ a implies a, b ≺ H a , b for every b ∈ I κ . (iv) a, b ≺ V a , b entails that a = a and that either b ≺ κ b or b = e A κ and b = d A κ . (v) b = e A κ and b = d A κ entails a, b ≺ V a, b for every a ∈ I κ . (vi) b ≺ κ b implies a, b ≺ V a, b for every a ∈ I κ . Proof. Property (i) follows by A |= η 1 ∧ η 2 ∧ η 5 ∧ η 6 . Property (ii) follows by A |= η 4 . In order to show Property (iii), we have to argue a bit more. First of all, we conclude a = e A κ , by A |= ψ 2 ∧ ψ 4 . Because of A |= η 3 and Lemma 5.3.23(i), for all a, b with a = e A κ there must exist a, b, a ∈ I κ such that a ∼ κ a, b ∼ κ b, and a, b ≺ H a , b . Due to Lemma 5.3.20 in combination with Lemma 5.3.23(v), we get a = a and b = b. Thus, we have a, b ≺ H a , b . Moreover, a = e A κ together with (i) leads to a ≺ κ a . Since we assumed a ≺ κ a , Lemma 5.3.23(vi) says that a is the only element satisfying a ≺ κ a , i.e. a = a . Consequently, we have a, b ≺ H a , b .

  5.3.26. Suppose that D, H, and V are nonempty. For all pairs a, b ∈ I 2 κ we have A |= D(a, b) for exactly one D ∈ D. Proof. Due to A |= η 15 ∧ η 16 , we observe the following properties for all pairs a, b , a , b ∈ I 2 κ : a, b ≺ H a , b implies that there are D, D ∈ D such that D, D ∈ H and A |= D(a, b) and A |= D (a , b ); a, b ≺ V a , b implies that there are D, D ∈ D such that D, D ∈ V and A |= D(a, b) and A |= D (a , b ). By virtue of Lemma 5.3.25, we know that there is a bijection ρ such that for every pair a, b in the image of ρ there is another pair a , b such that a, b ≺ H a , b or a, b ≺ V a , b . Since the image of ρ covers the entire set I 2 κ , this means that there is at least one D ∈ D for every pair a, b ∈ I 2 κ such that A |= D(a, b). Finally, because of A |= η 14 we know that there is at most one D ∈ D for every pair a, b ∈ I 2 κ such that A |= D(a, b). Lemma 5.3.27. Let r := 2 ↑κ (µ -1) + 1 and assume that D, H, and V are nonempty. A induces a tiling τ of Z 2 r with initial condition D := D 1 , . . . , D n . Proof. Let ρ be a bijection according to Lemma 5.3.25. We define the mapping τ τ such that τ (s, t) := D if and only if ρ(s, t) = a, b and A |= D(a, b). By Lemma 5.3.26, we know that τ is well defined. By A |= η 17 ∧ η 18 , we know that A |= D i (a, b) for a, b = ρ(i, 0) and i = 0, . . . , n -1. Hence, τ satisfies the initial condition. By definition of ρ and because of A |= η 15 ∧ η 16 , we observe the following: (a) For every pair s, t ∈ Z 2 r there are pairs D, D ∈ H, a, b = ρ(s, t), and a , b = ρ(s + 1, t) such that A |= D(a, b) and A |= D (a , b ). (b) For every pair s, t ∈ Z 2 r there are pairs D, D ∈ V, a, b = ρ(s, t), and a , b = ρ(s, t + 1) such that A |= D(a, b) and A |= D (a , b ).

  Theorem 6.1.1 (Craig-Lyndon interpolation for GBSR and SF). Let ϕ and ψ be GBSR or SF sentences without equality. If ϕ |= ψ, then there exists a BS sentence χ (without equality) such that (i) ϕ |= χ and χ |= ψ, and (ii) any predicate symbol P occurs positively (negatively) in χ only if it occurs positively (negatively) in ϕ and in ψ.

  Definition 6.1.6 (Ordered resolution with selection, based on O S [BG01]). Let lpo be an LPO and let sel be a selection function for literals, i.e. given any clause C, sel(C) is a subset of negative literals from C. The following two inference rules constitute a variant of the ordered resolution calculus with selection O S , due to Bachmair and Ganzinger ([BG01], Section 4.3). We use A, B to denote first-order atoms and C, D to denote first-order clauses. The clauses above the vertical lines are the premises and the clauses below the line are the conclusion of the respective rule. C ∨ A ¬B ∨ D binary resolution Cθ ∨ Dθ where (a) θ is an mgu of A and B, (b) Aθ is strictly maximal in Cθ ∨ Aθ, i.e. for every literal L in C we have Aθ lpo Lθ, (c) nothing is selected in C ∨ A, i.e. sel(C ∨ A) = ∅, and (d) either ¬B is selected in ¬B ∨ D, i.e. ¬B ∈ sel(¬B ∨ D), or nothing is selected in ¬B ∨ D and ¬Bθ is maximal in ¬Bθ ∨ Dθ, i.e. for every literal L in D we have ¬Bθ lpo Lθ. C ∨ A ∨ B positive factorization Cθ ∨ Aθ where (a) θ is an mgu of A and B, (b) Aθ is maximal in Cθ ∨ Aθ ∨ Bθ, and (c) nothing is selected in C ∨ A ∨ B.

  Proposition 6.1.7 (Soundness of O S , [BG01, SBTW18]). Let C, D, E be variable-disjoint clauses and let x := vars(C), ȳ := vars(D), and z := vars(E).

  ∃ū ∀v∃ w. ϕ |= false if and only if ∃ū ∀v∃ w. ϕ |= false, ¬∃ȳ ∀x ∃z. ψ |= false if and only if ¬∃ȳ ∀x ∃z. ψ |= false, and ∃ū ∀v∃ w. ϕ ∧ ¬ ∃ȳ ∀x ∃z. ψ |= false if and only if ∃ū ∀v∃ w. ϕ ∧ ¬ ∃ȳ ∀x ∃z. ψ |= false.Let ϕSk := ∀v. ϕ u 1 /c 1 , . . . , u |ū| /c |ū| , w 1 /f 1 (v), . . . , w | w| /f | w| (v) ϕ Sk , ψ Skwhere the c i are fresh Skolem constants and the f i are fresh unary Skolem functions. Moreover, let ψ Sk := ∀ȳz. ¬ ψ x/g(ȳ) where the g is a fresh Skolem function of arity |ȳ|. Hence, ϕ Sk ∧ ψ Sk is a Skolemized variant of ∃ū ∀v∃ w. ϕ ∧ ∀ȳ ∃x ∀z. ¬ ψ , which is equivalent to ∃ū ∀v∃ w. ϕ ∧ ¬ ∃ȳ ∀x ∃z. ψ . Therefore, we observe ϕ ∧ ¬ψ |= false if and only if ∃ū ∀v∃ w. ϕ ∧ ∀ȳ ∃x ∀z. ¬ ψ |= false if and only if ϕ Sk ∧ ψ Sk |= false .

  any Skolem function f occurring in ϕ Sk or ψ Sk , and any Skolem constant c occurring in ϕ Sk or ψ Sk . The used selection function sel selects exactly the literals ¬P (s ) with P ∈ Π 2 ∪ Π 3 in all clauses that contain such literals. Let M * M * be the result of saturating M in the same way as we have saturated N to obtain N * . Claim I: An Ackermann-like clause Ackermannlike clauses is a clause that contains at most one variable and only function symbols of arity at most 1. Consider any two Ackermann-like clauses C := [¬]A ∨ C and D := [¬]B ∨ D with unifiable atoms A and B. Let σ be a most general unifier of A and B. Then, (C ∨ D )σ is an Ackermann-like clause. Proof: Since σ is a most general unifier, for every variable x with σ(x) = x we observe that σ(x) is some term that (a) contains at most one variable and (b) that does not contain any function symbols of arity larger than one. But then, applying σ to the Ackermann-like clause C ∨ D clearly results in an Ackermann-like clause (C ∨ D )σ. ♦ Notice that N * may be infinite. Moreover, by Claim I, N * contains exclusively Ackermnann-like clauses over the vocabulary underlying N . Since ϕ (and thus also ϕ Sk ) is satisfiable and since ordered resolution with selection is sound, N * does not contain the empty clause. The set M * may also be infinite. Due to our assumption that ψ is not valid, ¬ψ (and thus also ψ Sk ) must be satisfiable. Hence, M * does not contain the empty clause either. As our assumption ϕ |= ψ is equivalent to ϕ∧¬ψ |= false and to ϕ Sk ∧ ψ Sk |= false, refutational completeness of ordered resolution with selection entails that there is a (finite) derivation D D of the empty clause from the unsatisfiable set of clauses N * ∪ M * . We assume that D is based on the same calculus and the same term ordering that we have used to saturate N * and M * . Let N * N * be the set of clauses from N * whose instances are used as premises in this derivation. Since N * and M * are both saturated and neither of them contains the empty clause, D must indeed make use of clauses from N * , and, hence, N * is not empty. Since N * is finite, we may define the sentence χ Sk := ∀v. χ Sk χ Sk , χ Sk with

  Sk cut(∃ȳ ∀v∃z . χ ) ϕ Sk ψ Sk which constitutes a valid derivation representing the interpolation property we intended to prove. ♦ We observe that ϕ Sk |= χ is equivalent to ϕ Sk ∧ ¬ χ |= false. De-Skolemization of the latter yields ϕ ∧ ¬ χ |= false or, equivalently, ϕ |= χ. Also by de-Skolemization, from χ ∧ ψ Sk |= false we conclude χ ∧ ¬ ψ |= false.

Figure 7

 7 Figure 7.1: Illustration of the solution sets of the three linear-arithmetic atoms A(x, y) = xy ≤ 1 (green), B(x, y) = 1 2 x + y ≥ 2 (blue), C(x, y) := 1 3 xy ≥ 1 3 (red).

  ū1 contains all the variables from W ∩ (x 1 ∪ . . . ∪ xk ), ū2 contains all the variables from W ∩ (x k+1 ∪ . . . ∪ xn ), v1 contains all the variables from W ∩ (ȳ 1 ∪ . . . ∪ ȳk ), v2 contains all the variables from W ∩ (ȳ k+1 ∪ . . . ∪ ȳn ), w1 contains all the variables from W ∩ (x 1 ∪ . . . ∪ xk ), w2 contains all the variables from W ∩ (x k+1 ∪ . . . ∪ xn ), z1 contains all the variables from W ∩ (ȳ 1 ∪ . . . ∪ ȳk ) \ {y * }, z2 contains all the variables from W ∩ (ȳ k+1 ∪ . . . ∪ ȳn ).

  c) for all ā ∈ A |ū| and c ∈ A | w| . Every pair ā, b of tuples ā ∈ A |ū| and b ∈ A |v| can be characterized by the set S ā, b, T c, d S ā, b := i ∈ I A |= χ i (ā, b) . Similarly, for every pair c, d with c ∈ A | w| and d ∈ A |z| we define the set T c, d := i ∈ I A |= ∃y * . η i c, y * , d) . Then, we observe that

  Definition 10.0.2 (BSR with bounded difference constraints -BSR(BD)). A BSR(BD) clause has the form Λ ∧ Γ → ∆, where the conjunctions Λ, Γ and the disjunction ∆ satisfy Condition (ii) of Definition 10.0.1, and every atom in Λ is an LRA atom of the form x c, x y, or xy c where c ∈ Z may be any integer (not a Skolem constant!), x, y ∈ Var Q are distinct, and ∈ {<, ≤, =, =, ≥, >}. Moreover, we require that whenever Λ contains an atom of the form xy c, then Λ also contains LRA atoms c x ≤ x, x ≤ d x , c y ≤ y, and y ≤ d y with c x , d x , c y , d y ∈ Z. We shall refer to atoms of the form xy c as difference constraints.

  (a) Q |= ∀x 0 x. Λ(x 0 , x) → xy ≤ r if and only if y is reachable from x in G Λ and d x,y ≤ r, and (b) Q |= ∀x 0 x. Λ(x 0 , x) → xy < r if and only if y is reachable from x in G Λ and we have either d x,y < r or d x,y < d x,y = r, where d x,y is the length of a shortest simple path from x to y in G Λ .

  Lemma 10.0.7. For every BSR(SLR) (or BSR(BD)) clause set N there is an equisatisfiable BSR(SLR) (or BSR(BD)) clause set N in BSR(SLR) normal form (BSR(BD) normal form) such that (a) the length of N is at most exponential in the length of N , (b) for any clause C in N the number of variables occurring in C is not larger than the number of variables occurring in any clause in N , (c) if N is a BSR(SLR) clause set, the number of distinct rational numbers and Skolem constants occurring in N is linear in the length of N , (d) if N is a BSR(BD) clause set, then (d.1) the number of clauses in N grows at most exponentially in the number of atoms s = t occurring in any clause in N , (d.2) the length of any clause in N is at most polynomial in the length of the longest clause in N , (d.3) every free-sort Skolem constant occurring in N also occurs in N , and

Figure 10

 10 Figure 10.1: Partition of the two-dimensional rational plane into equivalence classes induced by ∼ J A . Every dot, line segment, rectangular white area, and triangular white area represents an equivalence class. The open white areas represent open sets that stretch out towards infinity. The same holds true for the fringe line segments.

(

  I) Nondeterministically fix a total preorder over the set of all base-sort Skolem constants occurring in N Q ∪ N BSR . Define a clause set N that enforces for base-sort Skolem constants: N N := c > c → false c c .

  and Oppen [NO79, Opp80, Nel84, TH96] and by Shostak [Sho84, RS01, Gan02]. Over the years, combination of theories has received quite a bit of attention. The survey article [MZ02] summarizes the development of the field until 2002. Since then the field has developed further, of course. Here we can only give an incomplete list of works that is intended to mention many of the recent contributors: [SR02, TR03, TZ05, RRT04, RRZ05, CK06, GNZ08, ABRS09, WPK09, TRRK10, Sof13, CFR15, GG18]. A more detailed overview and further references can be found in [BM07], Chapter 10, [KS16], Chapter 10, and [BT18], Section 11.5. A conceptual continuation of the combination-of-theories paradigm in the full first-order setting is embodied in hierarchic superposition [BGW92, BGW94, BW13b, BW13a, KW12, Kru13]

  Figure 10.2: Left-hand side: partition of the set (-2, 2) 2 induced by 1 . Right-hand side: partition of Q 2 induced by 1 . Every dot, line segment, and white area represents an equivalence class.

γ

  C (x 1 ), . . . , γ C (x ) κ β(x 1 ), . . . , β(x ) . (10.2) For all other base-sort variables y ∈ {x 1 , . . . , x } we could define γ C (y) arbitrarily. For every free-sort variable u we set γ C (u) := β(u). As A is a model of N , we know A, γ C |= C. By case distinction on why A, γ C |= C holds, we use this result to infer B, β |= C. Case A, γ C |= x c for some atom x c in Λ. Hence, β C (x) c. Due to Equivalence (10.2), the assumption |c| ≤ κ, and the definition of κ , we know that γ C (x) c holds if and only if β(x) c. Consequently, we get β(x) c and thus B, β |= x c. Case A, γ C |= x y for some atom x y in Λ. By Equivalence (10.2) and the definition of κ , we know that γ C (x) γ C (y) if and only if β(x) β(y). Consequently, we get B, β |= x y. Case A, γ C |= xy c for some atom xy c in Λ. By definition of BSR(BD) clause sets, Λ must also contain atoms c x ≤ x, x ≤ d x , c y ≤ y, and y ≤ d y for certain rational numbers c x , d x , c y , d y whose absolute value is at most κ. If one of these atoms is not satisfied by γ C , then the first case applies. If all of these atoms are satisfied by γ C , then, by Equivalence (10.2), they are also satisfied by β. Moreover, Equivalence (10.2) and the definition of κ , entail γ C (x) = β(x) , γ C (y) = β(y) , γ C (x) = β(x) , γ C (y) = β(y) , fr(γ C (x)) ≤ fr(γ C (y)) if and only if fr(β(x)) ≤ fr(β(y)), and fr(γ C (x)) ≥ fr(γ C (y)) if and only if fr(β(x)) ≥ fr(β(y)). Hence, the following two observations hold:

Figure 10 .Figure 10 . 3 :

 10103 Figure10.3 illustrates the TA regions for a timed automaton with two clocks and in which all integer constants have an absolute value of at most 2. For every TA region R ⊆ Q 2 ≥0 of such an automaton, there is at least one representative r ∈ R which lies in the subspace [0, 5) 2 .

Figure 10 . 4 :

 104 Figure10.4: Synchronous versus asynchronous progress of time for two clocks. Left-hand side: Synchronous progress of time illustrated for two starting valuations within the same TA region. Right-hand side: Asynchronous progress of time illustrated for one starting valuation. The dashed blue lines mark the boundaries within which drifting of clocks does not affect reachability. In both cases the light green area depicts the union of TA regions that is reachable from the TA region containing the starting valuations.

  The first subchunk contains the current program line encoded in unary. The second and third subchunks store the current values of the counters C 1 , C 2 , respectively, also encoded in unary notation. Hence, every chunk has the form 001011

  1 10 . . . 0 Hence, C 1 and C 2 currently store the values c 1 = y -2x -3 and c 2 = z -3x -3, respectively.

  Proof sketch. We first observe the following technical properties of every structure A with A |= ϕ 1 .(a) For every integer r ∈ N we have A |= ψ 001011 (r) if and only if r = 4 i d for some i ∈ N. (b) For every integer r ∈ N we have A |= ψ 0011 (r) if and only if r = 2 • 4 i d or r = 3 • 4 i d for some i ∈ N. (c) For every integer r ∈ N we have A |= ψ 01 (r) if and only if r ∈ i∈N

∧

  N (0) ∧ N (1) ∧ ∀x. N (x) → 0 ≤ x ∧ x ≤ 1 ∧ ∀xy. yx = c ∧ N (x) → N (y) ∧ ∀xy. xy < c ∧ yx < c ∧ N (x) ∧ N (y) → x = y ∧ ∀x. P (x) → N (x)

  (d) ∧ d ≥ k • c (11.9) ∧ ψ 001011 (0) ∧ ψ 0011 (d) ∧ ψ 0011 (2d) ∧ ψ 001011 (1 -3d) (11.10) ∧ ∀x. ψ 001011 (x) ∧ x < 1 -3d → ψ 001011 (x + 3d) (11.11) ∧ ∀x. ψ 001011 (x + 3d) ∧ x ≥ 0 → ψ 001011 (x) (11.12) ∧ ∀x. ψ 0011 (x) ∧ x < 1 -3d → ψ 0011 (x + 3d) (11.13) ∧ ∀x. ψ 0011 (x + 3d) ∧ x ≥ 0 → ψ 0011 (x) (11.14) ∧ ∀x. ψ 001011 (x) ∧ x < 3d → x = 0 (11.15) ∧ ∀x. ψ 0011 (x) ∧ x < 3d → x = 2d ∨ x = d (11.16)

: 3 K ϕ 3 K:

 33 = χ 0 (0) ∧ ψ 10 (d + 3c + m • c) ∧ ψ 10 (2d + 3c + n • c) .With the sentence ϕ 3 K , we ensure that program lines never exceeds K:ϕ = ∀xy. ψ 001011 (x) ∧ ψ 10 (y) ∧ y < x + d → y ≤ x + 5c + K • c .

  K (1 -3d) .

