Matching Logic

TL;DR

Matching logic is a versatile first-order logic variant that uses patterns for specifying and reasoning about structures, generalizing many logical frameworks and enabling effective program analysis.

Contribution

It introduces matching logic, a new logical framework that unifies various logics and simplifies reasoning about complex program structures through pattern matching.

Findings

Generalizes propositional logic, algebraic specification, and modal logic

Allows specification of separation requirements at any program level

Can be translated into predicate logic with equality for practical reasoning

Abstract

This paper presents matching logic, a first-order logic (FOL) variant for specifying and reasoning about structure by means of patterns and pattern matching. Its sentences, the patterns, are constructed using variables, symbols, connectives and quantifiers, but no difference is made between function and predicate symbols. In models, a pattern evaluates into a power-set domain (the set of values that match it), in contrast to FOL where functions and predicates map into a regular domain. Matching logic uniformly generalizes several logical frameworks important for program analysis, such as: propositional logic, algebraic specification, FOL with equality, modal logic, and separation logic. Patterns can specify separation requirements at any level in any program configuration, not only in the heaps or stores, without any special logical constructs for that: the very nature of pattern matching is that if two structures are matched as part of a pattern, then they can only be spatially separated. Like FOL, matching logic can also be translated into pure predicate logic with equality, at the same time admitting its own sound and complete proof system. A practical aspect of matching logic is that FOL reasoning with equality remains sound, so off-the-shelf provers and SMT solvers can be used for matching logic reasoning. Matching logic is particularly well-suited for reasoning about programs in programming languages that have an operational semantics, but it is not limited to this.

Figures

Equations

$$\begin{array}[]{rrl@{\ \ \ //\ \ }l}\varphi_{s}&::=&x\in\textit{Var}_{s}&\mbox{Variable}\\ &\mid&\sigma(\varphi_{s_{1}},...,\varphi_{s_{n}})\ \mbox{ with }\sigma\in\Sigma_{s_{1}...s_{n},s}\textrm{ \ \ (written $\Sigma_{\lambda,s}$ when $n=0$)}&\mbox{Structure}\\ &\mid&\neg\varphi_{s}&\mbox{Complement}\\ &\mid&\varphi_{s}\wedge\varphi_{s}&\mbox{Intersection}\\ &\mid&\exists x\,.\,\varphi_{s}\mbox{ with }x\in\!\textit{Var}\textrm{ \ \ (of any sort)}&\mbox{Binding}\end{array}$$

$$\begin{array}[]{rcl@{\hspace*{10ex}}rcl}\top_{\!\!s}&\equiv&\exists x\!:\!s\,.\,x\hfil\hskip 43.05542pt&\varphi_{1}\rightarrow\varphi_{2}&\equiv&\neg\varphi_{1}\vee\varphi_{2}\\ \bot_{s}&\equiv&\neg\top_{\!\!s}\hfil\hskip 43.05542pt&\varphi_{1}\leftrightarrow\varphi_{2}&\equiv&(\varphi_{1}\rightarrow\varphi_{2})\wedge(\varphi_{2}\rightarrow\varphi_{1})\\ \varphi_{1}\vee\varphi_{2}&\equiv&\neg(\neg\varphi_{1}\wedge\neg\varphi_{2})\hfil\hskip 43.05542pt&\forall x.\varphi&\equiv&\neg(\exists x.\neg\varphi)\\ \end{array}$$

$$\begin{array}[]{rcl@{\hspace*{-6ex}}r}\lx@intercol\begin{array}[]{rcl@{\hspace*{8ex}}r@{}}S&=&\{\ \ \textit{Id},\textit{Exp},\textit{Stmt},...\hfil\hskip 34.44434pt&\textrm{// code synactic categories}\\ &&\ \ \ {\it Bool},{\it Nat},{\it Int},...\hfil\hskip 34.44434pt&\textrm{// basic domains}\\ &&\ \ \ {\it Seq}_{\it Int},{\it Map}_{\textit{Id},{\it Nat}},{\it Map}_{{\it Nat},{\it Int}},...\hfil\hskip 34.44434pt&\textrm{// more domains}\\ &&\ \ \ \textit{CfgCell},{\it Cfg},\hfil\hskip 34.44434pt&\textrm{// top cell and contents}\\ &&\ \ \ \textit{CodeCell},\textit{EnvCell},\textit{HeapCell},\textit{InCell},\textit{OutCell},\hfil\hskip 34.44434pt&\textrm{// config cells}\\ &&...\ \ \ \}\hfil\hskip 34.44434pt\end{array}\hfil\lx@intercol\\ \Sigma_{\textit{Id}\,\textit{Exp},\,\textit{Stmt}}&=&\{\_\texttt{=}\_\texttt{;},\ ...\}&\textrm{// assignment, ...}\\ \Sigma_{\textit{Exp}\,\textit{Stmt}\,\textit{Stmt},\,\textit{Stmt}}&=&\{\texttt{if(}\_\texttt{)\{}\_\texttt{\}else\{}\_\texttt{\}},\ ...\}&\textrm{// conditional, ...}\\ \Sigma_{\textit{Exp}\,\textit{Stmt},\,\textit{Stmt}}&=&\{\texttt{while(}\_\texttt{)\{}\_\texttt{\}},\ ...\}&\textrm{// while loop, ...}\\ \Sigma_{\textit{Stmt}\,\textit{Stmt},\,\textit{Stmt}}&=&\{\ \_\_\ \}&\textrm{// sequential composition}\\ \lx@intercol...\ \ \ \ \ \textrm{// other syntactic language constructs}\hfil\lx@intercol\\ \Sigma_{\textit{Stmt},\,{\it Cfg}}&=&\{\ \langle{\_}\rangle_{\sf{code}}\ \}&\textrm{// cell holding the code}\\ \Sigma_{\lambda,\,{\it Map}_{\textit{Id},{\it Nat}}}&=&\{\ .\ \}&\textrm{// empty environment map}\\ \Sigma_{\textit{Id}\,{\it Nat},{\it Map}_{\textit{Id},{\it Nat}}}&=&\{\ \_\mapsto\_\ \}&\textrm{// one-binding environment map}\\ \Sigma_{{\it Map}_{\textit{Id},{\it Nat}}\,{\it Map}_{\textit{Id},{\it Nat}},\,{\it Map}_{\textit{Id},{\it Nat}}}&=&\{\ \_,\_\ \}&\textrm{// environment map merge}\\ \Sigma_{{\it Map}_{\textit{Id},{\it Nat}},\,{\it Cfg}}&=&\{\ \langle{\_}\rangle_{\sf{env}}\ \}&\textrm{// cell holding the environment map}\\ \lx@intercol...\ \ \ \ \ {\it Map}_{{\it Nat},{\it Int}}\textrm{ symbols defined similarly to }{\it Map}_{\textit{Id},{\it Nat}}\hfil\lx@intercol\\ \Sigma_{{\it Map}_{{\it Nat},{\it Int}},\,{\it Cfg}}&=&\{\ \langle{\_}\rangle_{\sf{heap}}\ \}&\textrm{// cell holding the heap map}\\ \Sigma_{\lambda,\,{\it Seq}_{\it Int}}&=&\{\ \epsilon\ \}&\textrm{// empty sequence}\\ \Sigma_{{\it Int},\,{\it Seq}_{\it Int}}&=&\{\ \_\ \}&\textrm{// one-integer sequence}\\ \Sigma_{{\it Seq}_{\it Int}\,{\it Seq}_{\it Int},\,{\it Seq}_{\it Int}}&=&\{\ \_@\_\ \}&\textrm{// sequence concatenation}\\ \Sigma_{{\it Seq}_{\it Int},\,{\it Nat}}&=&\{\ \mathsf{len}\ \}&\textrm{// sequence length}\\ \Sigma_{{\it Seq}_{\it Int},\,{\it Seq}_{\it Int}}&=&\{\ \mathsf{rev}\ \}&\textrm{// sequence reverse}\\ \Sigma_{{\it Seq}_{\it Int},\,{\it Cfg}}&=&\{\ \langle{\_}\rangle_{\sf{in}}\ \}&\textrm{// input buffer}\\ \Sigma_{{\it Seq}_{\it Int},\,{\it Cfg}}&=&\{\ \langle{\_}\rangle_{\sf{out}}\ \}&\textrm{// output buffer}\\ \Sigma_{\lambda,\,{\it Cfg}}&=&\{\ .\ \}&\textrm{// empty configuration contents}\\ \Sigma_{{\it Cfg},\,{\it Cfg}}&=&\{\ \_\_\ \}&\textrm{// merging configuration contents}\\ \Sigma_{{\it Cfg},\,\textit{CfgCell}}&=&\{\ \langle{\_}\rangle_{\sf{cfg}}\ \}&\textrm{// top configuration cell}\end{array}$$

$$⟨⟨\text{LOOP}k{⟩}_{\mathsf{code}}⟨\text{x}\mapsto x,\text{n}\mapsto n,\text{i}\mapsto i,e{⟩}_{\mathsf{env}}⟨x\mapsto a,x+1\mapsto y,h{⟩}_{\mathsf{heap}}⟨\beta {⟩}_{\mathsf{in}}⟨ϵ{⟩}_{\mathsf{out}}{⟩}_{\mathsf{cfg}}$$

$$⟨⟨\text{LOOP}k{⟩}_{\mathsf{code}}⟨\text{x}\mapsto x,\text{n}\mapsto n,\text{i}\mapsto i,e{⟩}_{\mathsf{env}}⟨x\mapsto a,x+1\mapsto y,h{⟩}_{\mathsf{heap}}⟨\beta {⟩}_{\mathsf{in}}⟨ϵ{⟩}_{\mathsf{out}}{⟩}_{\mathsf{cfg}}\wedge i\le n$$

$$(\exists c.\exists e.\exists h.⟨⟨\text{x}\mapsto x,\text{n}\mapsto n,\text{i}\mapsto i,e{⟩}_{\mathsf{env}}⟨x\mapsto a,x+1\mapsto y,h{⟩}_{\mathsf{heap}}⟨\beta {⟩}_{\mathsf{in}}c{⟩}_{\mathsf{cfg}})\wedge i\le n$$

$$⟨⟨\text{x}\mapsto x,\text{n}\mapsto n,\text{i}\mapsto i\cdot \cdot \cdot {⟩}_{\mathsf{env}}⟨x\mapsto a,x+1\mapsto y\cdot \cdot \cdot {⟩}_{\mathsf{heap}}⟨\beta {⟩}_{\mathsf{in}}\cdot \cdot \cdot {⟩}_{\mathsf{cfg}}\wedge i\le n$$

$$\begin{array}[]{l}\langle{{\langle{{\texttt{x}\mapsto x,\,\texttt{n}\mapsto n,\,\texttt{i}\mapsto i}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{env}}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\ \ \ \ \ \ \ \ \ \ \textrm{// assumed by default below}\par\\ \ \mathbin{\wedge}\ \langle{{\langle{{x\mapsto a,\,x+1\mapsto y}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \langle{\beta}\rangle_{\sf{in}}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\ \mathbin{\wedge}\ i\leq n\end{array}$$

$$\begin{array}[]{l}\langle{{\langle{{{\it list}(x,\alpha)}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \langle{\beta}\rangle_{\sf{in}}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\ \mathbin{\wedge}\ i\leq n\end{array}$$

$$\begin{array}[]{l}\langle{{\langle{{{\it list}(x,\alpha)}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \langle{{\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta\end{array}$$

$$\begin{array}[]{l}\langle{{\langle{{{\it list}(x,\alpha)}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta\end{array}$$

$$\begin{array}[]{l}\langle{{\langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}\ \langle{{{\it list}(x,\alpha)}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\end{array}$$

$$\begin{array}[]{rl}&\langle{{\langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}\ \langle{{{\it list}(x,\alpha)}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\\ \rightarrow&\langle{{\langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}\ \langle{{\varphi_{1}\mathbin{\vee}\varphi_{2}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\end{array}$$

$$\begin{array}[]{rl}&\langle{{\langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}\ \langle{{\varphi_{1}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\\ \mathbin{\vee}&\langle{{\langle{{\beta\ \mathbin{\wedge}\ \mathsf{len}(\beta)=n-i\ \mathbin{\wedge}\ i\leq n}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{in}}\ \langle{{\varphi_{2}}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{heap}}\ \mathbin{\wedge}\ A=\mathsf{rev}(\alpha)@\beta}\ \mathrel{\cdot\kern-2.0pt\cdot\kern-2.0pt\cdot}}\rangle_{\sf{cfg}}\end{array}$$

$${\sigma }_M(A_1,\dots ,A_n)=\bigcup \{{\sigma }_M(a_1,\dots ,a_n)\mid a_1\in A_1,\dots ,a_n\in A_n\}$$

$$\begin{array}[]{@{}rcl}\overline{\rho_{1}}(\exists x.\varphi^{\prime})&=&\bigcup\{\overline{\rho_{1}^{\prime}}(\varphi^{\prime})\mid\rho_{1}^{\prime}:\textit{Var}\rightarrow M,\ \rho_{1}^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho_{1}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &&\mbox{(by Definition~{}\ref{def:rho-bar})}\\ &=&\bigcup\{\overline{\rho_{1}^{\prime}}(\varphi^{\prime})\mid\rho_{1}^{\prime}:\textit{Var}\rightarrow M,\ \rho_{1}^{\prime}\!\!\upharpoonright_{{\it FV}(\varphi)}=\rho_{1}\!\!\upharpoonright_{{\it FV}(\varphi)}\}\\ &&\mbox{(by the induction hypothesis)}\\ &=&\bigcup\{\overline{\rho_{2}^{\prime}}(\varphi^{\prime})\mid\rho_{2}^{\prime}:\textit{Var}\rightarrow M,\ \rho_{2}^{\prime}\!\!\upharpoonright_{{\it FV}(\varphi)}=\rho_{2}\!\!\upharpoonright_{{\it FV}(\varphi)}\}\\ &&\mbox{(since $\rho_{1}\!\!\upharpoonright_{{\it FV}(\varphi)}=\rho_{2}\!\!\upharpoonright_{{\it FV}(\varphi)}$)}\\ &=&\bigcup\{\overline{\rho_{2}^{\prime}}(\varphi^{\prime})\mid\rho_{2}^{\prime}:\textit{Var}\rightarrow M,\ \rho_{2}^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho_{2}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &&\mbox{(by the induction hypothesis)}\\ &=&\overline{\rho_{2}}(\exists x.\varphi^{\prime})\end{array}$$

$$\begin{array}[]{@{}rcl}\overline{\rho}(\forall x\,.\,\varphi_{1}\rightarrow\varphi_{2})&=&\bigcap\{\overline{\rho^{\prime}}(\varphi_{1}\rightarrow\varphi_{2})\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &=&\bigcap\{M_{s}\ \backslash\ (\overline{\rho^{\prime}}(\varphi_{1})\ \backslash\ \overline{\rho^{\prime}}(\varphi_{2}))\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &=&\bigcap\{M_{s}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \backslash\ \overline{\rho^{\prime}}(\varphi_{2}))\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &&\mbox{(by (1) in Proposition~{}\ref{prop:simple}, because $x\not\in{\it FV}(\varphi_{1})$)}\\ &=&M_{s}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \backslash\ \bigcap\{\overline{\rho^{\prime}}(\varphi_{2}))\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\\ &&\mbox{(set theory properties of relative complements)}\\ &=&M_{s}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \backslash\ \overline{\rho}(\forall x\,.\,\varphi_{2})\\ &=&\overline{\rho}(\varphi_{1}\rightarrow\forall x\,.\,\varphi_{2})\end{array}$$

$$\models (1\mapsto 5\ast 2\mapsto 0\ast 7\mapsto 9\ast 8\mapsto 1)\to list(7,9\cdot 5)$$

$$\models (1\mapsto 5\ast 2\mapsto 0\ast 7\mapsto 9\ast 8\mapsto 1\ast h)\to list(7,9\cdot 5)\ast h$$

$$\models ⟨⟨1\mapsto 5\ast 2\mapsto 0\ast 7\mapsto 9\ast 8\mapsto 1\ast h{⟩}_{\mathsf{heap}}c{⟩}_{\mathsf{cfg}}\to ⟨⟨list(7,9\cdot 5)\ast h{⟩}_{\mathsf{heap}}c{⟩}_{\mathsf{cfg}}$$

$$\begin{array}[]{rrl}\varphi&::=&\textit{Var}_{\textit{Prop}}\\ &\mid&\neg\varphi\\ &\mid&\varphi\wedge\varphi\end{array}$$

$$\begin{array}[]{rrl}\varphi&::=&\pi(x_{1},\ldots,x_{n})\mbox{ with }\pi\in\Pi_{s_{1}\ldots s_{n}},\ x_{1}\in\textit{Var}_{s_{1}},\ ...,\ x_{n}\in\textit{Var}_{s_{n}}\\ &\mid&\neg\varphi\\ &\mid&\varphi\wedge\varphi\\ &\mid&\exists x\,.\,\varphi\end{array}$$

$$\begin{array}[]{ll}\lceil\_\rceil_{s_{1}}^{s_{2}}\in\Sigma_{s_{1},s_{2}}&\mbox{// Definedness symbol}\\ \lceil x\!:\!s_{1}\rceil_{s_{1}}^{s_{2}}\in F&\mbox{// Definedness pattern}\end{array}$$

$$\begin{array}[]{lcl}\lfloor\varphi\rfloor_{s_{1}}^{s_{2}}&\equiv&\neg\lceil\neg\varphi\rceil_{s_{1}}^{s_{2}}\end{array}$$

$$\begin{array}[]{@{}rcll}\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}&\ \ \ \ \ \equiv&\lfloor\varphi\leftrightarrow\varphi^{\prime}\rfloor_{s_{1}}^{s_{2}}&\ \ \ \ \ \mbox{where }\varphi,\varphi^{\prime}\in\textsc{Pattern}_{s_{1}}\end{array}$$

$$list(x)=(x=0\wedge emp\vee \exists z.x\mapsto z\ast list(z))$$

$$list(x){=}_{Map}^s(x{=}_{Nat}^{Map}0\wedge emp\vee \exists z.x\mapsto z\ast list(z))$$

$$\begin{array}[]{@{}rcll}x\in_{s_{1}}^{s_{2}}\varphi&\ \ \ \ \ \equiv&\lceil x\wedge\varphi\rceil_{s_{1}}^{s_{2}}&\end{array}$$

$$\rho (x)\in {\sigma }_M(\overline{\rho }({\phi }_1),\dots ,\overline{\rho }({\phi }_{i-1}),\overline{\rho }({\phi }_i),\overline{\rho }({\phi }_{i+1}),\dots ,\overline{\rho }({\phi }_n))$$

$$\rho (x)\in {\sigma }_M(\overline{\rho }({\phi }_1),\dots ,\overline{\rho }({\phi }_{i-1}),\{{\rho }^{\prime }(y)\},\overline{\rho }({\phi }_{i+1}),\dots ,\overline{\rho }({\phi }_n)),$$

Full text

The work presented in this paper was supported in part by the Boeing grant on "Formal Analysis Tools for Cyber Security" 2014-2017, the NSF grants CCF-1218605, CCF-1318191 and CCF-1421575, and the DARPA grant under agreement number FA8750-12-C-0284.

1. 1 Introduction

2. 2 Matching Logic: Basic Notions

3. 2.1 Patterns

4. 2.2 Example

5. 2.3 Semantics

6. 2.4 Basic Properties

7. 3 Instance: Propositional Calculus

8. 4 Instance: (Pure) Predicate Logic

9. 5 Matching Logic: Useful Symbols and Notations

10. 5.1 Definedness and Totality

11. 5.2 Equality

12. 5.3 Membership

13. 5.4 Functions

14. 5.5 Partial Functions

15. 5.6 Total Relations

16. 5.7 Constructors, Unification, Anti-Unification

17. 5.8 Built-in Domains

18. 6 Instance: Algebraic Specifications and Beyond

19. 6.1 Sequences, Multisets and Sets

20. 6.2 Maps

21. 7 Instance: First-Order Logic

22. 8 Instance: Modal Logic

23. 9 Instance: Separation Logic

24. 9.1 Separation Logic Basics

25. 9.2 Map Patterns

26. 9.3 Separation Logic as an Instance of Matching Logic

27. 10 Matching Logic: Reduction to Predicate Logic with Equality

28. 11 Matching Logic: Sound and Complete Deduction

29. 12 Additional Related Work

30. 13 Conclusion and Future Work

1. Introduction

In their simplest form, as term templates with variables, patterns abound in mathematics and computer science. They match a concrete, or ground, term if and only if there is some substitution applied to the pattern’s variables that makes it equal to the concrete term, possibly via domain reasoning. This means, intuitively, that the concrete term obeys the structure specified by the pattern. We show that when combined with logical connectives and variable constraints and quantifiers, patterns provide a powerful means to specify and reason about the structure of states, or configurations, of a programming language.

Matching logic was inspired from the domain of programming language semantics, specifically from attempting to use operational semantics directly for program verification. Recently, operational semantics of several real languages have been proposed, e.g., of C [33, 48], Java [14], JavaScript [13, 70], Python [45, 76], PHP [36], CAML [69], thanks to the development of semantics engineering frameworks like PLT-Redex [53], Ott [86], $\mathbb{K}$ [81, 82], etc., which make defining an operational semantics for a programming language almost as easy as implementing an interpreter, if not easier. Operational semantics are comparatively easy to define and understand, require little formal training, scale up well, and, being executable, can be tested. Indeed, the language semantics above have more than 1,000 (some even more than 3,000) semantic rules and have been tested on benchmarks/test-suites that language implementations use to test their conformance, where available. Thus, operational semantics are typically used as trusted reference models for the defined languages. We would like to use such operational semantics of languages, unchanged, for program verification.

Despite their advantages, operational semantics are rarely used directly for program verification, because the general belief is that proofs tend to be low-level, as they work directly with the corresponding transition system. Hoare [49] or dynamic [46] logics are typically used, because they allow higher level reasoning. However, these come at the cost of (re)defining the language semantics as a set of abstract proof rules, which are harder to understand and trust. The state-of-the-art in mechanical program verification is to develop and prove such language-specific proof systems sound w.r.t. a trusted operational semantics [65, 51, 3], but that needs to be done for each language separately and is labor intensive.

Defining even one complete semantics for a real language like C or Java is already a huge effort. Defining multiple semantics, each good for a different purpose, is at best uneconomical, with or without proofs of soundness w.r.t. the reference semantics. It is therefore not surprising that many practical program verifiers forgo defining a semantics altogether, and instead they implement ad-hoc verification condition (VC) generation, sometimes via (unverified) translations to intermediate verification languages like Boogie [4] or Why3 [37]. For example, program verifiers for C like VCC [26] and Frama-C [37], and for Java like jStar [31] take this approach. Also, none of the 35 verifiers that participated in the 2016 software verification competition (SV-COMP) [10] appear to be based on a formal semantics of any kind. The consequence is that such tools cannot be trusted. We would like program verifiers, ideally, to produce proof certificates whose trust base is only an operational semantics of the target language, same as mechanical verifiers based on Coq [60] or Isabelle [66] do, but without the effort to define any other semantics of the same language, either directly as a separate proof system or indirectly by extending the operational semantics with language-specific lemmas. We would like program verifiers, ideally, to take an operational semantics of a language as input and to yield, as output, a verifier for that language which is as easy to use and as efficient as verifiers specifically developed for that language.

Matching logic was born from our belief that programming languages must have formal definitions, and that tools for a given language, such as interpreters, compilers, state-space explorers, model checkers, deductive program verifiers, etc., can be derived from just one reference formal definition of the language, which is executable. No other semantics for the same language should be needed. This belief is reflected in the design of the $\mathbb{K}$ framework  [81, 82] (http://kframework.org), illustrated in Figure 1. This is the ideal scenario and there is enough evidence that it is within our reach in the short term. For example, [28] presents a program verification module of $\mathbb{K}$, based on matching logic, which takes the respective operational semantics of C [48], Java [14], and JavaScript [70] as input and yields automated program verifiers for these languages, capable of verifying challenging heap-manipulating programs at performance comparable to that of state-of-the-art verifiers specifically crafted for those languages. A precursor of this verifier, MatchC [84], has an online interface at http://matching-logic.org where one can verify dozens of predefined programs or new ones; e.g., the program in Figure 2 is under the io folder and it takes about 150ms to verify.

To reason about programs we need to be able to reason about program configurations. Specifically, we need to define configuration abstractions and reason with them. Consider, for example, the program in Figure 2 which shows a C function that reads n elements from the standard input and prints them to the standard output in reversed order (for now, we can ignore the specifications, which are grayed). While doing so, it allocates a singly linked list storing the elements as they are read, and then deallocates the list as the elements are printed. In the end, the heap stays unchanged. To state the specification of this program, we need to match an abstract sequence of n elements in the input buffer, and then to match its reverse at the end of the output buffer when the function terminates. Further, to state the invariants of the two loops we need to identify a singly linked pattern in the heap, which is a partial map. Many such sequence or map patterns, as well as operations on them, can be defined using conventional algebraic data types (ADTs). But some of them cannot.

A major limitation of ADTs and of first-order logic (FOL) is that operation symbols are interpreted as functions in models, which sometimes is insufficient. E.g., a two-element linked list in the heap (we regard heaps as maps from natural number locations to values) starting with location 7 and holding values 9 and 5, written as ${\it list}(7,9@5)$, can allow infinitely many heap values, one for each location where the value 5 may be stored. So we cannot define ${\it list}$ as an operation symbol ${\it Int}\times{\it Seq}\rightarrow{\it Map}$. The FOL alternative is to define ${\it list}$ as a predicate ${\it Int}\times{\it Seq}\times{\it Map}$, but mentioning the map all the time as an argument makes specifications verbose and hard to read, use and reason about. An alternative, proposed by separation logic [77], is to fix and move the map domain from explicit in models to implicit in the logic, so that ${\it list}(7,9@5)$ is interpreted as a predicate but the non-deterministic map choices are implicit in the logic. We then may need custom separation logics for different languages that require different variations of map models or different configurations making use of different kinds of resources. This may also require specialized separation logic provers needed for each, or otherwise encodings that need to be proved correct. Finally, since the map domain is not available as data, one cannot use FOL variables to range over maps and thus proof rules like “heap framing” need to be added to the logic explicitly.

Matching logic avoids the limitations of both approaches above, by interpreting its terms/formulae as sets of values. Matching logic’s formulae, called patterns, are built using variables, symbols from a signature, and FOL connectives and quantifiers. We can think of matching logic as collapsing the function and predicate symbols of FOL, allowing patterns to be simultaneously regarded both as terms and as predicates. When regarded as terms they build structure, when regarded as predicates they express constraints. Semantically, the matching logic models are similar to the FOL models, except that the symbols in the signature are interpreted as functions returning sets of values instead of single values. Patterns are then also interpreted as sets of values, where conjunction is interpreted as intersection, negation as complement, and the existential quantifier as union over all compatible valuations. The name “matching logic” was inspired from the case when the model is that of terms, common in the context of language semantics, where terms represent (fragments of) program configurations. There, a pattern is interpreted as the set of terms that match it.

The (grayed) specifications in Figure 2 show examples of matching logic patterns, over the signature used to define the semantics of C [48]. The signature includes symbols corresponding to the syntax of the language, to semantic constructs such as $\langle{\_}\rangle_{\sf{code}}$ holding the remaining code fragment, $\langle{\_}\rangle_{\sf{heap}}$ holding the current heap as a map, and $\langle{\_}\rangle_{\sf{in}}$ and $\langle{\_}\rangle_{\sf{out}}$ holding the current input and resp. output buffers as sequences, among many others. Let us discuss the invariant pattern of the first loop (second grayed area). It says that the pattern $\mathsf{list}(\mathsf{x},\mathsf{\alpha})$ is matched somewhere in the heap, and that the sequence $\mathsf{\beta}$ of size $\mathsf{n}-\mathsf{i}$ is available at the beginning of the input buffer such that $\mathsf{A}$ is the reverse of the sequence that $\mathsf{x}$ points to, $\mathsf{rev}(\mathsf{\alpha})$, concatenated with $\mathsf{\beta}$. The ellipses “$\cdots$” are syntactic sugar for existentially quantified variables, which we call “structural frame variables”. Note how symbols from the signature are mixed with logical constructs, and how variables can range over any data stored in configurations, including over heap fragments. In addition to the implicit existential quantifiers for “$\cdots$”, the sequence $\beta$ under the $\langle{\_}\rangle_{\sf{in}}$ symbol is conjuncted with logical constraints about its length; also, the pair consisting of the $\langle{\_}\rangle_{\sf{in}}$ and $\langle{\_}\rangle_{\sf{heap}}$ patterns at the top, which is itself a configuration pattern, is conjuncted with the equality constraint $\mathsf{A}=\mathsf{rev}(\mathsf{\alpha})@\mathsf{\beta}$. While such mixes of symbols and logical connectives are disallowed in other logics, such as FOL or separation logic, they are not only well-formed but also strongly encouraged to be used in matching logic; besides succinctness of specifications, they also allow for local reasoning. This is discussed in detail shortly, in the example in Section 2.2.

Matching logic is particularly well-suited for reasoning about programs when their language has an operational semantics. That is because its patterns give us full access to all the details in a program configuration, at the same time allowing us to hide irrelevant detail using existential quantification (e.g., the “…” framing variables in Figure 2) or separately defined abstractions (e.g., the $\mathsf{list}(\mathsf{x},\alpha)$ pattern in Figure 2). Also, both the operational semantics of a language and its reachability properties can be encoded as rules $\varphi\mathbin{\Rightarrow}\varphi^{\prime}$ between patterns, called reachability rules in [28, 27, 79, 84], and one generic, language-independent proof system can be used both for executing programs and for proving them correct. In both cases, the operational semantics rules are used to advance the computation. When executing programs the pattern to reduce is ground and the application of the semantic steps becomes conventional term rewriting. When verifying reachability properties, the pattern to reduce is symbolic and typically contains constraints and abstractions, so matching logic reasoning is used in-between semantic rewrite rule applications to re-arrange the configuration so that semantic rules match or assertions can be proved. We refer the interested reader to [28] for full details on our recommended verification approach using matching logic.

Although we favor the verification approach above, which led to the development of matching logic, there is nothing to limit the use of matching logic with other verification approaches, as an intuitive and succinct notation for encoding state properties. For example, Proposition 29 tells us that any separation logic formula is a matching logic pattern as is. So one can, for example, take an existing separation logic semantics of a language, regard it as a matching logic semantics and then extend it to also consider structures in the configuration that separation logic was not meant to directly reason about, such as function/exception/break-continue stacks, input/output buffers, etc. For this reason, we here present matching logic as a stand-alone logic, without favoring any particular use of it.

This paper is an extended version of the RTA’15 conference paper [78], which was the first to allow the unrestricted mix of symbols and logical quantifiers in patterns. A much simpler variant of matching logic was introduced in 2010 in [80] as a state specification logic, and has been used since then in several verification efforts [83, 84, 85, 79, 27, 28], and implemented in MatchC [84] by reduction to Maude [25] (for matching) and to Z3 [29] (for domain reasoning). However, that matching logic variant shares only the basic intuition of “terms as formulae” with the logic presented in this paper, and was only syntactic sugar for first-order logic (FOL) with equality in a fixed model, essentially allowing only term patterns $t$ and regarding them as syntactic sugar for equalities $\square=t$ (see Section 12).

Section 2 introduces the syntax and semantics of matching logic, as well as some basic properties. Sections 3 and 4 show how propositional calculus and, respectively, pure predicate logic fall as instances of matching logic. Section 5 shows how several important mathematical concepts can be defined in matching logic, such as definedness, equality, membership, and functions. Using these, Sections 6, 7, 8 and 9 then show how algebraic specifications, first-order logic, modal logic and, respectively, separation logic also fall as instances of matching logic. Section 10 shows that, like FOL, matching logic also reduces to pure predicate logic with equality. Section 11 introduces our sound and complete proof system for matching logic. Section 12 discusses related work and Section 13 concludes.

2. Matching Logic: Basic Notions

We assume the reader is familiar with many-sorted sets, functions, and first-order logic (FOL). For any given set of sorts $S$, we assume Var is an $S$-sorted set of variables, sortwise infinite and disjoint. We may write $x:s$ instead of $x\in\textit{Var}_{s}$, and when the sort of $x$ is irrelevant we just write $x\in\textit{Var}$. We let ${\mathcal{}P}(M)$ denote the powerset of a many-sorted set $M$, which is itself many-sorted. We only treat the many-sorted case here, but we see no inherent limitations in extending the constructions and results in this paper to the order-sorted case.

2.1. Patterns

We start by defining the syntax of patterns.

{defi}

Let $(S,\Sigma)$ be a many-sorted signature of symbols. Matching logic $(S,\Sigma)$-formulae, also called $(S,\Sigma)$-patterns, or just (matching logic) formulae or patterns when $(S,\Sigma)$ is understood from context, are inductively defined as follows for all sorts $s\in S$:

[TABLE]

Let Pattern be the $S$-sorted set of patterns. By abuse of language, we refer to the symbols in $\Sigma$ also as patterns: think of $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ as the pattern $\sigma(x_{1}\!:\!s_{1},\ldots,x_{n}\!:\!s_{n})$.

We argue that the syntax of patterns above is necessary in order to express meaningful patterns, and at the same time it is minimal. Indeed, variable patterns allow us to extract the matched elements or structure and possibly use them in other places in more complex patterns. Forming new patterns from existing patterns by adding more structure/symbols to them is standard and the very basic operation used to construct terms, which are the simplest patterns. Complementing and intersecting patterns allows us to reason with patterns the same way we reason with logical propositions and formulae. Finally, the existential binder serves a dual role. On the one hand, it allows us to abstract away irrelevant parts of the matched structure, which is particularly useful when defining and reasoning about program invariants or structural framing. On the other hand, it allows us to define complex patterns with binders in them, such as $\lambda$-, $\mu$-, or $\nu$-bound terms/patterns (to be presented elsewhere).

To ease notation, $\varphi\in\textsc{Pattern}$ means $\varphi$ is a pattern, while $\varphi_{s}\in\textsc{Pattern}$ or $\varphi\in\textsc{Pattern}_{s}$ that it has sort $s$. We adopt the following derived constructs (“syntactic sugar”):

[TABLE]

Intuitively, $\top$ is a pattern that is matched by all elements, $\bot$ is matched by no elements, $\varphi_{1}\vee\varphi_{2}$ is matched by all elements matching $\varphi_{1}$ or $\varphi_{2}$, and so on. We will shortly formalize this intuition. We assume the usual precedence of the FOL-like constructs, with $\neg$ binding tighter than $\wedge$ tighter than $\vee$ tighter than $\rightarrow$ tighter than $\leftrightarrow$ tighter than the quantifiers.

We adapt from first-order logic the notions of free variable, (variable capture free) substitution, and variable renaming, briefly recalled below. Let ${\it FV}(\varphi)$ denote the free variables of $\varphi$, defined as follows: ${\it FV}(x)=\{x\}$, ${\it FV}(\sigma(\varphi_{s_{1}},...,\varphi_{s_{n}}))={\it FV}(\varphi_{s_{1}})\cup\cdots\cup{\it FV}(\varphi_{s_{n}})$, ${\it FV}(\neg\varphi)={\it FV}(\varphi)$, ${\it FV}(\varphi_{1}\mathbin{\wedge}\varphi_{2})={\it FV}(\varphi_{1})\cup{\it FV}(\varphi_{2})$, and ${\it FV}(\exists x.\varphi)={\it FV}(\varphi)\ \backslash\ \{x\}$. Similarly, the usual variable capture free substitution: $x[\varphi/x]=\varphi$ and $y[\varphi/x]=y$ when variable $y$ is different from $x$, $\sigma(\varphi_{s_{1}},...,\varphi_{s_{n}})[\varphi/x]=\sigma(\varphi_{s_{1}}[\varphi/x],...,\varphi_{s_{n}}[\varphi/x])$, $(\varphi_{1}\wedge\varphi_{2})[\varphi/x]=\varphi_{1}[\varphi/x]\wedge\varphi_{2}[\varphi/x]$, $(\neg\varphi^{\prime})[\varphi/x]=\neg(\varphi^{\prime}[\varphi/x])$, and $(\exists x.\varphi^{\prime})[\varphi/x]=\exists x.\varphi^{\prime}$ and $(\exists y.\varphi^{\prime})[\varphi/x]=\exists y.(\varphi^{\prime}[\varphi/x])$ when variable $y$ is different from $x$ and $y\not\in{\it FV}(\varphi)$ (to avoid variable capture). And variable renaming, $\exists x.\varphi\equiv\exists y.(\varphi[y/x])$, which can be used to avoid variable capture.

2.2. Example

There are many examples of patterns throughout the paper resulting from formulae in various other logics that are captured by matching logic, such as propositional logic (Section 3), predicate logic (Section 4), algebraic specifications (Section 6) first-order logic (Section 7) modal logic (Section 8), and separation logic (Section 9). We will discuss them in their respective sections, showing that formulae in these logics can be regarded as matching logic patterns. Here, instead, we discuss an example inspired from programming language semantics, which is the area that motivated the development of matching logic.

Consider the operational semantics of a real language like C, whose configuration has more than 100 semantic components [33, 48, 28]. The semantic components, here called “cells” and written using symbols $\langle{...}\rangle_{\sf{cell}}$, can be nested and their grouping (symbol) is governed by associativity and commutativity axioms. There is a top cell $\langle{...}\rangle_{\sf{cfg}}$ holding subcells $\langle{...}\rangle_{\sf{code}}$, $\langle{...}\rangle_{\sf{heap}}$, $\langle{...}\rangle_{\sf{in}}$, $\langle{...}\rangle_{\sf{out}}$ among many others, holding the current code fragment, heap, input buffer, output buffer, respectively. We cannot show the signature of all the symbols defining the configuration of a language like C for space reasons, but encourage the interested reader to check the aforementioned papers. We only show a small subset of symbols that is sufficient to write interesting patterns for illustration purposes, mentioning that nothing changes in the subsequent developments of matching logic as the signature grows or changes. That is, we do not have a matching logic for C, another for Java, another for JavaScript, etc.; all these languages have their respective signatures and patterns, and the same matching logic machinery applies to all of them in the same way.

To motivate certain patterns below, we will refer to results that are introduced later in the paper. The purpose of this example, however, is to illustrate and discuss various kinds of patterns, and especially to show that it is useful to mix symbols with logical connectives. The hasty reader can only skim the patterns and their descriptions below for now, and revisit the example later as other results back-reference it.

Consider the signature $(S,\Sigma)$ in Figure 3, consisting of symbols needed to construct semantic configurations for a C-like language. Usual terms are already patterns, in particular the first while loop in the program in Figure 2, say LOOP. So are terms with variables, e.g.:

[TABLE]

The intuition for this pattern is that it matches all the configurations whose code starts with LOOP ($k$, the “code frame”, matches the rest of the code), whose environment binds program identifiers n and i to values $n$ and $i$, respectively, and x to location $x$ ($e$, the “environment frame”, matches the rest of the environment map) such that both $x$ and $x+1$ are allocated and bound to some values in the heap ($h$, the “heap frame”, matches the rest of the heap), whose input buffer contains some sequence ($\beta$) and whose output buffer contains the empty sequence. This intuition will be formalized shortly. Also, we will show how the various symbols can be constrained or defined axiomatically, like in algebraic (Section 6) or FOL (Section 7) specifications; for example, sequences are associative and have $\epsilon$ as unit, maps and ${\it Cfg}$ are both associative and commutative with “.” as unit, $\mathsf{len}(i@\alpha)=1+\mathsf{len}(\alpha)$, etc.

The interesting patterns are those combining symbols and logical connectives. For example, suppose that we want to restrict the pattern above to only match configurations where $i\leq n$. As discussed later in the paper (Section 5.2), equality can be axiomatized in matching logic and used in any sort context. Also, due to their ubiquity, Boolean expressions are allowed to be used in any sort context unchanged, with the meaning that they equal ${\it true}$; that is, we write just $b$ instead of $b={\it true}$ (Section 5.8). With these, we can restrict the pattern above as follows (note the top-level conjuction):

[TABLE]

Quantifiers can be used, for example, to abstract away irrelevant parts of the pattern. Suppose, for example, that we work in a context where the code and the output cells are irrelevant, and so are the frames of the environment and heap cells. Then we can “hide” them to the context as follows:

[TABLE]

Following a notational convention proposed and implemented in $\mathbb{K}$ (http://kframework.org [81, 82]), we use “…” as syntactic sugar for such existential quantifiers used for framing:

[TABLE]

It is often the case that program identifiers are bound to default mathematical variables (their symbolic values) in the environment, and then the mathematical variables are used in many other parts of the configuration pattern to state additional logical or structural constraints. For that reason, we typically want to match the program identifiers to their (symbolic) values once and for all with a separate, default (sub)pattern, which is then not mentioned anymore in subsequent patterns:

[TABLE]

Note that the pattern above contains two (top-level) $\langle{...}\rangle_{\sf{cfg}}$ sub-pattern constraints and one logical constraint, $i\leq n$. This pattern will be matched by precisely those configurations that match both sub-patterns and satisfy the constraint, which are the same configurations that match the previous pattern. Therefore, the last two patterns are equal (pattern equality is formalized in Section 5.2; see Notation 5.2 and Proposition 11)).

Now suppose that we want to state that location $x$ in the heap points to a linked list over the list data-structure in the program in Figure 2, which comprises a mathematical sequence of integers $\alpha$. The precise locations of the various nodes in the list are irrelevant. Such a linked-list pattern can be defined by adding a symbol representing it to the signature, say ${\it list}\in\Sigma_{{\it Nat}\,{\it Seq}_{\it Int},{\it Map}_{{\it Nat},{\it Int}}}$, together with two axioms (similar to those in separation logic, Section 9); it is shown in Section 9.2 that the pattern ${\it list}(x,\alpha)$ is matched by precisely all the (infinitely many) linked lists starting with location $x$ and containing the sequence of elements $\alpha$. This shows why we want pattern symbols to be interpreted into power-set domains, so they can evaluate to sets of elements (all those that match them) instead of just elements. Matching logic also allows us to axiomatically state that a symbol is to be interpreted as a function (Section 5.4); in fact, in this simple example we assume all the symbols of our signature $\Sigma$ above to be constrained to be functions, except for those of ${\it Map}$ results. We can now refine the pattern above as follows:

[TABLE]

Inspired from the invariant of the first loop in Figure 2, let us add some more constraints:

[TABLE]

The pattern above is additionally stating that the $\langle{...}\rangle_{\sf{in}}$ cell starts with a prefix of size equal to $n-i$ which appended to the reverse of the sequence that $x$ points to in the heap equals the original input sequence $A$. We can arrange the pattern to better localize the logical constraints to the sub-patterns for which they are relevant. For example, the first two constraints are relevant for the sequence $\beta$, so we can move them to their place:

[TABLE]

The above transformation is indeed correct, thanks to Proposition 13 (constraint propagation). Similarly, the remaining constraint can be localized to the two cells that need it. Using also the fact that cell concatenation is commutative, we rewrite the pattern into:

[TABLE]

The pattern above is very similar to the first invariant in Figure 2; the latter does not mention the top $\langle{...}\rangle_{\sf{cfg}}$ cell because our implementation adds it automatically. The top cell is not necessary anyway, we added it mostly for uniformity in our notation for configurations.

So constraints can be propagated up and down a pattern to where they are needed. But how are the constraints generated? One way to generate constraints is through reasoning using language semantic rules, such as the case analysis and consequence rules in [28]. Another way to generate constraints is by local reasoning about patterns. For example, using the axioms of ${\it list}$ in Section 9.2, we can infer ${\it list}(x,\alpha)\rightarrow\varphi_{1}\mathbin{\vee}\varphi_{2}$, where $\varphi_{1}$ is $\cdot\mathbin{\wedge}(\alpha=\epsilon)$ (the empty map “$\cdot$” with constraint “$\alpha$ is the empty sequence”) and $\varphi_{2}$ is $\exists a\,.\,\exists\gamma\,.\,\alpha=a@\gamma\mathbin{\wedge}\exists y\,.\,(x\mapsto a,\,x+1\mapsto y,\,{\it list}(y,\gamma))$. By Proposition 3 (structural framing) and propositional reasoning we can then infer the following pattern:

[TABLE]

Since symbol application distributes over $\mathbin{\vee}$ (Proposition 4), the pattern to the right of $\rightarrow$ above becomes (again via propositional reasoning):

[TABLE]

We can now propagate the constraints of each of $\varphi_{1}$ and $\varphi_{2}$ up into their respective disjunct above, to be used in combination with the other constrains on sequences.

We stop here with our example. Note that we made no effort above to construct a signature that does not allow junk configurations (for example, there is nothing to stop us from adding two or more heaps in a configuration); such junk configurations can be dismissed either by adding stronger sorting or by well-formedness predicates/patterns. Also, our syntax for empty maps (“$\cdot$”) and for map merging (“$\_,\_$”) above is different from that in Section 9.2. The syntax above is close to the one we use in our $\mathbb{K}$ implementation, while the syntax in Section 9.2 was specifically chosen to be similar to that of separation logic in order to support the subsequent results in Section 9.3.

2.3. Semantics

In their simplest form, as terms with variables, patterns are usually matched by other terms that have more structure, possibly by ground terms. However, sometimes we may need to do the matching modulo some background theories or modulo some existing domains, for example integers where addition is commutative or $2+3=1+4$, etc. For maximum generality, we prefer to impose no theoretical restrictions on the models in which patterns are interpreted, or matched, leaving such restrictions to be dealt with in implementations (for example, one may limit to free models, or to ones for which decision procedures exist, etc.). This has the additional benefit that it yields complete deduction (Section 11).

{defi}

A matching logic $(S,\Sigma)$-model $M$, or just a $\Sigma$-model when $S$ is understood, or simply a model when both $S$ and $\Sigma$ are understood, consists of:

1. (1)

An $S$-sorted set $\{M_{s}\}_{s\in S}$, where each set $M_{s}$, called the carrier of sort $s$ of $M$, is assumed non-empty; and 2. (2)

A function $\sigma_{M}:M_{s_{1}}\times\cdots\times M_{s_{n}}\rightarrow{\mathcal{}P}(M_{s})$ for each symbol $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$, called the interpretation of $\sigma$ in $M$.

Note that symbols are interpreted as relations, and that the usual $(S,\Sigma)$-algebra models are a special case of matching logic models, where $|\sigma_{M}(m_{1},\ldots,m_{n})|=1$ for any $m_{1}\in M_{s_{1}}$, …, $m_{n}\in M_{s_{n}}$. Similarly, partial $(S,\Sigma)$-algebra models also fall as special case, where $|\sigma_{M}(m_{1},\ldots,m_{n})|\leq 1$, since we can capture the undefinedness of $\sigma_{M}$ on $m_{1}$, …, $m_{n}$ with $\sigma_{M}(m_{1},\ldots,m_{n})=\emptyset$. We tacitly use the same notation $\sigma_{M}$ for its extension to argument sets, ${\mathcal{}P}(M_{s_{1}})\times\cdots\times{\mathcal{}P}(M_{s_{n}})\rightarrow{\mathcal{}P}(M_{s})$, that is,

[TABLE]

where $A_{1}\subseteq M_{s_{1}},\ldots,A_{n}\subseteq M_{s_{n}}$.

{defi}

Given a model $M$ and a map $\rho:\textit{Var}\rightarrow M$, called an $M$-valuation, let its extension $\overline{\rho}:\textsc{Pattern}\rightarrow{\mathcal{}P}(M)$ be inductively defined as follows:

• •

$\overline{\rho}(x)=\{\rho(x)\}$, for all $x\in\textit{Var}_{s}$

• •

$\overline{\rho}(\sigma(\varphi_{1},\ldots,\varphi_{n}))=\sigma_{M}(\overline{\rho}(\varphi_{1}),\ldots\overline{\rho}(\varphi_{n}))$ for all $\sigma\in\Sigma_{s_{1}...s_{n},s}$ and appropriate $\varphi_{1},...,\varphi_{n}$

• •

$\overline{\rho}(\neg\varphi)=M_{s}\ \backslash\ \overline{\rho}(\varphi)$ for all $\varphi\in\textsc{Pattern}_{s}$

• •

$\overline{\rho}(\varphi_{1}\wedge\varphi_{2})=\overline{\rho}(\varphi_{1})\cap\overline{\rho}(\varphi_{2})$ for all $\varphi_{1},\varphi_{2}$ patterns of the same sort

• •

$\overline{\rho}(\exists x.\varphi)=\bigcup\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}=\bigcup_{a\in M}\overline{\rho[a/x]}(\varphi)$

where “ $\backslash$” is set difference, “$\rho\!\!\upharpoonright_{V}$” is $\rho$ restricted to $V\subseteq\textit{Var}$, and “$\rho[a/x]$” is map $\rho^{\prime}$ with $\rho^{\prime}(x)=a$ and $\rho^{\prime}(y)=\rho(y)$ if $y\neq x$. If $a\in\overline{\rho}(\varphi)$ then we say $a$ matches $\varphi$ (with witness $\rho$).

It is easy to see that the usual notion of term matching is an instance of the above; indeed, if $\varphi$ is a term with variables and $M$ is the ground term model, then a ground term $a$ matches $\varphi$ iff there is some substitution $\rho$ such that $\rho(\varphi)=a$. It may be insightful to note that patterns can also be regarded as predicates, when we think of “$a$ matches pattern $\varphi$” as “predicate $\varphi$ holds in $a$”. But matching logic allows more complex patterns than terms or predicates, and models which are not necessarily conventional (term) algebras.

The extension of $\rho$ works as expected with the derived constructs:

• •

$\overline{\rho}(\top_{\!\!s})=M_{s}$ and $\overline{\rho}(\bot_{s})=\emptyset$

• •

$\overline{\rho}(\varphi_{1}\vee\varphi_{2})=\overline{\rho}(\varphi_{1})\cup\overline{\rho}(\varphi_{2})$

• •

$\overline{\rho}(\varphi_{1}\rightarrow\varphi_{2})=\{m\in M_{s}\mid m\in\overline{\rho}(\varphi_{1})\mbox{ implies }m\in\overline{\rho}(\varphi_{2})\}=M_{s}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \backslash\ \overline{\rho}(\varphi_{2}))$

• •

$\overline{\rho}(\varphi_{1}\leftrightarrow\varphi_{2})=\{m\in M_{s}\mid m\in\overline{\rho}(\varphi_{1})\mbox{ iff }m\in\overline{\rho}(\varphi_{2})\}=M_{s}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))$

(“$\Delta$” is the set symmetric difference operation)

• •

$\overline{\rho}(\forall x.\varphi)=\bigcap\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}=\bigcap_{a\in M}\overline{\rho[a/x]}(\varphi)$

Interpreting formulae as sets of elements in models is reminiscent of modal logic, where they are interpreted as the “worlds” in which they hold, and of separation logic, where they are interpreted as the “heaps” they match. We discuss the relationship between matching logic and these logics in depth in Sections 8 and, respectively, 9.

Therefore, the matching logic interpretation of the logical connectives is not two-valued like in classical logics. In particular, the interpretation of $\varphi_{1}\rightarrow\varphi_{2}$ is the set of all the elements that if matched by $\varphi_{1}$ then are also matched by $\varphi_{2}$. One should be careful when reasoning with such non-classical logics, as basic intuitions may deceive. For example, the interpretation of $\varphi_{1}\rightarrow\varphi_{2}$ is the total set (i.e., same as $\top$) iff all elements matching $\varphi_{1}$ also match $\varphi_{2}$, but it is the empty set iff $\varphi_{2}$ is matched by no elements (same as $\bot$) while $\varphi_{1}$ is matched by all elements (same as $\top$). If in doubt, thanks to the set-theoretical interpretation of the matching logic connectives, we can always draw diagrams to enhance our intuition; for example, Figure 4 depicts the semantics of pattern implication and of pattern equivalence.

When doing logical reasoning with patterns, we sometimes want to think of a pattern exclusively as a “predicate”, that is, as something which is either true or false. To avoid using quotes in such situations, we introduce the following:

{defi}

Pattern $\varphi_{s}$ is an $M$-predicate, or a predicate in $M$, iff for any $M$-valuation $\rho:\textit{Var}\rightarrow M$, it is the case that $\overline{\rho}(\varphi_{s})$ is either $M_{s}$ (it holds) or $\emptyset$ (it does not hold). Pattern $\varphi_{s}$ is a predicate iff it is a predicate in all models $M$.

Note that $\top_{s}$ and $\bot_{s}$ are predicates, and if $\varphi$, $\varphi_{1}$ and $\varphi_{2}$ are predicates then so are $\neg\varphi$, $\varphi_{1}\wedge\varphi_{2}$, and $\exists x\,.\,\varphi$. That is, the logical connectives of matching logic preserve the predicate nature of patterns. Section 5 will introduce several useful predicate constructs.

{defi}

$M$ satisfies $\varphi_{s}$, written ${M}\models\varphi_{s}$, iff $\overline{\rho}(\varphi_{s})=M_{s}$ for all $\rho:\textit{Var}\rightarrow M$.

Proposition 1**.**

Unless otherwise stated, assume the default pattern sort to be $s$. Then:

1. (1)

If $\rho_{1},\rho_{2}:\textit{Var}\rightarrow M$, $\rho_{1}\!\!\upharpoonright_{{\it FV}(\varphi)}=\rho_{2}\!\!\upharpoonright_{{\it FV}(\varphi)}$ then $\overline{\rho_{1}}(\varphi)=\overline{\rho_{2}}(\varphi)$ 2. (2)

If $x\in\textit{Var}_{s}$ then ${M}\models x$ iff $|M_{s}|=1$ 3. (3)

If $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $\varphi_{1},\ldots,\varphi_{n}$ are patterns of sorts $s_{1},\ldots,s_{n}$, respectively, then we have ${M}\models\sigma(\varphi_{1},\ldots,\varphi_{n})$ iff $\sigma_{M}(\overline{\rho}(\varphi_{1}),\ldots,\overline{\rho}(\varphi_{n}))=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$ 4. (4)

${M}\models\neg\varphi$* iff $\overline{\rho}(\varphi)=\emptyset$ for any $\rho:\textit{Var}\rightarrow M$* 5. (5)

${M}\models\varphi_{1}\wedge\varphi_{2}$* iff ${M}\models\varphi_{1}$ and ${M}\models\varphi_{2}$* 6. (6)

If $\exists x.\varphi_{s}$ closed, ${M}\models\exists x.\varphi_{s}$ iff $\bigcup\{\overline{\rho}(\varphi_{s})\mid\rho:\textit{Var}\rightarrow M\}=M_{s}$; hence, ${M}\models\exists x.x$ 7. (7)

${M}\models\varphi_{1}\rightarrow\varphi_{2}$* iff $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$ for all $\rho:\textit{Var}\rightarrow M$* 8. (8)

${M}\models\varphi_{1}\leftrightarrow\varphi_{2}$* iff $\overline{\rho}(\varphi_{1})=\overline{\rho}(\varphi_{2})$ for all $\rho:\textit{Var}\rightarrow M$ * 9. (9)

${M}\models\forall x.\varphi$* iff ${M}\models\varphi$*

Proof 2.1**.**

The proof of each of the properties is below:

1. (1)

Structural induction on $\varphi$. The only interesting case is when $\varphi$ has the form $\exists x.\varphi^{\prime}$, so ${\it FV}(\varphi)={\it FV}(\varphi^{\prime})\ \backslash\ \{x\}$. Then

[TABLE] 2. (2)

${M}\models x$* iff $\overline{\rho}(x)=M_{s}$ for all $\rho:\textit{Var}\rightarrow M$, iff $\{\rho(x)\}=M_{s}$ for all $\rho:\textit{Var}\rightarrow M$, iff $M_{s}$ has only one element.* 3. (3)

${M}\models\sigma(\varphi_{1},\ldots,\varphi_{n})$* iff $\overline{\rho}(\sigma(\varphi_{1},\ldots,\varphi_{n}))=M_{s}$ for all valuations $\rho:\textit{Var}\rightarrow M$, iff $\sigma_{M}(\overline{\rho}(\varphi_{1}),\ldots\overline{\rho}(\varphi_{n}))=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$.* 4. (4)

${M}\models\neg\varphi$* iff $\overline{\rho}(\neg\varphi)=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $M_{s}\ \backslash\ \overline{\rho}(\varphi)=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi)=\emptyset$ for any $\rho:\textit{Var}\rightarrow M$.* 5. (5)

${M}\models\varphi_{1}\wedge\varphi_{2}$* iff $\overline{\rho}(\varphi_{1}\wedge\varphi_{2})=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi_{1})\cap\overline{\rho}(\varphi_{2})=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi_{1})=M_{s}$ and $\overline{\rho}(\varphi_{2})=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff ${M}\models\varphi_{1}$ and ${M}\models\varphi_{2}$.* 6. (6)

${M}\models\exists x.\varphi_{s}$* iff $\overline{\rho}(\exists x.\varphi_{s})=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\bigcup\{\overline{\rho^{\prime}}(\varphi_{s})\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff (by the first property in this proposition, since ${\it FV}(\varphi_{s})\subseteq\{x\}$) $\bigcup\{\overline{\rho^{\prime}}(\varphi_{s})\mid\rho^{\prime}:\textit{Var}\rightarrow M\}=M_{s}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\bigcup\{\overline{\rho}(\varphi_{s})\mid\rho:\textit{Var}\rightarrow M\}=M_{s}$. In particular, if $\varphi_{s}=x$ then $\bigcup\{\overline{\rho}(x)\mid\rho:\textit{Var}\rightarrow M\}=M_{s}$, so ${M}\models\exists x.x$.* 7. (7)

${M}\models\varphi_{1}\rightarrow\varphi_{2}$* iff $\overline{\rho}(\varphi_{1}\rightarrow\varphi_{2})=M$ for all $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\neg(\varphi_{1}\wedge\neg\varphi_{2}))=M$ for all $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi_{1}\wedge\neg\varphi_{2})=\emptyset$ for all $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi_{1})\cap(M\ \backslash\ \overline{\rho}(\varphi_{2}))=\emptyset$ for all $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$ for all $\rho:\textit{Var}\rightarrow M$.* 8. (8)

Follows from the previous similar properties for $\wedge$ and $\rightarrow$. 9. (9)

${M}\models\forall x.\varphi$* iff $\overline{\rho}(\forall x.\varphi)=\bigcap\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}=M$ for all $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho^{\prime}}(\varphi)=M$ for all $\rho,\rho^{\prime}:\textit{Var}\rightarrow M$ with $\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}$, iff $\overline{\rho}(\varphi)=M$ for all $\rho:\textit{Var}\rightarrow M$, iff ${M}\models\varphi$.*

Therefore, all properties hold.