  . . 0 0011 first subdelimiter 1 c1-1 10 . . . 0 0011 second subdelimiter 1 c2-1 10 . . . 0 Hence, C 1 and C 2 currently store the values c 1= 1 c (yxd -3c) and c 2 = 1 c (zx -2d -3c), respectively.Encoding of the instruction : test&dec(C 1 , ):The case of C 1 storing 0:∀x. ψ 001011 (x) ∧ χ (x) ∧ ψ 10 (x + d + 3c) → χ (x + 3d) ∀x. ψ 001011 (x) ∧ χ (x) ∧ ψ 10 (x + d + 3c) → ψ 10 (x + 4d + 3c) ∀xz. ψ 001011 (x) ∧ χ (x) ∧ ψ 10 (x + d + 3c) ∧ x + 2d ≤ z ∧ z ≤ x + 3d ∧ ψ 10 (z) → ψ 10 (z + 3d)The condition ψ 10 (x + d + 3c) ensures that the first counter stores the value 0.The case of C 1 storing a value greater than 0:∀xy. ψ 001011 (x) ∧ χ (x) ∧ x + d + 3c < y ∧ y ≤ x + 2d ∧ ψ 10 (y) → χ +1 (x + 3d) ∀xy. ψ 001011 (x) ∧ χ (x) ∧ x + d + 3c < y ∧ y ≤ x + 2d ∧ ψ 10 (y) → ψ 10 (y + 3dc) ∀xz. ψ 001011 (x) ∧ χ (x) ∧ ¬ψ 10 (x + d + 3c) ∧ x + 2d ≤ z ∧ z ≤ x + 3d ∧ ψ 10 (z) → ψ 10 (z + 3d)The condition y > x + d + 3 ensures that the first counter stores a value strictly greater than 0. The same applies to condition ¬ψ 10 (x + d + 3c) in the third sentence.Encoding of the instruction : goto( ):∀x. ψ 001011 (x) ∧ χ (x) → χ (x + 3d) ∀xy. ψ 001011 (x) ∧ χ (x) ∧ x + d + 3c ≤ y ∧ y ≤ x + 2d ∧ ψ 10 (y) → ψ 10 (y + 3d) ∀xz. ψ 001011 (x) ∧ χ (x) ∧ x + 2d ≤ z ∧ z ≤ x + 3d ∧ ψ 10 (z) → ψ 10 (z + 3d)Encoding of the instruction K : halt: ∀x. ψ 001011 (x) ∧ χ K (x) → x = 1 -3d

  Figure 11.3: Structure of a single chunk of constant length 3d.

d:

  ≥ k ∧ e ≥ 0 ∧ ∀x. x ≤ -1 → ¬P (x) ∧ ∀x. x ≥ e + 3d → ¬P (x) ∧ ψ 001011 (0) ∧ ψ 001011 (e) ∧ ∀x. ψ 001011 (x) ∧ x ≤ e -1 → ψ 001011 (x + 3d) ∧ ∀x. ψ 001011 (x) ∧ x ≤ e → ψ 0011 (x + d) ∧ ψ 0011 (x + 2d) ∧ ∀xy. ψ 001011 (x) ∧ ψ 001011 (y) ∧ x ≤ y -1 ∧ y ≤ x + 3d -1 → false ∧ ∀xy. ψ 001011 (x) ∧ ψ 0011 (y) ∧ x ≤ y -1 ∧ y ≤ x + d -1 → false ∧ ∀xyz. ψ 001011 (x) ∧ ψ 0011 (y) ∧ ψ 0011 (z) ∧ x ≤ y -1 ∧ y ≤ z -1 ∧ z ≤ x + 2d -1 → false ∧ ∀xy. ψ 001011 (x) ∧ ψ 01 (y) ∧ x ≤ y -6 ∧ y ≤ x + 3d -1 → ψ 0011 (y -1)The sentences ϕ m,n 2 and ϕ K 3 (page 270) can be adapted in the same spirit: = χ 0 (0) ∧ ψ 10(d + 3 + m) ∧ ψ 10 (2d + 3 + n) . ψ 001011 (x) ∧ ψ 10 (y) ∧ x ≤ y -(5 + K + 1) ∧ y ≤ x + d -→ false .The adapted encoding of an instruction : inc(C 1 ) comprises the formulas∀xy. ψ 001011 (x) ∧ x ≤ yd ∧ y ≤ x + 2d ∧ ψ 10 (y) ∧ χ (x)-→ ψ 10 (y + 3d + 1) ∧ χ +1 (x + 3d) ∀xz. ψ 001011 (x) ∧ x ≤ z -2d ∧ z ≤ x + 3d ∧ ψ 10 (z) ∧ χ (x) -→ ψ 10 (z + 3d)

  of First-Order Variables: Applications to the Classical Decision Problem and Other Areas

  Figure12.1: Schematic overview of the extended fragments (in green) that have been presented in Chapter 3. Notice that MFO is properly contained in all extended fragments. The focus is on the overlaps with MFO and on the proper containment relations between SF and GBSR, GAF and GGKS, and SGF and SLGF. The other depicted overlaps might be unsubstantiated.

  SS ∈ P k [n] ,P An i := a (1) S1 , . . . , a (n) Sn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . ., n, andSn ∈ A n i ∈ S 1 ∈ S 2 ∈ . . . ∈ S n for i = 1, . . . , n.Any of the structures A n neatly captures the essence of the logical property described by ϕ n , as every domain element a (k) S has a corresponding twin element b (k) S that mirrors in the predicates Q An i exactly the role that a (k)

Figure 12

 12 Figure 12.2: Partition of the two-dimensional rational plane into ∼ 1 -equivalence classes (cf. Chapter 8, page 221) with respect to two unspecified rational values s 1 , s 2 lying between 3 and 31 5 . Every dot, line segment, rectangular white area, and triangular white area represents an equivalence class induced by ∼ 1 .

  More succinct fragment Less succinct fragment Succinctness gap Reference

	SF	BSR	non-elementary	Theorem 3.2.7
	SF	Gaifman-local first-order fragment	non-elementary	Theorem 3.3.18
	GAF	AF	super-polynomial Proposition 3.8.9
	GGKS	GKS	exponential	Theorem 3.9.9
	SGF	LGF	non-elementary	Theorem 3.10.8
	SFO 2

  If ϕ is not satisfied under A and β, we write A, β |= ϕ. When there is no danger of confusion, we sometimes conveniently abbreviate expressions of the form A, [v 1 →a 1 , . . . , v m →a m ] |= ϕ(v 1 , . . . , v m ) by A |= ϕ(a 1 , . . . , a m ). We write A |= ϕ if A, β |= ϕ holds for every variable assignment β over A's domain. In such cases, we say that A is a model of ϕ. For sentences ϕ we often omit the variable assignment and say that A satisfies ϕ if A, β |= ϕ for any β. class of structures, if it is satisfied under every structure from the class. In particular in Part II of the present thesis we shall occasionally use this latter notion of validity with respect to a class of structures without explicitly referring to the class of structures, if it is clear from the current context.

and only if A(β)(s) = A(β)(t), A, β |= P (s 1 , . . . , s m ) if and only if A(β)(s 1 ), . . . , A(β)(s m ) ∈ P A , A, β |= ¬ψ if and only if A, β |= ψ does not hold, A, β |= ψ ∧ χ if and only if A, β |= ψ and A, β |= χ, A, β |= ψ ∨ χ if and only if A, β |= ψ or A, β |= χ, A, β |= ψ → χ if and only if A, β |= ψ implies A, β |= χ, A, β |= ψ ↔ χ if and only if A, β |= ψ implies A, β |= χ and vice versa, A, β |= ∀x. ψ if and only if A, β[x →a] |= ψ for every a ∈ A, A, β |= ∃y. ψ if and only if A, β[y →b] |= ψ for some b ∈ A. A sentence ϕ is called satisfiable if it has a model, i.e. if there is some structure A with A |= ϕ. Otherwise, we call ϕ unsatisfiable or inconsistent. Two sentences ϕ and ψ are considered equisatisfiable if ϕ has a model if and only if ψ has one. Furthermore, a sentence ϕ is called valid , if it is satisfied under any structure; if there is at least one structure not satisfying ϕ, then the sentence if invalid . A sentence is valid with respect to a certain

  , . . . and no further symbols. The superscript r stands for red and b stands for blue.In what follows, we abbreviate the expression 2 ↑n (1) with 2 ↑n

	R r 1 , R b 1 , R r 2 , R b 2	L b 2 , . . . and the binary predicate symbols E and

  In the Gaifman graph G F h,k the blue part of F h,k is disconnected from the red part of F h,k . There are no connections between (1) any a i and any b j , (2) any a i and any d ∈ Red F h,k , (3) any b j and any c ∈ Blue F h,k , (4) any c ∈ Blue F h,k and any d ∈ Red F h,k . Moreover, we assume that for all distinct F h,k , F h,k ∈ CF h the following properties hold.(a) F h,k and F h,k have the same domain, i.e.F h,k = F h,k . (b) The two substructures F h,k , F h,k of F h,k and F h,k induced by the set {a 1 , . . . , a 2 ↑h+2 , b 1 , . . . , b 2 ↑h+2 }, respectively, coincide.(c) Consider any node t in any tree T ( ) and let c ∈ F h,k and d ∈ F h,k be the domain elements corresponding to this node t in the respective structure.

	k or vice versa. The analogous property shall hold for all distinct red tree nodes c, d, some element b i ∈ L r h+2 F h,k , and the set R r F h,k .
	•

  class CF h contains 2 ↑h+2 forests F h,k . For every set S ⊆ [L] we define C S C S to be the class of all forests F h,k ∈ CF h for which we have F h,k |= η if and only if ∈ S.

				Then, there must be
	S *	some S * ⊆ [L]	for which C S * contains at least
			2 ↑h+2 2 L >	2 ↑h+2 2 ↑h+1 ≥ 2 ↑h > L
		structures. For every F h,k ∈ C S * and every ∈ S

* there are nodes c k, 1

  |= ϕ SF,h . , we set e i := e for the element e that originates from the substructure F r h,k d for which F r h,k d |= ψ (e). Since the formulas ψ are r -local and since there are no links in the Gaifman graph of A between the nodes stemming from the disjoint substructures forming A, we get Moreover, for every∈ [L] \ S * we have F h,k * |= ¬η and F h,k d |= ¬η for all d ∈ F r k * .That is, for any structure F among these structures we have F |= ∀y 1 . . . y j . Gaifman graph by entirely removing one connected component and leaving the rest untouched. Since all formulas ψ are r -local, F also satisfies the above sentence. In other words, we have F |= η . As A is the disjoint union of all these substructures, this also yields A |= η for every ∈ [L] \ S * .In summary, for every ∈ L we have A |= η if and only if ∈ S * . Consequently, A |= ψ. This contradicts our earlier observation A |= ϕ SF,h and our assumption that ψ is semantically equivalent to ϕ SF,h .

	3.4. THE GENERALIZED BERNAYS-SCH ÖNFINKEL-RAMSEY FRAGMENT (GBSR) 55
	where the domain elements e i are defined as follows. For every i with blue c k * , i c k * , i ∈ D k * \ F r k * , we set e i := c k * , i . For every i with red c k * , i , i.e. c k * , i ∈ F r 1≤i<j≤j k * A |= dist >2r (e i , e j ) .	, i.e.
	1≤i<j≤j	dist >2r (y i , y j ) →	1≤i≤j	¬ψ (y i ) .
	Let F be the corresponding substructure among F b h,k * and F r h,k d with d ∈ F r k * . The Gaifman graph of F can be obtained from F's
			ψ (e i )
		1≤i≤j

On the other hand, we have A |= η for every ∈ S * . More precisely, for every ∈ S * we observe A |= 1≤i<j≤j dist >2r (e i , e j ) ∧

  at k and A ∈ at ⊆ at , both containing x. Let C denote the (unique) connected component in G ϕ to which x belongs. By definition of at(C), both A k and A belong to at(C). Therefore, we have {A k , A } ⊆ at(C) ⊆ at . But since at k ⊆ at k \ at , A k cannot belong to at k . This yields a contradiction. Ad (ii): Let k ≤ n be some non-negative integer. Since for any > k at contains all atoms in which a variable y ∈ ȳ occurs, at k ⊆ at k \ at cannot contain any occurrence of y.Ad (iii): Let k ≤ n be some non-negative integer. Suppose we have vars(at k )∩ ≤k x = ∅. Because of X k = vars( at k ) ∩ x ⊆ vars(at k ) ∩ x, we conclude X k ∩ ≤k x = ∅. Hence, we have X k ⊆ >k x . ♦Claim II: The sentence ϕ belongs to GBSR if and only if for all k, with 1 ≤ ≤ k ≤ n we have vars(at k ) ∩ x = ∅.Proof: The if -direction follows immediately from Claim I, if we set At k := at k for every k.The only if -direction can be argued as follows. For every i,0 ≤ i ≤ n, let X i := vars(At i ) ∩ x.Consider the graph G ϕ . Since the X 1 , . . . , X n are pairwise disjoint, they induce subgraphs of G ϕ that are not connected to one another. Moreover, for every connected component C in G ϕ there is one X i such that C ⊆ X i . This entails that for every connected component C in G ϕ there is some At i such that at(C) ⊆ At i . By definition of at k , we have at k ⊆ At k ∪ . . .

	∪ At n and, moreover, vars(at k ) ∩ x ⊆ xk+1 ∪ . . . ∪ xn . This means, vars(at k ) ∩ x = ∅ for every , 1 ≤ ≤ k. ♦

  Illustration of the nesting of quantifier blocks in ϕ (2n) after narrowing the scopes of universal and existential quantifiers with respect to the pairwise-separated sets V 1 , . . . , V m . The sets U j,h denote the intersection X j ∩ V h .

											Vm)
	. . .	. . .	. . .			. . .	. . .	. . .	. . .	. . .	. . .	. . .
	Figure 3.5: More precisely, we now have 2 2•2 2•2	. . .	2•2 κ	instead of 2 2 2 . . .	2 κ
						1

  ȳn-1 , xn ) ∧ χ n (ȳ 1 , . . . , ȳn ) . , ϕ is equivalent to∀x 1 . . . xn . χ 0 (x 1 , . . . , xn ) ∧ ∃ȳ 1 . ∀x 2 . . . xn . χ 1 (ȳ 1 , x2 , . . . , xn )From this we obtain the BSR sentence ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . ψ by shifting quantifiers outwards in the right order.

	Then∧ ∃ȳ 2 . . . .
	∧ ∃ȳ n-1 . ∀x n . χ n-1 (ȳ 1 , . . . , ȳn-1 , xn )
	∧ ∃ȳ n . χ n (ȳ 1 , . . . , ȳn ) . . .	.

  ȳn ) . . . .If we now shift quantifiers outwards in the right order, we obtain ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . ψ , which is equivalent to ∃ȳ 1 . . . ȳn ∀x 1 . . . xn . ψ.

  xn , ȳ1 ) ∧ . . . ∧ χ n (x 1 , . . . , xn , ȳ1 , . . . , ȳn ) , where the χ k are (possibly empty) conjunctions of clauses, exclusively containing atoms from At(k) . Straightforward quantifier shifting allows us to transform ∀x 1 ∃ȳ 1 . . . ∀x n ∃ȳ n . ψ into the sentence∀x 1 . . . xn . χ 0 (x 1 , . . . , xn ) ∧ ∀x 1 ∃ȳ 1 . ∀x 2 . . . xn . χ 1 (x 1 , . . . , xn , ȳ1 )∧ ∀x 2 ∃ȳ 2 . . . .

	∧ ∀x n-1 ∃ȳ n-1 . ∀x n . χ n-1 (x 1 , . . . , xn , ȳ1 , . . . , ȳn-1 )
	∧ ∀x n ∃ȳ n . χ n (x 1 , . . . , xn , ȳ1 , . . . , ȳn ) . . .	.
	Renaming some of the bound variables yields

  , . . . , ȳn-1 ) ∧ ∀x n ∃ȳ n . χ n (x 1 , x2 , . . . , xn , ȳ1 , . . . , ȳn ) . . . .

	For every k, 0 ≤ k ≤ n, we define At	(k)

  y) with quantifier-free χ and η i , (b) the vocabulary underlying ψ FO 2 is that of ϕ FO 2 extended by fresh unary predicate symbols R 1 , . . . , R κ with κ ∈ O len(ϕ FO 2 ) κ , (c) ψ FO 2 |= ϕ FO 2 , (d) every model of ϕ FO 2 can be uniquely expanded to a model of ψ FO 2 over the same domain and conserving the interpretations of all predicate symbols occurring in ϕ FO 2 , and (e) len(ψ FO 2 ) ∈ O len(ϕ FO 2 ) . expansion of A for which B |= ψ FO 2 and B := A. Claim II can be extended to B, because of ψ FO 2 |= ϕ FO 2 . The set {b

	B	Let B	be the unique

  14.1 Unary Functions in Arguments of Monadic Atoms

Our first observations are inspired by the step from MFO to the Löb-Gurevich fragment -MFO with unary function symbols, cf. page 23. Adopting a method already used by Löb in

[START_REF] Löb | Decidability of the monadic predicate calculus with unary function symbols[END_REF]

and also by Grädel (cf. proof of Proposition 6.2.7 in

[START_REF] Börger | The Classical Decision Problem[END_REF]

), we can handle unary function symbols under certain restrictions.

Proposition 3.14.1. Let ϕ be a first-order sentence without non-unary function symbols (constant symbols are admitted). If the unary function symbols exclusively occur in atoms starting with a unary predicate symbol, then we can find an equisatisfiable sentence ϕ without non-constant function symbols such that any model B of ϕ can be transformed into a model A of ϕ over the same domain. The length of ϕ lies in O len(ϕ) .

  H be the objects described in Proposition 3.14.8. Then, we have H |= ϕ * and H |= ϕ. Let H be the domain of H, i.e. H is the set of all ground terms over Σ. We aim at constructing a finite model B |= ϕ = ∀x. C∈N C(x) starting from H.

For all other inputs, f A shall yield e as output. Every domain element in A represents one equivalence class of the terms in H 's Herbrand domain with respect to membership in the sets P H , Q H , and R H . The domain element a represents the class [a] := {a} of terms that belong to P H and to no other set. Similarly, b represents [b] := {b} of terms that belong to Q H and to no other set. The element c represents the class of all terms belonging to P H ∩ R H , i.e. to the class containing f (a, a), f (a, f (a, a)) and so on. The class of terms belonging to Q H ∩ R H is represented by d. Finally, e corresponds to the class of all terms that are member of R H but of none of the other predicates, e.g. f (a, b), f (a, f (b, a)).

We next describe formally how to construct a finite model for the given MSLH clause set N . Let N * , ϕ * , and H N * , ϕ * ,

  for every ground term s ∈ H. Based on ν, we define the equivalence relation ∼ ν on H such that we have s ∼ ν t if and only if ν(s) = ν(t). For every color C ⊆ Π for which H contains at least one element s with ν(s) = C, we pick one representative α C ∈ H α C with ν(α C ) = C. 7 Hence, for every non-empty equivalence class [s] ∼ν in the quotient set H/ ∼ν we have that [α ν(s)

  3.6: Illustration of the model A of ϕ from Example 3.14.9. We now construct the finite structure B. Let m * be the smallest positive integer such that every function symbol occurring in N has an arity of at most m * . m

Lemma 3.14.10. For every non-constant function symbol f ∈ Ω of arity m and all tuples s 1 , . . . , s m , t 1 , . . . , t m ∈ H m for which ν(s i ) = ν(t i ) holds for every i we have ν f (s 1 , . . . , s m ) = ν f (t 1 , . . . , t m ) .