Since $\exists x.x$ is satisfied by all models (by (6) above), we could have also defined $\top$ as $\exists x.x$ instead of as $x\vee\neg x$. Properties (9) and (2) in Proposition 1 imply that the pattern $\forall x.x$ is satisfied precisely by the models whose carrier of the sort of $x$ contains only one element.

Note that property “if $\varphi$ closed then ${M}\models\neg\varphi$ iff ${M}\not\models\varphi$”, which holds in classical logics like FOL, does not hold in matching logic. This is because $M\models\neg\varphi$ means $\neg\varphi$ is matched by all elements, i.e., $\varphi$ is matched by no element, while $M\not\models\varphi$ means $\varphi$ is not matched by some elements. These two notions are different when patterns can have more than two interpretations, which happens when $M$ can have more than one element.

{defi}

Pattern $\varphi$ is valid, written $\models\varphi$, iff ${M}\models\varphi$ for all ${M}$. If $F\subseteq\textsc{Pattern}$ then ${M}\models F$ iff ${M}\models\varphi$ for all $\varphi\in F$. $F$ entails $\varphi$, written $F\models\varphi$, iff for each ${M}$, ${M}\models F$ implies ${M}\models\varphi$. A matching logic specification is a triple $(S,\Sigma,F)$ with $F\subseteq\textsc{Pattern}$.

2.4. Basic Properties

A natural question is how to formally reason about patterns. Although they can be inductively built with symbols, like terms are, the following result says that pure predicate logic reasoning is sound for matching logic when we regard patterns as predicates. By pure predicate logic we mean predicate logic with just predicate symbols, without constants or function symbols. As shown in Section 11, the Substitution axiom of non-pure predicate logics ($\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$ is not sound when $t$ is an arbitrary matching logic pattern (it needs to be modified to only allow patterns which interpret to singletons).

Proposition 2**.**

The following properties hold for patterns of any sort $s\in S$, so the Hilbert-style axioms and proof rules that are sound and complete for pure predicate logic [38], are also sound for matching logic, for any sort (more axioms and proof rules are needed for completeness, as shown in Section 11):

1. (1)

$\models\varphi$, where $\varphi$ is a propositional tautology over patterns of sort $s$. 2. (2)

Modus ponens: $\models\varphi_{1}$ and $\models\varphi_{1}\rightarrow\varphi_{2}$ imply $\models\varphi_{2}$. 3. (3)

$\models(\forall x\,.\,\varphi_{1}\rightarrow\varphi_{2})\rightarrow(\varphi_{1}\rightarrow\forall x\,.\,\varphi_{2})$* when $x\not\in{\it FV}(\varphi_{1})$.* 4. (4)

Universal generalization: $\models\varphi$ implies $\models\forall x\,.\,\varphi$. 5. (5)

Substitution: $\models(\forall x\,.\,\varphi)\rightarrow\varphi[y/x]$, with variable $y\not\in{\it FV}(\forall x\,.\,\varphi)$ of same sort as $x$.

Proof 2.2**.**

Indeed,

1. (1)

Let $\psi$ be a propositional tautology over propositional variables $p_{1}$, …, $p_{n}$, such that $\varphi$ is obtained from $\psi$ by substituting patterns $\varphi_{1}$, …, $\varphi_{n}$ of sort $s$ for propositional variables $p_{1}$, …, $p_{n}$, respectively. Let $M$ be any matching logic model, whose carrier of sort $s$ is $M_{s}$, and let $\rho$ be any $M$-valuation. It is well-known that power-sets are Boolean algebras, in our case $({\mathcal{}P}(M_{s}),\neg,\cap)$ with $\neg$ the complement w.r.t. $M_{s}$, and that all Boolean algebras are models of propositional calculus. Therefore, no matter how we interpret the variables $p_{1}$, …, $p_{n}$ as subsets of $M_{s}$, in particular as $\overline{\rho}(\varphi_{1})$, …, $\overline{\rho}(\varphi_{n})$, respectively, the interpretation of $\psi$ is the entire set $M_{s}$. Hence, $\models\varphi$. 2. (2)

If $\rho:\textit{Var}\rightarrow M$ is a matching logic model valuation such that $\overline{\rho}(\varphi_{1})=M_{s}$ and $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$, then it must be that $\overline{\rho}(\varphi_{2})=M_{s}$. 3. (3)

By (7) in Proposition 1, it suffices to show that $\overline{\rho}(\forall x\,.\,\varphi_{1}\rightarrow\varphi_{2})\subseteq\overline{\rho}(\varphi_{1}\rightarrow\forall x\,.\,\varphi_{2})$ for any valuation $\rho:\textit{Var}\rightarrow M$. A stronger result (equality) holds, as expected:

[TABLE] 4. (4)

Immediate by (9) in Proposition 1. 5. (5)

Follows by (7) and (1) in Proposition 1, because for any valuation $\rho:\textit{Var}\rightarrow M$, we have $\overline{\rho}(\varphi[y/x])=\overline{\rho^{\prime}}(\varphi)$ where $\rho^{\prime}:\textit{Var}\rightarrow M$ is defined as $\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}$ and $\rho^{\prime}(x)=\rho(y)$ (this holds also when $y=x$), while $\overline{\rho}(\forall x\,.\,\varphi)$ is the intersection of all $\overline{\rho^{\prime\prime}}(\varphi)$ for all $\rho^{\prime\prime}:\textit{Var}\rightarrow M$ with $\rho^{\prime\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}$ and $\rho^{\prime}$ is one of these $\rho^{\prime\prime}$.

Therefore, pure predicate logic reasoning can also be used to reason about patterns.

Proposition 2 tells us that the proof system of pure predicate logic is actually sound for matching logic, unchanged. That is, we do not need to attempt to translate patterns to predicate logic formulae in order to reason about them, we can simply regard them as predicates the way they are. Section 11 shows that a few additional proof rules yield a sound and complete proof system for matching logic, similarly to how (term) Substitution together with the other four proof rules of pure predicate logic brings complete deduction to FOL.

Sometimes we can show that patterns are two-valued: {defi}

Pattern $\varphi$ is called a predicate in $(S,\Sigma,F)$, or simply a predicate when $(S,\Sigma,F)$ is understood, iff it is an $M$-predicate (Definition 2.3) in all models $M$ with $M\models F$.

However, note that Proposition 2 applies to any patterns, not only to predicates. Moreover, there are also interesting properties that appear to be very specific to patterns and their dual logical-structural nature, and not to predicates, such as the following:

Proposition 3**.**

(Structural Framing) If $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $\varphi_{i},\varphi^{\prime}_{i}\in\textsc{Pattern}_{s_{i}}$ such that $\models\varphi_{i}\rightarrow\varphi^{\prime}_{i}$ for all $i\in 1\ldots n$, then $\models\sigma(\varphi_{1},\ldots,\varphi_{n})\rightarrow\sigma(\varphi^{\prime}_{1},\ldots,\varphi^{\prime}_{n})$.

Proof 2.3**.**

Immediate by (7) in Proposition 1, because for any model $M$, the extension of $\sigma_{M}$ as a function ${\mathcal{}P}(M_{s_{1}})\times\cdots\times{\mathcal{}P}(M_{s_{n}})\rightarrow{\mathcal{}P}(M_{s})$ is monotone.

This structural framing property generalizes to positive, or monotone contexts: if $\models\varphi\rightarrow\varphi^{\prime}$ then $\models C[\varphi]\rightarrow C[\varphi^{\prime}]$ for any positive context $C$. By a positive/monotone context we mean a context with no negation on the path to the placeholder.111In the context of programming language semantics, reasoning typically happens in semantic cells in the program configuration and the program configuration is typically a term with variables, possibly domain-constrained, so requiring a context to be positive is not a strong requirement. Indeed, except for $\neg$, the matching logic constructs are interpreted as monotone functions over powerset domains. Structural framing is crucial for localizing reasoning. Consider, for example, the property

[TABLE]

proved in Section 11 for the matching logic specifications of maps (which captures separation logic: Section 9). Taking $\sigma$ as the map/heap merge operation $\_*\_$, Proposition 3 implies

[TABLE]

where $h$ is a free map/heap variable. So the property we “locally” proved can be “framed” within any map/heap. Of course, one can go further and “globalize” the property in any positive context. For example, consider the operational semantics of a real language like C, whose configuration was partly discussed in the example in Section 2.2. Recall from Section 2.2 that semantic cells, written using symbols $\langle{...}\rangle_{\sf{cell}}$, can be nested and their grouping (symbol) is governed by associativity and commutativity axioms. Also, there is a top cell $\langle{...}\rangle_{\sf{cfg}}$ holding a subcell $\langle{...}\rangle_{\sf{heap}}$ among many others. Proposition 1 then implies

[TABLE]

where $h$ and $c$ are free variables (the “heap” and, respectively, “configuration” frames).

As discussed in the example in Section 2.2, sometimes it is useful to move the logical connectives from inside terms to the top level, or viceversa. While disjunction and existential quantification can be propagated both ways through symbol applications ($\leftrightarrow$), conjunction and universal quantification weaken the pattern as they are propagated from the inside to the outside of a symbol application ($\rightarrow$), and negation appears to not be movable at all:

Proposition 4**.**

(Distributivity of symbol application) Let $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $\varphi_{i}\in\textsc{Pattern}_{s_{i}}$ for all $1\leq i\leq n$. Pick a particular $1\leq i\leq n$. Let $\varphi^{\prime}_{i}\in\textsc{Pattern}_{s_{i}}$ be another pattern of sort $s_{i}$ and let $C_{\sigma,i}[\square]$ be the context $\sigma(\varphi_{1},\ldots,\varphi_{i-1},\square,\varphi_{i+1},\ldots\varphi_{n})$ (a context $C[\square]$ is a pattern with one occurrence of a free variable, “$\square$”, and $C[\varphi]$ is $C[\varphi/\square]$). Then:

1. (1)

$\models C_{\sigma,i}[\varphi_{i}\mathbin{\vee}\varphi^{\prime}_{i}]\leftrightarrow C_{\sigma,i}[\varphi_{i}]\mathbin{\vee}C_{\sigma,i}[\varphi^{\prime}_{i}]$** 2. (2)

$\models C_{\sigma,i}[\exists x\,.\,\varphi_{i}]\leftrightarrow\exists x\,.\,C_{\sigma,i}[\varphi_{i}]$, where $x\not\in{\it FV}(C_{\sigma,i}[\square])$ 3. (3)

$\models C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\varphi^{\prime}_{i}]\rightarrow C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}C_{\sigma,i}[\varphi^{\prime}_{i}]$** 4. (4)

$\models C_{\sigma,i}[\forall x\,.\,\varphi_{i}]\rightarrow\forall x\,.\,C_{\sigma,i}[\varphi_{i}]$, where $x\not\in{\it FV}(C_{\sigma,i}[\square])$

Proof 2.4**.**

Trivial, using the basic set properties that for any function $f:X\rightarrow{\mathcal{}P}(Y)$ (i.e., relation in $X\times Y$), if $\{A_{i}\}_{i\in{\mathcal{}I}}$ is a family of subsets of $X$, i.e., $A_{i}\subseteq X$ for all $i\in{\mathcal{}I}$, then $f(\bigcup\{A_{i}\mid i\in{\mathcal{}I}\})=\bigcup\{f(A_{i})\mid i\in{\mathcal{}I}\}$ and $f(\bigcap\{A_{i}\mid i\in{\mathcal{}I}\})\subseteq\bigcap\{f(A_{i})\mid i\in{\mathcal{}I}\}$, where $f(A)=\bigcup\{f(a)\mid a\in A\}$. Note the inclusion for intersection, as opposed to equality for disjunction. The inclusion for intersection becomes equality when $f$ is injective as a relation, that is, when $f(a)\cap f(a^{\prime})\neq\emptyset$ implies $a=a^{\prime}$.

The other implications in (3) and (4) above in Proposition 4 do not hold in general. Consider a signature $\Sigma$ containing only one sort, two constants $a$ and $b$, and a binary symbol $f$. Consider also a model $M$ containing only two elements, $a_{M}$ and $b_{M}$, with constants $a$ and $b$ interpreted as $\{a_{M}\}$ and $\{b_{M}\}$, respectively, and with $f$ interpreted as the injective function $f_{M}(a_{M},a_{M})=\{a_{M}\}$, $f_{M}(b_{M},a_{M})=\{b_{M}\}$, $f_{M}(a_{M},b_{M})=\{b_{M}\}$, $f_{M}(b_{M},b_{M})=\{a_{M}\}$. Let $C_{f,2}[\square]$ be the context $f(a\vee b,\square)$ and let $\varphi_{2}$ and $\varphi_{2}^{\prime}$ be $a$ and $b$, respectively. Then the pattern $C_{f,2}[a]\wedge C_{f,2}[b]$, that is $f(a\vee b,a)\wedge f(a\vee b,b)$, is interpreted by any valuation to $M$ as the (total) set $\{a_{M},b_{M}\}$, while $C_{f,2}[a\wedge b]$, that is $f(a\vee b,a\wedge b)$, as the empty set (because $a\wedge b$ is interpreted as the empty set). Therefore, $\not\models C_{f,2}[a]\wedge C_{f,2}[b]\rightarrow C_{f,2}[a\wedge b]$. Similarly, $\not\models\forall x\,.\,C_{f,2}[x]\rightarrow C_{f,2}[\forall x\,.\,x]$ because $\forall x\,.\,C_{f,2}[x]$ and $C_{f,2}[\forall x\,.\,x]$ are interpreted as $\{a_{M},b_{M}\}$ and $\emptyset$, respectively, by any valuation to $M$.

The reason for which the counter-examples above worked was that the context $C_{f,2}[\square]$, that is $f(a\vee b,\square)$, did not yield an injective relation in $M$: indeed, it was not the case that the interpretations of $f(a\vee b,x)$ and $f(a\vee b,y)$ were disjoint whenever $x$ and $y$ were interpreted as distinct elements. We can define a general notion of injectivity, for any context $C_{\sigma,i}[\square]$, which generalizes the usual notion of injectivity of a function or relation:

{defi}

With the notation in Proposition 4, $C_{\sigma,i}[\square]$ is injective in specification $(S,\Sigma,F)$ iff $F\models C_{\sigma,i}[x]\wedge C_{\sigma,i}[y]\rightarrow C_{\sigma,i}[x\wedge y]$, where $x,y\in\textit{Var}_{s_{i}}$ are distinct variables which do not occur in $C_{\sigma,i}[\square]$. We drop $(S,\Sigma,F)$ when understood. Symbol $\sigma$ is injective on position $i$ iff $C_{\sigma,i}[\square]$ is injective with $\varphi_{1}$, …, $\varphi_{i-1}$, $\varphi_{i+1}$,…,$\varphi_{n}$ chosen as distinct variables.

It is easy to check that $\sigma$ is injective on position $i$ iff for any model $M$ with $M\models F$, $\sigma_{M}$ is injective on position $i$ as a relation in $M$. Recall that functions are particular relations, and that injectivity is a property of relations in general: $R\subseteq M_{s_{1}}\times M_{s_{n}}\times M_{s}$ is injective on position $1\leq i\leq$ iff $(a_{1},...,a_{i-1},a_{i},a_{i+1},...,a_{n},b)\in R$ and $(a_{1},...,a_{i-1},a_{i}^{\prime},a_{i+1},...,a_{n},b)\in R$ implies $a_{i}=a_{i}^{\prime}$. Regarding $\sigma_{M}$ as such a relation, its injectivity on position $i$ means that $\sigma_{M}(a_{1},...,a_{i-1},a_{i},a_{i+1},...,a_{n})\cap\sigma_{M}(a_{1},...,a_{i-1},a_{i}^{\prime},a_{i+1},...,a_{n})\neq\emptyset$ implies $a_{i}=a_{i}^{\prime}$.

Proposition 5**.**

(Distributivity of injective symbol application) With the notation in Definition 2.4, if $C_{\sigma,i}[\square]$ is injective in $(S,\Sigma,F)$ and $\varphi_{i},\varphi_{i}^{\prime}\in\textsc{Pattern}_{s_{i}}$ then:

1. (1)

$F\models C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}C_{\sigma,i}[\varphi^{\prime}_{i}]\rightarrow C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\varphi^{\prime}_{i}]$** 2. (2)

$F\models\forall x\,.\,C_{\sigma,i}[\varphi_{i}]\rightarrow C_{\sigma,i}[\forall x\,.\,\varphi_{i}]$, where $x\not\in{\it FV}(C_{\sigma,i}[\square])$

Together with Proposition 4, this implies the full distributivity of injective contexts w.r.t. the matching logic constructs $\wedge$, $\vee$, $\forall$, $\exists$ (but not $\neg$).

Proof 2.5**.**

Let $M$ be a model with $M\models F$ and let $\rho:\textit{Var}\rightarrow M$ be a valuation.

To prove the first property, let $b\in\overline{\rho}(C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}C_{\sigma,i}[\varphi^{\prime}_{i}])$, that is, $b\in\overline{\rho}(C_{\sigma,i}[\varphi_{i}])$ and $b\in\overline{\rho}(C_{\sigma,i}[\varphi^{\prime}_{i}])$. Then there are $a,a^{\prime}\in M_{s_{i}}$ such that $a\in\overline{\rho}(\varphi_{i})$ and $b\in\overline{\rho[a/\square]}(C_{\sigma,i}[\square])$, and $a^{\prime}\in\overline{\rho}(\varphi_{i}^{\prime})$ and $b\in\overline{\rho[a^{\prime}/\square]}(C_{\sigma,i}[\square])$. Let $x,y\in\textit{Var}_{s_{i}}$ be two distinct variables that do not occur in $C_{\sigma,i}[\square]$ and let $\rho^{\prime}$ be the valuation $\rho[a/x][a^{\prime}/y]$. Then we have $b\in\overline{\rho^{\prime}}(C_{\sigma,i}[x])$ and $b\in\overline{\rho^{\prime}}(C_{\sigma,i}[y])$, that is, $b\in\overline{\rho^{\prime}}(C_{\sigma,i}[x]\wedge C_{\sigma,i}[y])$. The injectivity hypothesis then implies $b\in\overline{\rho^{\prime}}(C_{\sigma,i}[x\wedge y])$. Therefore, $\overline{\rho^{\prime}}(x\wedge y)$ is non-empty, that is, $\{a\}\cap\{a^{\prime}\}$ is non-empty, that is, $a=a^{\prime}$. Since $a\in\overline{\rho}(\varphi_{i})$ and $a^{\prime}\in\overline{\rho}(\varphi_{i}^{\prime})$, it follows that $a\in\overline{\rho}(\varphi_{i}\wedge\varphi_{i}^{\prime})$. Since $b\in\overline{\rho[a/\square]}(C_{\sigma,i}[\square])$, it follows that $b\in\overline{\rho}(C_{\sigma,i}[\varphi_{i}\wedge\varphi_{i}^{\prime}])$.

For the second, let $b\in\overline{\rho}(\forall x\,.\,C_{\sigma,i}[\varphi_{i}])$, that is, $b\in\overline{\rho[v/x]}(C_{\sigma,i}[\varphi_{i}])$ for all $v\in M_{{\it sort}(x)}$, that is, for any $v\in M_{{\it sort}(x)}$ there is some $a_{v}\in\overline{\rho[v/x]}(\varphi_{i})$ such that $b\in\overline{\rho[a_{v}/\square]}(C_{\sigma,i}[\square])$ (because $x\not\in{\it FV}(C_{\sigma,i}[\square])$, so $\overline{\rho[v/x][a_{v}/\square]}(C_{\sigma,i}[\square])=\overline{\rho[a_{v}/\square]}(C_{\sigma,i}[\square])$). The injectivity of $C_{\sigma,i}[\square]$ implies that all such $a_{v}$ elements are equal. Indeed, let $v,v^{\prime}\in M_{{\it sort}(x)}$ and $a_{v}\in\overline{\rho[v/x]}(\varphi_{i})$ and $a_{v^{\prime}}\in\overline{\rho[v^{\prime}/x]}(\varphi_{i})$ such that $b\in\overline{\rho[a_{v}/\square]}(C_{\sigma,i}[\square])$ and $b\in\overline{\rho[a_{v^{\prime}}/\square]}(C_{\sigma,i}[\square])$. Let $z,y\in\textit{Var}_{s_{i}}$ be two distinct variables that do not occur in $C_{\sigma,i}[\square]$, like in the Definition 2.4 of injectivity (but with $z$ instead of $x$ to avoid name collision), and note that the above implies $b\in\overline{\rho[a_{v}/z][a_{v^{\prime}}/y]}(C_{\sigma,i}[z]\wedge C_{\sigma,i}[y])$. Then Definition 2.4 implies $b\in\overline{\rho[a_{v}/z][a_{v^{\prime}}/y]}(C_{\sigma,i}[z\wedge y])$. Therefore $\overline{\rho[a_{v}/z][a_{v^{\prime}}/y]}(z\wedge y)\neq\emptyset$, that is, $a_{v}=a_{v^{\prime}}$. Since all the elements $a_{v}\in\overline{\rho[v/x]}(\varphi_{i})$ for all $v\in M_{{\it sort}(x)}$ are equal, it follows that there is some element $a\in\overline{\rho}(\forall x\,.\,\varphi_{i})$ such that $a_{v}=a$ for all $a_{v}$ as above. Moreover, $b\in\overline{\rho[a/\square]}(C_{\sigma,i}[\square])$, that is, $b\in\overline{\rho}(C_{\sigma,i}[\forall x\,.\,\varphi_{i}])$.

The notion of context injectivity in Definition 2.4 is the weakest theoretical condition we were able to find in order for the (bidirectional) distributivity of conjunction and universal quantification to hold. In practice, stronger conditions are met. For example, Section 5.7 discusses constructors, which are symbols whose interpretations are injective in all their arguments at the same time (i.e., $\sigma_{M}(a_{1},...,a_{n})\cap\sigma_{M}(a_{1}^{\prime},...,a_{n}^{\prime})\neq\emptyset$ implies $a_{1}=a_{1}^{\prime}$, …, $a_{n}=a_{n}^{\prime}$). Contexts corresponding to constructors are injective in the sense of Definition 2.4.

We next demonstrate the usefulness of matching logic by a series of other examples.

3. Instance: Propositional Calculus

In Section 2, (1) in Proposition 2, we showed that propositional reasoning is sound for matching logic. Here we go one step further and show that we can can instantiate matching logic to become precisely propositional calculus, without any translation needed in any direction. The idea is to add a special sort for propositions, say Prop, then to use the already existing syntax of matching logic to build propositions as we know them, and then to show that the existing semantics of matching logic, given by $\models$, yields the expected semantics of propositions as we know it in propositional calculus (let us refer to it as $\models_{\textit{Prop}}$).

We build a matching logic signature as follows: $S$ contains only one sort, Prop, and $\Sigma$ is empty. Let us also drop the existential quantifier, so that the resulting syntax of patterns becomes exactly that of propositional calculus:

[TABLE]

Then the default matching logic semantics endows the resulting syntax of propositions with the desired propositional calculus semantics:

Proposition 6**.**

For any proposition $\varphi$, the following holds: $\models_{\it Prop}\varphi$ iff $\models\varphi$.

Proof 3.1**.**

The implication “$\models_{\it Prop}\varphi$ implies $\models\varphi$” follows by (1) in Proposition 2. For the other implication, let us suppose that $\models\varphi$ and let $\theta:\textit{Var}_{\textit{Prop}}\rightarrow\{{\it true},{\it false}\}$ be an arbitrary propositional valuation (it is often called a “model” in the literature, but we refrain from using that terminology to avoid confusion with our notion of model). All we have to do is show that $\theta(\varphi)={\it true}$. Let $M$ be the matching logic model with $M_{\textit{Prop}}=\{{\it true},{\it false}\}$ and let $\rho_{\theta}:\textit{Var}\rightarrow M$ be the matching logic valuation where $\rho_{\theta}(x)=\theta(x)$ for each $x\in\textit{Var}_{\textit{Prop}}$.

Note that, unlike in propositional calculus where propositions $\psi$ evaluate to precisely one of ${\it true}$ or ${\it false}$ for any given valuation $\theta$, in matching logic $\overline{\rho_{\theta}}(\psi)$ can be any of the four subsets of $\{{\it true},{\it false}\}$. For example, if $x$ and $y$ are variables such that $\theta(x)={\it true}$ and $\theta(y)={\it false}$, then $\overline{\rho_{\theta}}(x)=\{{\it true}\}$, $\overline{\rho_{\theta}}(y)=\{{\it false}\}$, $\overline{\rho_{\theta}}(\neg x)=\{{\it false}\}$, $\overline{\rho_{\theta}}(\neg y)=\{{\it true}\}$, $\overline{\rho_{\theta}}(x\wedge y)=\emptyset$, $\overline{\rho_{\theta}}(x\vee y)=\{{\it true},{\it false}\}$. Nevertheless, we can inductively show that the propositional validity of a proposition $\psi$ is dictated by the membership of ${\it true}$ to its matching logic evaluation as a set: $\theta(\psi)={\it true}$ iff ${\it true}\in\overline{\rho_{\theta}}(\psi)$. Indeed: if $\psi$ is a variable $x$ then $\overline{\rho_{\theta}}(x)=\{\theta(x)\}$, so the property holds; if $\psi$ is $\neg\psi^{\prime}$ then $\overline{\rho_{\theta}}(\neg\psi^{\prime})=\{{\it true},{\it false}\}\backslash\overline{\rho_{\theta}}(\psi^{\prime})$, so ${\it true}\in\overline{\rho_{\theta}}(\neg\psi^{\prime})$ iff ${\it true}\not\in\overline{\rho_{\theta}}(\psi^{\prime})$, iff (by the induction hypothesis) $\theta(\psi^{\prime})\not={\it true}$, iff (by the two-valued semantics of propositional calculus) $\theta(\neg\psi^{\prime})={\it true}$; finally, if $\psi$ is $\psi_{1}\wedge\psi_{2}$ then ${\it true}\in\overline{\rho_{\theta}}(\psi_{1}\wedge\psi_{2})$ iff ${\it true}\in\overline{\rho_{\theta}}(\psi_{1})$ and ${\it true}\in\overline{\rho_{\theta}}(\psi_{2})$, iff (by the induction hypothesis) $\theta(\psi_{1})={\it true}$ and $\theta(\psi_{2})={\it true}$, iff $\theta(\psi_{1}\wedge\psi_{2})={\it true}$.

Now $\models\varphi$ implies $\overline{\rho_{\theta}}(\varphi)=\{{\it true},{\it false}\}$, so ${\it true}\in\overline{\rho_{\theta}}(\varphi)$. By the result proved inductively above we conclude that $\theta(\varphi)={\it true}$.

An alternative way to capture propositional logic is to add a constant symbol (i.e., a symbol without any arguments) to $\Sigma$ for each propositional variable, like we do for modal logic in Section 8. This is similar to how predicate logic captures propositional calculus, namely by associating a predicate without arguments to each propositional variable. We leave the details as an exercise to the interested reader.

4. Instance: (Pure) Predicate Logic

Recall from Section 2, Proposition 2 and the discussion preceding it, that by pure predicate logic in this paper we mean predicate logic or first-order logic (FOL) with only predicate symbols (no function and no constant symbols). Note that some works call the fragment of FOL with only constant (i.e., zero-argument function) symbols “predicate logic”, others use “predicate logic” as a synonym for FOL. We do not discuss the fragment of FOL with only constant symbols in this paper, so from here on we take the liberty to refer to “pure predicate logic” as just “predicate logic”. Proposition 2 showed that predicate logic reasoning is sound for matching logic. Similarly to propositional calculus in Section 3, here we go one step further and show that we can can instantiate matching logic to become precisely predicate logic; the FOL case will be discussed in Section 7. We follow the same approach like for propositional calculus: add a special sort for predicates, say Pred, then use the already existing syntax of matching logic to build formulae as we know them in predicate logic, and then show that the existing semantics of matching logic, given by $\models$, yields the expected semantics of pure predicate logic. We let $\models_{\it PL}$ denote the predicate logic satisfaction.

Recall that predicate logic is the fragment of first-order logic with just predicate symbols, that is, with no function (including no constant) and no equality symbols. We consider only the many-sorted case here. Formally, if $S$ is a sort set and $\Pi$ is a set of predicate symbols, the syntax of pure predicate logic formulae is

[TABLE]

Without loss of generality, suppose that we can pick a fresh sort name, Pred; that is, $\textit{Pred}\not\in S$. Let us now construct the matching logic signature $(S\mathrel{\cup}\{{\textit{Pred}}\},\Sigma)$, where $\Sigma_{s_{1}\ldots s_{n},{\textit{Pred}}}=\Pi_{s_{1}\ldots s_{n}}$ are the only symbols in $\Sigma$; that is, $\Sigma$ contains precisely the predicate symbols of the predicate logic signature, but regarded as pattern symbols of result sort Pred. Suppose also that we disallow any variables of sort Pred in patterns. Then the matching logic patterns of sort Pred are precisely the predicate logic formulae, without any translation in any direction. Moreover, the following result shows that the default matching logic semantics endows these patterns with their desired predicate logic semantics:

Proposition 7**.**

For any predicate logic formula $\varphi$, the following holds: $\models_{\it PL}\varphi$ iff $\models\varphi$.

Proof 4.1**.**

That $\models_{\it PL}\varphi$ implies $\models\varphi$ follows by Proposition 2: each of the proof rules of the complete proof system of (pure) predicate logic [38] is sound for matching logic. For the other implication, note that we can associate to any predicate logic model $M^{\it PL}=(\{M_{s}^{\it PL}\}_{s\in S},\{\pi_{M^{\it PL}}\}_{\pi\in\Pi})$ a matching logic model $M^{\it ML}=(\{M_{s}^{\it ML}\}_{s\in S\cup\{\textit{Pred}\}},\{\pi_{M^{\it ML}}\}_{\pi\in\Sigma})$, where $M^{\it ML}_{s}=M^{\it PL}_{s}$ for all $s\in S$ and $M_{\textit{Pred}}^{\it ML}=\{\star\}$ (with $\star$ some arbitrary but fixed element) and $\pi_{M^{\it ML}}(a_{1},\ldots,a_{n})=\{\star\}$ iff $\pi_{M^{\it PL}}(a_{1},\ldots,a_{n})$ holds, and $\pi_{M^{\it ML}}(a_{1},\ldots,a_{n})=\emptyset$ otherwise. Furthermore, we can show that for any PL formula $\varphi$, we have $M^{\it PL}\models_{\it PL}\varphi$ iff $M^{\it ML}\models_{\it ML}\varphi$. Since $\varphi$ does not contain any variables of sort Pred, by (1) in Proposition 1 it suffices to show that for any $\rho:\textit{Var}\rightarrow M^{\it PL}$, it is the case that $M^{\it PL},\rho\models_{\it PL}\varphi$ iff $\overline{\rho}(\varphi)=\{\star\}$. We can easily show this property by structural induction on $\varphi$. The only relatively non-trivial case is the complement construct, which shows why it was important for $M_{\textit{Pred}}^{\it ML}$ to contain precisely one element: $M^{\it PL},\rho\models_{\it PL}\neg\varphi$ iff $M^{\it PL},\rho\not\models_{\it PL}\varphi$ iff (by the induction hypothesis) $\overline{\rho}(\varphi)\neq\{\star\}$ iff $\overline{\rho}(\varphi)=\emptyset$ iff $\overline{\rho}(\neg\varphi)=\{\star\}$.

Therefore, $M^{\it PL}\models_{\it PL}\varphi$ iff $M^{\it ML}\models_{\it ML}\varphi$. Since the predicate logic model $M^{\it PL}$ was chosen arbitrarily, it follows that $\models\varphi$ implies $\models_{\it PL}\varphi$.

5. Matching Logic: Useful Symbols and Notations

Here we show how to define, in matching logic, several mathematical instruments of practical importance, such as equality, membership, and functions. We also introduce appropriate notations for them, because they will be used frequently and tacitly in the rest of the paper.

The role of this section is twofold. On the one hand, it illustrates the expressiveness of matching logic. Indeed, we can define all the crucial mathematical notions above as matching logic specifications or as syntactic sugar, without any changes to the matching logic itself (recall, for example, that equality cannot be defined in first-order logics; the logic itself needs to be modified into “first-order logic with equality”—more details in Section 5.2). On the other hand, it shows that despite the apparently non-conventional interpretation of patterns as sets of values in matching logic, the conventional mathematical machinery used to reason about program states is still available, with its expected meaning.

Unless otherwise mentioned, for the rest of this section we assume an arbitrary but fixed matching logic specification $(S,\Sigma,F)$.

5.1. Definedness and Totality

In classical logics, the interpretation of a formula under a given valuation is either true or false, and there is only one syntactic category for formulae while multiple syntactic categories for data. In contrast, matching logic patterns are interpreted as sets of values, those that match them, where the total set corresponds to the intution of “true”, or $\top$, and the empty set corresponds to “false”, or $\bot$. Also, each matching logic syntactic category, or sort, admits both data constructs and its own logical connectives and quantifiers. These leave two questions open:

1. (1)

How can we interpret patterns in a conventional, two-valued way? Are the patterns matched by proper (i.e., neither total nor empty) subsets of elements true, or false? 2. (2)

How can we lift reasoning within syntactic category $s_{1}$ to syntactic category $s_{2}$?

These questions are particularly important when attempting to combine matching logic reasoning with classical reasoning or provers for existing mathematical domains.

It turns out that the above can be methodologically achieved by adding some symbols and defining patterns for them to the matching logic specification $(S,\Sigma,F)$. Specifically, for any pair of sorts of interest $s_{1},s_{2}\in S$, which need not be distinct, we can add a symbol $\lceil\_\rceil_{s_{1}}^{s_{2}}$ to $\Sigma_{s_{1},s_{2}}$ and an axiom pattern to $F$ that makes $\lceil\_\rceil_{s_{1}}^{s_{2}}$ behave like a definedness predicate for any pattern of sort $s_{1}$, with two-valued result of sort $s_{2}$: $\lceil\varphi\rceil_{s_{1}}^{s_{2}}$ is either $\bot_{s_{2}}$ when $\varphi$ is $\bot_{s_{1}}$, or $\top_{s_{2}}$ otherwise (i.e., if $\varphi$ is matched by some values of sort $s_{1}$). The pattern that we can add to $F$ in order to achieve the above is in fact unexpectedly simple: $\lceil x\!:\!s_{1}\rceil_{s_{1}}^{s_{2}}$.

Although we do not need it for many of the subsequent results, to simplify the overall presentation of the rest of the paper, from here on we tacitly work under the following:

{asm}

For any (not necessarily distinct) sorts $s_{1},s_{2}\in S$, assume the following:

[TABLE]

We call the symbols $\lceil\_\rceil_{s_{1}}^{s_{2}}$ definedness symbols.

We next show that the definedness symbol indeed has the expected meaning:

Proposition 8**.**

If $\varphi\in\textsc{Pattern}_{s_{1}}$ then $\lceil\varphi\rceil_{s_{1}}^{s_{2}}$ is a predicate (Definition 2.2). Specifically, if $\rho:\textit{Var}\rightarrow M$ is any valuation then $\overline{\rho}(\lceil\varphi\rceil_{s_{1}}^{s_{2}})$ is either $\emptyset$ (i.e., $\overline{\rho}(\bot_{s_{2}})$) when $\overline{\rho}(\varphi)=\emptyset$ (i.e., $\varphi$ undefined in $\rho$), or is $M_{s_{2}}$ (i.e., $\overline{\rho}(\top_{s_{2}})$) when $\overline{\rho}(\varphi)\neq\emptyset$ (i.e., $\varphi$ defined).

Proof 5.1**.**

By Definition 2.3, $\overline{\rho}(\lceil\varphi\rceil_{s_{1}}^{s_{2}})=(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi))$. The definedness pattern axiom states that $\lceil x:s_{1}\rceil_{s_{1}}^{s_{2}}$ is valid (Assumption 5.1), which implies $(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(m_{1})=M_{s_{2}}$ for all $m_{1}\in M_{s_{1}}$, so if there is any $m_{1}\in\overline{\rho}(\varphi)$ then $(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi))$ can only be $M_{s_{2}}$. On the other hand, if $\overline{\rho}(\varphi)=\emptyset$ then $(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi))=\emptyset$.

{nota}

We also define totality, $\lfloor\_\rfloor_{s_{1}}^{s_{2}}$, as a derived construct dual to definedness:

[TABLE]

The totality construct states that the enclosed pattern must be matched by all values:

Proposition 9**.**

If $\varphi\in\textsc{Pattern}_{s_{1}}$ then $\lfloor\varphi\rfloor_{s_{1}}^{s_{2}}$ is a predicate (Definition 2.2). Specifically, if $\rho:\textit{Var}\rightarrow M$ is any valuation then $\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{2}})$ is either $\emptyset$ (i.e., $\overline{\rho}(\bot_{s_{2}})$) when $\overline{\rho}(\varphi)\neq M_{s_{1}}$ (i.e., $\varphi$ not total in $\rho$), or is $M_{s_{2}}$ (i.e., $\overline{\rho}(\top_{s_{2}})$) when $\overline{\rho}(\varphi)=M_{s_{1}}$ (i.e., $\varphi$ total).

Proof 5.2**.**

$\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{2}})=\overline{\rho}(\neg\lceil\neg\varphi\rceil_{s_{1}}^{s_{2}})=M_{s_{2}}\backslash\overline{\rho}(\lceil\neg\varphi\rceil_{s_{1}}^{s_{2}})$. So $\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{2}})=\emptyset$ iff $\overline{\rho}(\lceil\neg\varphi\rceil_{s_{1}}^{s_{2}})=M_{s_{2}}$ iff $\overline{\rho}(\neg\varphi)\neq\emptyset$ (by Proposition 8) iff $\overline{\rho}(\varphi)\neq M_{s_{1}}$. Similarly, $\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{2}})=M_{s_{2}}$ iff $\overline{\rho}(\lceil\neg\varphi\rceil_{s_{1}}^{s_{2}})=\emptyset$ iff $\overline{\rho}(\neg\varphi)=\emptyset$ (by Proposition 8) iff $\overline{\rho}(\varphi)=M_{s_{1}}$.

Totality is useful, for example, to define pattern equality as the totality of the pattern equivalence relation; this is discussed in depth shortly (Section 5.2). It is also useful when there is a need to restrict a pattern context, say $\varphi$ of sort $s_{2}$, to only instances where pattern $\varphi_{1}$ of sort $s_{1}$ implies pattern $\varphi_{2}$ of sort $s_{1}$: $\varphi\wedge\lfloor\varphi_{1}\rightarrow\varphi_{2}\rfloor_{s_{1}}^{s_{2}}$. Indeed, $\overline{\rho}(\varphi\wedge\lfloor\varphi_{1}\rightarrow\varphi_{2}\rfloor_{s_{1}}^{s_{2}})$ is $\overline{\rho}(\varphi)$ iff $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$, and it is $\emptyset$ otherwise. For example, $\exists x\,.\,x\wedge\lfloor\varphi_{1}\rightarrow\varphi_{2}\rfloor_{s_{1}}^{s_{2}}$ defines the set of all values of $x$ with the property that if they match $\varphi_{1}$ then they also match $\varphi_{2}$. A concrete instance of this is the definition of “magic wand” in separation logic (Section 9).

The totality constructs satisfy, in a more general sorted setting, some of the basic properties of modal logic operators, such as (N), (K), (M) and (5) [7, 56, 44]:

Corollary 10**.**

If $s_{1},s_{2}\in S$ and $\varphi$, $\varphi_{1}$ and $\varphi_{2}$ are patterns of sort $s_{1}$, then:

• (N)

If $\models\varphi$ then $\models\lfloor\varphi\rfloor_{s_{1}}^{s_{2}}$

• (K)

$\models\lfloor\varphi_{1}\rightarrow\varphi_{2}\rfloor_{s_{1}}^{s_{2}}\rightarrow(\lfloor\varphi_{1}\rfloor_{s_{1}}^{s_{2}}\rightarrow\lfloor\varphi_{2}\rfloor_{s_{1}}^{s_{2}})$**

• (M)

$\models\lfloor\varphi\rfloor_{s_{1}}^{s_{1}}\rightarrow\varphi$**

• (5)

$\models\lceil\varphi\rceil_{s_{1}}^{s_{2}}\rightarrow\lfloor\lceil\varphi\rceil_{s_{1}}^{s_{2}}\rfloor_{s_{2}}^{s_{2}}$**

Proof 5.3**.**

The (N) property is an immediate corollary of Proposition 9. For the (K) property, let $M$ be a model and $\rho:\textit{Var}\rightarrow M$ a valuation. By Proposition 9 and the discussion in the paragraph following it, $\overline{\rho}(\lfloor\varphi_{1}\rightarrow\varphi_{2}\rfloor_{s_{1}}^{s_{2}})$ is either $\emptyset$ or $M_{s_{2}}$, the latter happening iff $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$. The first case makes our property vacuously hold. In the second case, we have to show that $\overline{\rho}(\lfloor\varphi_{1}\rfloor_{s_{1}}^{s_{2}}\rightarrow\lfloor\varphi_{2}\rfloor_{s_{1}}^{s_{2}})=M_{s_{2}}$, that is, that $\overline{\rho}(\lfloor\varphi_{1}\rfloor_{s_{1}}^{s_{2}})\subseteq\overline{\rho}(\lfloor\varphi_{2}\rfloor_{s_{1}}^{s_{2}})$, which follows by Proposition 9 from $\overline{\rho}(\varphi_{1})\subseteq\overline{\rho}(\varphi_{2})$. To show (M), we have to show $\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{1}})\subseteq\overline{\rho}(\varphi)$ for any $\rho:\textit{Var}\rightarrow M$. By Proposition 9, we only need to consider the case where $\overline{\rho}(\lfloor\varphi\rfloor_{s_{1}}^{s_{1}})=M_{s_{1}}$; but this can only happen when $\overline{\rho}(\varphi)=M_{s_{1}}$, so the property holds. For (5), let $\rho:\textit{Var}\rightarrow M$ be such that $\overline{\rho}(\lceil\varphi\rceil_{s_{1}}^{s_{2}})=M_{s_{2}}$ (by Proposition 8, the only other case is $\overline{\rho}(\lceil\varphi\rceil_{s_{1}}^{s_{2}})=\emptyset$, so the property holds vacuously for that case). Then by Proposition 9 it follows that $\overline{\rho}(\lfloor\lceil\varphi\rceil_{s_{1}}^{s_{2}}\rfloor_{s_{2}}^{s_{2}})=M_{s_{2}}$, so $\overline{\rho}(\lceil\varphi\rceil_{s_{1}}^{s_{2}})\subseteq\overline{\rho}(\lfloor\lceil\varphi\rceil_{s_{1}}^{s_{2}}\rfloor_{s_{2}}^{s_{2}})$.

In Section 8 we show that the modal logic S5 is equivalent to a matching logic specification, where the definedness and totality constructs play the role of the $\Diamond$ and $\Box$ modalities.

{nota}

Since $s_{1}$ and $s_{2}$ can usually be inferred from context, we write $\lceil\_\rceil$ or $\lfloor\_\rfloor$ instead of $\lceil\_\rceil_{s_{1}}^{s_{2}}$ or $\lfloor\_\rfloor_{s_{1}}^{s_{2}}$, respectively. If the sort decorations cannot be inferred from context, then we assume the stated property/axiom/rule holds for all such sorts.

For example, the generic pattern axiom “$\lceil x\rceil$ where $x\in\textit{Var}$” replaces all the axioms $\lceil x\!:\!s_{1}\rceil_{s_{1}}^{s_{2}}$ above for all the definedness symbols for all the sorts $s_{1}$ and $s_{2}$.

{nota}

If $\varphi$ is a predicate (Definition 2.2, then we write $[\varphi]$ instead of $\lceil\varphi\rceil$ or $\lfloor\varphi\rfloor$. This notation is justified, because if $\varphi$ is a predicate then $\models\lceil\varphi\rceil\leftrightarrow\lfloor\varphi\rfloor$.

As Proposition 13 will shortly show, if $\varphi$ is a predicate, then by “wrapping” it with square brackets, as $[\varphi]$, we can propagate it through the configuration symbols and conjunctive constraints to wherever it is needed, to facilitate local reasoning.

5.2. Equality

Here we show that, unlike in predicate logic or FOL, equality can be defined in matching logic. Before that, let us recall why equality cannot be defined in FOL. We only give a short intuitive explanation here; the interested reader is referred to authoritative FOL textbooks for full details, e.g., [55, 47]. Suppose that equality were definable in FOL, that is, that there existed some FOL specification in which a formula $\textit{Eq}(x,y)$ could only be interpreted as equality in models. Then we could use such a formula to state that all models have singleton carriers: $\forall x.\forall y\,.\,\textit{Eq}(x,y)$. However, FOL is not expressive enough to define models of fixed carrier size. In FOL, if a specification admits a model of non-empty carrier $A$ then it also admits a model whose carrier is $A\cup\{b\}$, where $b$ is some element that is not already in $A$. Indeed, pick some arbitrary element $a\in A$ and extend all the operations and predicates in the model to behave on $b$ exactly the same as on $a$. Since the operation and predicate interpretations cannot distinguish between $a$ and $b$, the model of carrier $A$ and the model of carrier $A\cup\{b\}$ satisfy exactly the same formulae. In particular, no FOL specification can admit only models of singleton carrier. One can define equivalence and congruence relations, but not actual equality. Since precise equality is sometimes desirable, extensions of FOL with equality have been proposed [55, 47], where a special binary predicate “$=$” is added to the logic together with axioms like equality introduction “$t=t$” and elimination “$(t_{1}=t_{2})\mathrel{\wedge}\varphi[t_{1}/x]\rightarrow\varphi[t_{2}/x]$”, and interpreted as the equality/identity relation in models.

Let us first discuss why we cannot use $\leftrightarrow$ as equality in matching logic. Indeed, since ${M}\models\varphi_{1}\leftrightarrow\varphi_{2}$ iff $\overline{\rho}(\varphi_{1})=\overline{\rho}(\varphi_{2})$ for all $\rho:\textit{Var}\rightarrow M$, one may be tempted to use $\leftrightarrow$ as equality. E.g., given a signature with one sort and one unary symbol $f$, one may think that the pattern $\exists y\,.\,f(x)\leftrightarrow y$ defines precisely the models where $f$ is a function (because a function evaluates to only one value for any given argument, and the interpretation of variable pattern $y$ has precisely one value). Unfortunately, that is not true. Consider model $M$ with $M=\{1,2\}$ and $f_{M}$ the non-functional relation $f_{M}(1)=\{1,2\}$, $f_{M}(2)=\emptyset$. Let $\rho:\textit{Var}\rightarrow M$ be any $M$-valuation; recall (Definition 2.3) that $\rho$’s extension $\overline{\rho}$ to patterns interprets “$\exists$” as union and “$\leftrightarrow$” as the complement of the symmetric difference. If $\rho(x)=1$ then $\overline{\rho}(\exists y\,.\,f(x)\leftrightarrow y)=(M\backslash(\{1,2\}\Delta\{1\}))\cup(M\backslash(\{1,2\}\Delta\{2\}))=\{1,2\}=M$. If $\rho(x)=2$ then $\overline{\rho}(\exists y\,.\,f(x)\leftrightarrow y)=(M\backslash(\emptyset\Delta\{1\}))\cup(M\backslash(\emptyset\Delta\{2\}))=\{1,2\}=M$. Hence, ${M}\models\exists y\,.\,f(x)\leftrightarrow y$, yet $f_{M}$ is not a function, so $\leftrightarrow$ fails to capture the pattern equality.

The problem above is that the interpretation of $\varphi_{1}\leftrightarrow\varphi_{2}$, depicted in Figure 4, is not two-valued ($\top$ or $\bot$), as we are used to think in classical logics. Specifically, $\overline{\rho}(\varphi_{1})\neq\overline{\rho}(\varphi_{2})$ does not suffice for $\overline{\rho}(\varphi_{1}\leftrightarrow\varphi_{2})=\emptyset$ to hold. Indeed, $\overline{\rho}(\varphi_{1}\leftrightarrow\varphi_{2})=M\ \backslash\ (\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))$ and there is nothing to prevent, e.g., $\overline{\rho}(\varphi_{1})\cap\overline{\rho}(\varphi_{2})\neq\emptyset$, in which case $\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2})\neq M$. What we would like is a proper equality over patterns, $\varphi_{1}=\varphi_{2}$, which behaves as a two-valued predicate: $\overline{\rho}(\varphi_{1}=\varphi_{2})=\emptyset$ when $\overline{\rho}(\varphi_{1})\neq\overline{\rho}(\varphi_{2})$, and $\overline{\rho}(\varphi_{1}=\varphi_{2})=M$ when $\overline{\rho}(\varphi_{1})=\overline{\rho}(\varphi_{2})$. Moreover, we want equalities to be used with patterns of any sort $s_{1}$ and in contexts of any sort $s_{2}$, similarly to the definedness and totality constructs in Section 5.1.

Equality can be defined quite compactly using the pattern totality and equivalence constructs, which were themselves defined using the assumed definedness symbols (Assumption 5.1, Section 5.1) and, respectively, the core $\wedge$ and $\neg$ constructs (Section 2). Specifically,

{nota}

For each pair of sorts $s_{1}$ (for the compared patterns) and $s_{2}$ (for the context in which the equality is used), we define $\_=_{s_{1}}^{s_{2}}\_$ as the following derived construct:

[TABLE]

Intuitively, $\varphi\leftrightarrow\varphi^{\prime}$ matches the grey area in the diagram depicting pattern equivalence in Figure 4 (complement of the symmetric difference), so $\lfloor\varphi\leftrightarrow\varphi^{\prime}\rfloor_{s_{1}}^{s_{2}}$ is interpreted as $M_{s_{2}}$ iff the white area is empty, iff the two patterns match exactly the same elements. Formally,

Proposition 11**.**

Let $\varphi,\varphi^{\prime}\in\textsc{Pattern}_{s_{1}}$. Then:

1. (1)

$\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})=\emptyset$* iff $\overline{\rho}(\varphi)\neq\overline{\rho}(\varphi^{\prime})$, for any $\rho:\textit{Var}\rightarrow M$* 2. (2)

$\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})=M_{s_{2}}$* iff $\overline{\rho}(\varphi)=\overline{\rho}(\varphi^{\prime})$, for any $\rho:\textit{Var}\rightarrow M$* 3. (3)

${M}\models\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$* iff ${M}\models\varphi\leftrightarrow\varphi^{\prime}$, for any model $M$* 4. (4)

$\models\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$* iff $\models\varphi\leftrightarrow\varphi^{\prime}$*

Proof 5.4**.**

Recall that $\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$ stands for $\lfloor\varphi\leftrightarrow\varphi^{\prime}\rfloor_{s_{1}}^{s_{2}}$, which stands for $\neg\lceil\neg(\varphi\leftrightarrow\varphi^{\prime})\rceil_{s_{1}}^{s_{2}}$.

1. (1)

Therefore, $\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})$ is equal to $M_{s_{2}}\ \backslash\ (\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(M_{s_{1}}\ \backslash\ (M_{s_{1}}\ \backslash\ (\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))))$, which is further equal to $M_{s_{2}}\ \backslash\ (\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))$. So $\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})=\emptyset$ iff $(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))=M_{s_{2}}$, iff $\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2})\neq\emptyset$, iff $\overline{\rho}(\varphi)\neq\overline{\rho}(\varphi^{\prime})$. 2. (2)

Similarly to the above, we have $\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})=M_{s_{2}}$ iff $(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2}))=\emptyset$, iff $\overline{\rho}(\varphi_{1})\ \Delta\ \overline{\rho}(\varphi_{2})=\emptyset$, iff $\overline{\rho}(\varphi)=\overline{\rho}(\varphi^{\prime})$. 3. (3)

$M\models\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$* iff $\overline{\rho}(\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime})=M_{s_{2}}$ for any $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi)=\overline{\rho}(\varphi^{\prime})$ for any $\rho:\textit{Var}\rightarrow M$, iff (by Proposition 1) $M\models\varphi\leftrightarrow\varphi^{\prime}$.* 4. (4)

$\models\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$* iff $M\models\varphi=_{s_{1}}^{s_{2}}\varphi^{\prime}$ for any model $M$, iff (by the above) $M\models\varphi\leftrightarrow\varphi^{\prime}$ for any model $M$, iff $\models\varphi\leftrightarrow\varphi^{\prime}$.*

Therefore, pattern equality satisfies all these properties.

Note that (4) in the proposition above is not in conflict with the discussion at the beginning of this section concluding that we cannot use equivalence instead of equality. The example there illustrated an equivalence which was nested under a quantifier ($\exists y\,.\,f(x)\leftrightarrow y$), while (4) above says that equivalence and equality are interchangeable at the pattern top.

Like for definedness and totality (Section 5.1), where we decided to drop the sorts $s_{1}$ and $s_{2}$ from $\lceil\_\rceil_{s_{1}}^{s_{2}}$ and instead write $\lceil\_\rceil$ because the sort of the enclosed pattern and that of the context dictate $s_{1}$ and $s_{2}$, we also take the freedom to drop the sort embellishments of $=_{s_{1}}^{s_{2}}$ and instead write just $=$. Like for definedness and totality, $s_{1}$ and $s_{2}$ can typically be inferred from context, and, if ambiguity arises, then we assume all instances. For example, “$x=x$” means “$x=_{s_{1}}^{s_{2}}x$” for any $s_{1},s_{2}\in S$ and $x\in\textit{Var}_{s_{1}}$. Note that the equality symbol in algebraic specifications and in FOL (with equality) is also implicitly indexed by the sort of the two terms, although that sort is typically not mentioned as subscript; but one needs to exercise more care in matching logic, because equality patterns can be nested now. For example, the pattern in Section 9.2 defining linked list data-structures within maps,

[TABLE]

is a sugared variant of the explicit patterns (one for each “equality context” sort $s$),

[TABLE]

To minimize the number of disambiguation parentheses, we assumed that equality ($=$) binds tighter than conjunction ($\wedge$). We also assume that negation ($\neg$) binds tighter than equality ($=$). To avoid confusion, we may use disambiguation parentheses even if not strictly needed.