Proof. By Definition of H and ν, for every S ∈ ν f (s 1 , . . . , s m ) there is a clause C of the form ¬P 1 (x 1 ) ∨ . . . ∨ ¬P n (x n ) ∨ S f (y 1 , . . . , y m ) in N * and a variable assignment β that satisfy Properties (a) to (c) from Proposition 3.14.8. Let γ be a variable assignment for which we have γ(y i ) := t i for every i. Notice that such a γ with γ(y 1 ), . . . , γ(y m ) = t 1 , . . . , t m always exists because the y 1 , . . . , y m are pairwise distinct. Since we assume ν(s i ) = ν(t i ) for every i and because of {x 1 , . . . , x n } ⊆ {y 1 , . . . , y m }, Conditions (b) and (c) of Proposition 3.14.8 require β(x j ) ∈ P H j and, hence, we also have γ(x j ) ∈ P H j for every j. Since H is a model of ϕ * , we have H, γ |= C. This together with H, γ |= P j (x j ), for every j, entails H, γ |= S(f (y 1 , . . . , y m )). Put differently, we have S ∈ ν f (t 1 , . . . , t m ) .

Consequently, we obtain ν f (s 1 , . . . , s m ) ⊆ ν f (t 1 , . . . , t m ) . The converse direction can be shown by a symmetric argument. * , B k

  .11 into a simpler form: for every ground term t and every predicate symbol P ∈ Π we have H |= P (t) if and only if B |= P (t).Using Lemma 3.14.11, it is easy to show that ϕ is satisfied by the finite structure B.

Lemma 3.14.12. B is a model of ϕ.

Proof. Let C be any clause in N . Since ϕ is satisfiable, C cannot be the empty clause. Suppose there is some variable assignment γ over B's domain such that B, γ |= C. Let β be the variable assignment over H's domain defined by β(x) := α λ(γ(x)) for every x. Consider any atom P (t) in C. The structure B is defined such that B, γ |= P (t) holds if and only if P ∈ λ B(γ)(t) . Moreover, by definition of ν, we have H, β |= P (t) if and only if P ∈ ν H(β)(t) . Hence, Lemma 3.14.11 entails that B, γ |= P (t) holds if and only if H, β |= P (t) does. But then, B, γ |= C entails H, β |= C. This contradicts our assumption that H is a model of ϕ. Hence, we must have B |= C.

Theorem 3.14.13. Every satisfiable MSLH sentence ϕ has a finite model whose domain contains at most k + (m + 1) • 2 p elements, where k is the number of constant symbols in ϕ, p the number of predicate symbols in ϕ, and all function symbols in ϕ have an arity of at most m.

Put differently, the MSLH fragment enjoys the finite model property.

  ×A |xn| → PAt such that for all tuples ā1 , . . . , ā , b +1 , . . . , bn and every atom A(ȳ 1 , . . . , ȳ , x +1 , . . . , xn ) ∈ At we have A ∈ µ ,n (ā 1 , . . . , ā , b +1 , . . . , bn ) if and only if A |= A(ā 1 , . . . , ā , b +1 , . . . , bn ); µ ,n-1 : A |ȳ1| ×. . .×A |ȳ | ×A |x +1 | ×. . .×A |xn-1| → P 2 At such that for all ā1 , . . . , ā , b +1 , . . . , bn-1 and every S ∈ PAt we have S ∈ µ ,n-1 (ā 1 , . . . , ā , b +1 , . . . , bn-1 ) if and only if there is some bn for which µ ,n (ā 1 , . . . , ā , b +1 , . . . , bn-1 , bn ) = S; . . . µ , +1 : A |ȳ1| × . . . × A |ȳ | × A |x +1 | → P n-At such that for all tuples ā1 , . . . , ā , b +1 and every S ∈ P n--1 At we have S ∈ µ , +1 (ā 1 , . . . , ā , b +1 ) if and only if there exists b +2 for which µ

  Let ā1 , . . . , ā , b +1 , . . . , bk be tuples of domain elements, where āi ∈ A |ȳi| , bi ∈ A |xi| for every i. Let ck+1 , . . . , cn and dk+1 , . . . , dn be sequences of tuples with ci , di ∈ A |xi| . Assume that ck+1 , . . . , cn and dk+1 , . . . , dn coincide in all positions that correspond to variables x ∈ x occurring in At .We have µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck ) = µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk ) for every k with k ≤ k ≤ n. Proof: We proceed inductively from k = n downwards. Let k = n. By definition of the sequences ck+1 , . . . , cn and dk+1 , . . . , dn we have A |= A(ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , cn ) if and only if A |= A(ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dn ) for every atom A(ȳ 1 , . . . , ȳ , x +1 , . . . , xn ) ∈ At . Hence, we have µ ,n (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , cn ) = µ ,n (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dn ). Let k < n. Consider any set S ∈ µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck ). By definition of µ ,k , there must be some tuple ck +1 such that S = µ ,k +1 (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck , ck +1 ). By induction, S = µ ,k +1 (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk , ck +1 ) and thus we have S ∈ µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk ).Since this argument is symmetric, we obtain µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck ) = µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk ).

♦

Claim II: Let , k, k be three integers such that 0 ≤ < k < k ≤ n. Let ā1 , . . . , ā , b +1 , . . . , bk be tuples of domain elements, where āi ∈ A |ȳi| , bi ∈ A |xi| for every i. Consider two sequences of tuples ck+1 , . . . , ck and dk+1 , . . . , dk that coincide in all positions that correspond to variables x occurring in At , where ci , di ∈ A |xi| for every i. We have µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck ) = µ ,k (ā 1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk ). Proof: For k = n Claim II follows immediately from Claim I. For k < n we simply pad the sequences ck+1 , . . . , ck and dk+1 , . . . , dk with tuples ēk +1 , . . . , ēn . Then, Claim II follows from Claim I applied to the sequences ā1 , . . . , ā , b +1 , . . . , bk , ck+1 , . . . , ck , ēk +1 , . . . , ēn and ā1 , . . . , ā , b +1 , . . . , bk , dk+1 , . . . , dk , ēk +1 , . . . , ēn . ♦ For i = 1, . . . , n we define A i as abbreviation of A |x1| × . . . × A |xi| . A i α i, ... , S (k) i

  For convenience, we sometimes split σ i into two parts: a ȳi -part σ 1 i : A |x1| × . . . × A |xi| → A |ȳi| and a ūi -part σ 2

i : A |x1| × . . . × A |xi| → A |ūi| . A strategy σ is satisfying for ϕ if A,[x 1 →ā 1 , . . . ,

xn →ā n , ȳ1 ū1 →σ 1 (ā 1 ), . . . , ȳn ūn →σ n (ā 1 , . . . , ān )] |= ψ holds for every choice of tuples ā1 , . . . , ān of appropriate length. The other related notions, such as outcomes, are adapted accordingly. Example 4.3.1. Consider the GAF sentence

  j

	0	∃y 1 ∃y 2	s d d d E d ∃y 1 ∃y 2 1 3 s d d d E d ∃y 1 ∃y 2 5 s ∃y 2 ∃y 1 d d d E d s E ∃y 1 ∃y 2 s E ∃y 1 ∃y 2 s ∃y 1 E 2 4 6 ∃y 2	. . . . . .

  āk-1 ), a, τ 2 k (ā 1 , . . . , āk ), . . . , τ 2 n (ā 1 , . . . , ān ) , where a from āk corresponds to x in xk . Combining the sets S x for one xk into one tuple, we construct sets T k T k := S x1 , . . . , S x |x k | for every xk = x 1 , . . . , x |x k | . Hence,

  The interpretation of the predicate symbols Q and R under C is depicted in Figure4.2. The canonical satisfying strategy τ for ϕ under C is indicated by the arrows and their annotation.

	s ¨¨¨B ∃y 1 r r r r j ∃y 2 1 s s d d d E ∃y 1 d 3 s s d d d E ∃y 1 d C 3 s s d d ∃y 1 E 3 s s ∃y 1 ∃y 2 ∃y 2 ∃y 2 0 s ∃z d d E ∃y 2 E ∃y 2 E ∃y 2 ∃y 1 ∃y 1 ∃y 1 % k 2 4 4 4	∃y 2 ∃y 1
	∃y 2

  Sk and also of ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong . Let B be a model of ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong . By the Substructure Lemma, we may assume that B's domain is B = c B c ∈ Ω . We now construct a model A |= ϕ Sk from B. Because of B |= ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong , we know that E B is a congruence relation over B. We define the domain of A to be the quotient set A := B/ E B . Moreover, we define c A := [c B ] E B for every c ∈ Ω. For every congruence class [a] E B we know that two domain elements d It now remains to show equisatisfiability of ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong and ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong . The direction from left to right is obvious. Claim II: Any model B |= ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong gives rise to a model A |= ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong . Proof: Again, by the Substructure Lemma, we may assume that B's domain is c B c ∈ Ω . Let P (c 1 , . . . , c m ) and P (d 1 , . . . , d m ) be two atoms that occur in ϕ . We observe the following property: ( * ) If E B contains the pairs c B 1 , d B 1 , . . . , c B m , d B m , then B |= ψ cong entails that B |= P (c 1 , . . . , c m ) holds if and only if B |= P (d 1 , . . . , d m ) does.

I: ϕ Sk is satisfiable if and only if ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong is satisfiable. Proof: Let A be any model of ϕ Sk . By the Substructure Lemma, we may assume that A's domain is c A c ∈ Ω . We now construct a model B |= ϕ ∧ ψ refl ∧ ψ symm ∧ ψ trans ∧ ψ cong from A. We take over A's domain and its interpretation of the predicate symbols and constant symbols. We define E's interpretation under B such that E B := a, a a ∈ A . Hence, for all c, d ∈ Ω we observe B |= E(c, d) if and only if B |= c ≈ d. Consequently, B must be a model of ϕ B , e B ∈ [a] E B are indistinguishable by the relations P B for which P occurs in ϕ . Therefore, we can use the following definition for every m-ary predicate symbol P in ϕ (including E): P A := [a 1 ] E B , . . . , [a m ] E B a 1 , . . . , a m ∈ P B . This yields A |= ϕ and for all c, d ∈ Ω we observe A |= E(c, d) if and only if A |= c ≈ d. Hence, A |= ϕ Sk . ♦

  NExpTime SF ≤k -Sat and GBSR ≤k -Sat Theorem 5.0.3

	Classes	Complete problems	References
	NL	Krom-SAT	[JLL76]
	P	Horn-SAT	[JL77, Kas86, Pla84]
		Krom-MFO-Sat	[DL84a]
	NP	SAT	[Coo71, Lev73]
	PSpace	Krom-BS-Sat	[DL84a, Pla84]
		Krom-BSR-Sat	Proposition 5.2.1
	ExpTime	Horn-BS-Sat	[CLM81, DL84a, Pla84]
		Horn-BSR-Sat	Proposition 5.2.1
		Horn-MFO-Sat	[DL84b], see also Proposition 3.14.7
		Maslov-Sat	[DL84a]
	NExpTime	BSR-Sat	[Lew80]
	k-Table

  5 in which all variables occurring in equations are existentially quantified. Moreover, it is easy to see that ϕ |= ϕ and that any model A |= ϕ contains some substructure that is also a model of ϕ. Such a substructure of A is induced by any set{a i ∈ A | A, [z |= ā] |= ∀x. χ and ā = a 1 , . . . , a |z| } -there exists at least one such set if A is a model of ϕ .For the rest of this proof we fix some strict linear order ≺ ≺, S on the variables in z and define S to be the set {z ≈ z | z, z ∈ z}. Every subset T ⊆ S induces an equivalence relation ∼ T ∼ T over the variables in z. Although there are 2 |z| 2 such subsets T , there are only B |z| equivalence classes over |z|, where B n denotes the n-th Bell number , which is known to be bounded by B

n < 0.792n ln(n+1) n (Theorem 2.1 in

[START_REF] Berend | Improved bounds on Bell numbers and on moments of sums of random variables[END_REF]

). Operationally, such an equivalence relation can be represented by a rewrite function ρ T : z → z ρ T

  More precisely, we have ∃ȳ∀x. ϕ |= false if and only if ∃ȳ∀x. ϕ |= false, ¬∃v∀ū. ψ |= false if and only if ¬∃v∀ū. ψ |= false, and ∃ȳ∀x. ϕ ∧ ¬ ∃v∀ū. ψ |= false if and only if ∃ȳ∀x. ϕ ∧ ¬ ∃v∀ū. ψ |= false. Let ϕ Sk := ∀x. ϕ y 1 /c 1 , . . . , y |ȳ| /c |ȳ| ϕ Sk , ψ Sk where the c i are fresh Skolem constants. Moreover, let ψ Sk := ∀v. ¬ ψ u 1 /f 1 (v), . . . , u |ū| /f |ū| (v) where the f i are fresh Skolem functions of arity |v|. Hence, ϕ Sk ∧ ψ Sk is a Skolemized variant of ∃ȳ ∀x. ϕ ∧ ∀v ∃ū. ¬ ψ , which is semantically equivalent to ∃ȳ ∀x. ϕ ∧ ¬ ∃v ∀ū. ψ . Therefore, we observe ϕ ∧ ¬ψ |= false if and only if ∃ȳ ∀x. ϕ ∧ ¬ ∃v ∀ū. ψ |= false if and only if ϕ Sk ∧ ψ Sk |= false .

  1) ϕ Sk |= χ Sk , (2) χ Sk ∧ ψ Sk |= false, But then, due to the order restrictions in ordered resolution, ¬R( t )τ must be maximal in Cτ , where τ is the unifier that is used to unify R( t ) and R( t ). But this contradicts P (s ) ¬R( t ), as the latter entails P (s )τ ¬R( t )τ . Suppose there is a binary resolution step between two clauses C = C ∨ R( t ) ∈ N * and D = D ∨ ¬R( t ) ∈ M * over the literals R( t ) and ¬R( t ) such that C contains some literal ¬P (s ) with P ∈ Π 2 ∪ Π 3 . Since ¬P (s ) is selected in C by sel, this resolution step is not admitted. Suppose there is an binary resolution step between two clauses C = C ∨ ¬R( t ) ∈ N * and D = D ∨ R( t ) ∈ M * over the literals ¬R( t ) and R( t ) such that C contains some literal ¬P (s ) with P ∈ Π 2 ∪ Π 3 . Since R occurs negatively in N * and positively in M * , it must occur negatively in ψ , and thus R ∈ Π 1 ∪ Π 2 ∪ Π 3 . Hence, the literal ¬R( t ) is not selected in C. Since, on the other hand, there is a selected literal in C by sel, namely ¬P (s ), this resolution step is not admitted. Consequently, the result of any inference step starting from two leaf nodes of the derivation tree of D cannot contain any predicate symbol P ∈ Π 1 and it cannot contain any literal ¬R(. . .) with R ∈ Π 2 ∪ Π 3 . By an inductive argument (over the height of derivation trees), this leads to the observation that none of the clauses from N * that are involved in the derivation D can contain any predicate symbols from Π 1 or any negative literals ¬R(. . .) with R ∈ Π 2 ∪ Π 3 . Since N

	(3) for every C ∈ N * we have
	(3.1) for every literal P (s 1 , . . . , s

m ) in C there is a clause D ∈ M that contains some literal ¬P (t 1 , . . . , t m ), and (3.2) for every literal ¬P (s 1 , . . . , s m ) in C there is a clause D ∈ M that contains some literal P (t 1 , . . . , t m ).

Ad (1) and (2). Both observations follow by soundness of ordered resolution with selection. ♦ Ad (3). Since N * and M * are both saturated and do not contain the empty clause, any inference step in D that starts from two leaves of the derivation tree involves one clause taken from N * and one clause taken from M * . Consider any such resolution step between clauses C ∈ N * and D ∈ M * . By case distinction on the possible resolution steps we show that C cannot contain any literal [¬]P (s ) with P ∈ Π 1 ∪ Π 2 ∪ Π 3 . Suppose there is a binary resolution step between two clauses C = C ∨ R( t ) ∈ N * and D = D ∨ ¬R( t ) ∈ M * over the literals R( t ) and ¬R( t ) such that C contains some literal [¬]P (s ) with P ∈ Π 1 . Since R occurs in N * and in M * , we have R ∈ Π 1 . Hence, we get P (s ) R( t ). Due to the order restrictions in ordered resolution, R( t )τ must be maximal in Cτ , where τ is the unifier that is used in the resolution step to unify R( t ) and R( t ). But this contradicts P (s ) R( t ), as the latter entails P (s )τ R( t )τ . Suppose there is a binary resolution step between two clauses C = C ∨ ¬R( t ) ∈ N * and D = D ∨ R( t ) ∈ M * over the literals ¬R( t ) and R( t ) such that C contains some literal [¬]P (s ) with P ∈ Π 1 . Since R occurs negatively in N * and positively in M * , we conclude R ∈ Π 1 ∪ Π 2 ∪ Π 3 . Hence, we have that P (s ) R( t ), which entails P (s ) ¬R( t ), and ¬R( t ) is not selected in C. * contains only clauses that are involved in D, Condition (3.2) is satisfied. By construction of N * from ϕ = ∃ȳ ∀x. ϕ via ∃ȳ ∀x. ϕ and ϕ Sk , Condition (3.1) is satisfied as well. ♦

  Since ∃ȳ ∀x. ϕ ∧ ¬ ∃ȳ ∀x. χ |= false holds if and only if ∃ȳ ∀x. ϕ ∧ ¬ ∃ȳ ∀x. χ |= false, and since the latter is equivalent to ∃ȳ ∀x. ϕ |= ∃ȳ ∀x. χ we in the end get ϕ |= χ. ♦ Ad (5). The formula χ Sk ∧ ψ Sk can be conceived as a Skolemized variant of ∃ȳ ∀x. χ ∧ ∀v ∃ū. ¬ ψ , which is semantically equivalent to ∃ȳ ∀x. χ ∧ ¬ ∃v ∀ū. ψ . Hence, we have χ Sk ∧ ψ Sk |= false if and only if ∃ȳ ∀x. χ ∧ ¬ ∃v ∀ū. ψ |= false. As we, in addition, observe that ∃ȳ ∀x. χ ∧ ¬ ∃v ∀ū. ψ |= false holds if and only if ∃ȳ ∀x. χ ∧ ¬ ∃v ∀ū. ψ |= false, we in the end get Because of the equivalence of χ ∧ ¬ψ |= false and χ |= ψ, we have shown that χ satisfies Requirement (i) of the lemma.