Despite the fact that patterns evaluate to any set of values and thus are more general than both terms (which evaluate to only one value) and predicates (which evaluate to one of two values), and despite the fact that Boolean combinations of patterns and quantification yield other patterns which can be used under any symbol in $\Sigma$, as we saw in Proposition 2, the proof rule/axiom schemas of (pure) predicate logic continue to be sound for matching logic. Now that we have equality, a natural question is whether the equality proof rule/axiom schemas of FOL with equality [55, 47] are also sound. For example, in FOL with equality, “equality elimination” states that terms can be substituted with equal terms in any context. A similar result holds for matching logic, where terms are replaced with arbitrary patterns:

Proposition 12**.**

The following hold:

1. (1)

Equality introduction: $\models\varphi=\varphi$ 2. (2)

Equality elimination: $\models(\varphi_{1}=\varphi_{2})\mathrel{\wedge}\varphi[\varphi_{1}/x]\rightarrow\varphi[\varphi_{2}/x]$

Proof 5.5**.**

(1) follows by (4) in Proposition 11 and by Proposition 6. For (2), let $M$ be some model and $\rho:\textit{Var}\rightarrow M$. By Proposition 1, it suffices to show $\overline{\rho}(\varphi_{1}=\varphi_{2})\cap\overline{\rho}(\varphi[\varphi_{1}/x])\subseteq\overline{\rho}(\varphi[\varphi_{2}/x])$. If $\overline{\rho}(\varphi_{1})\neq\overline{\rho}(\varphi_{2})$ then $\overline{\rho}(\varphi_{1}=\varphi_{2})=\emptyset$ by Proposition 11, so the inclusion holds. Now suppose that $\overline{\rho}(\varphi_{1})=\overline{\rho}(\varphi_{2})$, which implies $\overline{\rho}(\varphi_{1}=\varphi_{2})=M$ by Proposition 11, so it suffices to show $\overline{\rho}(\varphi[\varphi_{1}/x])\subseteq\overline{\rho}(\varphi[\varphi_{2}/x])$. The stronger result $\overline{\rho}(\varphi[\varphi_{1}/x])=\overline{\rho}(\varphi[\varphi_{2}/x])$ in fact holds, because the first element is a function of $\overline{\rho}(\varphi_{1})$, the second element is the same function but of $\overline{\rho}(\varphi_{2})$, and $\overline{\rho}(\varphi_{1})=\overline{\rho}(\varphi_{2})$.

{nota}

From here on in the rest of the paper we write $\varphi\neq\varphi^{\prime}$ instead of $\neg(\varphi=\varphi^{\prime})$.

One may wonder what really made it possible to define equality in matching logic, which is not possible in predicate or first-order logic. Let us consider the simplest instance of equality, $x=y$ between two variables, which is sugar for $\neg\lceil\neg(x\leftrightarrow y)\rceil$. After all, definedness-like predicates can also be defined in predicate logic; following the translation in Section 10, for example, the unary matching logic symbols $\lceil\_\rceil$ are associated binary predicates $\pi_{\lceil\_\rceil}$, and the definedness pattern axioms $\lceil x\rceil$ are translated into formula axioms $\pi_{\lceil\_\rceil}(x,r)$. So the definedness symbol is not the key. The key is the capability to allow logical connectives between “terms”, which is not allowed in first-order logic. For example, $x\leftrightarrow y$ already tells us whether $x$ and $y$ are interpreted as the same value or not: for any valuation $\rho$, it is indeed the case that $\overline{\rho}(x\leftrightarrow y)$ is the total set iff $\rho(x)=\rho(y)$ (see Proposition 1).

Equality elimination (Proposition 12) allows us to replace patterns by equal patterns in any context. Further, Proposition 11 allows us to replace any top-level $\leftrightarrow$ with $=$. In particular, the equivalences in Proposition 4 become $\models C_{\sigma,i}[\varphi_{i}\mathbin{\vee}\varphi^{\prime}_{i}]=C_{\sigma,i}[\varphi_{i}]\mathbin{\vee}C_{\sigma,i}[\varphi^{\prime}_{i}]$ and $\models C_{\sigma,i}[\exists x\,.\,\varphi_{i}]=\exists x\,.\,C_{\sigma,i}[\varphi_{i}]$, respectively, meaning that we can propagate disjunction and existential quantification through symbols in any context, not only at the top level. Because of the stronger nature of equality, from here on we state properties in terms of equality instead of $\leftrightarrow$ whenever possible. Below is an important such property:

Proposition 13**.**

(Constraint propagation) Assume the same hypothesis as in Proposition 4: $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $\varphi_{i}\in\textsc{Pattern}_{s_{i}}$ for all $1\leq i\leq n$, a particular $1\leq i\leq n$, and let $C_{\sigma,i}[\square]$ be the context $\sigma(\varphi_{1},\ldots,\varphi_{i-1},\square,\varphi_{i+1},\ldots\varphi_{n})$. Then for any pattern $\varphi$:

1. (1)

$\models C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lceil\varphi\rceil]=C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lceil\varphi\rceil$** 2. (2)

$\models C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lfloor\varphi\rfloor]=C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lfloor\varphi\rfloor$** 3. (3)

$\models C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}[\varphi]]=C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}[\varphi]$* if $\varphi$ is a predicate (Definition 2.2 and Notation 5.1).*

Proof 5.6**.**

We only show (1), because (2) and (3) are similar. Let $\rho:\textit{Var}\rightarrow M$ and let $\overline{\rho}(C_{\sigma,i}):M_{s_{i}}\rightarrow{\mathcal{}P}(M_{s})$ be defined as $\overline{\rho}(C_{\sigma,i})(a)=\sigma_{M}(\overline{\rho}(\varphi_{1}),\ldots,\overline{\rho}(\varphi_{i-1}),a,\overline{\rho}(\varphi_{i+1}),\ldots,\overline{\rho}(\varphi_{n}))$. Then $\overline{\rho}(C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lceil\varphi\rceil])=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i})\cap\overline{\rho}(\lceil\varphi\rceil))$ and $\overline{\rho}(C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lceil\varphi\rceil)=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i}))\cap\overline{\rho}(\lceil\varphi\rceil])$. By Proposition 8, $\overline{\rho}(\lceil\varphi\rceil])$ is either the empty set or the total set, regardless of the result sort context ($s_{i}$ vs. $s$). If the empty set, then $\overline{\rho}(C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lceil\varphi\rceil])=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i})\cap\emptyset)=\emptyset$ and $\overline{\rho}(C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lceil\varphi\rceil)=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i}))\cap\emptyset=\emptyset$. If the total set, then $\overline{\rho}(C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lceil\varphi\rceil])=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i})\cap M_{s_{i}})=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i}))$ and $\overline{\rho}(C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lceil\varphi\rceil)=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i}))\cap M_{s}=\overline{\rho}(C_{\sigma,i})(\overline{\rho}(\varphi_{i}))$. Therefore, $\overline{\rho}(C_{\sigma,i}[\varphi_{i}\mathbin{\wedge}\lceil\varphi\rceil])=\overline{\rho}(C_{\sigma,i}[\varphi_{i}]\mathbin{\wedge}\lceil\varphi\rceil)$.

Constraint propagation allows us to propagate, through symbols, any logical constraints that appear in a conjunctive context. Indeed, as seen in the rest of this section (in particular in Section 5.8) and in Section 7, domain constraints can be expressed as equalities or as FOL predicates, and both of these are instances of matching logic predicates. Recall from Definition 2.2 that (matching logic) predicates are patterns which interpret to either the empty or the total set of their carrier. The definedness symbol applied to a predicate, the square brackets in $[\varphi]$ (Notation 5.1), does not change the semantics of the predicate, but thanks to its polymorphic nature (Notation 5.1) we can syntactically move $\varphi$ from the sort context of the argument pattern ($s_{i}$) of $\sigma$ to the sort context of $\sigma$’s result ($s$).

Proposition 13 (constraint propagation) and Proposition 3 (structural framing) are particularly useful to localize proof efforts, as illustrated in the example in Section 2.2.

5.3. Membership

Since in matching logic a pattern $\varphi$ evaluates to a set of values while a variable (pattern) $x$ evaluates to just a (set containing only one) value, the membership question, “does $x\in\varphi$ hold?”, is natural. As seen later in Section 11, membership in fact plays a key role in proving the completeness of matching logic reasoning. Fortunately, membership can be quite easily defined as a derived construct in matching logic, making use of the definedness symbol (Section 5.1), in a similar way to equality (Section 5.2): {nota}

If $x\in\textit{Var}_{s_{1}}$, $\varphi\in\textsc{Pattern}_{s_{1}}$ and $s_{2}\in S$, then we introduce the notation

[TABLE]

Like for definedness, totality and equality, there is a membership construct for each pair of sorts $s_{1}$ (for variable and pattern) and $s_{2}$ (for context); we take the freedom to omit them.

Proposition 14**.**

With the above, the following hold:

1. (1)

$\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=\emptyset$* iff $\rho(x)\not\in\overline{\rho}(\varphi)$, for any $\rho:\textit{Var}\rightarrow M$* 2. (2)

$\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=M_{s_{2}}$* iff $\rho(x)\in\overline{\rho}(\varphi)$, for any $\rho:\textit{Var}\rightarrow M$* 3. (3)

$\models(x\in_{s_{1}}^{s_{2}}\varphi)=_{s_{2}}^{s_{3}}(x\wedge\varphi=_{s_{1}}^{s_{2}}x)$, for any sort $s_{3}$

Proof 5.7**.**

Recall that $x\in_{s_{1}}^{s_{2}}\varphi$ is $[x\wedge\varphi]_{s_{1}}^{s_{2}}$.

1. (1)

Therefore, we have $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=(\lceil\_\rceil_{s_{1}}^{s_{2}})_{M}(\{\rho(x)\}\cap\overline{\rho}(\varphi))$, so $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=\emptyset$ iff $\{\rho(x)\}\cap\overline{\rho}(\varphi)=\emptyset$, that is, iff $\rho(x)\not\in\overline{\rho}(\varphi)$. 2. (2)

Similarly to above, $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=M_{s_{2}}$ iff $\{\rho(x)\}\cap\overline{\rho}(\varphi)\neq\emptyset$, that is, iff $\rho(x)\in\overline{\rho}(\varphi)$. 3. (3)

Let $M$ be some model and $\rho:\textit{Var}\rightarrow M$. By Proposition 11, the property holds iff we can show $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=\overline{\rho}(x\wedge\varphi=_{s_{1}}^{s_{2}}x)$. Since the membership and equality patterns are predicates (Definition 2.3), and thus they evaluate either to the entire set or to the empty set, the following completes the proof: by (2) we have $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=M_{s_{2}}$ iff $\rho(x)\in\overline{\rho}(\varphi)$, iff $\{\rho(x)\}\cap\overline{\rho}(\varphi)=\{\rho(x)\}$, iff, by (2) in Proposition 11, $\overline{\rho}(x\wedge\varphi=_{s_{1}}^{s_{2}}x)=M_{s_{2}}$; and by (1) we have $\overline{\rho}(x\in_{s_{1}}^{s_{2}}\varphi)=\emptyset$ iff $\rho(x)\not\in\overline{\rho}(\varphi)$, iff $\{\rho(x)\}\cap\overline{\rho}(\varphi)\not=\{\rho(x)\}$, iff, by (1) in Proposition 11, $\overline{\rho}(x\wedge\varphi=_{s_{1}}^{s_{2}}x)=\emptyset$;

Therefore, these basic properties hold.

Property (3) in Proposition 14 suggests that the equality $x\wedge\varphi=x$ can be regarded as an alternative definition of membership $x\in\varphi$, but we prefer $\lceil x\wedge\varphi\rceil$ because is simpler (the other one requires an additional sort, $s_{3}$, for the context of the equality).

Proposition 2 showed that some of the proof rule/axiom schemas of FOL with equality are already sound for matching logic, namely the rules corresponding to (pure) predicate logic. Proposition 12 further showed that the equality-related rules/axioms are also sound. The soundness of several other rule/axiom schemas are shown below, essentially completing the soundness of the matching logic proof system (discussed later in Section 11), except for one rule, Substitution, which needs more discussion and we postpone it to Section 11:

Proposition 15**.**

The following hold:

1. (1)

$\models\forall x\,.\,x\in\varphi$* iff $\models\varphi$* 2. (2)

$\models(x\in y)=(x=y)$* when $x,y\in\textit{Var}$* 3. (3)

$\models(x\in\neg\varphi)=\neg(x\in\varphi)$** 4. (4)

$\models(x\in\varphi_{1}\wedge\varphi_{2})=(x\in\varphi_{1})\wedge(x\in\varphi_{2})$** 5. (5)

$\models(x\in\exists y.\varphi)=\exists y.(x\in\varphi)$, with $x$ and $y$ distinct 6. (6)

$\models x\in\sigma(\varphi_{1},...,\varphi_{i-1},\varphi_{i},\varphi_{i+1},...,\varphi_{n})=\exists y.(y\in\varphi_{i}\mathrel{\wedge}x\in\sigma(\varphi_{1},...,\varphi_{i-1},y,\varphi_{i+1},...,\varphi_{n}))$* *

Proof 5.8**.**

The proofs below make repetitive use of Propositions 11 and  14:

1. (1)

Let $M$ be a model. Then $M\models\forall x\,.\,x\in\varphi$ iff $M\models x\in\varphi$ (Proposition 1), iff $\overline{\rho}(x\in\varphi)=M$ for any $\rho:\textit{Var}\rightarrow M$, iff $\rho(x)\in\overline{\rho}(\varphi)$ for any $\rho:\textit{Var}\rightarrow M$, iff $\overline{\rho}(\varphi)=M$ for any $\rho:\textit{Var}\rightarrow M$, iff $M\models\varphi$. 2. (2)

It suffices to show $\overline{\rho}(x\in y)=M$ iff $\overline{\rho}(x=y)=M$ for any model $M$ and any $\rho:\textit{Var}\rightarrow M$, that is, that $\rho(x)\in\{{\rho}(y)\}$ iff $\rho(x)={\rho}(y)$, which obviously holds. 3. (3)

It suffices to show $\overline{\rho}(x\in\neg\varphi)=M$ iff $\overline{\rho}(x\in\varphi)=\emptyset$ for any model $M$ and any $\rho:\textit{Var}\rightarrow M$, that is, that $\rho(x)\in M\backslash\overline{\rho}(\varphi)$ iff $\rho(x)\not\in\overline{\rho}(\varphi)$, which obviously holds. 4. (4)

It suffices to show $\rho(x)\in\overline{\rho}(\varphi_{1})\cap\overline{\rho}(\varphi_{2})$ iff $\rho(x)\in\overline{\rho}(\varphi_{1})$ and $\rho(x)\in\overline{\rho}(\varphi_{2})$ for any model $M$ and any $\rho:\textit{Var}\rightarrow M$, which obviously holds. 5. (5)

It suffices to show for any model $M$ and any $\rho:\textit{Var}\rightarrow M$, that $\rho(x)\in\bigcup\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}\}$ iff $\bigcup\{\overline{\rho^{\prime}}(x\in\varphi)\mid\rho^{\prime}:\textit{Var}\rightarrow M,\ \rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}\}=M$. It is easy to see that each of the two statements holds iff there exists some $\rho^{\prime}:\textit{Var}\rightarrow M$ with $\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}$ such that $\rho(x)\in\overline{\rho^{\prime}}(\varphi)$. 6. (6)

It suffices to prove for any model $M$ and any valuation $\rho:\textit{Var}\rightarrow M$, that

[TABLE]

iff there exists a $\rho^{\prime}:\textit{Var}\rightarrow M$ with $\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}$ such that $\rho^{\prime}(y)\in\overline{\rho}(\varphi_{i})$ and

[TABLE]

which obviously holds.

The proof is complete.

We next define several common relations using patterns, such as functions.

5.4. Functions

Matching logic makes no distinction between function and predicate symbols, treating all symbols uniformly as pattern symbols which are interpreted relationally. A natural question is whether there is any way, in matching logic, to state that a symbol is to be interpreted as a function in all models. We show a more general result, namely that there is a way to state that any pattern, not only a symbol, has a functional interpretation.

{defi}

Pattern $\varphi$ is functional in a model $M$ iff $|\overline{\rho}(\varphi)|=1$ for any valuation $\rho:\textit{Var}\rightarrow M$. Furthermore, $\varphi$ is functional in $F\subseteq\textsc{Pattern}$, or simply functional when $F$ is understood, iff it is functional in all models $M$ with $M\models F$.

Recall from the preamble of Section 5 that $(S,\Sigma,F)$ was assumed to be an arbitrary but fixed matching logic specification. Therefore $F$ is understood, so we take the freedom to just say “$\varphi$ is functional” instead of “$\varphi$ is functional in $F$”.

The following trivial result relates functional patterns to (total) functions:

Proposition 16**.**

If $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $M$ is a $\Sigma$-model, then pattern $\sigma(x_{1},\ldots,x_{n})$ is functional in $M$ iff $\sigma_{M}:M_{s_{1}}\times\cdots\times M_{s_{n}}\rightarrow M_{s}$ is a total function in $M$, that is, iff $\sigma_{M}(a_{1},...,a_{n})$ contains precisely one element for any elements $a_{1}\in M_{s_{1}}$, …, $a_{n}\in M_{s_{n}}$.

Proof 5.9**.**

Pattern $\sigma(x_{1},\ldots,x_{n})$ is functional in $M$ iff $|\overline{\rho}(\sigma(x_{1},\ldots,x_{n}))|=1$ for any valuation $\rho:\textit{Var}\rightarrow M$ (by Definition 5.4), iff $|\sigma_{M}(a_{1},...,a_{n})|=1$ for any $a_{1}\in M_{s_{1}}$, …, $a_{n}\in M_{s_{n}}$.

The following proposition gives an axiomatic characterization of functional patterns:

Proposition 17**.**

Pattern $\varphi$ is functional in model $M$ iff $M\models\exists y\,.\,(\varphi=y)$, where variable $y$ is chosen so that $y\not\in{\it FV}(\varphi)$. Therefore, $\varphi$ is functional iff $F\models\exists y\,.\,(\varphi=y)$.

Proof 5.10**.**

$\varphi$* is functional in $M$ iff $|\overline{\rho}(\varphi)|=1$ for any $\rho:\textit{Var}\rightarrow M$ (by Definition 5.4), iff for any $\rho:\textit{Var}\rightarrow M$ there is some $a\in M$ such that $\overline{\rho}(\varphi)=\{a\}$, iff for any $\rho:\textit{Var}\rightarrow M$ there is some $\rho^{\prime}:\textit{Var}\rightarrow M$ with $\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{y\}}$ such that $\overline{\rho^{\prime}}(\varphi)=\overline{\rho^{\prime}}(y)$ (by (1) in Proposition 1), iff $M\models\exists y\,.\,(\varphi=y)$ (by Definition 2.3 and Proposition 11).*

Corollary 18**.**

Variables are functional: $\models\exists y\,.\,x=y$ for any variable $x$.

Proof 5.11**.**

Immediate consequence of Definition 5.4 and Proposition 17, because variables are interpreted as singletons: $\overline{\rho}(x)=\{\rho(x)\}$ for any valuation $\rho:\textit{Var}\rightarrow M$.

We have seen in the discussion at the beginning of Section 5.2 that if $f$ is a one-argument symbol, the pattern $\exists y\,.\,f(x)\leftrightarrow y$ is not strong enough to enforce $f(x)$ to be functional. However, thanks to Proposition 17, using equality instead of equivalence works:

Corollary 19**.**

If $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and $M$ is a $\Sigma$-model, then $\sigma_{M}$ is a total function iff $M\models\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$.

Proof 5.12**.**

By Propositions 16 and 17.

Hence, we can state that a symbol $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ is a function in all models by requiring $\sigma(x_{1},\ldots,x_{n})$ to be a functional pattern, which by Proposition 17 is equivalent to stating that the pattern $\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$ holds (i.e., it is entailed by $F$), where $x_{1}$, …, $x_{n}$ are free variables. The simplest way to ensure this is to add this pattern directly to $F$, as an axiom. To avoid manually writing such trivial pattern axioms for lots of symbols which are meant to be interpreted as functions, we adopt the following notation and terminology:

{defi}

For a symbol $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$, the notation

[TABLE]

is syntactic sugar for stating that $F$ contains the pattern $\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$. If $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ is a symbol such that $\sigma:s_{1}\times\cdots\times s_{n}\rightarrow s$, then we call $\sigma$ a function symbol. Patterns built with only function symbols are called term patterns, or simply just terms.

Definition 5.4 is instrumental to capturing algebraic specifications and first-order logic as instances of matching logic; full details are given in Sections 6 and 7.

Corollary 20**.**

Term patterns are functional: $\models\exists y\,.\,t=y$ for any term pattern $t$.

Proof 5.13**.**

Structural induction on term pattern $t$. Obvious when $t$ is a variable. Let $t$ be $\sigma(t_{1},\ldots,t_{n})$ with $\sigma:s_{1}\times\ldots\times s_{n}\rightarrow s$ and $t_{1},\ldots,t_{n}$ term patterns of sorts $s_{1}$, …, $s_{n}$, respectively, and let $\rho:\textit{Var}\rightarrow M$. Then $\overline{\rho}(t)=\sigma_{M}(\overline{\rho}(t_{1}),\ldots,\overline{\rho}(t_{n}))$. By the induction hypothesis, $t_{1},\ldots,t_{n}$ are functional, that is, $\overline{\rho}(t_{1})$, …, $\overline{\rho}(t_{n})$ are singleton sets (Definition 5.4), say $\{m_{1}\}$, …, $\{m_{n}\}$, respectively. Then $\overline{\rho}(t)=\sigma_{M}(m_{1},\ldots,m_{n})$, which is also a singleton set, say $\{m\}$, as $\sigma_{M}$ is a function (Corollary 19). The rest follows by Proposition 17.

In FOL, the Substitution axiom ($(\forall x\!:\!s\,.\,\varphi)\rightarrow\varphi[t/x]$) allows for universally quantified variables to be substituted with any terms. Together with the proof rules and axioms of predicate logic, Substitution makes FOL deduction complete. An important property of term patterns in matching logic is that the Substitution axiom of FOL holds for them:

Corollary 21**.**

If $\varphi$ is any pattern and $t$ is a term pattern of sort $s$, then

Term Substitution: $\models(\forall x\!:\!s\,.\,\varphi)\rightarrow\varphi[t/x]$

Proof 5.14**.**

Let $\rho:\textit{Var}\rightarrow M$ be any valuation. Then

[TABLE]

where $\rho^{\prime\prime}:\textit{Var}\rightarrow M$ is such that $\rho^{\prime\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}$ and $\{\rho^{\prime\prime}(x)\}=\overline{\rho}(t)$. Such a $\rho^{\prime\prime}$ exists thanks to Corollary 20 and can only be $\rho^{\prime\prime}=\rho[m/x]$ where $\overline{\rho}(t)=\{m\}$, so $\overline{\rho^{\prime\prime}}(\varphi)=\overline{\rho}(\varphi[t/x])$.

Note Corollary 21 generalizes Corollary 20: pick $\varphi$ to be $\exists y\,.\,x=y$; then $\forall x:s\,.\,\varphi$ is a tautology and $\varphi[t/x]$ is $\exists y\,.\,t=y$, which by Proposition 17 implies that $t$ is functional. Corollary 21 also generalizes (5) in Proposition 2, because variables are particular terms.

Corollary 21, Proposition 12 and Proposition 2 imply that FOL reasoning with or without equality is sound for matching logic, provided that the Substitution axiom of FOL is only applied when $t$ is a term pattern. To avoid confusing the FOL Substitution axiom schema with the matching logic variant in Corollary 21, we called the later Term Substitution. As shown in Section 11, Term Substitution can be generalized a bit into Functional Substitution, which takes functional patterns instead of term patterns $t$, but in general it is not sound for arbitrary patterns instead of $t$.

Since functional patterns evaluate to singleton sets for any valuation, the conjunction of two functional patterns evaluate either to the empty set when the two patterns evaluate to different singleton sets, or to the same singleton set when the two patterns evaluate to the same singleton set. Formally,

Proposition 22**.**

If $\varphi$ and $\varphi^{\prime}$ are functional patterns of the same sort, then:

1. (1)

$\models((\varphi\wedge\varphi^{\prime})=\bot)=(\varphi\neq\varphi^{\prime})$** 2. (2)

$\models((\varphi\wedge\varphi^{\prime})\neq\bot)=(\varphi=\varphi^{\prime})$** 3. (3)

$\models(\varphi\wedge\varphi^{\prime})=(\varphi\wedge(\varphi=\varphi^{\prime}))$**

Proof 5.15**.**

Trivial: pick a model $M$ and a valuation $\rho:\textit{Var}\rightarrow M$, and apply the definitions.

Particular functions with particular properties, such as injective of surjective functions, can be defined in a conventional way using conventional FOL. For example, pattern (one-argument functions only, for simplicity)

[TABLE]

states that $f$ is injective and pattern

[TABLE]

states that $f$ is surjective. We only show the former: if $(M,f_{M}:M\rightarrow M)$ is any model satisfying $f(x)=f(y)\rightarrow x=y$, then $f_{M}$ must be injective. Indeed, let $a,b\in M$ such that $a\neq b$ and $f_{M}(a)=f_{M}(b)$. Pick $\rho:\textit{Var}\rightarrow M$ such that $\rho(x)=a$ and $\rho(y)=b$. Since $M$ satisfies the axiom above, we get $\overline{\rho}(f(x)=f(y))\subseteq\overline{\rho}(x=y)$. But Proposition 11 implies that $\overline{\rho}(x=y)=\emptyset$ and $\overline{\rho}(f(x)=f(y))=M$, which is a contradiction. We can also show that any model whose $f$ is injective satisfies the axiom. Let $(M,f_{M}:M\rightarrow M)$ be any model such that $f_{M}$ is injective. It suffices to show $\overline{\rho}(f(x)=f(y))\subseteq\overline{\rho}(x=y)$ for any $\rho:\textit{Var}\rightarrow M$, which follows by Proposition 11: if $\rho(x)=\rho(y)$ then $\overline{\rho}(f(x)=f(y))=\overline{\rho}(x=y)=M$, and if $\rho(x)\neq\rho(y)$ then $\overline{\rho}(f(x)=f(y))=\overline{\rho}(x=y)=\emptyset$ because $f_{M}$ is injective.

With the notation $\varphi\neq\varphi^{\prime}$ for $\neg(\varphi=\varphi^{\prime})$ introduced in Section 5.2, $x\neq y\rightarrow f(x)\neq f(y)$ is an alternative way to capture the injectivity of $f$.

5.5. Partial Functions

In FOL, operation symbols are interpreted as total functions by default, meaning that they are defined on all the elements in their domain. Interpreting function symbols as partial functions leads to a completely different logic, called partial FOL in the literature (see, e.g., [34]), which has many different axioms to properly capture the desired properties of definedness and undefinedness. Our interpretations of symbols into powersets allows us not only to elegantly define definedness (Section 5.1), but also to define partial functions without a need to develop a different logic. Specifically, the pattern

[TABLE]

where $\neg\sigma(x_{1},\ldots,x_{n})$ can be equivalently replaced with $\sigma(x_{1},\ldots,x_{n})=\bot_{s}$, states that $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ is a partial function. From now on we use the notation (note the “$\rightharpoonup$” symbol)

[TABLE]

to automatically assume a pattern like the above for $\sigma$. For example, a division partial function which is undefined iff the denominator is 0 can be specified as:

[TABLE]

which means a symbol $\_\,/\!\_\in\Sigma_{{\it Nat}\times{\it Nat},{\it Nat}}$ with pattern axioms $\neg(x/y)\vee\exists z\,.\,x/y=z$ and $x/y=\bot\leftrightarrow y=0$; the latter is equivalent to $\lceil x/y\rceil=(y\neq 0)$ and to $\lfloor\neg(x/y)\rfloor=(y=0)$.

5.6. Total Relations

Recall from Section 5.4 that we can define total functions using patterns of the form $\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$, stating not only that the interpretation of $\sigma$ in model $M$, $\sigma_{M}$, is defined in any of its arguments, but also that it has only one value. We sometimes want to state that relations, not only functions, are total. All we have to do is to say that the relation is non-empty for any arguments, which can be easily stated with a pattern of the form $\lceil\sigma(x_{1},\ldots,x_{n})\rceil_{s}^{s}$, equivalent to $\sigma(x_{1},\ldots,x_{n})\neq\bot_{s}$. We write

[TABLE]

to automatically state that $\sigma$ is a total relation.

5.7. Constructors, Unification, Anti-Unification

Constructors can be used to build programs, data, as well as semantic structures to define and reason about languages and programs. Hence, constructors have been extensively studied in the literature, using various approaches and logical formalisms. We believe that classic approaches to constructors can also be adapted to our matching logic setting, either directly by redefining the corresponding concepts (e.g., the matching logic analogous to initial algebras [43], etc.) or indirectly by translating them together with their underlying logic to matching logic (e.g., following the translations of FOL and algebraic specifications to matching logic in Sections 7 and 6, respectively). Here we discuss a different approach. Specifically, we show how the dual nature of patterns to specify both structure and constraints can make some of the definitions and notions related to constructors more elegant and appealing. For example, unification and anti-unification can be seen as conjunction and, respectively, disjunction of patterns.

One main property of constructors is that they collectively can construct all the elements of their target domain; i.e., the target domain has “no junk” [43]. One simple pattern stating that a unary symbol $f$ is to be interpreted as a surjective relation in every model is $\exists x\,.\,f(x)$. Generalizing this idea to an arbitrary set of $n$ symbols

[TABLE]

that we want to be constructors for target sort $s$, we get the following “no junk” pattern:

[TABLE]

For example, applied to the usual [math] and $\it succ$ constructors of natural numbers, the above becomes $0\ \vee\ \exists x:{\it Nat}\,.\,{\it succ}(x)$. Indeed, the interpretation of this pattern in the model of natural numbers is the entire domain; or said differently, any number matches this pattern.