A |= ∃ȳ ∀x. ϕ there is some model B |= ϕ Sk such that A and B differ only in their interpretation of the Skolem constants c 1 , . . . , c |ȳ| . By (1) and because of χ Sk |= ∃ȳ ∀x. χ , we get B |= ∃ȳ ∀x. χ . Since B differs from A only in the interpretation of symbols that do not occur in ∃ȳ ∀x. χ , A is also a model of ∃ȳ ∀x. χ . Hence, ∃ȳ ∀x. ϕ |= ∃ȳ ∀x. χ , which can equivalently be written as ∃ȳ ∀x. ϕ ∧ ¬ ∃ȳ ∀x. χ |= false. χ Sk ∧ ψ Sk |= false if and only if ∃ȳ ∀x. χ ∧ ¬ ∃v ∀ū. ψ |= false if and only if χ ∧ ¬ψ |= false . By (2), this yields χ ∧ ¬ψ |= false. ♦

  ∃P. ∃y. P (x) ∧ ∃y. ¬P (x) |=| ∃y 1 y 2 . ∃P. ∀x. x ≈ y 1

1) ∃P. ∃y. P (y) |=| ∃y. ∃P. ∀x. x ≈ y ∨ P (x) ∧ true ∨ ¬P (x) |=| ∃y∀x. x ≈ y ∨ true |=| true (2) ∃P. ∃y. ¬P (y) |=| ∃y. ∃P. ∀x. x ≈ y ∨ ¬P (x) ∧ true ∨ P (x) |=| ∃y∀x. x ≈ y ∨ true |=| true (3)

  .1) As A is a model of N , we get A, γ C |= C. By case distinction on why A, γ C |= C holds, we can infer B, β |= C as follows: Case A, γ C |= t t for some LRA atom t t in Λ, where t, t are base-sort variables or ground LRA terms. Notice that, since we assume C to be in BSR(SLR) normal form, if t is a variable, then t is either a variable or a constant symbol, and if t is a variable, then t is either a variable or a constant symbol. Since B and A interpret constant symbols in the same way and due to (10.1), we conclude B, β |= t t . Case A, γ C |= t ≈ t for some free-sort equation t ≈ t ∈ Γ. In this case, t and t are either variables or constant symbols of the free sort, which means they do not contain subterms of the base sort. Since B and A behave identical on free-sort constant symbols and β(u) = γ C (u) for every variable u ∈ V S , we have B, β |= t ≈ t .

Case A, γ C |= t ≈ t for some t ≈ t ∈ ∆. In analogy to the above case, we get B, β |= t ≈ t .

  Definition 11.1.1. A two-counter machine M consists of two counters C 1 , C 2 and a finite program whose lines are labeled with integers 0, . . . , K for some nonnegative integer K. Each program line contains one of five possible instructions with the following meaning: , ) if C 1 > 0 then decrement C 1 and proceed with the next instruction, otherwise proceed with instruction and leave the counters unchanged; test&dec(C 2 , ) if C 2 > 0 then decrement C 2 and proceed with the next instruction, otherwise proceed with instruction and leave the counters unchanged;

	inc(C 1 )	increment counter C 1 and proceed with the next instruction;
	inc(C 2 )	increment counter C 2 and proceed with the next instruction;
	test&dec(C 1 goto( )	leave the counters unchanged and proceed with instruction ;
	halt	halt the computation.

  .1 illustrates the structure of a single chunk in the sequence, starting at position x.

	earlier configu-rations	'		unary encoding of the current			unary encoding of the current			unary encoding of the current			E	later configu-rations
				program line				value of C1				value of C2
		. . .	001011	1 . . . 1 0 . . .	0011	1 . . . 1 0 . . .	0011	1 . . . 1 0 . . .	001011	1 . . . 10 . . .	. . .	E 0011 . . .
	0
	'	x	E	' '	x	E	'	3x x	E	'	x	E E	'	4x	E
					Figure 11.1: Structure of a single chunk of length 3x.
	11.2.2 Formal Encoding of Two-Counter Machine Computations

Recall that we assume to be given a two-counter machine M with K + 1 program lines, labeled 0, . . . , K, and two input values m and n. We use the following abbreviations for arbitrary terms t: ψ 001011 (t) := ¬P (t) ∧ ¬P (t + 1) ∧ P (t + 2) ∧ ¬P (t + 3) ∧ P (t + 4) ∧ P (t + 5) ψ 0011 (t) := ¬P (t) ∧ ¬P (t + 1) ∧ P (t + 2) ∧ P (t + 3) ψ 01 (t) := ¬P (t) ∧ P (t + 1) ψ 10 (t) := P (t) ∧ ¬P (t + 1) χ (t) := ψ 10 (t + 5 + ) for = 0, . . . , K

  • d bits each, and every subchunk contains d bits. Obviously, the constant symbol d has to be interpreted by some positive integer that allows the subchunks to store sufficiently large values for the current program line and the current counter values. If M halts when started on the input m, n , then there exists such a sufficiently large value for d. Due to the length of the used delimiters, we set max{K + 6, m + 4, n + 4} as a lower bound for d, where K is the last line of M's program. Moreover, the leftmost chunk starts at position 0, i.e. there is a 001011-delimiter starting at position 0 but none starting left of 0. Figure 11.2 illustrates the structure of a single chunk in the sequence, starting at position x. . . . 1 0 . . . 1 . . . 1 0 . . . 1 . . . 1 0 . . . 1 . . . 10 . . .Figure 11.2: Structure of a single chunk of length 3d.

	earlier configu-rations	. . . '	001011 program line 1 unary encoding of the current	0011 unary encoding value of C1 of the current	0011 unary encoding value of C2 of the current	001011 E	later configu-rations	E
	0
	' '	x	E	'	d	E	x + 3d '	d	E	'	d	E E

  001011 (t) ψ 001011 := ¬P (t) ∧ ¬P (t + c) ∧ P (t + 2c) ∧ ¬P (t + 3c) ∧ P (t + 4c) ∧ P (t + 5c)

	ψ 0011 ψ 01 ψ 10	ψ 0011 (t) ψ 01 (t) ψ 10 (t)	:= ¬P (t) ∧ ¬P (t + c) ∧ P (t + 2c) ∧ P (t + 3c) := ¬P (t) ∧ P (t + c) := P (t) ∧ ¬P (t + c)
	χ	χ (t)	:= ψ 10 (t + 5c + • c)	for = 0, . . . , K

  Table 12.2. In Sections 10.4 and 11.4, we have studied the decidability boundary around one particular -LRA+P undec., but Unsat is r.e. Theorems 11.2.2, 11.2.6, 11.3.3 ∀-Horn-Krom PA+P undecidable Theorem 11.2.4 ∀ 2 ∃-PA+P and ∀ 2 ∃-LRA+P undec. and not r.e. Theorems 11.3.7, 11.3.8 ∀∃-PA+P undec. and not r.e. Theorem 11.3.9 ∃ 2 ∀ * -LRA+P N over [0, 1], difference constraints only, undec., but Sat is r.e. Theorem 11.4.4 N, P interpreted with finite sets Table

	Fragment description	Result	References
	∀

* -PA+P and ∀ *

  reveal that this sentence is satisfiable over the integers if and only if the , 20, 111, 113, 117, 124, 125, 197 λ-semi-uniform ∼, 125, 126 µ-uniform ∼, 117, 118, 124, 190 ν-ξ-uniform ∼, 198, 202 satisfying ∼, 5, 20, 113, 115, 117, 124, 125, 190, 196 semi-uniform ∼, 113, 125 target set of a ∼, 123, 130, 136, 190 uniform ∼, 113, 115, 117 winning ∼, 5, 38, 113, 117 stratified occurrences of function symbols, 103 stratified vocabulary, 103, 299 strongly separated fragment (SSF), 32, 36, 42,

	229, 235, 238, 240, 242, 251, 253, 286, 295, 297, 301 degree of interaction for GAF sentences, 137 for GBSR sentences, 58, 66, 139 of existential variables, 31, 139 of universal variables, 122, 139 dependence finitely controllable ∼, 112, 124 strong ∼, 19, 20, 28, 111, 124 weak ∼, 5, 6, 19, 20, 28, 111, 122, 124, 293, 295 dependence logic, 192, 295 dependency scheme, 191 diagonal constraint, 255 difference constraint, 5, 218, 219, 221, 227, 254, 265, 279, 284, 297 bounded ∼, 227 difference constraint graph, 228 difference logic, 228, 254 disjunctive companion, 63 disjunctive normal form (DNF), 10, 62 distance of domain elements, 46 domain, 11 Herbrand ∼, 13, 104 domino problem, 3 bounded ∼, 45, 149, 150 unconstrained ∼, 40, 150 domino system bounded ∼, 149 unconstrained ∼, 41 effectively propositional logic (EPR), 294 elimination lemma, 208 elimination set, 21, 186, 229 entailment equality over uninterpreted functions (EUF) theory of ∼, 242, 285, 288, 298 equisatisfiability, 11 equivalence for timed automata, 255 Herbrand model quotient constraint, 218, 265 superposition T -∼, 12 halting problem, 265, 297 hashtable property fragment, 219 Henkin quantifier, 192, 295 Herbrand domain, 13, 104, 107 Herbrand fragment, 28 scope of a ∼, 9, 83, 193 quantifier elimination, 20, 299 first-order ∼, 20, 183, 185, 217, 244 quantifier shifting, 12, 15, 35, 56, 62, 67 sufficient completeness, 276 second-order ∼, 22, 29, 204 virtual ∼, 20, 185, 229, 244 Substructure Lemma, 12 simultaneous ∼, 10 sequential ∼, 10 semantic ∼, 12, 224 separated loosely guarded ∼, 83 SGF ∼, 84 SGNFO ∼, 93 SLGF ∼, 84 Fourier-Motzkin elimination, 20, 230 fractional part, 225 Gödel-Kalmár-Schütte fragment (GKS), 3, 24, 42, 77, 293 GAF special form, 70, 74 GAF-Sat, 70 Gaifman graph, 46 Gaifman normal form, 46, 61, 292 GBSR with simple linear rational constraints (GBSR(SLR)), 245 GBSR-Sat, 57, 61, 140 r-∼, 46 Nelson-Oppen combination framework, 221, 242, 285, 294, 298 one-free fragment, 28 outcome, 117, 125 PA formula, 223 PA term, 223 PA+P formula, 223 PA+P term, 223 packed guarded fragment, 27 path, 228 length of a ∼, 228 simple ∼, 228 polarity, 21, 22, 156 Skolem function, 12, 187 Skolem term, 12 Skolemization, 6, 12, 19, 111, 191, 293, 295 exhaustive ∼, 12 SLGF-Sat, 84 small model property, 23, 36, 61, 122, 124, 139 sort background ∼, 223 base ∼, 223 free ∼, 223 uninterpreted ∼, 223 spectrum, 294 stable infiniteness, 243 standard form, 10 standard translation, 26 state transition system, 255 bound second-order ∼, 14 clock ∼, 254 first-order ∼, 9 free first-order ∼, 10 free second-order ∼, 14 guard-separated sets of ∼s, 83 index of a ∼, 32, 58, 67 interaction of ∼s, 31 reference ∼, 67, 78, 113, 124 second-order ∼, 14, 22 separated sets of ∼s, 15 strictly separated sets of ∼s, 15 variable assignment, 11 explicit definition of a ∼, 11 update of a ∼, 11 virtual substitution, 20, 185, 229, 244 generalized Ackermann fragment (GAF), 3, 67, 102, 292, 293, 295 generalized Bernays-Schönfinkel-Ramsey fragment (GBSR), 3, 56, 102-104, 139, 220, 244, 291-293, 295, 298 generalized Gödel-Kalmár-Schütte fragment (GGKS), 3, 77, 102, 292, 293 GGKS special form, 80 GGKS-Sat, 80 GNFO-Sat, 93 guard, 21, 83, 168, 295 atomic ∼, 83, 92 loose ∼, 83 negation ∼, 92 separated negation ∼, 93 guarded fragment (GF), 3, 26, 39, 83, 168, 222, 291, 294 guarded-negation fragment (GNFO), 3, 27, 93, 292 Gurevich-Maslov-Orevkov fragment, 24, 67, 76 H 1 , 27, 106 polynomial-time hierarchy (PH), 142 positive occurrence, 168 positive variable dominated clause fragment (PVD), 28 power set, 14 precedence, 169 prenex normal form, 10 preorder, 239 Presburger arithmetic, 4, 6, 20, 217, 223, 263, 264, 297 universal fragment of ∼, 264 pseudo-integers, 281 purification, 224 quantifier block, 9 counting ∼, 30 guarded ∼, 83 Henkin ∼, 192 leading ∼, 29 rank, 10 substitution, 10, 170 uniform ∼, 220, 299 structure Σ-∼, 11 sub-∼, 12 Herbrand ∼, 13, 104, 105, 143 κ -uniform ∼, 246 κ -uniform ∼, 246 quantified Boolean formula (QBF), 142, 191 strategy, 5141, 190 vocabulary, 9 relational ∼, 9 stratified ∼, 103, 103, 299, 301	one successor (S1S), 220 SF-Sat, 29, 31, 40, 45, 139 uninterpreted function symbol, 223 102, 104, 115, 123, 141, 147, 157, 204, 222, 291, 292, 294, 298 monadic second-order fragment (MSO), 23, 29, 204, 212 monadic second-order theory of sequent calculus, 174 uniformly colored set, 231 separateness of variables, 15 strict ∼, 15 separation logic, 286, 298 separation predicate, 219 uniform one-dimensional fragment, 28, 291 most general ∼ (mgu), 170 unifier, 170 unifiable terms, 170 fingerprint function, 114, 117, 118, 125, 181, 189, 197 λ x, , 125 µ , 189 µ ,k , 118 finite model property, 23, 24, 25, 29, 36, 61, 104, 109, 112, 122, 124, 139, 220, 296 finite-variable logic, 92, 95, 141 fluted fragment (FL), 3, 26, 39, 42, 99, 100, 115, 141 FOL(LA) encoding, 256 fomula Horn, 275, 297 Krom, 275, 297 formula Σ-∼, 9 r-local ∼, 46, 55 atomic Σ-∼, 9 basic ∼, 18, 94, 96, 101, 192 binary encoding of a ∼, 11 closed ∼, 10 encoding length of a ∼, 11, 224 first-order ∼, 9 GF ∼, 83 GNFO ∼, 93 ground ∼, 10 guarded-negation ∼, 92 guarded ∼, 83 Horn ∼, 10, 27, 37, 39, 104, 106, 143, 146, 147, 154, 156, 157, 266, 276, 279 in conjunctive normal form, 10 in disjunctive normal form, 10 in negation normal form, 10 in prenex normal form, 10 interpolation Craig-Lyndon ∼, 6, 167, 168, 174, 293 intersection non-emptiness problem, 104 inverse method, 25 Löb-Gurevich fragment, 24, 31, 76, 102 Löwenheim fragment, 23 Lewis' fragment T , 27 lexicographic path ordering (LPO), 169 linear program, 241 linear rational arithmetic (LRA), 6, 20, 181, 182, 217, 223, 297 linear-time temporal logic, 222 literal, 10 LK ⊥ , 174 location, 254 resolution ordered ∼, 169 rewrite function, 148 run of a two-counter machine, 265 SAT, 143, 147 Horn-∼, 143, 147 Krom-∼, 143, 147 satisfiability, 11 saturation, 170 scope of a negation sign, 9 of a quantifier, 9, 83, 193 Scott normal form, 97 selection function, 33, 205 INDEX length of a ∼, 10 linear ∼, 27, 106 LRA+P N ∼, 224 LRA ∼, 223 PA+P ∼, 223 PA ∼, 223 shallow ∼, 27 Skolem ∼, 12 unifiable ∼s, 170 testpoint, 21, 185, 229 tetration, 14 theory background ∼, 223 base ∼, 223 decidable Σ-∼, 217 logical Σ-∼, 12 in standard form, 10 INDEX initial ∼, 254 location invariant, 255 location transition relation, 255 loosely guarded fragment (LGF), 3, 26, 83, 168, 222, 291, 294 LRA formula, 223 LRA term, 223 LRA+P N formula, 224 LRA+P N term, 224 Maslov fragment, 25, 28, 147, 149 Maslov's fragment K, 25, 42, 56, 76, 80, 99, 142, 291, 295 matrix, 10 metric temporal logic, 222 miniscoping, 191 Minsky machine, 1, 265 model, 11 model-checking game, 5, 20, 57, 70, 113, 117, 124, 197 monadic first-order fragment (MFO), 3, 22, 23, 29, 36, 39, 70, 76, 80, 84, 93, 95, 100, separated guarded fragment (SGF), 3, 83, 102, 291, 292, 295 separated guarded-negation fragment (SGNFO), 3, 93, 102, 292 separated loosely guarded fragment (SLGF), 3, 83, 102, 291, 292, 295 102, 292, 293 unary-negation fragment, 28, 291 ultimately periodic set, 299 separated two-variable fragment (SFO 2 ), 3, 96, type, 187 96, 222, 293 two-variable fragment (FO 2 ), 3, 25, 39, 42, 95, recurring ∼, 275, 278, 297 nondeterministic ∼, 278 for ordered resolution, 170 sentence Σ-∼, 10 basic local ∼, 46 inconsistent ∼, 11 invalid ∼, 11 monadic ∼, 22 satisfiable ∼, 11 valid ∼, 11 separated k-variable fragment (SFO k ), 95 separated fluted fragment (SFL), 3, 99, 100, 102, 292 separated fragment (SF), 3, 19, 29, 102, 104, 124, 139, 220, 244, 291-293, 295, 298 transition guard, 255 tree, 46 tree automaton, 104, 105 tree-like model property, 27 tuple ascending, 231 Turing machine, 1, 150, 265 recurring ∼, 263 simple ∼, 150 two-counter machine, 265, 297 stably infinite ∼, 243 tiling, 41 time constructible function, 150 timed automaton, 6, 222, 254, 254, 298
	semantic ∼, 12, 224 equivalence class, 14 essentially uninterpreted fragment, 301 least ∼, 13, 27 quotient set, 14 hierarchic, 222, 242, 276, 277, 280, 298, 301 minimal ∼, 13, 27, 105, 106 Herbrand structure, 13, 104-106, 143 Rabin fragment, 24, 28, 76 TA region, 254, 256	monadic shallow linear Horn fragment (MSLH), 27, 104 SFL-Sat, 102 uninterpreted predicate symbol, 223 SFO 2 -Sat, 96 uninterpreteed sort, 223 multiplicative constraint, 218, 265 SGF-Sat, 84 unit clause, 10
	existential first-order fragment (∃FO), 42, 140, Herzig's ordered fragment, 26, 99, 100 Ramsey theory, 24, 231 target set, 123, 130, 136, 190	SGNFO-Sat, 95 universe, 11
	142 hierarchic superposition, 242, 276, 301 reachability problem, 6, 222, 298 term	negation Shelah fragment, 24, 67, 76 upward closure, 69, 78, 193
	existential rule, 28 exponential-time hierarchy, 142 fingerprint, 112, 114, 117, 125, 181, 187, 196, 197 independence logic, 192, 295 infinity axiom, 24, 40 integral part, 225 interpolant, 167, 168, 174 recurrence problem, 275, 297 reference variable, 67, 78, 113, 124 refinement of an equivalence relation, 14 refutational completeness, 170, 276, 280 representative, 107, 119, 127, 198 Σ-∼, 9 encoding length of a ∼, 11 evaluation of a ∼, 11 formal ∼, 186 ground ∼, 10, 219, 227	guarded ∼, 92 scope of a ∼ sign, 9 negation normal form, 10 negative occurrence, 168 neighborhood Shostak combination framework, 242 signature, 9 simple cycle, 228 Skolem constant, 12, 224 Skolem fragment, 25, 25, 42, 291 extended ∼, 193 variable block index of a ∼, 193 bound first-order ∼, 10

Detailed discussions of the Church-Turing thesis can be found, for instance, in the textbooks [HU79], Sections 7.1 and 7.6,[START_REF] Rogers | Theory of recursive functions and effective computability[END_REF], Section 1.7, and in the more recent[START_REF] Cooper | Computability Theory[END_REF], Chapters 1 and

2, and[START_REF] Irving | Turing Computability Theory and Applications. Theory and Applications of Computability[END_REF], Chapter 17. 2 There are many textbooks treating first-order logic on an introductory level, e.g.[START_REF] Herbert | A mathematical introduction to logic[END_REF][START_REF] Fitting | First-Order Logic and Automated Theorem Proving[END_REF][START_REF] Van Dalen | Logic and Structure[END_REF], Sch08, Smu95, EFT94, TS96].

In fact, BSR(SLR) and BSR(BD) can be conceived as generalizations of formalisms that are already used for verification, such as the Bernays-Schönfinkel-Ramsey fragment itself, the existential fragment of linear arithmetic, or difference constraints -references are given in Section 12.1.1, in Chapter 8 (Remarks 8.0.1 and 8.0.2 and the subsection on related work), and in Sections 11.5 and 12.2.1.

In contrast to the tradition in automated reasoning, we do allow quantifier prefixes in formulas in conjunctive or disjunctive normal form.

Notice that the form of standard Skolemization used in the present thesis is regarded as being inefficient in automated reasoning, as there are improved variants available that produce Skolem terms with fewer arguments. We shall discuss this topic in more depth in Section 7.2.

In automated reasoning Herbrand structures are often represented by sets of atoms over a given vocabulary. We deviate from this definition, although the intended semantical object is ultimately the same.

The following remark is intended to clarify any possible confusion regarding terminology. Krom[START_REF] Melven | The Decision Problem for Segregated Formulas in First-Order Logic[END_REF] defines the notion of segregated formulas which, despite the name similarity to the separated fragment, constitutes a classification of formulas completely orthogonal to the approach used in the present thesis. According to Krom, formulas in conjunctive normal form are segregated if every clause either contains positive literals alone or exclusively negative ones. Certain classes of segregated formulas in Krom's sense yield decidable fragments, while others form reduction classes for full first-order logic.

Validity in the theory of the rationals with addition and multiplication is undecidable. This was proven by Robinson[START_REF] Robinson | Definability and Decision Problems in Arithmetic[END_REF] via a reduction of the validity problem for the integers with addition and multiplication. Undecidability of the latter, in turn, was established by Church[START_REF] Church | An Unsolvable Problem of Elementary Number Theory[END_REF].

The presented result is due to Thomas Sturm and Christoph Weidenbach, who wrote it up in an unpublished note in 2014.

Brief historical accounts with a focus on the dawn of computability theory can be found, for instance, in [HU79], Section 7.1 (alternatively: Section 8.2.1 in[START_REF] Hopcroft | Introduction to Automata Theory, Languages, and Computation[END_REF]), and in[START_REF] Cooper | Computability Theory[END_REF], Chapter 1.

The inverse method has strong connections to resolution, as noted byKuehner [Kue71], Zamov[START_REF] Zamov | On a Connection Between the Resolution Method and the Inverse Method[END_REF], Lifschitz[START_REF] Lifschitz | What Is the Inverse Method[END_REF], and Bachmair and Ganzinger (Section 7.5 in[START_REF] Bachmair | Resolution Theorem Proving[END_REF]).

This intuitive explanation is based on the report of an anonymous referee the author of the present thesis received for a submission to LICS 2018.

The approximation scheme we discuss here was already used in[START_REF] Košta | New Concepts for Real Quantifier Elimination by Virtual Substitution[END_REF], Section 3.2, under the label conjunctive associativity. Košta makes use of the concept in order to substantially reduce the size of elimination sets in the context of quantifier elimination by virtual substitution. Basic ideas in this direction were already present in[START_REF] Dolzmann | Algorithmic strategies for applicable real quantifier elimination[END_REF].

This example is an adaptation of an example from[START_REF] Bárány | Guarded Negation[END_REF], page 3.

ExpTime-hardness of the intersection non-emptiness problem was already pointed out in[START_REF] Frühwirth | Logic Programs as Types for Logic Programs[END_REF] accompanied by a very brief proof sketch. A detailed proof for the case of (bottom-up) deterministic tree automata is given in[START_REF] Veanes | Computational Complexity of Basic Decision Problems of Finite Tree Automata[END_REF] and[START_REF] Veanes | On Simultaneous Rigid E-Unification[END_REF], Lemma 5.4. More references and historical background can be found in[START_REF] Veanes | Computational Complexity of Basic Decision Problems of Finite Tree Automata[END_REF] and in the bibliographic notes in Section 1.9 of [CDG + 08].

Technically, this definition would generate a further domain element f ∈ A for the color C = ∅ in Example 3.14.9, which we have not added for simplicity.

This notion is also used in the literature, e.g. in[START_REF] Dreben | The Decision Problem: Solvable Classes of Quantificational Formulas[END_REF], to refer to classes of first-order sentences that enjoy the finite model property.

See also Remark 7.1.4 on page 187 for a brief discussion of the connection between fingerprints and the model-theoretic concept of types.

This was suggested to the author by Ian Pratt-Hartmann during a discussion at the Seventeenth International Workshop on Logic and Computational Complexity (LCC'16) in Marseille, France, in September 2016.

The exponential-time hierarchy should not be confused with the hierarchy of k-fold (nondeterministic) exponential time for increasing k. The exponential-time hierarchy lies completely within ExpSpace, just like the polynomial-time hierarchy lies entirely within PSpace.

The idea underlying the reduction was suggested to the author of the present thesis by Christoph Weidenbach during a discussion in October 2018.

The calculus LK ⊥ from[START_REF] Baaz | Methods of Cut-Elimination[END_REF] is, according to the authors, almost identical to the original LK by Gentzen[START_REF] Gentzen | Untersuchungen über das logische Schließen[END_REF][START_REF] Gentzen | Untersuchungen über das logische Schließen[END_REF]. The adaptations to LK ⊥[START_REF] Baaz | Methods of Cut-Elimination[END_REF] made in the present thesis are inessential. The rules dedicated to implication are left out -they are derivable using the rules for ¬ and ∨. We do not syntactically distinguish free from bound first-order variables. Our permutation rule is more compact. And, finally, we have not integrated implicit contraction into the cut rule -this can be simulated by using the contraction rule appropriately prior to cuts.

Compare, e.g., the notion of type in[START_REF] Chung | Model Theory[END_REF] or rank-k type in[START_REF] Libkin | Elements of Finite Model Theory[END_REF]. Another close relative is the notion of constituent by Hintikka, see[START_REF] Hintikka | Distributive Normal Forms in First-Order Logic[END_REF][START_REF] Rantala | Constituents[END_REF]

QBF stands for quantified Boolean formulas; CSP stands for constraint satisfaction problems.

This was suggested to the author of the present thesis by Erich Grädel at the Algorithmic Model Theory Meeting in Berlin, Germany, in March 2018.

Formally, a logical Σ-theory T is considered decidable, if there is an algorithm that can decide membership of any given Σ-sentence in T .

Originally, Presburger arithmetic considers the domain of the nonnegative integers. But this is not serious restrictions, see, e.g., Example

3.7 in[START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF].

This was brought to the attention of the author of the present theses by Viorica Sofronie-Stokkermans at the VTSA summer school in Koblenz, Germany, in August 2015

In parts of the literature difference constraints are referred to as separation predicates[START_REF] Ofer Strichman | Deciding Separation Formulas with SAT[END_REF][START_REF] Talupur | Range Allocation for Separation Logic[END_REF].

We use symbols such as Q, Z, N, and R with different meaning. Depending on the current context, we use them to address the respective sets of numbers, structures, or sorts.

Notice that the formal term length of the LRA term t 1 := 4x -2 differs significantly from the length of the PA term t 2 := 4x -2. While the former has term length len(t 1 ) = len(4 • x + (-2)) = 5, the latter has length len(t 2 ) = len(x + x + x + x -1 -1) = 11. More generally, the rational numbers in LRA terms are formally represented by constant symbols, the integers in (abbreviated) PA terms can be conceived as being represented in a unary encoding. Since we will not be concerned with PA terms when analyzing computational complexity of certain decision procedures later, this technical curiosity will not impact our investigations any further.

Although J A -equivalence and the coloring function χ A are technically defined for a different setting, we reuse the definitions in Lemma 10.2.11 and in Proposition 10.2.12 with their intended meaning without formally adapting them to the new setting.

See Footnote 2.

See Footnote 2 on page 240.

Recall that validity in the theory of the rationals with addition and multiplication is undecidable, cf. Footnote 2 on page 20.

Although κ-equivalence and κ-equivalence and the coloring function χ A are technically defined for a different setting, we reuse the definitions in Lemma 10.4.8 and in Proposition 10.4.9 with their intended meaning without formally adapting them to the new setting.

See Footnote 6 on page 252.

See Footnote 6 on page 252.

Notice that it is sufficient to set µ = κ • m instead of µ := κ • (m + 1), as the start and end points of the paths we need to consider in difference constraint graphs associated with clock constraints in timed automata do not coincide.

Halpern's proof shifts the perspective from the validity problem to the problem of satisfiability. A Σ 1 1 -complete satisfiability problem entails a Π 1 1 -complete validity problem and vice versa, given that the considered languages are closed under negation. For the definition of the analytical hierarchy and the sets Π 1 1 and Σ 1 1 , see, e.g., Chapter IV.2 in[START_REF] Odifreddi | Classical Recursion Theory[END_REF] or Chapter 16 in[START_REF] Rogers | Theory of recursive functions and effective computability[END_REF].

While atoms of the form x c • y, with c being any nonnegative integer, can be read as an abbreviation of PA terms x y + . . . + y c times , atoms of the form x • y c cannot. We view the latter as nonlinear arithmetic terms either over the integers or over the reals. They will not play any significant role in the rest of the present thesis.

Using d as a starting point instead of 0, say, is convenient, since we can use this information about the starting point to determine the length of subchunks.

Technically, a length of d + 1 for the subchunks of the second chunk would suffice. After all, the value of a counter can increase by at most one in a single computation step. However, we have chosen to increase the length in an exponential fashion rather than a linear one, as this will keep the encoding simple.

The sets Σ 0 n , Π 0 n are sets of sets of natural numbers that are describable by certain first-order-arithmetic

See, e.g.,[START_REF] Rogers | Theory of recursive functions and effective computability[END_REF][START_REF] Odifreddi | Classical Recursion Theory[END_REF] for a definition of the analytical hierarchy. It can be conceived as the second-order equivalent of the arithmetical hierarchy. The main result we need in the present thesis is that any problem that is hard or complete for Σ 1 n or Π 1 n with n ≥ 1 is not recursively enumerable; the same applies to the complement of such a problem.

The idea to use an uninterpreted Skolem constant as the quantity for increment was suggested to the author of the present thesis by Dietrich Kuske during breakfast at the 32nd Annual ACM/IEEE Symposium on Logic in Computer Science (LICS'17) in Reykjavik, Iceland, in June 2017.

The fact that the shift of recursive enumerability from the unsatisfiability problem to the satisfiability problem is a rather peculiar property was brought to the attention of the author of the present thesis by Dietrich Kuske, cf. Footnote 7 on page 279.

In the literature, the definition of EUF often includes uninterpreted predicate symbols, which are then ignored in the further treatment for convenience. See, e.g., Section 3.2 in[START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF], or Section 4.2 in[START_REF] Kroening | Decision Procedures[END_REF].

Although the term EPR is used ambiguously throughout the literature, e.g. sometimes referring to BSR, sometimes only referring to BSR without equality, the alternative term should be kept in mind when looking up publications in which BSR is used in applications.

The spectrum of a satisfiable sentence ϕ is the set of all cardinalities κ such that there is some model A |= ϕ whose domain A has cardinality κ.

This trick is inspired by optimizations used in the field of linear quantifier elimination over the reals[START_REF] Loos | Applying Linear Quantifier Elimination[END_REF].

Krom ∼, 10, 25, 28, 37, 39, 143, 146, 147 length of a ∼, 10 LGF ∼, 83 local ∼, 46 loosely guarded ∼, 83 LRA+P N ∼, 224 LRA ∼, 182, 223 matrix of a ∼, 10 monadic ∼, 22 PA+P ∼, 223 PA ∼, 223 positive ∼, 185 propositional ∼, 143 quantified Σ-∼, 9 relational ∼, 10 satisfied ∼, 11 second-order ∼, 14 segregated ∼, 19 separated guarded-negation ∼, 93

Acknowledgments

Proposition 5.3.6 ([BGG97], Theorem 6.1.8). Let T : N → N be a time-constructible function with T (dn)

2 ∈ o(T (n)) for some constant d > 0 and let L be a problem such that for every domino system D we have DOMINO(D, T (n)) ≤ g(n) L, i.e. DOMINO(D, T (n)) is polynomially reducible to L via length order g(n). Moreover, let h : N → N be a function such that h(e • g(n)) ∈ O(n) for any positive constant e. There exists a positive constant c > 0 such that L ∈ NTIME(T (c • h(n))).

We are now almost done with the preliminaries. It only remains to show that the functions we intend to use as time bounds T (n) satisfy the requirements of Proposition 5.3.6. Recall our notation for the tetration operation 2 ↑k (m), which we defined inductively: 2 ↑0 (m) := m and 2 ↑k+1 (m) := 2 (2 ↑k (m)) . In addition, we use the short-hand 2 ↑k 2 ↑k to abbreviate 2 ↑k (2). We need to find positive constants c 1 , c 2 and verify the conditions 2 ↑k (c 1 n)

2 ∈ o(2 ↑k (n)) for every fixed k ≥ 1, and 2 ↑c2n 2 ∈ o(2 ↑n ), respectively. Setting c 1 := 1 4 and c 2 := 1 2 entails the following. Lemma 5.3.7. Let k ≥ 1 be some fixed positive integer. For every positive constant c > 0 there exists some positive integer n 0 ≥ 1 such that for every n ≥ n 0 we have

Proof. Let k = 1. We observe 2 ↑1 (n/4)

Assume 0 < c < 1 and set d := 1 c . Hence, d > 1. If remains to show d • 2 n/2 ≤ 2 n for every sufficiently large n. Due to 2 n = 2 n/2+n/2 = 2 n/2 • 2 n/2 , we observe d • 2 n/2 ≤ 2 n/2 • 2 n/2 if and only if d ≤ 2 n/2 . But the latter certainly holds for sufficiently large n.

equivalently, 1 4 n + 1 ≤ n for sufficiently large n. But this is obviously true. Assume 0 < c < 1 and define d := 1 c . It follows that d > 1. It remains to show d•2 2 n/4+1 ≤ 2 2 n for sufficiently large n. Due to 2 2 n = 2 2 n/2 •2 n/2 ≥ 2 2 n/2 +2 n/2 = 2 2 n/2 • 2 2 n/2 with d ≤ 2 2 n/2 and 2 2 n/4+1 ≤ 2 2 n/2 for sufficiently large n, we also observe d • 2 2 n/4+1 ≤ 2 2 n/2 • 2 2 n/2 ≤ 2 2 n for sufficiently large n. Analogous arguments hold for every k ≥ 2. Lemma 5.3.8. For every positive constant c > 0 there exists some positive integer n 0 > 0 such that for every n ≥ n 0 we have

Proof. We distinguish two cases:

Suppose c ≥ 1. We observe

, and

(2) c • 2 ↑n ≥ 2 ↑n = 2 2 2 ↑n-2 .

Hence, it suffices to show there is some n 0 ≥ 2 such that 1 + 2 ↑ n/2 -2 ≤ 2 ↑n-2 holds for every n ≥ n 0 . One possible choice is n 0 = 4 Suppose 0 < c < 1. We set d := 1 c . Due to d > 1, log 2 d is defined. Moreover, we observe

= 2 2 log 2 (log 2 d+2) •2 2 ↑ n/2 -2 = 2 2 log 2 (log 2 d+2)+2 ↑ n/2 -2 .

get the following for the index j and its successors: Representation of index j: binary representation: 1 0 1 1 J-J * -representation:

J(2, j, 11, 1) J(2, j, 10, 0) J(2, j, 01, 1) J(2, j, 00, 1) J * (2, j, 11, 0) J * (2, j, 10, 1) J * (2, j, 01, 1) J * (2, j, 00, 1) Representation of the successor index j : binary representation: 1 1 0 0 J-J * -representation:

J(2, j , 11, 1) J(2, j , 10, 1) J(2, j , 01, 0) J(2, j , 00, 0) J * (2, j , 11, 0) J * (2, j , 10, 0) J * (2, j , 01, 0) J * (2, j , 00, 1) Representation of the second successor index j : binary representation: 1 1 0 1 J-J * -representation:

J(2, j , 11, 1) J(2, j , 10, 1) J(2, j , 01, 0) J(2, j , 00, 1) J * (2, j , 11, 0) J * (2, j , 10, 0) J * (2, j , 01, 1) J * (2, j , 00, 1) What we observe is that the J-representation of j's successor j is the result of combining j's J-representation with its J * -representation using bitwise exclusive OR. More technically, for every i ∈ {00, 01, 10, 11} and all b, b * ∈ {0, 1} we have that J(2, j, i, b) and J * (2, j, i, b * ) entails J(2, j , i, b ⊕ b * ).

Proof. By totality of f , it follows that for every b ∈ I -1 we have A |= J( , a, b, f (b)) and A |= J( , a , b, f (b)). Moreover, A |= ψ 13 entails A |= J( , a, b, 1-f (b)) and A |= J( , a , b, 1-f (b)). This results in a ∼ a .

Lemma 5.3.20. Let a, a ∈ I for some , 1 ≤ ≤ κ. Moreover, let f be some function in F -1 . If a belongs to S ,f and we have a ∼ a , then a ∈ S ,f . Proof. By totality of f , it follows that for every b ∈ I -1 we have A |= J( , a, b, f (b)). Moreover, A |= ψ 13 entails A |= J( , a, b, 1f (b)). Since we assume a ∼ a , we know that these properties transfer to a . Hence, for every b ∈ I -1 we observe A |= J( , a , b, f (b)) and A |= J( , a , b, 1-f (b)). Consequently, a ∈ S ,f . Lemma 5.3.21. Consider any , 0 ≤ ≤ κ -1. If there is a unique chain a 1 ≺ . . . ≺ a p comprising all elements in I , then we can uniquely arrange all functions in F into a chain f 1 . . . f p where p = |F | = 2 p-1 + 1.

Proof. Let {0, 1} p be the set of all bit strings of length p. If we interpret each of them as a number encoded in binary (where we assume the rightmost bit to be the least significant one), we can uniquely arrange the 2 p-1 + 1 smallest bit strings in {0, 1} p into a chain b0 < b1 < . . . < b2 p-1 -1 < b2 p-1

where the indices reflect the encoded numerical value and < is intended to be the usual ordering based on this value. Since we assume the leftmost bit to be the most significant one, it is 0 in b0 , . . . , b2 p-1 -1 . Accordingly, b2 p-1 is the bit string with all zeros except for the most significant bit, i.e. b2 p-1 = 10 . . . 0. Obviously, the following mapping ρ ρ induces a one-to-one correspondence between bit strings and all the mappings in F : ρ(f ) := f (a p )f (a p-1 ) . . . f (a 2 )f (a 1 ). By definition of , we have f g if and only if ρ(f ) + 1 = ρ(g). Consequently, we obtain the chain ρ -1 ( b0 ) ρ -1 ( b1 ) . . . ρ -1 ( b2 p-1 -1 ) ρ -1 ( b2 p-1 ).

Lemma 5.3.22. I 0 contains exactly the elements c A 1 , . . . , c A µ , and these are pairwise distinct. Moreover, there is a unique chain c A 1 ≺ 0 . . . ≺ 0 c A µ .

Proof. A |= χ 1 entails that I 0 ⊆ {c A 1 , . . . , c A µ }. Due to A |= ψ 8 we have c A 1 ≺ 0 . . . ≺ 0 c A µ . By A |= ψ 6 , a ≺ 0 b entails a, b ∈ I 0 . Hence, {c A 1 , . . . , c A µ } ⊆ I 0 . We next show that all c A 1 , . . . , c A µ are pairwise distinct.