The other main property of constructors is that they yield a unique way to construct each element in the target domain; i.e., the target domain has “no confusion” [43]. That means two separate types of conditions, each specifiable with patterns. First, each constructor $c_{i}$ builds a set of elements distinct from that of any other constructor $c_{j}$ with $s_{j}=s_{i}$:

[TABLE]

Recall that, by convention, free variables in pattern axioms are assumed universally quantified. For our [math] and $\it succ$ example, the above becomes $\neg(0\wedge{\it succ}(x))$, stating that ${\it succ}(x)$ is different from [math] for any $x$. Second, each constructor $c_{i}$ is injective in all its arguments at once (regarded as a tuple), which can be specified with a pattern as follows:

[TABLE]

Indeed, the above pattern ensures that in any model $M$, if

[TABLE]

then it must be that $a_{i}^{1}=b_{i}^{1}$, …, $a_{i}^{m_{i}}=b_{i}^{m_{i}}$.

Putting all the above together, below we formally introduce constructors:

{defi}

Given a specification $(S,\Sigma,F)$, the symbols in set

[TABLE]

are called constructors iff they have the following properties:

**No junk: **

For any sort $s\in\{s_{i}\mid 1\leq i\leq n\}$,

[TABLE]

**No confusion, different constructors: **

For any $1\leq i\neq j\leq n$ with $s_{j}=s_{i}$,

[TABLE]

**No confusion, same constructor: **

For any $1\leq i\leq n$,

[TABLE]

Additionally, if each $c_{i}$ is functional, then we call them functional constructors. The usual way to define a set of constructors is to have $F$ include all the patterns above.

It is easy to see that if the symbol $\sigma$ that occurs in the context $C_{\sigma,i}[\square]$ in Definition 2.4 is a constructor, then $C_{\sigma,i}[\square]$ is injective, and thus, by Propositions 5 and 4, it enjoys full distributivity w.r.t. the matching logic constructs $\wedge$, $\vee$, $\forall$ and $\exists$. Thanks to Propositions 11 and 12, we can therefore apply these distributivity properties of constructors in any context. In addition to the distributivity properties, the following equality properties of constructors turned out to also be very useful in program verification efforts:

Proposition 23**.**

Given a set of constructors $\{c_{i}\in\Sigma_{s_{i}^{1}...s_{i}^{m_{i}},s_{i}}\mid 1\leq i\leq n\}$ for a specification $(S,\Sigma,F)$, the following hold:

**Case analysis: **

If $\varphi$ is a pattern of sort $s\in\{s_{i}\mid 1\leq i\leq n\}$, then

[TABLE]

Additionally, if the constructors and $\varphi$ are all functional, then

[TABLE]

**Different constructors: **

If $1\leq i\neq j\leq n$ with $s_{i}=s_{j}$, and $\varphi_{i}^{1}\in\textsc{Pattern}_{s_{i}^{1}}$, …, $\varphi_{i}^{m_{i}}\in\textsc{Pattern}_{s_{i}^{m_{i}}}$, and $\varphi_{j}^{1}\in\textsc{Pattern}_{s_{j}^{1}}$, …, $\varphi_{j}^{m_{j}}\in\textsc{Pattern}_{s_{j}^{m_{j}}}$, then

[TABLE]

**Same constructor: **

If $\varphi_{i}^{1},\psi_{i}^{1}\in\textsc{Pattern}_{s_{i}^{1}}$, …, $\varphi_{i}^{m_{i}},\psi_{i}^{m_{i}}\in\textsc{Pattern}_{s_{i}^{m_{i}}}$, then

[TABLE]

Proof 5.16**.**

Case analysis follows by Proposition 11, which reduces equality ($=$) to double implication ($\leftrightarrow$). The latter follows by the propositional distributivity of $\wedge$ over $\vee$ and, of course, the “no junk” requirement of constructors in Definition 5.7. The part where the constructors and $\varphi$ are functional is an immediate corollary, making use of Proposition 22.

Different constructors: Suppose that there is some model $M$ and valuation $\rho:\textit{Var}\rightarrow M$ such that $\overline{\rho}(c_{i}(\varphi_{i}^{1},\dots,\varphi_{i}^{m_{i}})\wedge c_{j}(\varphi_{j}^{1},\dots,\varphi_{j}^{m_{j}}))\neq\emptyset$. Then there are some elements $a_{i}^{1}\in\overline{\rho}(\varphi_{i}^{1})$, …, $a_{i}^{m_{i}}\in\overline{\rho}(\varphi_{i}^{m_{i}})$, and $a_{j}^{1}\in\overline{\rho}(\varphi_{j}^{1})$, …, $a_{j}^{m_{j}}\in\overline{\rho}(\varphi_{j}^{m_{j}})$ such that $(c_{i})_{M}(a_{i}^{1},\dots,a_{i}^{m_{i}})\cap(c_{j})_{M}(a_{j}^{1},\dots,a_{j}^{m_{j}})\neq\emptyset$, which contradicts the “no confusion” requirement for different constructors in Definition 5.7.

Same constructor: By Proposition 11, we can replace $=$ with $\leftrightarrow$. The $\leftarrow$ implication is immediate by structural framing, Proposition 3. For the $\rightarrow$ implication, let $M$ be a model, $\rho:\textit{Var}\rightarrow M$ a valuation, and $b\in\overline{\rho}(c_{i}(\varphi_{i}^{1},\dots,\varphi_{i}^{m_{i}})\wedge c_{i}(\psi_{i}^{1},\dots,\psi_{i}^{m_{i}}))$. Then there are some elements $u_{i}^{1}\in\overline{\rho}(\varphi_{i}^{1})$, …, $u_{i}^{m_{i}}\in\overline{\rho}(\varphi_{i}^{m_{i}})$, and $v_{i}^{1}\in\overline{\rho}(\psi_{i}^{1})$, …, $v_{i}^{m_{i}}\in\overline{\rho}(\psi_{i}^{m_{i}})$ such that $b\in(c_{i})_{M}(u_{i}^{1},\dots,u_{i}^{m_{i}})\wedge(c_{i})_{M}(v_{i}^{1},\dots,v_{i}^{m_{i}}))$, that is, $b\in\overline{\rho^{\prime}}(c_{i}(x_{i}^{1},\dots,x_{i}^{m_{i}})\wedge c_{i}(y_{i}^{1},\dots,y_{i}^{m_{i}}))$, where $\rho^{\prime}:\textit{Var}\rightarrow M$ is some valuation that takes $x_{i}^{1}$ to $u_{i}^{1}$, …, $x_{i}^{m_{i}}$ to $u_{i}^{m_{i}}$, and $y_{i}^{1}$ to $v_{i}^{1}$, …, $y_{i}^{m_{i}}$ to $v_{i}^{m_{i}}$. By the “no confusion” requirement for the same constructor in Definition 5.7 we conclude that $b\in\overline{\rho^{\prime}}(c_{i}(x_{i}^{1}\wedge y_{i}^{1},\dots,x_{i}^{m_{i}}\wedge y_{i}^{m_{i}}))$, that is, $b\in(c_{i})_{M}(\{u_{i}^{1}\}\wedge\{v_{i}^{1}\},\dots,\{u_{i}^{m_{i}}\}\wedge\{v_{i}^{m_{i}}\})$. This can only happen when $u_{i}^{1}=v_{i}^{1}$, …, $u_{i}^{m_{i}}=v_{i}^{m_{i}}$. And in that case it can only be that $b\in\overline{\rho}(c_{i}(\varphi_{i}^{1}\wedge\psi_{i}^{1},\dots,\varphi_{i}^{m_{i}}\wedge\psi_{i}^{m_{i}}))$.

The case analysis property is useful when additional constraints are needed on a pattern in order to reason with it. For example, if $b$ is a Boolean (symbolic) expression in a given positive context, $C[b]$, then we can replace $b$ with ${\it true}\wedge(b={\it true})\vee{\it false}\wedge(b={\it false})$, and then by Propsitions 4 (distributivity) and 13 (constraint propagation) we can reduce $C[b]$ to $C[{\it true}]\wedge(b={\it true})\vee C[{\it false}]\wedge(b={\it false})$. Similarly, if $e$ is a ${\it Nat}$ (symbolic) expression in a positive context $C[e]$, then we can reduce the pattern $C[e]$ to the pattern $C[0]\wedge(e=0)\vee\exists x\,.\,C[\textit{succ}(x)]\wedge(e=succ(x))$, which may be further reducible. The other two properties in Proposition 23 are self-explanatory and clearly useful for the same reasons why constructors are useful, but we found them particularly useful when attempting to do symbolic execution using the operational semantics rules of a language. As explained in [28], the main technical instrument there is unification: indeed, in order to check if a symbolic program configuration $\varphi$ can be executed with an operational rule $\textit{left}\mathbin{\Rightarrow}\textit{right}$, a unification of $\varphi$ and left is attempted. If it fails then the rule cannot be applied; if it succeeds then the rule can be applied and $\varphi$ is advanced to $\textit{right}\wedge\psi$, where $\psi$ is the constraints resulting from unifying $\varphi$ and left. As discussed below, unification can be achieved in matching logic by pattern conjunction, which makes the last properties in Proposition 13 indispensable.

We next show how unification and anti-unification can be explained as conjunction and, respectively, disjunction of matching logic patterns. To fall into the conventional setting, for the reminder of this section assume that all the symbols are functional constructors and all the starting patterns are term patterns (Definition 5.4) built with such constructors.

Let us re-think unification in terms of matching logic and pattern matching. Consider two patterns $\varphi_{1}$ and $\varphi_{2}$ having the same sort. Each of them is matched by a potentially infinite set of elements. We are interested in the elements that match both $\varphi_{1}$ and $\varphi_{2}$. Moreover, we are interested in some pattern $\varphi$ that captures all these elements. Clearly $\varphi\rightarrow\varphi_{1}$ and $\varphi\rightarrow\varphi_{2}$, and we would like the most general such $\varphi$, that is, if $\varphi^{\prime}\rightarrow\varphi_{1}$ and $\varphi^{\prime}\rightarrow\varphi_{2}$ then $\varphi^{\prime}\rightarrow\varphi$. We do not have to search for such a $\varphi$ any further, because it is, by definition, $\varphi_{1}\wedge\varphi_{2}$. All we have to do then is to simplify $\varphi_{1}\wedge\varphi_{2}$ to a convenient form, say a term pattern constrained with equalities telling how $\varphi_{1}$ and $\varphi_{2}$ fall as instances, using matching logic reasoning. Let us exemplify this when $\varphi_{1}\equiv f(g(x),x)$ and $\varphi_{2}\equiv f(y,0)$ where $f$ is a binary symbol (functional construct), $g$ is unary, and [math] is a constant:

[TABLE]

Therefore, using matching logic reasoning we obtained both the most general unifier of the two term patterns, encoded as a conjunction of equalities $(y=g(0))\wedge(x=0)$, and the unifying term pattern $f(g(0),0)$. We believe that unification algorithms should not be difficult to adapt into matching logic proof search heuristics capable of producing proofs like above, thus narrowing the gap between tools and certifiable program verification.

Anti-unification, or generalization, can be dually regarded as disjunction of patterns222The author thanks Traian Florin Şerbănuţă for observing this.. Let us briefly recall Plotkin’s original two-rule algorithm [75]:

1. (1)

$f(u_{1},\dots,u_{n})\sqcup f(v_{1},\ldots,v_{n})\rightsquigarrow f(u_{1}\sqcup v_{1},\ldots,u_{n}\sqcup v_{n})$, 2. (2)

$u\sqcup v\rightsquigarrow x_{u,v}$ otherwise, where $x_{u,v}$ is a variable uniquely determined by $u$ and $v$.

Given terms $s$ and $t$, the term obtained by applying this algorithm to $s\sqcup t$ is their anti-unification; the corresponding substitutions instantiating it to $s$ and, respectively, $t$ are obtained by instantiating each variable $x_{u,v}$ to $u$ and, respectively, $v$. For example, $f(g(0),0)\sqcup f(g(1),1)\rightsquigarrow^{*}f(g(x_{0,1}),x_{0,1})$. Indeed, the term $f(g(x_{0,1}),x_{0,1})$ containing one variable, $x_{0,1}$, is the least general term that is more general than both $f(g(0),0)$ and $f(g(1),1)$. Also, the two original terms can be recovered by substituting $x_{0,1}$ with [math] and, respectively, $1$.

Plotkin’s algorithm can be mimicked with inference in matching logic. For the example above, the following matching logic proof blindly follows the application of Plotkin’s algorithm (all proof steps correspond to applications of proof rules of FOL with equality):

[TABLE]

The resulting pattern contains both the generalization, $f(g(z),z)$, and the two witness substitutions that can recover the original terms (encoded as a disjunction of equalities).

5.8. Built-in Domains

Dedicated solvers and decision procedures specialized for particular but important mathematical domains abound in the literature. Some domains may not even have finite descriptions in certain logics; a classic example is the domain of natural numbers, which does not admit a finite, not even a recursively enumerable axiomatization in FOL (Gödel’s incompleteness [38, 39]). Therefore, to reason about certain properties that involve natural numbers, we need to leave FOL. The standard approach is to assume some oracle for the domain of interest, which is capable of answering validity questions within that domain. At the practical level, such an oracle may be implemented using specialized procedures and algorithms for that domain, such as those provided by Z3 [29], Yices [32], CVC [6, 5], etc. At the theoretical level, the set of models of the FOL specification in question is restricted to those that inherit the desired model for the built-in data-types, and thus we can assume all the valid FOL properties of that domain in the rest of the proof even if those properties are not provable using FOL.

Reasoning with built-in domains can be done exactly the same way in matching logic: assume the desired sorts and symbols for the built-in domains, together with all their valid patterns. Due to their ubiquitous nature, from now on we tacitly assume definitions of integers and of natural numbers, as well as of Boolean values, with common operations on them. We assume that these come with three sorts, ${\it Int}$, ${\it Nat}$ and ${\it Bool}$, and the operations on them use the conventional syntax; e.g., $\_+\_:{\it Int}\times{\it Int}\rightarrow{\it Int}$, $\_+\_:{\it Nat}\times{\it Nat}\rightarrow{\it Nat}$, $\_>\_:{\it Nat}\times{\it Nat}\rightarrow{\it Bool}$, $\_{\it and}\_:{\it Bool}\times{\it Bool}\rightarrow{\it Bool}$, ${\it not}\_:{\it Bool}\rightarrow{\it Bool}$, etc.

Boolean expressions are frequently used in matching logic specifications to constrain variables that occur in patterns of possibly other sorts. For example, suppose that in some domain ${\it Real}$ of real numbers we want to refer to all numbers of the form $1/x$ where $x$ is a strictly positive integer. These numbers are precisely matched by the pattern $1/x\wedge(x>0=_{\it Bool}^{\it Real}{\it true})$. However, this pattern is too verbose. For the sake of a more compact and easy to read notation, we introduce the following:

{nota}

If $b$ is a proper Boolean expression, that is, a term pattern of sort ${\it Bool}$ (Definition 5.4), then we will write just $b$ instead of $b={\it true}$ in any other sort context.

Notation 5.8 allows us to use Boolean expressions in any sort context, thanks to the additional notational conventions for equality in Section 5.2. For example, we can write $1/x\wedge x>0$ instead of $1/x\wedge(x>0=_{\it Bool}^{\it Real}{\it true})$.

To avoid confusion or even introducing inconsistencies, we urge the reader to respect the underlined words proper and other in Notation 5.8. That’s because ${\it Bool}$ expressions, when regarded as patterns, evaluate to one of the singleton sets $\{t\}$ (the true value) or $\{f\}$ (the false value), while patterns of sort ${\it Bool}$ can evaluate to any of the four sets $\emptyset$, $\{t\}$, $\{f\}$, or $\{t,f\}$. For example, consider the ${\it Bool}$ patterns $\top_{\it Bool}$ and $\bot_{\it Bool}$, which are not proper ${\it Bool}$ expressions and evaluate to the sets $\{t,f\}$ and $\emptyset$, respectively, and an equality pattern $\top_{\it Bool}=\bot_{\it Bool}$ which is obviously $\bot$ (regardless of the sort context). If we carelessly apply the notation above to this pattern we get $(\top_{\it Bool}={\it true})=(\bot_{\it Bool}={\it true})$, that is, $\top$; that’s because both $\top_{\it Bool}={\it true}$ and $\bot_{\it Bool}={\it true}$ are $\bot$, and $\bot=\bot$ is $\top$. So it is important to apply the notation “$b$ as a shortcut for $b={\it true}$” only when it is guaranteed that $b$ evaluates to either $\{t\}$ or $\{f\}$, such as when $b$ is a proper Boolean expression term. It is also important to apply the notation only when $b$ occurs in sort contexts other than Bool. For example, consider the Boolean expression $b\equiv({\it true\,or\,false})$. If we carelessly apply the notation above to the Boolean sub-expressions $\it true$ and $\it false$, which occur in $b$ above in ${\it Bool}$ contexts, then we get $({\it true}={\it true})\,{\it or}\,({\it false}={\it true})$, which is $\top_{\it Bool}\,{\it or}\,\bot_{\it Bool}$, which is $\bot_{\it Bool}$ (by the second item in Definition 2.3). On the other hand, $b={\it true}$ is $\top_{\it Bool}$.

When reasoning with matching logic patterns, it is often the case that various Boolean expression constraints come from various sub-patterns. We would like to combine them into larger Boolean expressions, which we can then send to SMT solvers. The following result allows us to do that:

Proposition 24**.**

If $b$, $b_{1}$ and $b_{2}$ are proper ${\it Bool}$ expressions, then

• •

$\models(b_{1}={\it true}\wedge b_{2}={\it true})=(b_{1}\,{\it and}\,b_{2}={\it true})$**

• •

$\models\neg(b={\it true})=({\it not}\,b={\it true})$**

Other similar properties for derived Boolean constructs can be derived from these.

Proof 5.17**.**

Trivial: each of $\overline{\rho}(b)$, $\overline{\rho}(b_{1})$, and $\overline{\rho}(b_{2})$ can only be $\{t\}$ or $\{f\}$, for any valuation $\rho$.

6. Instance: Algebraic Specifications and Beyond

An algebraic specification is a many-sorted signature $(S,\Sigma)$ together with a set of equations333We only consider unconditional equations here. $E$ over $\Sigma$-terms with variables. The variables are assumed universally quantified over the entire equation. The models, called $\Sigma$-algebras, are first-order $\Sigma$-models without predicates where equality is interpreted as the identity relation. We let $\models_{\it Alg}$ denote the algebraic specification satisfaction relation; in particular, $E\models_{\it Alg}e$ means that any model that satisfies all the equations in $E$ also satisfies $e$.

Algebraic specifications play a crucial role in theoretical computer science and program reasoning, because they are often used to define abstract data types (ADTs) [59, 40]. Some common ADTs, which have proved useful in many applications, are lists (or sequences), sets, multisets, maps, multimaps, graphs, stacks, queues, priority queues, double-ended queues, double-ended priority queues, etc. [90]. These ADTs can be found a variety of formal definitions using algebraic specifications in the literature, not necessarily always equivalent, and are easily definable or already pre-defined in algebraic specification languages such as Maude [25], CASL [62], CafeOBJ [30], OBJ [41], Clear [19], etc., as well as in many other languages with support for ADTs.

Here we show not only that algebraic specifications can be regarded as matching logic specifications, but also that the use of matching logic often allows for more expressive, concise and intuitive specifications of ADTs. To capture conventional ADTs as matching logic specifications, we need to do almost nothing besides recalling the conventions and notations introduced in Section 5. Specifically, algebraic equations $t=t^{\prime}$ in $E$ are regarded as matching logic equality patterns $t=t^{\prime}$ (Section 5.2), algebraic symbols in $\Sigma$ are interpreted as functional symbols (Section 5.4, Definition 5.4), and no other patterns but equations are allowed in specifications. The resulting matching logic specifications are then precisely the algebraic specifications not only syntactically, but also semantically:

Proposition 25**.**

Let $(S,\Sigma,F)$ be the matching logic specification associated to the algebraic specification $(S,\Sigma,E)$ as above, that is, $F$ contains an equality pattern for each equation in $E$, as well as all the patterns stating that the symbols in $\Sigma$ are interpreted as functions (see Definition 5.4). Then for any $\Sigma$-equation $e$, we have $E\models_{\it Alg}e$ iff $F\models e$.

Proof 6.1**.**

The key observation is that, in a similar style to the proof of Proposition 7, there is a bijection between the matching logic models $M$ satisfying $F$ and the $(S,\Sigma)$-algebras $M^{\prime}$ satisfying $E$, such that ${M}\models e$ iff ${M}^{\prime}\models_{\it Alg}e$ for any $\Sigma$-equation $e$. The model bijection is defined as follows:

• •

$M^{\prime}_{s}=M_{s}$* for each sort $s\in S$;*

• •

${\sigma}_{M^{\prime}}:M_{s_{1}}\times\cdots\times M_{s_{n}}\rightarrow M_{s}$* with $\sigma_{M^{\prime}}(a_{1},\ldots,a_{n})=a$ iff $\sigma_{M}:M_{s_{1}}\times\cdots\times M_{s_{n}}\rightarrow{\mathcal{}P}(M_{s})$ with $\sigma_{M}(a_{1},\ldots,a_{n})=\{a\}$. Note that this is well-defined because $F$ includes all the patterns stating that all the symbols are functional, so $\sigma_{M}$ is a function.*

This model relationship is easy to prove a bijection, and everything else follows from it.

Using the notations introduced so far, Peano natural numbers, for example, can be defined as the following matching logic specification:

[TABLE]

This looks identical to the conventional algebraic specification definition, which is precisely the point and justifies our notation conventions in Section 5. In particular, the functional notation (Definition 5.4) for the three symbols ensures that they will be interpreted as functions in the matching logic models. Also, as seen in the proof of Proposition 25, there is a bijective correspondence between the matching logic models of the specification above and the conventional models of the Peano algebraic specification (we only discuss the loose semantics here, not the initial-algebra semantics [43]).

Note, however, that matching logic allows more than just equational patterns. For example, we can add to $F$ the pattern $0\ \vee\ \exists x\,.\,{\it succ}(x)$ stating that any number is either 0 or the successor of another number. Nevertheless, since matching logic ultimately has the same expressive power as predicate logic (Proposition 30), we cannot finitely axiomatize in matching logic any mathematical domains that do not already admit finite FOL axiomatizations. As indicated in Section 5.8, we follow the standard approach to deal with built-in domains, namely we assume them theoretically presented with potentially infinitely many axioms but implemented using specialized decision procedures. Indeed, our matching logic implementation prototype in $\mathbb{K}$ defers the solving of all domain constraints to Z3 [29].

6.1. Sequences, Multisets and Sets

Sequences, multisets and sets are typical ADTs. Matching logic enables, however, some useful developments and shortcuts. For simplicity, we only discuss collections over Nat, and name the corresponding sorts ${\it Seq}$, ${\it MultiSet}$, and ${\it Set}$, respectively. Ideally, we would build upon an order-sorted algebraic signature setting, e.g. following the approach in [42], so that we can regard $x\!:\!{\it Nat}$ not only as an element of sort ${\it Nat}$, but also as one of sort ${\it Seq}$ (a one-element sequence), as one of sort ${\it MultiSet}$, as well as one of sort ${\it Set}$. Extending matching logic to an order-sorted setting is beyond the scope of this paper. The reader who is not familiar with order-sorted concepts can safely assume that elements of sort ${\it Nat}$ used in a ${\it Seq}$, ${\it MultiSet}$, or ${\it Set}$ context are wrapped with injection symbols. The symbols below can have many equivalent definitions.

Sequences can be defined with two symbols and corresponding equations:

[TABLE]

We assume that lowercase variables have sort ${\it Nat}$ and uppercase variables have the appropriate collection sort. To avoid adding initiality constraints on models, yet be able to do proofs by case analysis and elementwise equality, we can add the following patterns:

[TABLE]

The second axiom above holds strictly for sequences, but not for commutative collections, so it needs to be removed later when we add the commutativity axiom to define multisets and sets. We next define two common operations on sequences:

[TABLE]

To illustrate the flexibility of matching logic, we next define up-to and Fibonacci sequences of natural numbers.

[TABLE]

This specification needs to be explained. Let $M$ be a model satisfying the above. First recall Notation 5.8. For notational simplicity, assume that $M_{\it Nat}$ and $M_{\it Seq}$ are the sets of natural numbers and of comma-separated sequences of natural numbers, respectively. We show by induction on $m$ that ${\it upto}_{M}(m)=\{1\cdot 2\cdots m\}$. If $m=0$ then the second disjunct of the axiom is $\emptyset$ and thus the first disjunct ensures that ${\it upto}_{M}(0)=\epsilon_{M}=\epsilon$. If $m>0$ then the first disjunct is $\emptyset$ and thus the second disjunct, with $\rho:\textit{Var}\rightarrow M$ such that $\rho(n)=m$, yields $\overline{\rho}({\it upto}(n))=\overline{\rho}({\it upto}(n-1)\cdot n)$, that is, ${\it upto}_{M}(m)={\it upto}_{M}(m-1)\cdot m$, which by the induction hypothesis implies ${\it upto}_{M}(m)=\{1\cdot 2\cdots m-1\}\cdot m=\{1\cdot 2\cdots m\}$.

Similarly, we can specify a function that defines the sequence of Fibonacci numbers up to a given number $n>0$:

[TABLE]

We conclude the discussion on sequences with an elegant means to sort sequences following a bubble-sort methodology:

[TABLE]

Since equations are symmetric, the above effectively allows to prove (so far only semantically, in a model) a sequence equal to any of its permutations, i.e., sequences become multisets. If the equations were oriented, like they are in reachability logic [79], then the above would yield a sequence sorting procedure.

We can transform sequences into multisets adding the equality axiom $x\cdot y=y\cdot x$, and into sets by also including $x\cdot x=\bot$ or $x\cdot x=x$. Here is one way to axiomatize intersection:

[TABLE]

6.2. Maps

Finite-domain maps are also a typical ADT. Due to their ubiquity in defining algebraic specifications, maps are usually predefined in languages like those mentioned in the preamble of this section (Section 6). For example, below is a snippet of Maude’s MAP module [25], which is parametric in both the source and the target domains:

⬇

fmod MAP{X :: TRIV, Y :: TRIV} is

sorts Entry{X,Y} Map{X,Y} .

subsorts Entry{X,Y} < Map{X,Y} .

op |-> : X$Elt Y$Elt -> Entry{X,Y} [ctor] .

op empty : -> Map{X,Y} [ctor] .

op , : Map{X,Y} Map{X,Y} -> Map{X,Y} [assoc comm id: empty ctor] .

...

endfm

Note that the map concatenation symbol, “,”, is associative (attribute “assoc”), commutative (“comm”), and has the “empty” map as identity (“id: empty”). The attribute “ctor” states that the corresponding symbols are constructors. Additional axioms, not shown here, ensure that maps are always well-formed, that is, maps with multiple bindings of the same key are disallowed. When instantiated with natural numbers for both the domain and the target, this MAP module defines well-formed finite-domain maps such as “1 |-> 5, 2 |-> 0, 7 |-> 9, 8 |-> 1”. In Section 9, to show how separation logic can be framed as a matching logic theory with essentially zero representational/encoding distance, we will pick an instance of maps with natural numbers as both the domain and the co-domain, and will rename empty to ${\it emp}$ and , to $\_*\_$.

7. Instance: First-Order Logic

First-order logic (FOL) extends predicate logic with function symbols and allows predicates to apply to terms with variables built using the function symbols. Recall from Section 4 that by “predicate logic” in this paper we mean what is also called “pure predicate logic” in the literature, namely FOL without any function or constant symbols.

Formally, given a FOL signature $(S,\Sigma,\Pi)$, the syntax of its (many-sorted) formulae is:

[TABLE]

Compare the above with the syntax of matching logic in Section 2. Unlike FOL, matching logic does not distinguish between the term and predicate syntactic categories, reason for which its syntax is in fact more compact than FOL’s. Moreover, matching logic allows logical constructs over all the syntactic categories, not only over predicates, and locally where they are needed instead of only at the top, predicate level. Also, matching logic allows quantification over any sorts, including over sorts of symbols thought of as predicates.