Claim: For every index j ≥ 2 the first j elements c A 1 , . . . , c A j are distinct.

Proof: We proceed by induction on j.

For j = 2, c A 1 = c A 2 must hold, for otherwise c A 1 ≺ 0 c A 2 contradicts A |= ψ 7 which entails A |= ∀j. ¬Succ(0, j, j).

Let j ≥ 3 and assume, by induction, that the elements c A 1 , . . . , c A j-1 are all pairwise distinct. Suppose there is some index i * , 1 ≤ i * < j, such that c A i * = c A j . We distinguish two cases:

and since we assumed

But this contradicts our inductive hypothesis, because i * -1 and j -1 are distinct indices and thus the inductive hypothesis implies that c A i * -1 and c A j-1 are distinct. ♦

The above claim entails

By the above arguments, we know that this chain comprises all elements in I 0 . Moreover, due to A |= ψ 7 , this chain is the only chain satisfying the desired properties.

Lemma 5.3.23. For every = 1, . . . , κ the following properties are satisfied:

(i) For all a, a ∈ I with A, [j →a, j → a] |= eq j, j we have a ∼ a.

(ii) All a, a ∈ I with a ∼ a satisfy A, [j →a, j → a] |= eq j, j .

(iii) For every f ∈ F -1 the set S ,f is nonempty.

(v) For every f ∈ F -1 the set S ,f contains exactly one element.

(vi) There is a unique chain a 1 ≺ . . . ≺ a p comprising all elements in I , and we have A |= MinIdx( , a 1 ) and A |= MaxIdx( , a p ).

Proof. We proceed by induction on .

Base case: = 1.

Ad (i). Due to the assumption A, [j →a, j → a] |= eq 1 j, j , the construction of eq 1 j, j entails

.

Ad (ii). By definition of ∼ 1 , a ∼ 1 a entails that for every b ∈ I 0 we have

Moreover, Lemma 5.3.22 states that I 0 = {c A 1 , . . . , c A µ }. Since a, a belong to I 1 , we conclude A, [j →a, j → a] |= eq 1 j, j . Ad (iii). A |= ψ 8 entails c A 1 ≺ 0 . . . ≺ 0 c A µ . By Lemma 5.3.22, we know that this chain comprises all elements in I 0 . Moreover, due to A |= ψ 7 , this chain is the only chain satisfying this property. Hence, by Lemma 5.3.21, we can arrange all functions in F 0 into a sequence f 1 0 . . . 0 f p for p = 2 µ-1 + 1. Clearly, f 1 maps every element b ∈ I 0 to f 1 (b) = 0, and

Let a be an element of S 1,f k . Because of k < p, we know that A |= J(1, a, c µ , 0). By virtue of (i) and due to A |= ψ 16 we conclude that there are elements a, a ∈ I 1 such that a ∼ 1 a and a ≺ 1 a . By Lemma 5.3.18, this results in a ∈ S ,f k+1 .

Ad (iv)

. By definition of the sets S ,f , we have S 1,f ⊆ I 1 . It remains to show

As a consequence of A |= ψ 13 there is a unique partial function g a : I 0 → {0, 1} for every a ∈ I 1 such that for every b ∈ I 0 we have A |= J(1, a, b, g a (b)) if and only if g a is defined for b. Because of A |= χ 2 , we know that g a must be total. For every a ∈ I 1 where g a (c A µ ) = 0 we have g a ∈ F 0 and thus also a ∈ S 1,ga . Because of A |= ψ 5 ∧ ψ 11 ∧ ψ 12 we know that A |= MaxIdx(1, e 1 ) and that e A 1 is the only element e ∈ I 1 for which we have A |= J(1, e, c µ , 1). It remains to show that for every b ∈ I 0 with b = c A µ we have A |= J(1, e 1 , b, 0). But this is a consequence of (iii) and the fact that the total function f * mapping all elements b in I 0 but c A µ to f * (b) = 0 belongs to F 0 , and thus S 1,f * is nonempty. In particular, S 1,f * = {e A 1 }. Consequently, I 1 cannot contain any elements that do not lie in f ∈F0 S 1,f . Ad (4). Due to (3) and due to the way χ is constructed from N * , every positive occurrence of a predicate symbol P in χ entails the existence of a negative occurrence of P in ¬ψ, and every negative occurrence of a predicate symbol P in χ entails the existence of a positive occurrence of P in ¬ψ. Consequently, χ satisfies Requirement (ii) as well.

Chapter 7

Beyond the Classical Decision Problem: Further Applications of Separateness

Evidently, the analysis of separateness of quantified variables and of weak dependences has applications in the quest for decidable first-order fragments. In the present chapter we briefly outline the applicability of these concepts to three other areas: the analysis of computational complexity of reasoning with respect to a fixed theory, e.g., rational arithmetic; proof complexity and automated reasoning in first-order logic; and the elimination of second-order quantifiers.

Separated Formulas and Linear Rational Arithmetic: A Little Case Study

In Chapter 4 we discussed fingerprints as a means to semantically characterize tuples of domain elements with respect to a given sentence and its atoms under a given structure. We recapitulate the underlying idea in Example 7.1.1. The purpose of the present section is to show that the number of fingerprints that possibly occur can be severely limited when we restrict the syntax of first-order formulas and focus on a certain kind of structures. As an exemplary case we study linear rational arithmetic (LRA).

Example 7.1.1. Consider the sentence ϕ := ∀x

Let µ 2 be the fingerprint function mapping pairs of elements from A's domain to fingerprints:

Fingerprints for unary tuples are a bit more interesting. Let µ 1 be the fingerprint function mapping elements from A's domain to fingerprints:

Technically, we have µ 1 (d) := S S = µ 2 (d, d ) for some element d ∈ A . Hence, µ 1 (d) characterizes for cases where the value d is assigned to x 1 which atoms will potentially become true under A when choosing a values for x 2 from A's domain.

It is easy to see that if we were to consider a different structure B the image of µ 2 could potentially contain a number of fingerprints that is exponential in the number of atoms occurring in ϕ, i.e. up to 2 3 = 8 sets of atoms. For the image of µ 1 , we even get a doubly exponential upper bound, i.e. 2 2 3 = 256. Indeed, we have (almost) constructed such structures in the proofs of Theorems 3.2.7, 3.9.9, 3.10.8, and 3.12.5.

The fingerprints described in the above example are very general. This generality is certainly necessary in settings where we do not restrict the class of structures we consider. However, there are (classes of) structures that do not require as much freedom for the fingerprints of domain elements. In such settings fingerprints could be structured in a simpler way. The example we shall consider is linear arithmetic over the rationals. More precisely, we consider first-order formulas over the vocabulary Σ LRA := {<, ≤, =, ≥, >}, Q ∪ {+, •} containing the rational numbers as constant symbols under the following syntactic restriction: multiplication is only allowed in terms a • x where a is some rational coefficient and x is some first-order variable. We shall call the set of all first-order formulas in which all terms are LRA terms LRA formulas LRA formulas . Semantically, we fix the structure under which LRA formulas are interpreted to Q, the rational numbers with the standard interpretation for the symbols in Σ LRA . For convenience, we use abbreviations such as 3 2 x -5yz for the formal expression 3 2 • x + (-5) • y + (-1) • z.

Example 7.1.2. Consider the linear-arithmetic atoms A(x, y) The above example illustrates nicely that fingerprints over linear-arithmetic atoms are very restricted. For instance, there cannot be any rational number r with a fingerprint µ 1 (r) that is a superset of {A(x, y)}, {A(x, y), B(x, y)}, {B(x, y)}, {C(x, y)} . The reason is that for any fixed r the solution spaces for A(r, y), B(r, y), and C(r, y) are either empty or singleton sets or the union of (at most two) unbounded intervals, respectively. Hence, if there are three rationals s 1 , s 2 , s 3 such that we have

(1)

(1)

.4: Illustration of the solution set of three linear-arithmetic atoms A(y 1 , y 2 , y 3 ) (in green), B(y 1 , y 2 , y 3 ) (in blue), and C(y 1 , y 2 , y 3 ) (in red) for certain rational values r 1 < r 2 < r 3 assigned to y 1 . Each diagram represents one of the fingerprints ν 1 (r 1 ), ν 1 (r 2 ), ν 1 (r 3 ), as indicated. The initial sequence S 0 for each of these fingerprints is the sequence {C}|{B}{C}{A}, i.e. the fingerprint associated with (1). After S 0 each fingerprint lists the intersections of the hyperplanes induced by A, B, C in the order they occur, viewed from -∞ along the y 2 -axis in the positive direction. Every set in the list represents a point in which the indicated hyperplanes intersect. The overall fingerprint ν 0 is represented by the sequence {C}|{B}{C}{A} {B, C}{A, B}{A, C} {A, B, C}.

(1)

(1)

.5: Illustration of the solution set of two linear-arithmetic atoms A(y 1 , y 2 , y 3 ) (in green) and B(y 1 , y 2 , y 3 ) (in blue) for certain rational values r 1 < r 2 < r 3 assigned to y 1 . Each diagram represents one of the fingerprints ν 1 (r 1 ), ν 1 (r 2 ), ν 1 (r 3 ), as indicated. The initial sequence in the fingerprint representations differ for each of the three points, however, after the initial sequence, the empty sequence ε follows. This means, for fixed y 1 = r the fingerprints ν 2 (r, y 2 ) along the y 2 -axis do not change. The overall fingerprint ν 0 is represented by the sequence {A}|{A}{B} ε {A, B}.

Next, we describe the virtual substitution virtual substitution method for the elimination of existential quantifiers in first-order formulas over linear rational arithmetic. We have already outlined the method in Chapter 2 (page 20). In our simple setting virtual substitution is based on two components: (a) a method for extracting a set of testpoints from a given formula ϕ, also called an elimination set, and (b) the virtual substitution operator x/ /t , which is a generalization of the syntactic substitution operator x/t . An LRA formula is called positive positive formulas , if it does not contain any negation sign. Notice that any LRA formula can be transformed into an equivalent positive LRA formula whose length Now consider any LRA sentence ϕ := ∀x 1 ∃y 1 . . . ∀x n ∃y n . ψ(x, ȳ) with quantifier-free ψ in which the tuples x := x 1 , . . . , x n and ȳ := y 1 , . . . , y n are separated. Without loss of generality, we assume that ϕ is a positive formula and that every atom in it has the form a 1 z 1 + . . . a n z n b. Let At be the set of atoms occurring in ϕ. Then, At can be partitioned into two parts At x and At ȳ such that vars(At x) ⊆ x and vars(At ȳ) ⊆ ȳ.

Definition 7.1.7 (Fingerprint functions µ ). We define the family of fingerprint functions µ with 0 ≤ ≤ n in analogy to Definition 4.2.4 as follows:

µ n : Q n → PAt x such that for every sequence r ∈ Q n and every A(x) ∈ At x we have A(x) ∈ µ n (r) if and only if Q |= A(r). For every , 1 ≤ < n, we set µ : Q → P n-+1 At x such that for every sequence r ∈ Q and every S ∈ P n-At x we have S ∈ µ (r) if and only if there is some rational number q such that µ +1 (r, q) = S. Moreover, we define µ 0 ⊆ P n+1 At x such that for every S ∈ P n At x we have S ∈ µ 0 if and only if there is some rational number q such that µ 1 (q) = S. We denote the image of a fingerprint function µ by im(µ ) := µ r r ∈ Q .

Lemma 7.1.8. For every i, 0 ≤ i ≤ n -1, and any fixed sequence r

Proof. We define the sets Ψ x i and Ψ x i (r) Ψ x i , Ψ x i (r) in analogy to the sets Ψ i and Ψ i (r) based on At x rather than an arbitrary set At. Moreover, let the bijections ρ i : P n-i+1 At x → Ψ x i ρ i be defined inductively as follows: For every S ∈ PAt x we set ρ n (S) := ∃x n . A∈S A ∧ A∈Atx\S ¬A . For every i < n and every S ∈ P n-i+1 At x we set ρ i (S) :

Claim I: For every i and every

Proof: We proceed by induction on i, starting from i = n going downwards.

Base case: Let i = n. Given any tuple r ∈ Q n-1 , for every set S ∈ µ n-1 (r) there is some q n ∈ Q such that for every A(x) ∈ At x we have Q |= A(r, q n ) if and only if A ∈ S. In other words, we have

, which holds if and only if ρ n (S) ∈ Ψ x n (r). Conversely, from ρ n (S) ∈ Ψ x n (r) follows the existence of some q n for which

Inductive case: Let i < n. Given any tuple r ∈ Q i-1 , for every set S ∈ µ i-1 (r) there is some q i ∈ Q such that S = µ i (r, q i ). By induction, for every

, which holds if and only if ρ i (S) ∈ Ψ x i (r). Conversely, from ρ i (S) ∈ Ψ x i (r) follows the existence of some q i for which

Fix any structure A over the vocabulary of ϕ and consider the model-checking game associated with ϕ over A. In the context of Theorem 7.2.8, we use the notion of strategy and related concepts from Chapter 4. Again, let W := vars(ϕ) \ W W denote the complement of W . By Lemmas 7.2.5 and 7.2.6, we know that W and W are separated in ϕ and that, hence, the sets of atoms At(W ) and At(W ) are disjoint (see also the proof of Theorem 7.2.7). Recall that a strategy σ is a sequence σ 1 , . . . , σ n of mappings σ i :

Analogously, we divide every ȳi into two parts ȳ1 i , ȳ2 i . For convenience, we also split every σ i into two parts:

Next, we define fingerprint functions that suit the setting of Theorem 7.2.8. In this situation it is convenient to use two complementing kinds of fingerprints. On the one hand, the mappings ν k , ν k assign fingerprints over the set At(W ) to sequences of tuples ā1 , c1 , . . . , āk , ck with āi

The mappings ξ k , ξ k , on the other hand, assign fingerprints over the set At(W ) to sequences of tuples b1 , d1 , . . . , bk , dk with bi

Definition 7.2.9 (Fingerprint functions ν k , ν k ). Based on ϕ and A, we define the family of

such that for all tuples ā1 , . . . , ān , c1 , . . . , cn and every

such that for all tuples ā1 , . . . , ān , c1 , . . . , cn-1 and every S ∈ PAt(W ) we have

such that for all tuples ā1 , . . . , ān-1 , c1 , . . . , cn-1 and every S ∈ P 2 At(W ) we have S ∈ ν n-1 (ā 1 , c1 , . . . , ān-1 , cn-1 ) if and only if there is some ān such that ν n (ā 1 , c1 , . . . , ān-1 , cn-1 , ān ) = S;

. . .

such that for all tuples ā1 , c1 and every S ∈ P 2n-2 At(W ) we have S ∈ ν 1 (ā 1 , c1 ) if and only if there exist some ā2 such that ν 2 (ā 1 , c1 , ā2 ) = S.

such that for every tuple ā1 and every S ∈ P 2n-1 At(W ) we have S ∈ ν 1 (ā 1 ) if and only if there exist some c1 such that ν 1 (ā 1 , c1 ) = S.

We denote the image of any fingerprint function

for every i . Analogously, we denote the image of any fingerprint function ν k by im(ν k ). Given a strategy σ, we denote the image under σ of any fingerprint function

for every i . Analogously, we denote the image under σ of any fingerprint function ν k by im σ (ν k ). Definition 7.2.10 (Fingerprint functions ξ k , ξ k ). Based on ϕ and A, we define the family of

such that for all tuples b1 , . . . , bn , d1 , . . . , dn and every

such that for all tuples b1 , . . . , bn , d1 , . . . , dn-1 and every S ∈ PAt(W ) we have S ∈ ξ n ( b1 , d1 , . . . , bn-1 , dn-1 , bn ) if and only if there is some dn such that ξ n ( b1 , d1 , . . . , bn-1 , dn-1 , bn , dn ) = S;

such that for all tuples b1 , . . . , bn-1 , d1 , . . . , dn-1 and every S ∈ P 2 At(W ) we have S ∈ ξ n-1 ( b1 , d1 , . . . , bn-1 , dn-1 ) if and only if there is some bn such that ξ n ( b1 , d1 , . . . , bn-1 , dn-1 , bn ) = S;

. . .

such that for all tuples b1 , d1 and every S ∈ P 2n-2 At(W ) we have S ∈ ξ 1 ( b1 , d1 ) if and only if there exist some b2 such that ξ 2 ( b1 , d1 , b2 ) = S.

such that for every tuple b1 and every S ∈ P 2n-1 At(W ) we have S ∈ ξ 1 ( b1 ) if and only if there exist some d1 such that ξ 1 ( b1 , d1 ) = S.

In analogy to Definition 7.2.9, we denote the image of any fingerprint function

and the image of any ξ k by im(ξ k ). Moreover, given any strategy σ, we denote the image under σ of any fingerprint function

for every i , and the image under σ of any fingerprint function ξ k is denoted by im σ (ξ k ).

Next we show that, staring from any given strategy, we can construct a strategy with a similar outcome that is uniform with respect to the just defined fingerprint functions.

Lemma 7.2.11. For every strategy σ = σ 1 , . . . , σ n there is a strategy τ = τ 1 , . . . , τ n that satisfies the following conditions.

(a) τ is required to be ν-ξ-uniform ν-ξ-uniformity . That is, for every k and all tuples ā1 , ā

Proof. For i = 1, . . . , n we define

as abbreviation of

We partition A 1 into sets A 1, S1,T1 with S 1 ∈ im(ν 1 ) and T 1 ∈ im(ξ 1 ) by set-

and there is some

Having all the representatives α k, S (k) ,T (k) at hand, we inductively construct τ , starting from τ 1 1 , τ 2 1 and going to τ 1 n , τ 2 n .