Like with predicate logic (Section 4), we can instantiate matching logic to capture FOL as is, modulo the notational conventions in Section 5 but without any translations from one logic to the other. Like in predicate logic, we add a Pred sort and regard the FOL predicate symbols as matching logic symbols of result Pred, and disallow variables of sort Pred and restrict the use of logical connectives and quantifiers to only patterns of sort Pred. Then there is a one-to-one correspondence between FOL formulae and matching logic patterns of sort Pred; we let $\varphi$ range over them. Moreover, following the approach in Section 5.4, we constrain each FOL operational symbol $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ to be interpreted as a function, that is, with the notation introduced in Section 5.4, we write the symbols meant to be functions as $\sigma:s_{1}\ldots s_{n}\rightarrow s$. Formally, let $(S^{\it ML},\Sigma^{\it ML})$ be the matching logic signature with $S^{\it ML}=S\mathrel{\cup}\{{\textit{Pred}}\}$ and $\Sigma^{\it ML}=\Sigma\mathrel{\cup}\{\pi:s_{1}\ldots s_{n}\rightarrow{\textit{Pred}}\mid\pi\in\Pi_{s_{1}\ldots s_{n}}\}$, and let $F$ be $\{\exists z\!:\!s\,.\,\sigma(x_{1}\!:\!s_{1},\ldots,x_{n}\!:\!s_{n})=z\mid\sigma\in\Sigma_{s_{1}\ldots s_{n},s}\}$ stating that each symbol in $\Sigma$ is a function.

Proposition 26**.**

For any FOL formula $\varphi$, we have $\models_{\it FOL}\varphi$ iff $F\models\varphi$.

Proof 7.1**.**

The proof is similar to that of Proposition 7. Like there, the implication “$\models_{\it FOL}\varphi$ implies $F\models\varphi$” follows by the completeness of FOL. Indeed, it is well-known that the properties in Proposition 2 and Corollary 21, when regarded as proof rules for deriving FOL formulae $\varphi$, yield a sound and complete proof system for FOL [38]. That is, “$\models_{\it FOL}\varphi$ iff $\vdash_{\it FOL}\varphi$”. However, since Proposition 2 and Corollary 21 show that these proof rules are also sound for matching logic in the context of $F$ (Corollary 21 requires that $t$ is a term pattern in the substitution rule, which holds in the context of $F$), we conclude that “$\vdash_{\it FOL}\varphi$ implies $F\models\varphi$”. Therefore, “$\models_{\it FOL}\varphi$ implies $F\models\varphi$”.

For the other implication, we also follow the idea in Proposition 7. From any FOL model $M^{\it FOL}=(\{M_{s}^{\it FOL}\}_{s\in S},\{\sigma_{M^{\it FOL}}\}_{\sigma\in\Sigma},\{\pi_{M^{\it PL}}\}_{\pi\in\Pi})$ we can construct a matching logic model $M^{\it ML}=(\{M_{s}^{\it ML}\}_{s\in S\cup\{\textit{Pred}\}},\{\sigma_{M^{\it ML}}\}_{\sigma\in\Sigma}\cup\{\pi_{M^{\it ML}}\}_{\pi\in\Pi})$, where $M^{\it ML}_{s}=M^{\it FOL}_{s}$ for all sorts $s\in S$ and $M_{\textit{Pred}}^{\it ML}=\{\star\}$ (with $\star$ some arbitrary but fixed element), $\sigma_{M^{\it ML}}(a_{1},\ldots,a_{n})=\{\sigma_{M^{\it FOL}}(a_{1},\ldots,a_{n})\}$, and $\pi_{M^{\it ML}}(a_{1},\ldots,a_{n})=\{\star\}$ iff $\pi_{M^{\it PL}}(a_{1},\ldots,a_{n})$ holds, and otherwise $\pi_{M^{\it ML}}(a_{1},\ldots,a_{n})=\emptyset$. Note that $M^{\it ML}\models F$: indeed, $\sigma_{M^{\it ML}}(a_{1},\ldots,a_{n})$ contains precisely one element for any $\sigma\in\Sigma_{s_{1}\ldots s_{n},s}$ and any $a_{1}\in M^{\it ML}_{s_{1}}$, …, $a_{n}\in M^{\it ML}_{s_{n}}$, namely $\sigma_{M^{\it FOL}}(a_{1},\ldots,a_{n})$. It therefore suffices to show, for any FOL formula $\varphi$, that $M^{\it FOL}\models_{\it FOL}\varphi$ iff $M^{\it ML}\models_{\it ML}\varphi$. Like in Proposition 7, we can show by structural induction on $\varphi$ that for any $\rho:\textit{Var}\rightarrow M^{\it FOL}$, it is the case that $M^{\it FOL},\rho\models_{\it FOL}\varphi$ iff $\overline{\rho}(\varphi)=\{\star\}$. The induction proof differs from that in Proposition 7 only in the base case, where we need to notice that term patterns are functional in $M^{\it ML}$, thanks to Corollary 20, and that $\overline{\rho}(t)=a$ for a term $t$ in the FOL context (with $\rho:\textit{Var}\rightarrow M^{\it FOL}$) iff $\overline{\rho}(t)=\{a\}$ in the matching logic context (where $\rho$ is regarded as $\rho:\textit{Var}\rightarrow M^{\it ML}$, which is possible as we disallow Pred variables).

Consequently, FOL is also a methodological fragment of matching logic. Moreover, since the rules of FOL where we replace all the predicate meta-variables with pattern meta-variables are sound for matching logic, we can use off-the-shelf decision procedures and solvers for FOL or fragments of it unchanged when doing matching logic reasoning. The only thing we have to be careful about is to distinguish the term patterns from arbitrary patterns, and make sure that the Substitution rule of FOL is only applied with $t$ a term pattern, otherwise it may be unsound. Section 11 discusses this in detail.

Predicate logic and FOL with equality also fall as methodological fragments of matching logic. In addition to the constructions in Section 4 and, respectively, above in this section, all we have to do is to is to make use of the definedness symbols that we assume by convention included in all signatures (Section 5.1), which give us equality as an alias as described in Section 5.2. We leave the details as an exercise for the interested reader.

Like Boolean expressions, FOL is also frequently used in matching logic specifications to constrain variables that occur in patterns of possibly other sorts. Consider the same example we discussed before and after Notation 5.8, where we want to refer to all real numbers of the form $1/x$ with $x$ a strictly positive integer, but this time using a given predicate ${\it positive?}(x)$ that tells whether $x$ is positive. We can use the pattern $1/x\wedge({\it positive?}(x)=_{\textit{Pred}}^{\it Real}\top_{\textit{Pred}})$, but that is too verbose. We would like to just write $1/x\wedge{\it positive?}(x)$. Following Notation 5.8, we introduce the following similar notation for predicates instead of Boolean expressions:

{nota}

If $\varphi$ is a FOL formula, we take the freedom to write $\varphi$ instead of $\varphi=\top_{\textit{Pred}}$.

Since both the FOL formulae and the patterns of Pred sort evaluate to only two possible values, $\emptyset$ or $\{\star\}$, unlike Notation 5.8 we can freely apply the notation above in any contexts, including of sort Pred. Note, however, that care must be exercised to ensure that $\varphi$ is indeed a FOL formula. For example, if one extends FOL with additional formula constructs, like separation logic does for example (Section 9), then the above notation may lead to inconsistencies. As discussed in Section 9 in detail, matching logic has a different way to deal with such extensions (allowing different sorts of “predicates”), without polluting the universe of FOL formulae and thus allowing the notation above to still apply.

Same as with Boolean expressions in Proposition 24, we sometimes need to combine various FOL constraints resulting from various sub-patterns in order to make appropriate calls to FOL provers, e.g., SMT solvers. The following result allows us to do that:

Proposition 27**.**

If $p$, $p_{1}$ and $p_{2}$ are FOL formulae, then

• •

$\models(p_{1}=\top_{\textit{Pred}}\wedge p_{2}=\top_{\textit{Pred}})=(p_{1}\wedge p_{2}=\top_{\textit{Pred}})$**

• •

$\models\neg(p=\top_{\textit{Pred}})=(\neg p=\top_{\textit{Pred}})$**

Other similar properties for derived FOL constructs can be derived from these.

Proof 7.2**.**

Trivial: each of $\overline{\rho}(p)$, $\overline{\rho}(p_{1})$, and $\overline{\rho}(p_{2})$ can only be $\emptyset$ or $\{\star\}$, for any valuation $\rho$.

8. Instance: Modal Logic

It turns out that the vanilla matching logic over just one sort with (countably many) constants and definedness (as defined in Section 5.1) captures one of the most popular modal logics, S5 [7, 56, 44]. At the end of this section we briefly discuss how other modal logics can also be framed as matching logic instances, but until there we only discuss S5 and thus take the liberty to implicitly mean the “S5 modal logic” whenever we say “modal logic”.

We start by giving the syntax and semantics of modal logic. Let $\textit{Var}_{\textit{Prop}}$ be a countable set of propositional variables $p$, $q$, etc. Then the modal logic syntax is defined as follows:

[TABLE]

The remaining propositional constructs $\wedge$, $\vee$ and $\leftrightarrow$, can be defined as derived constructs. Therefore, syntactically, modal logic adds the $\Box$ construct to propositional logic, which is called necessity: $\Box\varphi$ is read “it is necessary that $\varphi$”. The dual possibility construct can be defined as a derived construct: $\Diamond\varphi\equiv\neg\Box\neg\varphi$ is read “it is possible that $\varphi$”. Semantically, the truth value of a formula is relative to a “world”. Propositions can be true in some worlds but false in others, and thus formulae can also be true in some worlds but not in others:

{defi}

Let $W$ be a set of worlds. Mappings $v:\textit{Var}_{\textit{Prop}}\times W\rightarrow\{{\it true},{\it false}\}$, called (modal logic) $W$-valuations, state that each proposition only holds in a given (possibly empty or total) subset of worlds. Valuations extend to modal logic formulae:

• •

$v(\neg\varphi,w)={\it true}$ iff $v(\varphi,w)={\it false}$

• •

$v(\varphi_{1}\rightarrow\varphi_{2},w)={\it true}$ iff $v(\varphi_{1},w)={\it false}$ or $v(\varphi_{2},w)={\it true}$

• •

$v(\Box\varphi,w)={\it true}$ iff $v(\varphi,w^{\prime})={\it true}$ for every $w^{\prime}\in W$

Formula $\varphi$ is valid in $W$, written $W\models_{\rm S5}\varphi$, iff $v(\varphi,w)={\it true}$ for any $W$-valuation $v$ and any $w\in W$. Formula $\varphi$ is valid, written $\models_{\rm S5}\varphi$, iff $W\models_{\rm S5}\varphi$ for all $W$.

Modal logic (S5) admits the following sound and complete proof system [7, 56]:

• (N)

Rule: If $\varphi$ derivable then $\Box\varphi$ derivable

• (K)

Axiom: $\Box(\varphi_{1}\rightarrow\varphi_{2})\rightarrow(\Box\varphi_{1}\rightarrow\Box\varphi_{2})$

• (M)

Axiom: $\Box\varphi\rightarrow\varphi$

• (5)

Axiom: $\Diamond\varphi\rightarrow\Box\Diamond\varphi$

We next show that we can define a matching logic specification $(S,\Sigma,F)$ which faithfully captures modal logic, both syntactically and semantically. The idea is quite simple: $S$ contains precisely one sort, say ${\it World}$; $\Sigma$ contains one constant symbol $p\in\Sigma_{\lambda,{\it World}}$ for each propositional variable $p\in\textit{Var}_{\textit{Prop}}$, plus a unary symbol $\Diamond\in\Sigma_{{\it World},{\it World}}$; and $F$ contains precisely one axiom stating that $\Diamond$ is the definedness symbol (Section 5.1), namely $\Diamond x\!:\!{\it World}$ ($x$ is a free ${\it World}$ variable in this pattern). Then we let $\Box\varphi$ be the totality construct (Notation 5.1), that is, syntactic sugar for $\neg\Diamond\neg\varphi$. Note that any modal logic formula $\varphi$ can be regarded, as is, as a ground matching logic pattern over this signature; by “ground” we mean a pattern without variables, so the other implication is also true, because disallowing variables includes disallowing quantifiers. Moreover, Corollary 10 implies that the modal logic proof system above is sound for the resulting matching logic specification, so $\models_{\rm S5}\varphi$ implies $\models\varphi$. We show the stronger result that the world/valuation models of modal logic are essentially identical the the matching logic $(S,\Sigma,F)$-models, and thus:

Proposition 28**.**

For any modal logic formula $\varphi$, we have $\models_{\rm S5}\varphi$ iff $\models\varphi$.

Proof 8.1**.**

For any world $W$ and $W$-valuation $v:\textit{Var}_{\textit{Prop}}\times W\rightarrow\{{\it true},{\it false}\}$ (Definition 8), let $M_{W,v}$ be the matching logic $(S,\Sigma,F)$-model whose carrier is $W$, whose constant symbols $p\in\Sigma_{\lambda,{\it World}}$ (i.e., $p\in\textit{Var}_{\textit{Prop}}$) are interpreted as the sets of worlds $p_{M_{W,v}}=\{w\in W\mid v(p,w)={\it true}\}$, and $\Diamond w$ is the total set $W$ for each $w\in W$. Similarly, for each matching $(S,\Sigma,F)$-model $M$ let $W_{M}=M_{\it World}$ be its carrier and let $v_{M}:\textit{Var}_{\textit{Prop}}\times W_{M}\rightarrow\{{\it true},{\it false}\}$ be defined as $v(p,w)={\it true}$ iff $w\in p_{M}$. It is clear that the two mappings defined above, $(W,v)\mapsto M_{W,v}$ and respectively $M\mapsto(W_{M},v_{M})$, are inverse to each other.

Since a modal logic formula $\varphi$ can be regarded as a matching logic pattern with no variables, $\overline{\rho}(\varphi)$ only depends on the model $M$ but not on any particular valuation $\rho:\textit{Var}\rightarrow M$ (by (1) in Proposition 1). Let us then use the notation $\varphi_{M}$ for the (unique) interpretation of $\varphi$ in matching logic model $M$; note that $\varphi_{M}\subseteq M_{\it World}$.

We show that for any $W$ and any $W$-valuation $v$, we have $v(\varphi,w)={\it true}$ iff $w\in\varphi_{M_{W,v}}$. We show it by structural induction on $\varphi$. The cases when $\varphi$ is a propositional symbol or a logical connective are trivial. For the necessity modal construct $\Box$, we have $v(\Box\varphi,w)={\it true}$ iff $v(\varphi,w^{\prime})={\it true}$ for all $w^{\prime}\in W$ (Definition 8), iff $w^{\prime}\in\varphi_{M_{W,v}}$ for all $w^{\prime}\in W$ (induction hypothesis), iff $\varphi_{M_{W,v}}=W=(M_{W,v})_{\it World}$, iff $(\Box\varphi)_{M_{W,v}}=W$ (by Proposition 9), iff $w\in(\Box\varphi)_{M_{W,v}}$ (by Proposition 9). Therefore, $v(\varphi,w)={\it true}$ iff $w\in\varphi_{M_{W,v}}$.

We are now ready to prove the main result: $\models_{\rm S5}\varphi$ iff $v(\varphi,w)={\it true}$ for any $W$ and $W$-valuation $v$ and $w\in W$ (Definition 8), iff $w\in\varphi_{M_{W,v}}$ for any $W$ and $W$-valuation $v$ and $w\in W$ (by the property proved above by structural induction), iff $\varphi_{M_{W,v}}=W$ for any $W$ and $W$-valuation $v$, iff $M_{W,v}\models\varphi$ for any $W$ and $W$-valuation $v$ (by Proposition 2.3), iff $M\models\varphi$ for any matching logic $(S,\Sigma,F)$-model $M$ (because of the bijective correspondence between pairs $(W,v)$ and $(S,\Sigma,F)$-models $M$ proved above), iff $\models\varphi$.

The result above, together with the general translation of matching logic to predicate logic with equality discussed in Section 10, will also give us a translation of modal logic to predicate logic with equality. Translations from modal logic to various types of first-order (or second-order or other even more expressive) logics are well-known in the literature, one of them to predicate logic being called the “standard translation” [89, 11]. Our goal in this section was not to propose yet another translation, but to show how modal logic can be framed as a matching logic specification without any translation.

There are many variants of modal logic [89, 11, 44]. One may naturally wonder if all of them can be similarly regarded as matching logic theories. While systematically investigating each and everyone of them seems tedious and likely not worth the effort, it is nevertheless interesting to note that there is an immediate connection between one of the most general variants of modal logic, called multi-dimensional or polyadic modal logic [11], and matching logic. Instead of particular unary modal operators like $\Box$ and $\Diamond$, polyadic modal logic allows arbitrary operators taking any number of formula arguments; if $\Delta$ is such an operator of $n$ arguments and $\varphi_{1}$, …, $\varphi_{n}$ are formulae, then $\Delta(\varphi_{1},...,\varphi_{n})$ is also a formula. In models, called general frames, each such operator $\Delta$ is associated a relation $R_{\Delta}$ of $n+1$ arguments. Propositional variables are also interpreted as sets (of “worlds in which they hold”) by valuations, and given set of worlds $W$, valuation $v:\textit{Var}_{\textit{Prop}}\times W\rightarrow\{{\it true},{\it false}\}$ and world $w\in W$, we have $v(\Delta(\varphi_{1},...,\varphi_{n}),w)={\it true}$ iff there are $w_{1},...,w_{n}\in W$ such that $v(\varphi_{1},w_{1})={\it true}$, …, $v(\varphi_{n},w_{n})={\it true}$ and $R_{\Delta}(w,w_{1},...,w_{n})$.

It is easy to associate a matching logic specification $(S,\Sigma,F)$ to any polyadic modal logic. Like for $S5$, we let $S$ contain precisely one sort, ${\it World}$, and $\Sigma$ contain one constant symbol $p\in\Sigma_{\lambda,{\it World}}$ for each propositional variable $p\in\textit{Var}_{\textit{Prop}}$. Further, we add a symbol $\Delta\in\Sigma_{{\it World}\times\cdots\times{\it World},{\it World}}$ of $n$ arguments for each polyadic modal operator $\Delta$ taking $n$ arguments. Then any polyadic modal logic formula $\varphi$ can be regarded without any change/translation as a matching logic formula. Further, any axioms/schemas in polyadic modal logic can be added as matching logic axioms/schemas in $F$. Then we can extend Proposition 28 to show $\models\varphi$ in the polyadic modal logic iff $F\models\varphi$ in matching logic; the key technical insight here is that there is a bijective correspondence between relations of $n+1$ arguments and functions of $n$ arguments returning sets of elements.

When compared to polyadic modal logic, matching logic has a couple of advantages which, in our view, make it more appealing to use in practice. First, it has sorts. Thus, unlike polyadic modal logic which only has “formulae”, matching logic allows us to have patterns of various types. For example, in Section 2.2 we show how heap patterns interact with program patterns and how all can be put together in configuration patterns; while possible in theory, it would be quite inconvenient to force all patterns to have the same sort. Second and more importantly, modal logic and matching logic have a different interpretation for “variables”. In modal logic (propositional) variables are interpreted as sets and we are not allowed to quantify over them, while in matching logic variables are interpreted as just elements and we can quantify over them. Like shown above, the set interpretation can be recovered in matching logic by associating constant symbols to propositional variables. But the singleton interpretation of variables in matching logic, combined with the capability to quantify over variables of any sort, allows us to elegantly define many useful properties, such as those in Section 5. For example, the simple pattern $\forall x\,.\,\lceil x\rceil$ defines the semantics of the definedness symbol $\lceil\_\rceil$, which as seen above gives us the $\Diamond$ construct of S5. It is critical that $x$ ranges over singleton elements in models. If one attempts to do the same in polyadic modal logic naively replacing $x$ with a propositional variable $p$, then one gets an inconsistent theory (because we want $\lceil p\rceil$ to be false when $p$ is interpreted as the empty set of worlds). Definedness then allows us to define membership and equality, and thus allows us to use patterns like $\forall x\,.\,\exists y\,.\,f(x)=y$ to state that symbol $f$ is a function, etc.

Whether the results and observations above have practical relevance remains to be seen. We hope they at least enhance our understanding of both matching logic and modal logic.

9. Instance: Separation Logic

Matching logic has inherent support for structural separation, without a need for any special logic constructs or extensions. Indeed, pattern matching has a spatial meaning by its very nature: matching a subterm already separates that subterm from the rest of the context, so matching two or more terms can only happen when there is no overlapping between them. Moreover, matching logic patterns can combine structure with logical constraints, which allows not only to define very sophisticated patterns, but also to reason about patterns as if they were logical formulae, and to achieve modularity by globalizing local reasoning. Finally, since matching logic allows variables of any sorts, including of sort ${\it Map}$ when heaps are concerned, it has inherent support for heap framing and local reasoning, too.

9.1. Separation Logic Basics

Separation logic (originating with ideas in [68, 67], followed by canonical work in [77], with more recent developments in [72, 18, 24, 17, 54] and with several provers supporting it in [8, 2, 15, 63, 9, 64, 71, 74, 72]), is a logic specifically crafted for reasoning about heap structures. There are many variants, but here we only consider the original variant in [67, 77]. Moreover, here we only discuss separation logic as an assertion-language, used for specifying state properties, and not its extension as an axiomatic programming language semantic framework. We regard the latter as an orthogonal aspect, which can similarly be approached using matching logic.

Separation logic extends the syntax of formulae in FOL (Section 7) as follows:

[TABLE]

Its semantics is based on a fixed model of stores and heaps, which are finite-domain maps from variables and, respectively, locations (which are particular numbers), to integers. Below we recall the formal definition of satisfaction in the original variant of separation logic, noting that subsequent variants of separation logic extend the underlying model to include stacks (instead of stores) as well as various types of resources that are encountered in modern programming languages. Such extensions are ignored here because they would only complicate the presentation without changing the overall message: they would only add more symbols to the corresponding matching logic signature with appropriate interpretations in the underlying model, and Theorem 29 would still hold. Nevertheless, we leave the thorough analysis of the diversity of separation logic variants proposed in the last 15 years through the lenses of matching logic as a subject for future work.

{defi}

(Separation logic semantics, adapted from [67, 77]) Partial finite-domain maps $s:\textit{Var}\rightharpoonup{\it Nat}$ are called stores, partial finite-domain maps $h:{\it Nat}\rightharpoonup{\it Nat}$ are called heaps, and pairs $(s,h)$ of a store and a heap are called states. The semantics of the separation logic constructs are given in terms of such states, as follows:

• •

$(s,h)\models_{\it SL}\varphi$ for a FOL formula $\varphi$ iff $s\models_{\it FOL}\varphi$ (the heap portion of the model is irrelevant for the FOL fragment);

• •

$(s,h)\models_{\it SL}{\it emp}$ iff ${\it Dom}(h)=\emptyset$;

• •

$(s,h)\models_{\it SL}e_{1}\mapsto e_{2}$ where $e_{1}$ and $e_{2}$ are terms of sort ${\it Nat}$ (thought of as “expressions”) iff ${\it Dom}(h)=\overline{s}(e_{1})\neq 0$ and $h(\overline{s}(e_{1}))=\overline{s}(e_{2})$, where $\overline{s}$ is the (partial function) extension of $s$ to expressions (with variables) of sort ${\it Nat}$, defined similarly to the extension of valuations to patterns in Definition 2.3;

• •

$(s,h)\models_{\it SL}\varphi_{1}*\varphi_{2}$ iff there exist $h_{1}$ and $h_{2}$ such that ${\it Dom}(h_{1})\cap{\it Dom}(h_{2})=\emptyset$ and $h=h_{1}*h_{2}$ (the merge of $h_{1}$ and $h_{2}$, a partial function on maps written as an associative/commutative comma in Section 6.2) and $(s,h_{1})\models_{\it SL}\varphi_{1}$, $(s,h_{2})\models_{\it SL}\varphi_{2}$;

• •

(s,h)\models_{\it SL}\varphi_{1}\mbox{-!*,}\varphi_{2} iff for any $h_{1}$ with ${\it Dom}(h_{1})\cap{\it Dom}(h)=\emptyset$, if $(s,h_{1})\models_{\it SL}\varphi_{1}$ then $(s,h*h_{1})\models_{\it SL}\varphi_{2}$; i.e., the semantics of “magic wand” is defined as the states whose heaps extended with a fragment satisfying $\varphi_{1}$ result in ones satisfying $\varphi_{2}$.

Separation logic formula $\varphi$ is valid, written $\models_{\it SL}\varphi$, iff $(s,h)\models_{\it SL}\varphi$ for any state $(s,h)$.

9.2. Map Patterns

One of the most appealing aspects of separation logic is that it allows us to define compact and elegant specifications of heap abstractions using inductively defined predicates. Such an abstraction which is quite common is the linked-list abstraction ${\it list}(x,S)$ stating that $x$ points to a linked list containing an abstract sequence of natural numbers $S$:

[TABLE]

Above, $\epsilon$ is the empty sequence, $n\cdot S$ is the sequence starting with natural number $n$ and followed by sequence $S$, and $x\mapsto[n,z]$ is syntactic sugar for $x\mapsto n*(x+1)\mapsto z$. So a linked list starting with address $x$ takes either empty heap space, in which case $x$ must be 0 and the abstracted sequence is $\epsilon$, or there is some node in the linked list at location $x$ in the heap that holds the head of the abstracted sequence ($n$) and a link ($z$) to another linked list that holds the tail of the abstracted sequence ($S$). The implicit properties of the implicit map model (the heap) in Definition 9.1 ensures the well-definedness of this abstraction, which essentially means that all the locations reached by unfolding a list abstraction using the inductive properties above are distinct. The symbol $\stackrel{{\scriptstyle\it{def}}}{{=}}$, sometimes written $\equiv$ in the literature, is not part of separation logic; it is a meta-logical means to define inductive, or recursive predicates, also encountered in the context of first-order logic: the predicate in question is interpreted in models as the least-fixed point of its defining (meta-)equations.

We next show that similar heap patterns can be defined directly in matching logic. Specifically, we pick a particular signature (for maps/heaps) together with desired axioms, that is, a matching logic specification, and show how additional patterns can be defined in the context of that specification. The definitions are as compact and elegant as those in separation logic, and no meta-logical constructs, such as $\stackrel{{\scriptstyle\it{def}}}{{=}}$ or $\equiv$, appear to be necessary.

In what follows, we only discuss maps from natural numbers to natural numbers, but they can be similarly defined over arbitrary domains as keys and as values. Consider a matching logic specification of maps like the one shown in Section 6.2, but instantiated to natural numbers as both keys and values, with its axioms explicitly listed, and with a syntax that deliberately resembles that of separation logic (i.e., we use “*” instead of “,”):

[TABLE]

Recall that there are no predicates here, only patterns. When regarding the above ADT as a matching logic specification, we can prove that the bottom two pattern equations above are equivalent to $\neg(0\mapsto a)$ and, respectively, $(x\mapsto a*y\mapsto b)\rightarrow x\neq y$, giving the $\_\mapsto\_$ and $\_*\_$ the feel of “predicates”. Maps, like natural numbers, do not admit finite (or even recursively enumberable) equational (or first-order) axiomatizations, so adding a “good enough” subset of equations is the best we can do in practice. We chose ones that have been proposed by algebraic specification languages and by separation logics for several reasons. First, they have been extensively used, so there is a good chance they are “good enough” for many purposes. Second, we do not want to imply that we propose a novel axiomatization of maps; our novelty is the presentation of known specifications of maps using the general infrastructure of matching logic at no additional translation cost, without a need to craft a new logic to address the particularities of maps. Third, this will ease our presentation in Section 9.3 where the connection with such a logic specifically crafted for maps is discussed.

Consider the canonical model of partial maps $M$, where: $M_{\it Nat}\mathrel{=}\{0,1,2,\ldots\}$; $M_{\it Map}=$ partial maps from natural numbers to natural numbers with finite domains and undefined in 0, with ${\it emp}$ interpreted as the map undefined everywhere, with $\_\mapsto\_$ interpreted as the corresponding one-element partial map except when the first argument is 0 in which case it is undefined (note that $\_\mapsto\_$ was declared using $\rightharpoonup$), and with $\_*\_$ interpreted as map merge when the two maps have disjoint domains, or undefined otherwise (note that $\_*\_$ was also declared using $\rightharpoonup$). $M$ satisfies all axioms above.

Following similar definitions in the context of separation logic, we next define several patterns that are commonly used when proving properties about programs that can allocate and de-allocate data-structures in the heap. We emphasize that our matching logic specifications below look almost identical, if not identical, to their separation logic variants. Which is, in fact, the main point we are making in this subsection. That is, that matching logic allows us to specify the same complex heap predicates as separation logic, equally compactly and elegantly, but without a need to devise any new heap-specific logic for that.