Let k = 1. Consider any representative c1 , d1 := α 1, S1,T1 for any fingerprints S 1 , T 1 . Let

, there is some tuple ē1 for which ν 1 ā1 , ē1 = S 2 . We set τ 1 1 (ā 1 , d1 ) := ē1 . In case of ā1 = c1 , we make sure that ē1 = σ 1 1 (c 1 , d1 ), i.e. we set

). Hence, we get ν 1 ā1 , τ 1 1 (ā 1 , d1 ) = S 2 . Symmetriaclly, for any tuple b1 ∈ A |x 2 1 | with ξ 1 b1 = T 1 we define τ 2 1 (c 1 , b1 ) as follows. Since T 2 ∈ T 1 = ξ 1 b1 , there is some tuple f1 for which ξ 1 b1 , f1 = T 2 . We set τ 2 1 (c 1 , b1 ) := f1 . In case of b1 = d1 , we make sure that f1 = σ 2 1 (c 1 , d1 ), i.e. we set τ 2 1 (α 1, S1,T1 ) := σ 2 1 (α 1, S1,T1 ). Hence, we get ξ 1 b1 , τ 2 1 (c 1 , b1 ) = T 2 . Now, consider any two tuples ā1

, and let S 1 := ν 1 (ā 1 ) and T 1 := ξ 1 ( b1 ). Moreover, let c1 , d1 := α 1, S1,T1 . We set and τ

Let k > 1. Consider any representative c1 , d1 , . . . , ck , dk := α 1, S (k) ,T (k) for any two sequences of fingerprints S (k) , T (k) . Let S 2k := ν k c1 , σ 1 1 (c 1 , d1 ), . . . , ck , σ 1 k (c 1 , d1 , . . . , ck , dk ) and T 2k := ξ k d1 , σ 2 1 (c 1 , d1 ), . . . , dk , σ 2 k (c 1 , d1 , . . . , ck , dk ) . For any sequence of tuples ā1 , . . . , āk with

. . , āk , dk ) as follows. Since S 2k ∈ S 2k-1 , there is some tuple ēk for which

. . , āk , dk ) := ēk . In case of āi = ci for every i, we make sure that ēk = σ 1 k (c 1 , d1 , . . . , ck , dk ), i.e. we set

. Symmetrically, for any sequence of tuples b1 , . . . , bk with

. . , ck , bk ) as follows. Since T 2k ∈ T 2k-1 , there is some tuple fk for which ξ k b1 , τ 2 1 (c 1 , b1 ), . . . , āk-1 , τ 2 k-1 (c 1 , b1 , . . . , ck-1 , bk-1 ), bk , fk = T 2k . We set τ 2 k (c 1 , b1 , . . . , ck , bk ) := fk . In case of bi = di for every i, we make sure that fk = σ 2 k (c 1 , d1 , . . . , ck , dk ), i.e. we set

. Now, consider any sequence of tuples ā1 , b1 , . . . , āk , bk with āi ∈ A |x 1 i | and bi ∈ A |x 2 i | for every i. Let S (k) := S 1 . . . S 2k-1 be a sequence of fingerprints such that

. . , āk-1 , bk-1 ), āk . In addition, let T (k) := T 1 . . . T 2k-1 be a sequence of fingerprints such that

. . , āk-1 , bk-1 ), bk . Suppose there exists a representative c1 , d1 , . . . , ck , dk := α k, S (k) ,T (k) -we show in Claim II that this is always the case. Then, we set τ 1 k (ā 1 , b1 , . . . , āk , bk ) := τ 1 k (ā 1 , d1 , . . . , āk , dk ) and

Claim Ia: For all k, 1 ≤ k ≤ n, we have im τ ν k ⊆ im σ ν k (where we consider im τ (ν k ) to be defined such that any value ν k (. . .) can only enter im τ (ν k ) if all of its arguments are defined).

Proof: Fix some ν k and let S ∈ im τ (ν k ). Then, there are tuples ā1

. . , āk-1 , bk-1 ) are defined and we have S = ν k ā1 , τ 1 1 (ā 1 , b1 ), . . . , āk-1 , τ 1 k-1 (ā 1 , b1 , . . . , āk-1 , bk-1 ), āk . By construction of τ , the mapping τ 1 k-1 is defined in such a way that

for a certain representative c1 , d1 , . . . , ck-1 , dk-1 = α k-1, S (k-1) ,T (k-1) .

Since S ∈ ν k-1 ā1 , τ 1 1 (ā 1 , b1 ), . . . , āk-1 , τ 1 k-1 (ā 1 , b1 , . . . , āk-1 , bk-1 ) , the definition of ν k-1 entails that there is some tuple ā

where we consider im τ (ξ k ) to be defined such that any value ξ k (. . .) can only enter im τ (ξ k ) if all of its arguments are defined).

Proof: The proof is similar to the proof of Claim Ia. ♦

Claim II: For every k, 1 ≤ k ≤ n, and all tuples ā1 , . . . , āk , b1 , . . . , bk there is a (unique) representative α k, S (k) ,T (k) such that

and

. . , āk-1 , bk-1 ), bk .

Proof: We proceed by induction on k.

Let k = 1. Consider any pair of tuples ā1 , b1 and set S 1 := ν 1 ā1 and T 1 := ξ 1 b1 . Obviously, we have S 1 ∈ im(ν 1 ) and T 1 ∈ im(ξ 1 ) and ā1 , b1 ∈ A 1, S1,T1 . Since the set is nonempty, there is a representative α 1, S1,T1 ∈ A 1, S1,T1 .

Let k > 1. Consider any sequence of tuples ā1 , . . . , āk , b1 , . . . , bk . Let the sequences S (k) := S 1 . . . S 2k-1 and T (k) := T 1 . . . T 2k-1 be defined as indicated in the claim. By

Claim Ia and Claim Ib, we have S 2j-1 ∈ im τ (ν j ) ⊆ im σ (ν j ) ⊆ im(ν j ) and T 2j-1 ∈ im τ (ξ j ) ⊆ im σ (ξ j ) ⊆ im(ξ j ) for every j, 1 ≤ j ≤ k. Moreover, the definitions of the ν j and the ξ j entail that S 2j ∈ S 2j-1 and T 2j ∈ T 2j-1 for every j, 1 ≤ j ≤ k. Therefore, we have constructed the subset A k, S (k) ,T (k) ⊆ A k when defining representatives. We next show that this set is not empty. By induction, there is some representative c1 , d1 , . . . , ck-1 , dk-1 := α k-1, S (k-1) ,T (k-1) . More precisely, the definition of τ entails

The mappings τ 1 k-1 and τ 2 k-1 are defined in such a way that

By definition of ν k-1 and ξ k-1 and the fact that S 2k-1 ∈ S 2k-2 and T 2k-1 ∈ T 2k-2 , there are tuples ā k , b k such that

is not empty. This means we have defined some -indeed, exactly one -representative α k, S (k) ,T (k) . ♦

Claim III: τ satisfies (a), i.e. it is ν-ξ-uniform.

Proof: By construction of τ . ♦

It remains to show Out τ ⊆ Out σ . Let U ∈ Out τ , i.e. there exist tuples ā1 , . . . , ān , b1 , . . . , bn such that U = out τ (ā 1 , b1 , . . . , ān , bn ). Since the sets At(W ) and At(W ) are disjoint, we may partition U into two (possibly empty) parts S 2n := U ∩ At(W ) and T 2n := U ∩ At(W ) which constitute the fingerprints S 2n = ν n ā1 , τ 1 n (ā 1 , b1 ), . . . , ān , τ 1 n (ā 1 , b1 , . . . , ān , bn ) and T 2n = ξ n b1 , τ 2 n (ā 1 , b1 ), . . . , bn , τ 2 n (ā 1 , b1 , . . . , ān , bn ) . Claim II guarantees the existence of some representative c1 , d1 , . . . , cn , dn :

. . , cn-1 , dn-1 ), dn . The mappings τ 1 n , τ 2 n are defined in such a way that

. . , cn , dn ) and

Consequently, we have U = out τ (ā 1 , b1 , . . . , ān , bn ) = out σ (c 1 , d1 , . . . , cn , dn ) ∈ Out σ . Altogether, it follows that Out τ ⊆ Out σ .

Lemma 7.2.11 entails the existence of satisfying strategies that are uniform simultaneously for the fingerprint functions ν k , ν k , ξ k , ξ k , if there are satisfying strategies at all. Since this uniformity applies with respect to finitely many fingerprints, the existence of such strategies reveals the weak character of certain dependences in the sentence ϕ. The next lemma makes this explicit.

Lemma 7.2.12. Suppose that A is a model of ϕ and let σ be a strategy that is satisfying for ϕ under A. There is some sequence m 1 , . . . , m n of positive integers and there is a strategy τ and a family of mappings ρ j k :

with 1 ≤ k ≤ n and 1 ≤ j ≤ m k such the following conditions are met.

(a) For every k and for all sequences ā1 , . . . , āk , b1 , . . . , bk there is some j such that we have τ 2 k (ā 1 , b1 , . . . , āk , bk ) = ρ j k ( b1 , . . . , bk ).

(b) The strategy τ is satisfying for ϕ under A.

Proof. Without loss of generality, we assume that σ is ν-ξ-uniform (cf. Requirement (a) in Lemma 7.2.11). In other words, we assume that σ is ν-ξ-uniform. Before we start constructing τ , we define the following notation. Let ā1 , . . . , āk and b1 , . . . , bk be sequences with āi

we mean the pair S 1 . . . S 2k-1 , T 1 . . . T 2k-1 such that for every i,

We now show that there is a witness for the strategy τ . For every k, let m k m k be the number of pairs S 1 . . . S 2k-1 , T 1 . . . T 2k-1 for which S 2i-1 ∈ im σ (ν i ) and S 2i ∈ im σ (ν i ) for every i, and S 2k-1 ∈ S 2k-2 ∈ . . . ∈ S 1 , we have χ(r ρ(1) , . . . , rρ(m) ) = C.

Proof. We again assume n ≥ m. We define a new coloring χ : Q mp → C by χ (r 1,1 , . . . , r 1,m , . . . , r p,1 , . . . , r p,m ) := χ(r ρ(1) , . . . , r ρ(m) ) for every mp-tuple r1 , . . . , rp ∈ R m 1 × . . . × R m p with ascending r1 , . . . , rp . By Lemma 10.1.2, there exist subsets Q 1 ⊆ R 1 , . . . , Q p ⊆ R p , each with n elements, such that for all ascending tuples r1 ∈ Q m 1 , . . . , rp ∈ Q m p the colors χ (r 1 , . . . , rp ) are the same. By definition of χ , the sets Q 1 , . . . , Q p satisfy the requirements of the lemma. Now we have the right tools at hand to prove Lemma 10.1.4 Lemma 10.1.4. Let n, m, p > 0 be positive integers, let K ≥ 0 be a nonnegative integer and let χ : Q m → C be an arbitrary coloring. Let R 1 , . . . , R p be sufficiently large but finite subsets of Q. Let q 1 , . . . , q K be fixed rational numbers. Let ρ 1 , . . . , ρ L be some enumeration of all mappings

and every index j, 1 ≤ j ≤ L, we have χ r ρj (1) , . . . , r ρj (m) = χ r ρj (1) , . . . , r ρj (m) .

Proof. We again assume n ≥ m. We construct sequences of subsets S ,0 ⊇ . . . ⊇ S ,L for every , 1 ≤ ≤ p, such that S ,0 = R , and S ,j+1 ⊆ S ,j is a subset of sufficient cardinality that is constructed by application of Lemma 10.1.3 for ρ := ρ j+1 , i.e. for all ascending tuples

the colors χ(s ρj+1(1) , . . . , sρj+1(m) ) are the same.

Then the sets S 1,L , . . . , S p,L are the sought Q 1 , . . . , Q p .

The Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Rational Constraints is Decidable

For the rest of the present section we fix two positive integers m, m > 0 and some finite BSR(SLR) clause set N N , m, m in BSR(SLR) normal form. For the sake of simplicity, we assume that all uninterpreted predicate symbols P occurring in N have the sort P : S m × Q m . This assumption does not limit expressiveness, as the arity of a predicate symbol P can easily be increased in an (un)satisfiabilitypreserving way by padding the occurring atoms with additional arguments. For instance, every Case A, γ C |= P (t 1 , . . . , t m , t 1 , . . . , t m ) for some non-equational atom P (t 1 , . . . , t m , t 1 , . . . , t m ) in Γ. This translates to A(γ C )(t 1 ), . . . , A(γ C )(t m ), A(γ C )(t 1 ), . . . , A(γ C )(t m ) ∈ P A . Moreover, since N is in BSR(SLR) normal form,, C must belong to N BSR and thus each t j is either a variable of sort Q or a Skolem constant of sort Q. By definition of γ C , we have A(γ C )(t j ) ∈ Q for every j, 1 ≤ j ≤ m. Therefore, and by construction of B, A(γ C )(t 1 ), . . . , A(γ C )(t m ), A(γ C )(t 1 ), . . . , A(γ C )(t m ) ∈ P B . We observe the following properties:

(I) We have A(γ C )(t j ) = B(β)(t j ) for every j, 1 ≤ j ≤ m , due to the definition of B and γ C .

(II) Since A and B interpret constant symbols in the same way, we get In order to show that uniform models always exist for satisfiable clause sets N , we still need to prove the existence of the sets Q i required in Lemma 10.2.7. We use Lemma 10.1.4 to show this. As an auxiliary result, we first show a correspondence between the equivalence classes with respect to ∼ J A and mappings ρ :

Lemma 10.2.8. Let A be any structure. Let J 1 , {q 1 }, J 2 , {q 2 }, . . . , {q κ }, J κ+1 J i , q i be an enumeration of all intervals in J A sorted in ascending order with the J i being the open intervals. Let S ∈ Q m / ∼ J A be any equivalence class with respect to ∼ J A containing m-tuples. There is some mapping

ρ such that (i) whenever ρ(i) = k, with k > κ + 1 then = 1, and (ii) for all ascending tuples

we have r ρ(1) , . . . , r ρ(m) ∈ S, and (iii) for every tuple s 1 , . . . , s m ∈ S there exist ascending tuples r1 , . . . , r2κ+1 defined like in (ii) such that s 1 , . . . , s m = r ρ(1) , . . . , r ρ(m) .

Proof. Fix any S ∈ Q m / ∼ J A . Let s be some representative taken from S, i.e. S = [s ] ∼ J A . Given s , we construct 2κ + 1 possibly empty sequences s k := s k,1 , s k,2 , . . . , such that every s k with k ≤ κ + 1 lists all elements of s in ascending order that lie in J k , and every s k with k > κ + 1 contains exactly the value q k-κ-1 . We construct the mapping ρ in such a way that ρ(i) = k, holds if and only if s i = s k, . Now let r1 , . . . , r2κ+1 be any tuples of rationals chosen in accordance with requirement (ii). It is easy to verify that rρ := r ρ(1) , . . . , r ρ(m) is J A -equivalent to s , i.e. rρ belongs to S.

In order to show (iii), we construct the tuples r1 , . . . , r2κ+1 from s 1 , . . . , s m in the same way we have constructed the s k from s above. In addition, we pad them with suitable values from the respective intervals J k to reach the length m for every tuple. Then, it is easy to verify that s 1 , . . . , s m = r ρ(1) , . . . , r ρ(m) .

Lemma 10.2.9. Let A be any structure. Let J 0 , {r 1 }, J 1 , . . . , {r κ }, J κ J i , r i be an enumeration of all intervals in J A sorted in ascending order with the J i being the open intervals. Let λ be any positive integer. There is a collection of finite sets Q 0 , . . . , Q κ such that Requirements (i) and (ii) of Lemma 10.2.7 are met:

Proof. Let the sets Q 1 , . . . , Q κ+1 be the Q 1 , . . . , Q p which we obtain by virtue of Lemma 10.1.4 when we set n := λ, p

. By Lemma 10.2.8, the equivalence class to which any two given J Aequivalent tuples q, q belong corresponds to some mapping ρ :

. Part (ii) of Lemma 10.2.8 states that q can be written in the form r ρ(1) , . . . , r ρ(m) for appropriate values r k, and q can be represented in the form r ρ(1) , . . . , r ρ(m) for appropriate r k, . We then know by Lemma 10.1.4 that χ A (q) = χ A ( r ρ(1) , . . . , r ρ(m) ) = χ A ( r ρ(1) , . . . , r ρ(m) ) = χ A (q ). Lemmas 10.2.7 and 10.2.9 together entail the existence of some J A -uniform model A |= N with a finite free-sort domain S A , if N is satisfiable.

Corollary 10.2.10. If N has a model, then it has a model A that is J A -uniform and that interprets the sort S with some finite set.

Corollary 10.2.10 provides the key tool for devising a decision procedure for finite BSR(SLR) clause sets. But before we present such a procedure, we need to develop a variant of Lemma 10.2.7 that is easier to handle from the computational point of view. 1 Recall that we assume N to be in normal form (cf. Definition 10.0.3). Therefore, N can be partitioned into N Q , N BSR , where N BSR ⊆ N is a subset that contains exactly the clauses Λ ∧ Γ → ∆ from N with nonempty Γ or ∆. By Requirement (b) of Definition 10.0.3, we may assume that N BSR does not contain any symbol from the arithmetic part of the underlying vocabulary, except for <, ≤. That is, N BSR does neither contain any rational numbers nor any arithmetic operators. Our aim is to treat N Q and N BSR in isolation: combining a decision procedure for LRA and one for BSR sentences over uninterpreted vocabularies.

Let c 1 , . . . , c k c i , d i be an enumeration of all the constant symbols in N Q ∪ N BSR that are of the sort Q and let d 1 , . . . , d be an enumeration of all free-sort constant symbols occurring in N BSR . We 1 The author of the present thesis is indebted to Pascal Fontaine for pointing out in a discussion in November 2017 that Lemma 10.2.7 and Corollary 10.2.10 alone are not sufficient for devising a decision procedure for BSR(SLR).

DECIDABILITY OF BSR WITH SIMPLE LINEAR RATIONAL CONSTRAINTS 239

define ψ to be the following BSR sentence (with constant symbols)

which explicitly stipulates sort membership for constant symbols and contains the axioms of total orders for < and ≤. We assume, without loss of generality, that the predicate symbols Rat and Free do not occur in N . The length of ψ is linear in the length of N Q ∪ N BSR . Notice that we use the equality sign ≈ instead of =, and thus refrain from treating arithmetic variables in a privileged way. The reason will become apparent in Lemma 10.2.11. Let ū be some tuple listing all variables from vars(N BSR ) ∩ Var S and let x be some tuple listing all variables from vars(N BSR ) ∩ Var Q . We define the sentence ϕ NBSR

which is evidently equivalent to some BSR sentence and whose length is linear in the length of N Q ∪ N BSR . In addition, we define the sentence η for any total preorder (a reflexive and transitive binary relation) over the constant symbols c 1 , . . . , c k as follows. We write c i ≺ c j c i ≺ c j if and only if we have c i c j and c j c i . Suppose that c j1 ≺ . . . ≺ c j k is a maximal ≺-chain with k ≤ k. Let λ λ be the maximal number of distinct base-sort variables in any single clause in N BSR . In case of λ < m we set λ := m. Let z0 , . . . , zk zi be pairwise-disjoint tuples of first-order variables of length λ each. We set

Written in a more convenient notation, η establishes the chain

and identifies c i and c j whenever c i c j c i . Notice that the length of η is at most quadratic in the length of

. . , c k /v k denotes the clause C after replacing every c i in C with v i . The question whether Q |= ϕ Q holds can be decided nondeterministically in polynomial time with respect to N Q ∪ N , i.e. with respect to the length of the binary encoding of the clause set N Q ∪ N .

Proof sketch. We devise the following nondeterministic decision procedure:

(1) Let At be the set of all atoms occurring in ϕ Q . Nondeterministically choose a subset S ⊆ At.

(2) Construct the propositional counterpart ϕ prop of ϕ Q by replacing every arithmetic atom A in ϕ Q with the propositional variable p A . Check whether

and check whether we have Q |= ∃v. ψ(v).

(4) If both Steps (2) and (3) succeed, then ϕ Q is satisfied under Q.

As the formula

Step (2) describes a complete assignment of all the propositional variables occurring in ϕ prop , Step (2) amounts to checking whether ϕ prop is satisfied under this assignment. Hence, Step (2) can be done in polynomial time (with respect to len(ϕ prop )). Regarding Step (3), conjunctions of linear inequalities with existentially quantified variables over the rational numbers can be solved deterministically in polynomial time (with respect to the length of their binary encoding) via a transformation into a linear program (see, for instance, [START_REF] Bradley | The Calculus of Computation -Decision Procedures with Applications to Verification[END_REF], pages 217-218 in Section 8.3 and Theorem 8.17). It is well known that for any feasible linear program over the rational numbers a solution can be computed in polynomial time [Kha80, GL81, Kar84] (see also [START_REF] Ruggieri | On the complexity of quantified linear systems[END_REF] and [START_REF] Schrijver | Theory of linear and integer programming[END_REF], Sections 10, 13, and 14).

By virtue of Proposition 10.2.13, Step (II) can be done nondeterministically in polynomial time with respect to N Q ∪ N , where the formula length of N (and also N ) is at most quadratic in the length of N Q ∪ N BSR . On the other hand, the sentence ϕ NBSR ∧ η has a formula length that is polynomial in the length of N Q ∪ N BSR . By Proposition 3.1.6, we know that, if ϕ NBSR ∧ η is satisfiable, then it has a model whose domain contains at most as many elements as ϕ NBSR ∧ η contains existentially quantified variables plus constant symbols.

Unfortunately, we cannot invoke Proposition 5.0.1 directly to obtain an upper bound regarding the computational complexity of Step (III), because the proposition only speaks about the general first-order satisfiability problem and Step (III) is about satisfiability with respect to a restricted class of structures. However, the decision procedure underlying Proposition 5.0.1 (see, e.g., Proposition 6.0.4 in [START_REF] Börger | The Classical Decision Problem[END_REF]) starts with nondeterministically guessing a structure A that is a candidate model for the sentence at hand, and then checks in deterministic exponential time whether A is indeed a model. It is easy to see that we could restrict the guessing step to structures that are J A -uniform 4 . The latter in fact amounts to an additional step for checking whether the candidate model is indeed J A -uniform, which can be done deterministically in time that is exponential in the length of the considered sentence. Hence, by a modified variant of Proposition 5.0.1, we conclude that the satisfiability problem that needs to be solved in Step (III) belongs to NExpTime, and, as the problem is at least as hard as BSR-Sat, it is in fact NExpTime-complete.

Theorem 10.2.14. The satisfiability problem for finite BSR(SLR) clause sets is decidable, and for clause sets in BSR(SLR) normal form the problem is NExpTime-complete. By Lemma 10.0.7, every finite BSR(SLR) clause set N can be transformed into an equisatisfiable clause set N in BSR(SLR) normal form. The occurring blowup is such that (a) the length of N is at most exponential in the length of N , (b) the number of variables occurring in any clause in N is not larger than the number of variables occurring in any clause in N , (c) the number of uninterpreted constant symbols occurring in N is linear in the length of N . Hence, by and

Consequently, since we assume c to be an integer, we have γ C (x)γ C (y) c if and only if β(x)β(y) c. In other words, A, β |= xy c.

Case A, γ C |= t ≈ t for some atom t ≈ t ∈ Γ. Hence, t and t are either variables or constant symbols of the free sort, which means they do not contain subterms of the base sort. Since B and A behave identical on free-sort constant symbols and

Case A, γ C |= t ≈ t for some t ≈ t ∈ ∆. In analogy to the above case, we obtain B, β |= t ≈ t .

Case A, γ C |= P (t 1 , . . . , t m , t 1 , . . . , t m ) for some non-equational atom P (t 1 , . . . , t m , t 1 , . . . , t m ) in Γ. This translates to

By construction of γ C , we have A(γ C )(t j ) ∈ Q for every j. Due to our assumptions regarding Q and by construction of B, we therefore have

We observe the following properties:

We have A(γ C )(t j ) = B(β)(t j ) for every t j due to the definition of B and γ C . Since all the t j are base-sort variables, we get A(γ C )(t j ) = B(γ C )(t j ) for every t j . We shall employ Lemma 10.1.1 to prove the existence of the set Q that is required for Lemma 10.4.4. This will finish the proof concerning the existence of κ -uniform models for finite satisfiable BSR(BD) clause sets. But first, we need the following auxiliary result.

Lemma 10.4.5. Let S ∈ (-κ -1, κ + 1) m / κ S be an equivalence class with respect to κ . There are two mappings ρ : [m] → {0, 1, . . . , m} and σ : [m] → {-κ -1, . . . , 0, . . . , κ} such that (i) for every ascending tuple r 0 , r 1 , . . . , r m ∈ [0, 1) m+1 with r 0 = 0 we have r ρ(1) + σ(1), . . . , r ρ(m) + σ(m) ∈ S, and

(ii) for every tuple s 1 , . . . , s m ∈ S there is an ascending tuple r 0 , r 1 , . . . , r m ∈ [0, 1) m+1 with r 0 = 0 such that s 1 , . . . , s m = r ρ(1) + σ(1), . . . , r ρ(m) + σ(m) .

Proof. Fix some tuple q q, q i taken from S. Given q, we set q 0 := 0 and further construct the sequence q 1 , q 2 , . . . in such a way that it lists all strictly positive fractional values occurring in fr(q) in ascending order. We construct σ σ, ρ by setting σ(i) := q i for every i, and ρ such that ρ(i) = k holds if and only if fr(q i ) = q k . Consequently, we have q 1 , . . . , q m = fr(q 1 ) + q 1 , . . . , fr(q m ) + q m = q ρ(1) + σ(1), . . . , q ρ(m) + σ(m) .

(10.3) Let r 0 , r 1 , . . . , r m ∈ [0, 1) m+1 r i be any ascending tuple with r 0 = 0. For all i, j we observe the following properties:

(1)

(3) ρ(i) = 0 if and only if fr(q i ) = q 0 = 0, which entails that fr(r ρ(i) + σ(i)) = 0 holds if and only if we have fr(q i ) = 0.

(4) fr(q i ) = q ρ(i) .

(5) We have fr(r ρ(i) + σ(i)) ≤ fr(r ρ(j) + σ(j)) if and only if r ρ(i) ≤ r ρ(j) if and only if ρ(i) ≤ ρ(j) if and only if q ρ(i) ≤ q ρ(j) if and only if fr(q i ) ≤ fr(q j ).

Taken together, these observations imply q κ r ρ(1) + σ(1), . . . , r ρ(m) + σ(m) . Hence, we have just proved (i).

In fact, we have also already proved (ii), by giving the construction of the sequence q 0 , q 1 , q 2 , . . . and by having derived Equation (10.3). If the sequence q 1 , q 2 , . . . is shorter than m elements, we can simply pad it in an ascending fashion with arbitrary values from the interval (0, 1).

We now have all necessary auxiliary results in place to prove Lemma 10.4.6, which stipulates the existence of the set Q required by Lemma 10.4.4.

Lemma 10.4.6. Let A A, κ, λ be any structure and let κ, λ be positive integers with λ ≥ m. There exists a finite set Q ⊆ [0, 1) of cardinality λ + 1 such that 0 ∈ Q and for all tuples s, s ∈ Q m , s κ s entails χ A (s) = χ A (s ), where Q := q + k q ∈ Q and k is any integer with -κ -1 ≤ k ≤ κ .

Proof. Let S 1 , . . . , S k S j be some enumeration of all equivalence classes in (-κ -1, κ + 1) m / κ . By Lemma 10.4.5, there is a (not necessarily unique) sequence ρ 1 , σ 1 , . . . , ρ k , σ k ρ j , σ j of pairs of mappings such that each pair ρ j , σ j corresponds to the equivalence class S j in the sense of Lemma 10.4.5. Let c 1 , . . . , c be an enumeration of all constant symbols in N that are of the sort S. Let S S denote the set {a ∈ S A | a = c A i for some c i } containing all domain elements assigned to free-sort constant symbols by A. We define a coloring χ χ :

for every tuple r = r 1 , . . . , r m ∈ (0, 1) m , where we define r 0 to be 0. By virtue of Lemma 10.1.1, there is a set Q ⊆ (0, 1) Q , Q of cardinality λ such that all ascending tuples r 1 , . . . , r m ∈ Q m are assigned the same color by χ. We then set Q := Q ∪ {0}.

Consider any equivalence class S j and the corresponding pair ρ j , σ j and let s, s ∈ Q m be two κ -equivalent tuples. Let q 1 , q 2 , . . . be an enumeration of all the strictly positive fractional parts in fr(s) in ascending order and let q 0 := 0. Hence, q 0 < q 1 < q 2 < . . .. By definition of ρ j , σ j , there are two ascending tuples q := 0, q 1 , . . . , q m and q := 0, q 1 , . . . , q m in [0, 1) m+1 such that s = q ρj (1) + σ j (1), . . . , q ρj (m) + σ j (m) and s = q ρj (1) + σ j (1), . . . , q ρj (m) + σ j (m) .

The case of C 1 storing a value greater than 0:

The condition y > 2x + 3 ensures that the first counter stores a value strictly greater than 0.

Encoding of the instruction : test&dec(C 2 , ):

The case of C 2 storing 0:

The case of C 2 storing a value greater than 0:

Encoding of the instruction : goto( ):

Encoding of the instruction : halt:

-→ ψ 10 (6x + y) ∧ ψ 10 (9x + z) ∧ χ K (4x) .

The consequent of the implication ensures that the counters remain unchanged and that the computation continues at program line K. Since we assume the K-th program line to contain the instruction halt, the rest of the bit sequence will repeat the same chunk structure again and again, as the counter values will remain unchanged and the encoded program line will also repeat indefinitely.

Finally, we pose the central question concerning the halting behavior of the machine: Does the machine ever reach a program line containing the halt instruction? The question is posed as a requirement in a negative fashion:

Technically speaking, we require that the machine never reaches the K-th program line, which we assume to be the one and only line containing the halt instruction.

Given the the two-counter machine M, we denote by ϕ M ϕ M the sentence that encodes M's behavior in accordance with the described formula schemes. Then, the sentence ϕ 1 ∧ ϕ m,n 2 ∧ ϕ K 3 ∧ ϕ K 4 ∧ ϕ M is satisfied if and only if the machine will never reach the instruction halt when started on the given input.

Lemma 11.2.1. The two-counter machine M with K + 1 program lines, labeled 0, . . . , K, started on input m, n eventually reaches a program line containing the instruction halt if and only if the Since we have completed a chain of reductions from the halting problem of Turing machines via the halting problem of two-counter machines to the unsatisfiability problem of the universal fragment of Presburger arithmetic with uninterpreted predicate symbols, we conclude Σ 0 1 -completeness of the latter problem by Lemma 11.2.1 together with Propositions 11.3.1 and 11.3.2.

Satisfiability Unsatisfiability Validity Invalidity

Theorem 11.3.3. The set of unsatisfiable sentences from the universal fragment of Presburger arithmetic with uninterpreted predicate symbols is Σ 0 1 -complete.

It is worth noticing that the theorem can be translated to the realm of linear arithmetic over the reals. The reason is that hierarchic superposition is also refutationally complete over the universal fragment of this language, if there are no uninterpreted constant or function symbols involved.

Since any reduction of a problem S to a problem T (both read as a set of Gödel numbers) at the same time yields a reduction from S to T , the complement of a Σ 0 1 -complete set is complete for Π 0 1 . Hence, Theorem 11.3.3 entails Π 0 1 -completeness of the set of satisfiable sentences over the same language.

There are strong ties between (un)satisfiability in the universal fragment of the language we consider and (in)validity in the dual language, the existential fragment. The bottom line is that the obtained completeness results can be transfered to the corresponding (in)validity problems. The overall situation is depicted in Table 11.2.

For the sake of completeness, we briefly discuss (un)satisfiability for the existential fragment. Kruglov and Weidenbach [START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF][START_REF] Kruglov | Superposition Modulo Theory[END_REF] have presented a general result regarding the satisfiability problem for hierarchic clause sets that are ground. More precisely, they have devised a decision procedure for that problem, based on a hierarchic superposition calculus. Proposition 11.3.4 (Corollary of Theorem 23 from [START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF]). Satisfiability of the existential fragment of Presburger arithmetic with additional uninterpreted predicate symbols is decidable.

With this knowledge we can complete the overview in Table 11.2 and thus reveal the full picture of where the (un)satisfiability and (in)validity problems of the universal and existential fragments of Presburger arithmetic augmented with uninterpreted predicate symbols reside in the arithmetical hierarchy.

formulas. Whenever we speak of problems or sets of sentences belonging to Σ 0 n or Π 0 n , or being complete for these classes, we implicitly refer to the Gödelization of these problems or sets of sentences.

Operation

Encoding

Initial condition: M ( init , 0, (m + 1) • c, (n + 1) • c, 0) Halting condition: M ( halt , 1, 0, 0, 0) Side conditions:

.3: Encoding of the basic two-counter-machine instructions, including a step counter. is in addition conjoined with bounds c x ≤ x ≤ d x and c y ≤ y ≤ d y could proceed as follows. Let c be the tuple collecting all occurring uninterpreted constant symbols. We enumerate all tuples r of rational numbers and use them as candidate values for the constant symbols in c. For each step of the enumeration, we consider the values of c := r to be fixed. After replacing the constant symbols from c with the values from r, we obtain a finite clause set that almost belongs to BSR(BD). We now compute the least common multiple of all denominators that occur in the clause set and multiply all rational constants with this value. After reduction of all rationals to integers we obtain an equisatisfiable finite clause set that belongs to BSR(BD). At this point, we apply the decision procedure from Section 10.4. If it succeeds, the clause set at hand is satisfiable.

If satisfiability is undecidable but semi-decidable, then unsatisfiability cannot be semi-decidable. Hence, hierarchic superposition cannot be refutationally complete for the extended fragment described above (compare with the discussion at the beginning Section 11.3). On the other hand, we have "model completeness" in the sense that, if there is a model, it can be constructed using the procedure we have just described. This is a somewhat unusual situation in automated reasoning, where we often find the opposite: the set of unsatisfiable sentences is semi-decidable, e.g. due to the existence of calculi that are sound and refutationally complete, whereas the set of satisfiable sentences is not recursively enumerable. 8

In the remaining subsections we will blend the ideas described above with the encoding from Section 11.2.3. We shall start with an informal description. computationally very hard and thus using FL alone one can already enforce very large domain sizes in a succinct manner. It remains to be investigated whether one can do significantly better using SFL syntax instead. For the case GAF versus AF we have only derived a bound conditioned on NExpTime = ExpTime in Proposition 3.8.9, and an unconditional lower bound is missing for the time being. Similarly, the exponential lower bounds regarding the succinctness gaps between GGKS and GKS and between SFO 2 and FO 2 could possibly be improved. This is left for future work. One more aspect of the succinctness gaps that might be worth investigating in the future will be discussed in Section 12.1.2. Our main method for proving decidability of the newly introduced first-order fragments is based on the mentioned equivalence-preserving translations into fragments that are already known to be decidable. In Chapter 4 we have complemented this syntactic point of view with a semantic perspective, based on an investigation of dependences between existentially and universally quantified variables in sentences. What we have found are weak dependences, which have a finite character. BSR, SF, and GBSR are special fragments in this respect, as all dependences in sentences from these fragments are weak. Conversely, we have observed in Theorem 4.2.1 that every sentence in which all dependences are weak has some equivalent in the BSR fragment; one may say that BSR semantically captures this class of sentences. Again, the BSR equivalents may be significantly longer than the initial sentence. The weakness of all occurring dependences leads to the property that any model of such a sentence, even if it has an infinite domain, has a finite substructure that is a model of the very same sentence. This highlights a difference in expressive power between BSR, SF, GBSR and other fragments, such as GAF: a GAF sentence can have a model without satisfying substructures, see Example 4.3.1. Hence, among the other applications that we have sketched previously, an analysis of weak dependences could perhaps also help discern expressive power when comparing two first-order fragments.

Informal Description of the Encoding

Speaking of applications for the analysis of weak dependences, Section 7.2 offered first insights concerning Skolemization techniques that are sensitive to weak dependences. Taking the Boolean structure of sentences into account in addition, e.g. in the spirit of Section 3.6, might lead to further improvements. As we have already pointed out in the beginning of that section, this might offer interesting and valuable directions of research automated reasoning could benefit from. Moreover, further investigations might yield new insight in proof complexity.

In addition to the already mentioned results, we have investigated the computational complexity of SF-Sat, GBSR-Sat, and some of their subproblems in detail. Figure 5.1 on page 141 depicts an overview and shows that both SF-Sat and GBSR-Sat have k-NExpTime-complete subfragments for every positive integer k. The respective unrestricted satisfiability problems are non-elementary, or, more precisely, Tower-complete (cf. Definition 5.0.2). Since the computational complexity of the satisfiability problem associated with the Horn and Krom subcases of the ∃ * and ∃ * ∀ * subfragments of SF and GBSR is significantly lower (unless some of the complexity classes NL, P, NP, PSpace, ExpTime, NExpTime coincide), we have formulated the conjecture that this behavior might continue on a larger scale -cf. Conjecture 5.2.2 and see also Figure 5.2 on page 149.

Furthermore, we have shown that BSR and AF are closed under Craig-Lyndon interpolation, following sentence is satisfiable over the integers:

The sentence ϕ has been derived from ϕ by the following instantiation steps: (1) u has been instantiated with the existentially quantified variable z, (2) x 2 and y 2 have been instantiated with the (abstract) integer values 5 + 1 and -∞, and (3) x 1 and y 1 have been instantiated with -∞ only. The instantiation does not need to consider any instantiation point derived from upper bounds y 1 < 7, y 2 ≤ 2, because it is sufficient to explore the integers either from -∞ upwards -in this case upper bounds on integer variables can be ignored -or from +∞ downwards -ignoring lower bounds. 3 Moreover, instantiation does not need to consider the value 5 + 1 for x 1 and y 1 , motivated by the fact that in the first conjunct of ϕ the argument x 1 of R is not affected by the constraint x 2 = 5. The abstract values -∞ and +∞ are represented by fresh uninterpreted constant symbols, together with defining axioms. For the example, we introduce the fresh Skolem constant c -∞ to represent -∞ (a "sufficiently small" value) together with the axiom c -∞ < 2, where 2 is the smallest integer occurring in ϕ.

If we consider ϕ over the rational domain, instantiation leads to a sentence ϕ that is slightly different from ϕ :

The difference between ϕ and ϕ is that the expressions 5 + 1 have been replaced with the constant symbol c 5+ε . This constant symbol is intended to represent some value that is "just a little larger" than 5. That is, the value of c 5+ε is supposed to be larger than 5 but smaller than all occurring rational values larger than 5. This is why the axiom 5 < c 5+ε ∧ c 5+ε < 7 needs to be added to ϕ .

In [START_REF] Horbach | On the Combination of the Bernays-Schönfinkel-Ramsey Fragment with Simple Linear Integer Arithmetic[END_REF] it is shown in addition that the outlined instantiation methods are compatible with uninterpreted function symbols and additional background theories under certain syntactic restrictions. These results are based on an (un)satifiability-preserving embedding of uninterpreted function symbols into BSR. There are interesting known logic fragments that fall into this syntactic category: many-sorted first-order sentences over stratified vocabularies [ARS07, ARS10, Kor13b]see also Section 3.14.2 -, the array property fragment [START_REF] Bradley | What's Decidable About Arrays? In Verification, Model Checking, and Abstract Interpretation[END_REF][START_REF] Bradley | Safety Analysis of Systems[END_REF], and the finite essentially uninterpreted fragment, possibly extended with simple integer arithmetic [START_REF] Ge | Complete Instantiation for Quantified Formulas in Satisfiabiliby Modulo Theories[END_REF]. Consequently, reasoning procedures for these fragments that employ forms of instantiation may benefit from the outlined instantiation approach.

Regarding automated reasoning techniques that work well in practice, it might be interesting to devise decision procedures for BSR(SLR), BSR(BD), or other fragments of first-order arithmetic with uninterpreted function or predicate symbols based on hierarchic superposition coupled with strong instantiation methods. Starting points for such an endeavor can be found in [START_REF] Kruglov | Superposition Decides the First-Order Logic Fragment Over Ground Theories[END_REF][START_REF] Fietzke | Superposition as a Decision Procedure for Timed Automata[END_REF][START_REF] Kruglov | Superposition Modulo Theory[END_REF][START_REF] Fietzke | Labelled Superposition[END_REF].

Index