We start with matching logic definitions for complete linked lists and for list fragments. Let ${\it list}\in\Sigma_{{\it Nat},{\it Map}}$ and ${\it lseg}\in\Sigma_{{\it Nat}\times{\it Nat},{\it Map}}$ be two symbols together with patterns

[TABLE]

Note that ${\it list}$ and ${\it lseg}$ are not meant to be functions, so we did not use the functional notation (Section 5.4) for them. Moreover, note that ${\it lseg}$ is not even meant to be a totally defined relation (Section 5.6); indeed, ${\it lseg}(0,m)$ is $\emptyset$ (and not ${\it emp}$) for all $m>0$.

The main difference between our definitions above and their separation logic variants is that the latter cannot use the (FOL) equality symbol as we did. Indeed, ${\it list}$ and ${\it lseg}$ are predicates there, same as equality, and predicates cannot take predicates as arguments. To define predicates like ${\it list}$ and ${\it lseg}$, as seen at the beginning of this section, we have to explicitly use the meta-logical notation $\stackrel{{\scriptstyle\textrm{def}}}{{=}}$ or $\equiv$ for defining “recursive predicates”: predicates satisfying desired properties which have a least fixed-point interpretation in models. We emphasized “explicitly” above to distinguish it from the implicit least fixed-point principles used when mathematically defining the semantics of any logic. For example, in our context, the extension of $\rho$ to $\overline{\rho}$ in Definition 2.3 uses a least-fixed point construction, similar to any other logic with terms, but that is orthogonal to how symbols are interpreted in the given model (symbol interpretation is given by the model, not by $\rho$).

There are two important questions about the matching logic specification above:

1. (1)

Does this specification admit any solution in $M$, i.e., total relations ${\it list}_{M}:M_{\it Nat}\rightarrow{\mathcal{}P}(M_{\it Map})$ and ${\it lseg}_{M}:M_{\it Nat}\times M_{\it Nat}\rightarrow{\mathcal{}P}(M_{\it Map})$ satisfying the patterns above? 2. (2)

If yes, is the solution unique? This is particularly important because we do not require initiality constraints on $M$ nor smallest fixed-point constraints on solutions.

We answer these questions positively. We only discuss ${\it lseg}_{M}$, because the other is similar and simpler. A solution ${\it lseg}_{M}:M_{\it Nat}\times M_{\it Nat}\rightarrow{\mathcal{}P}(M_{\it Map})$ exists iff it satisfies the two pattern axioms for ${\it lseg}$ above; explicitly, that means that any solution must satisfy:

[TABLE]

where $\_*_{M}\_$ is $M$’s merge function explained above extended to sets of maps for each argument; recall that the map merge function is undefined (i.e., it yields an empty set of maps) when the two argument maps are not merge-able. Note that we had to split the interpretation of the second equation pattern for ${\it lseg}$ into two equalities, reflecting a case analysis on whether the first argument is 0 or not. Note also that ${\it lseg}(n,m)\neq\emptyset$ when $n\neq 0$, and that ${\it lseg}(n,m)$ contains only non-empty maps when $n\neq 0$ and $n\neq m$.

First, we claim that the following is a solution:

[TABLE]

Indeed, the first two equalities that need to be satisfied by any solution vacuously hold, while for the third all we need to note is that the “junk” maps where $n$ is 0 or in the domain of a map in ${\it lseg}_{M}(n_{1},m)$ are simply discarded by the map merge interpretation of $\_*\_$.

Second, we claim that the above is the unique solution. Let ${\it lseg}_{M}:M_{\it Nat}\times M_{\it Nat}\rightarrow{\mathcal{}P}(M_{\it Map})$ be some solution satisfying the three equality constraints. It suffices to prove, by induction on the size $k$ of the domain of $h\in M_{\it Map}$ that: $h\in{\it lseg}_{M}(n,m)$ for $n,m\in M_{\it Nat}$ iff either $n=m$ and $h={\it emp}_{M}$ (i.e., $k=0$), or otherwise $n\neq 0$ and $n\neq m$ and $k>0$ and there are distinct $n_{0}=n$, $n_{1}$, …, $n_{k-1}$ distinct from $m$ such that $h=(n\mapsto_{M}n_{1}*_{M}n_{1}\mapsto_{M}n_{2}*_{M}\cdots*_{M}n_{k-1}\mapsto_{M}m)$. Since the maps in ${\it lseg}_{M}(n,m)$ when $n\neq 0$ and $n\neq m$ contain at least one binding, we conclude $k=0$ can only happen iff $h\in{\it lseg}_{M}(n,n)$, and then $h={\it emp}_{M}$. Now suppose $k>0$, which can only happen iff $h\in{\it lseg}_{M}(n,m)$ for $n\neq 0$ and $n\neq m$, which can only happen iff $n\neq 0$ and $n\neq m$ and $h=n\mapsto_{M}n_{1}*_{M}h_{1}$ for some $n_{1}\geq 0$ and $h_{1}\in{\it lseg}_{M}(n_{1},m)$. It all follows now by the induction hypothesis applied to $h_{1}$.

It should be clear that patterns can be specified in many different ways. E.g., the first list pattern can also be specified with a single pattern:

[TABLE]

We can similarly define more complex patterns, such as lists with data. But first, we specify a convenient operation for defining maps over contiguous keys, making use of a sequence data-type. The latter can be defined like in Section 6.1; for notational convenience, we take the freedom to use comma “,” instead of “$\cdot$” for sequence concatenation in some places:

[TABLE]

In our model $M$, we can take $M_{\it Seq}$ to be the finite sequences of natural numbers, with $\epsilon_{M}$ and $\_\cdot_{M}\_$ interpreted as the empty sequence and, respectively, sequence concatenation.

We can now define lists with data as follows:

[TABLE]

Note that, unlike in the case of lists without data, this time we have not required the side conditions $x\neq 0$ and $x\neq y$, respectively. The side conditions were needed in the former case because without them we can infer, e.g., ${\it list}(0)=\bot$ (from the second equation of ${\it list}$), which using the first equation would imply ${\it emp}=\bot$. However, they are not needed in the latter case because it is safe (and even desired) to infer ${\it list}(0,n\cdot S)=\bot$ for any $n$ and $S$. We can show, using a similar approach like for lists without data, that the pattern ${\it lseg}(x,S,y)$ matches in $M$ precisely the lists starting with $x$, exiting to $y$, and holding data sequence $S$.

We can similarly define other data-type specifications, such as trees with data:

[TABLE]

Therefore, in the model $M$ of partial maps described above, there is a unique way to interpret ${\it list}$ and ${\it lseg}$, namely as the expected linked lists and, respectively, linked list fragments. Fixing the interpretations of the basic mathematical domains, such as those of natural numbers, sequences, maps, etc., suffices in order to define interesting map patterns that appear in verification of heap properties of programs, in the sense that the axioms themselves uniquely define the desired data-types. No logic extensions (such as adding free models with induction/recursion principles as a matching logic equivalent to “recursive predicates”, or least fixed-point constraints, or even fixed points of any kind) were needed to define them. The defining axioms were precise enough to capture the intended concept in the intended model. Choosing the right basic mathematical domains is, however, crucial. For example, if we allow the maps in $M_{\it Map}$ to have infinite domains then the list patterns without data above (the first ones) also include infinite lists. The lists with data cannot include infinite lists, because we only allow finite sequences. This would, of course, change if we allow infinite sequences, or streams, in the model. In that case, ${\it list}$ and ${\it lseg}$ would not admit unique interpretations anymore, because we can interpret them to be either all the finite domain lists, or both the finite and the infinite-domain lists. Writing patterns which admit the desired solution in the desired model suffices in practice; our reasoning techniques developed in the sequel allow us to derive properties that hold in all models satisfying the axioms, so any derived property is sound also for the intended model and interpretations.

9.3. Separation Logic as an Instance of Matching Logic

Consider the FOL fragment in Section 7, where the signature $\Sigma$ includes the signature of maps in Section 9.2. Any additional FOL constructs, background theories, and/or built-in domains that one wants to consider in separation logic specifications, are handled as already explained in Sections 7 and  5.8. It is clear then that all the syntactic constructs of separation logic, except for the magic wand, $-\!*\,$, are given by the above matching logic signature. The magic wand, on the other hand, can be defined as the following derived construct:

[TABLE]

Recall from Section 5.1 that $\lfloor\varphi\rfloor$ is $\top$ (it matches the entire set) iff its enclosed pattern $\varphi$ is $\top$; otherwise, if $\varphi$ does not match some elements, then $\lfloor\varphi\rfloor$ is $\bot$ (it matches nothing). In words, \varphi_{1}\mbox{-!*,}\varphi_{2} matches all maps $h$ which merged with maps matching $\varphi_{1}$ yield only maps matching $\varphi_{2}$. Thanks to the notational convention that Booleans $b$, respectively usual predicates $p$, stand for equalities $b={\it true}$, respectively $p=\top_{\textit{Pred}}$ (Notation 5.8),

Any separation logic formula is a matching logic pattern of sort ${\it Map}$.

Semantically, note that separation logic hard-wires a particular model of maps. That is, its satisfaction relation $\models_{\it SL}\varphi$ is defined using a pre-defined universe of maps, which is conceptually the same as our model of maps in Section 9.2. Since separation logic extends FOL, its models are still allowed to instantiate the FOL part of its syntax in the usual FOL way, but the maps are rigid and the models cannot touch them. It is therefore not surprising that we also have to fix the maps in our matching logic models corresponding to the syntax described so far in order to faithfully capture separation logic semantically. For the rest of this section, we only consider models $M$ for the matching logic specification above whose reduct to the syntax of maps is precisely the map domain in Section 9.2. We let ${\it Map}\models\varphi$ denote the resulting satisfaction relation: ${\it Map}\models\varphi$ iff $M\models\varphi$ for any model $M$ like above.

In separation logic formulae, variables range only over the domains of data (e.g., natural numbers), but not over heaps/maps; for example, “$\exists H\!:\!{\it Map}\,.\,1\mapsto 2*H$” is not a proper separation logic formula (although it is one in matching logic). Also, stores $s$ are mappings of variables to particular values. In matching logic, variables range over all syntactic categories, including over heaps in our case, and valuations $\rho$ can map such variables to any values in the model; for example, the variable $H$ of sort ${\it Map}$ in the pattern defining $-\!*\,$ above is a heap variable. Since separation logic formulae $\varphi$ contain no heap variables, we can regard separation logic stores $s$ as $M$-valuations with the property that $\overline{s}(\varphi)$ contains precisely the heaps which together with $s$ satisfy the original separation logic formula $\varphi$. We prove this in the next proposition showing that separation logic is not only syntactically an instance of matching logic (modulo notations in Section 5), but also semantically:

Proposition 29**.**

If $\varphi$ is a separation logic formula, then $\models_{\it SL}\varphi\mbox{ iff }{\it Map}\models\varphi$.

Proof 9.1**.**

Like in the proofs of Propositions 7, 25, and 26, there is a bijection between the models of separation logic and the matching logic ${\it Map}$-models. The bijection works as described in the aforementioned propositions for the FOL part, and adds the map model in Section 9.2 to the resulting matching logic models. To keep the notation simple, we use the same name, $M$, to refer both to a separation logic model and to its corresponding matching logic model, remembering from the proofs of Propositions 7 and 25 that the latter’s carrier of sort Pred is a singleton $\{\star\}$. The context makes it clear which one we are referring to.

We show by structural induction on the separation logic formula $\varphi$ the more general result that for any store $s$ and any heap $h$, we have $(s,h)\models_{\it SL}\varphi$ iff $h\in\overline{s}(\varphi)$.

If $\varphi$ is a FOL formula then its desugared matching logic correspondent is $\varphi=_{\textit{Pred}}^{\it Map}\top_{\textit{Pred}}$ (Notation 7). Then $(s,h)\models_{\it SL}\varphi$ iff $s\models_{\it FOL}\varphi$ (Definition 9.1), iff $\overline{s}(\varphi)=\{\star\}$ (see proof of Proposition 26), iff $\overline{s}(\varphi)=\overline{s}(\top_{\textit{Pred}})$, iff $\overline{s}(\varphi=_{\textit{Pred}}^{\it Map}\top_{\textit{Pred}})=M_{\it Map}$ (by Proposition 11), iff $h\in\overline{s}(\varphi=_{\textit{Pred}}^{\it Map}\top_{\textit{Pred}})$ (Proposition 11 again: equality is interpreted as either $M_{\it Map}$ or $\emptyset$).

Conjunction and negation are trivial. Existential quantification: $(s,h)\models_{\it SL}\exists x\,.\,\varphi$ iff there exists some $a\in M$ of appropriate (non-heap) sort such that $(s[a/x],h)\models\varphi$, iff $h\in\overline{s[a/x]}(\varphi)$ (induction hypothesis), iff $h\in\bigcup\{\overline{s^{\prime}}(\varphi)\mid s^{\prime}:\textit{Var}\rightarrow M,\ s^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=s\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}$, iff $h\in\overline{s}(\exists x\,.\,\varphi)$. We next discuss the heap-related constructs of separation logic.

If $\varphi\equiv{\it emp}$ then $(s,h)\models_{\it SL}{\it emp}$ iff $h={\it emp}_{M}$, iff $h\in\{{\it emp}_{M}\}$, iff $h\in\overline{s}({\it emp})$.

If $\varphi\equiv e_{1}\mapsto e_{2}$ then $(s,h)\models_{\it SL}e_{1}\mapsto e_{2}$ iff ${\it Dom}(h)=\overline{s}(e_{1})\neq 0$ and $h(\overline{s}(e_{1}))=\overline{s}(e_{2})$ (Definition 9.1), iff $h$ is the partial-domain map $\overline{s}(e_{1})\mapsto_{M}\overline{s}(e_{2})$ (which is undefined when $\overline{s}(e_{1})=0$—see Section 9.2), iff $h\in\overline{s}(e_{1}\mapsto e_{2})$.

If $\varphi\equiv\varphi_{1}*\varphi_{2}$ then $(s,h)\models_{\it SL}\varphi_{1}*\varphi_{2}$ iff there exist $h_{1}$ and $h_{2}$ of disjoint domains such that $h=h_{1}*_{M}h_{2}$ (the merge of $h_{1}$ and $h_{2}$, which is a partial function on maps—see Definition 9.1 and Section 9.2) and $(s,h_{1})\models_{\it SL}\varphi_{1}$ and $(s,h_{2})\models_{\it SL}\varphi_{2}$, iff $h=h_{1}*_{M}h_{2}$ and $h_{1}\in\overline{s}(\varphi_{1})$ and $h_{2}\in\overline{s}(\varphi_{2})$ (induction hypothesis), iff $h\in\overline{s}(\varphi_{1})*_{M}\overline{s}(\varphi_{2})$, iff $h\in\overline{s}(\varphi_{1}*\varphi_{2})$.

The only case left is the “magic wand”, \varphi\equiv\varphi_{1}\mbox{-!,}\varphi_{2}:*

[TABLE]

The proof is complete.

Although matching logic is complete (Section 11), so its validity $\models$ is semi-decidable, while results in [21, 1] state that the validity problem in separation logics is not semi-decidable, note that there is no conflict here because we restricted matching logic validity to ${\it Map}$-models. As an analogy, it is well-known that the validity of predicate logic formulae can be arbitrarily hard when particular (and not all) models are concerned. All the above says is that the results in [21, 1] carry over to the particular matching logic theory restricted to ${\it Map}$-models discussed in this section. Most likely one can obtain even more general instances of the results [21, 1] for matching logic, but that is beyond the scope of this paper.

The loose-model approach of matching logic is in sharp technical, but not conceptual, contrast to separation logic. In separation logic, the syntax of maps and separation constructs is part of the syntax of the logic itself, and the model of maps is intrinsically integrated within the semantics of the logic: its satisfaction relation is defined in terms of a fixed syntax and the fixed model of the basic domains (maps, sequences, etc.). Then specialized proof rules and theorem provers need to be devised. If any changes to the syntax or semantics are desired, for example adding a new stack, or an I/O buffer, etc., then a new logic is obtained. Proof rules and theorem provers may need to change as the logic changes. In matching logic, the basic ingredients of separation logic form one particular specification, with its particular signature and pattern axioms, together with particular but carefully chosen models. This enables us to use generic first-order reasoning in matching logic (Section 11), as well as theorem provers or SMT solvers for reasoning about the intended models. Nevertheless, several high performance automated provers for separation logics have been developed, e.g. [8, 2, 15, 63, 9, 64, 71, 74, 72], while there are no automated provers available for matching logic yet. A technical challenge, left for future work, is to investigate the techniques and algorithms underlying the existing separation logic provers and to generalize them if possible to work with matching logic in general or at least with common fragments of it.

Like for modal logic (Section 8), the result above in combination with the reduction of matching logic to predicate logic with equality in Section 10 yields a translation from separation logic to predicate logic with equality. Note that many of the separation logic provers above are implicitly or explicitly based on translations to FOL, and specific translations to FOL or fragments of it have been already studied [20, 22, 12]. Like for modal logic (Section 8), our goal in this section was not to propose yet another translation. Our goal was to show how separation logic can be framed as a matching logic specification both syntactically and semantically, without any translation (but only with syntactic sugar notations). Such results can help us better understand both logics, as well as their strengths and limitations.

10. Matching Logic: Reduction to Predicate Logic with Equality

It is known that FOL formulae can be translated into equivalent predicate logic with equality formulae (i.e., no function or constant symbols—see Section 4), by replacing all functions with their graph relations (see, e.g., [55]). Specifically, function symbols $\sigma:s_{1}\times\cdots\times s_{n}\rightarrow s$ are replaced with predicate symbols $\pi_{\sigma}:s_{1}\times\cdots\times s_{n}\times s$, and then terms are transformed into formulae by adding existential quantifiers for subterms. Let us define such a translation, say ${\it PL}$. It takes each FOL predicate $\pi(t_{1},\ldots,t_{n})$ into a pure predicate logic formula as follows:

[TABLE]

where ${\it PL}_{2}(t,r)$ is a translation of term $t$ into a predicate stating that $t$ equals variable $r$:

[TABLE]

Axioms stating that the predicate symbols $\pi_{\sigma}:s_{1}\times\cdots\times s_{n}\times s$ associated to function symbols $\sigma:s_{1}\times\cdots\times s_{n}\rightarrow s$ are interpreted as total function relations are also needed:

[TABLE]

We can similarly translate matching logic patterns into equivalent predicate logic formulae. Consider predicate logic with equality (and no function or constant symbols) whose satisfaction relation is $\models_{\it PL}^{=}$. For matching logic signature $(S,\Sigma)$, let $(S,\Pi_{\Sigma})$ be the predicate logic signature with $\Pi_{\Sigma}=\{\pi_{\sigma}:s_{1}\times\cdots\times s_{n}\times s\mid\sigma\in\Sigma_{s_{1}\ldots s_{n},s}\}$, like above but without the axioms stating that these predicates have a functional interpretation in models (because the matching logic symbols need not be interpreted as functions). We define the translation ${\it PL}$ of matching logic $(S,\Sigma)$-patterns into predicate logic $(S,\Pi_{\Sigma})$-formulae inductively:

[TABLE]

The predicate logic formula ${\it PL}_{2}(\varphi,r)$ captures the intuition that “$r$ matches $\varphi$”. The top transformation above, ${\it PL}(\varphi)=\forall r\,.\,{\it PL}_{2}(\varphi,r)$, is different from (and simpler than) the corresponding translation of predicates from FOL to predicate logic. It captures the intuition that the pattern $\varphi$ is valid iff it is matched by all values $r$. Then the following result holds:

Proposition 30**.**

If $F$ is a set of patterns and $\varphi$ is a pattern, $F\models\varphi$ iff ${\it PL}(F)\models_{\it PL}^{=}{\it PL}(\varphi)$.

Proof 10.1**.**

It suffices to show that there is a bijective correspondence between matching logic $(S,\Sigma)$-models $M$ and predicate logic $(S,\Pi_{\Sigma})$-models ${M}^{\prime}$, such that ${M}\models\varphi$ iff ${M}^{\prime}\models_{\it PL}^{=}{\it PL}(\varphi)$ for any $(S,\Sigma)$-pattern $\varphi$. The bijection is defined as follows:

• •

$M^{\prime}_{s}=M_{s}$* for each sort $s\in S$;*

• •

${\pi_{\sigma}}_{M^{\prime}}\subseteq M_{s_{1}}\times\cdots\times M_{s_{n}}\times M_{s}$* with $(a_{1},\ldots,a_{n},a)\in{\pi_{\sigma}}_{M^{\prime}}$ iff $\sigma_{M}:M_{s_{1}}\times\cdots\times M_{s_{n}}\rightarrow{\mathcal{}P}(M_{s})$ with $a\in\sigma_{M}(a_{1},\ldots,a_{n})$.*

To show ${M}\models\varphi$ iff ${M}^{\prime}\models_{\it PL}^{=}{\it PL}(\varphi)$, it suffices to show $a\in\overline{\rho}(\varphi)$ iff $\rho[a/r]\models_{\it PL}^{=}{\it PL}_{2}(\varphi,r)$ for any $\rho:\textit{Var}\rightarrow M$, which follows easily by structural induction on $\varphi$.

It is informative to translate the definedness and equality patterns in Sections 5.1 and Section 5.2 using the above, and especially to sanity check that the equality pattern of matching logic indeed translates to the equality predicate of predicate logic with equality. Recall that the definedness symbols were axiomatized with pattern axioms $\lceil x\rceil$, and that we assumed them always available (Assumption 5.1). Then ${\it PL}(\lceil x\rceil)$ is $\forall r\,.\,\pi_{\lceil\_\rceil}(x,r)$. We can drop the universal quantifier and therefore assume $\pi_{\lceil\_\rceil}(x,r)$ as an axiom formula in the translated predicate logic specification. Let us now show that the matching logic equality $x=y$, which is syntactic sugar for $\neg\lceil\neg(x\leftrightarrow y)\rceil$, translates to the equality $x=y$ in predicate logic. Applying the translation above, we get ${\it PL}(x=y)$ is $\forall r\,.\,\neg(\exists r_{1}\,.\,\neg(x=r_{1}\leftrightarrow y=r_{1})\wedge\pi_{\lceil\_\rceil}(r_{1},r))$, which is equivalent, in predicate logic with equality, to $\forall r\,.\,\forall r_{1}\,.\,(x=r_{1}\leftrightarrow y=r_{1})$, which is further equivalent to $x=y$. Similarly, we can show that the translation of the equational pattern stating that $\sigma$ is functional, namely $\forall x_{1}\ldots x_{n}\,.\,\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$, indeed corresponds to the predicate logic formula $\forall x_{1},\ldots,x_{n}\,.\,\exists y\,.\,\forall z\,.\,(\pi_{\sigma}(x_{1},\ldots,x_{n},z)\leftrightarrow y=z)$, as expected. We leave this as an exercise to the interested reader.

Proposition 30 gives us a sound and complete procedure for matching logic reasoning: translate the specification $(S,\Sigma,F)$ and pattern to prove $\varphi$ into the predicate logic specification $(S,\Pi_{\Sigma},{\it PL}(F))$ and formula ${\it PL}(\varphi)$, respectively, and then derive it using the sound and complete proof system of predicate logic. However, translating patterns to predicate logic formulae makes reasoning harder not only for humans, but also for computers, since new quantifiers are introduced. For example,

[TABLE]

discussed and proved in a few steps in Section 11, translates into the following formula (to keep it small, we do not translate the numbers), which takes dozens, if not hundreds of steps to prove using the predicate logic proof system:

[TABLE]

What we would like is to reason directly with matching logic patterns, the same way we reason directly with terms in FOL without translating them to predicate logic.

11. Matching Logic: Sound and Complete Deduction

In Figure 5, we propose a sound and complete proof system for matching logic (under Assumption 5.1). The first group of rules/axioms are those of FOL with equality, discussed and proved sound in Section 2 (predicate logic: Proposition 2), Section 5.2 (equational: Proposition 11), and Section 5.4 (FOL Substitution, called Term Substitution there: Corollary 21), with a slightly generalized Substitution axiom that we call Functional Substitution (discussed below), which requires another axiom (shown sound by Corollary 18), called Functional Variable, stating that variables are functional. The second group of rules/axioms are about membership and were proved sound in Section 5.3 (Proposition 14).

Substitution must be used with care. Recall FOL’s Substitution: $(\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$. Since matching logic makes no syntactic distinction between terms and predicates, we would like to have a proof system that does not make such a distinction either. Ideally, since terms and predicates are particular patterns, we would like to take the proof system of FOL with equality and turn it into a proof system for matching logic by simply replacing “predicate” and “term” with “pattern”. This actually worked for all the rules and axioms, except for Substitution: $(\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$. Unfortunately, Substitution is not sound if we replace $t$ with any pattern. For example, let $\varphi$ be $\exists y\,.\,x=y$ (Corollary 18). If FOL’s Substitution were sound for arbitrary patterns $\varphi^{\prime}$ instead of $t$, then the formula $\exists y\,.\,\varphi^{\prime}=y$, stating that $\varphi^{\prime}$ is a functional pattern (i.e., it evaluates to a unique element for any valuation: Definition 5.4), would be valid for any pattern $\varphi^{\prime}$. That is, any pattern would be functional, which is neither true nor desired (e.g., $\top$ evaluates to the total set, $\bot$ to the empty set, etc.).

Nevertheless, as proved in Corollary 21, Substitution stays sound if $t$ is a term pattern (Definition 5.4), that is, a pattern build with only functional symbols (interpreted as functions in all models) and no other constructs: $\models(\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$ holds if $\varphi$ is any pattern but $t$ is a term pattern. It turns out that the fact that $t$ is built with only functional symbols is irrelevant, and all that matters is that $t$ is a functional pattern (all term patterns are functional: Corollary 20). We therefore generalize the Term Substitution axiom:

Functional Substitution: $\vdash(\forall x\,.\,\varphi)\wedge(\exists y\,.\,\varphi^{\prime}=y)\rightarrow\varphi[\varphi^{\prime}/x]$

This is more general than the original Substitution in FOL (which allowed only predicates for $\varphi$) and than Term Substitution (Corollary 21): it can also apply when $\varphi^{\prime}$ is not a term pattern but can be proved to be functional. It is interesting to note that a similar modification of Substitution was needed in the context of partial FOL (PFOL) [34], where the interpretations of functional symbols are partial functions, so terms may be undefined; axiom PFOL5 in [34] requires $\varphi^{\prime}$ to be defined in the Substitution rule, and several rules for proving definedness are provided. Note that our condition $\exists y\,.\,\varphi^{\prime}=y$ is equivalent to definedness in the special case of PFOL, and that, thanks to the definability of equality in matching logic, we do not need any special axiomatic or rule support for proving definedness.

We have made no effort to minimize the number of rules and axioms in our proof system in Figure 5. On the contrary, our approach was to include all the rules and axioms that turned out to be useful in proof derivations, especially if they already existed in FOL. Moreover, we preferred to frame “unexpected” properties of matching logic as axioms or proof rules, so that users of the proof system are fully aware of them. For example, we could have merged the Functional Substitution and Functional Variable axioms into the conventional predicate logic Substitution ((5) in Proposition 2) or the FOL Term Substitution (Corollary 21), but we preferred not to, because we want the user of our proof system to be fully aware of the fact that they cannot substitute arbitrary patterns for variables; they should first prove that the pattern is functional. Additionally, our Functional Substitution is more general, in that it applies in more instances, so proof derivations are shorter.

Proposition 31**.**

With the proof system in Figure 5, the following are derivable:

1. (1)

Predicate Logic Substitution ((5) in Proposition 2): $\vdash(\forall x\,.\,\varphi)\rightarrow\varphi[y/x]$ 2. (2)

Term patterns are functional (Corollary 20): $\vdash\exists y\,.\,t=y$ for any term pattern $t$ 3. (3)

Term Substitution (Corollary 21): $\vdash(\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$

Proof 11.1**.**

By propositional calculus reasoning, which is subsumed by our proof system (1. and 2. in Figure 5), for any patterns $A$, $B$, and $C$, if $\vdash A\wedge B\rightarrow C$ and $\vdash B$ then $\vdash A\rightarrow C$. To prove (1), pick $A$ as $\forall x\,.\,\varphi$, $B$ as $\exists z\,.\,y=z$, $C$ as $\varphi[y/x]$. Then $\vdash A\wedge B\rightarrow C$ by Functional Substitution and $\vdash B$ by Functional Variable, so $\vdash A\rightarrow C$, i.e., $\vdash(\forall x\,.\,\varphi)\rightarrow\varphi[y/x]$.

We prove (2) and (3) together, by structural induction on $t$. If $t$ is a variable then they follow by Functional Variable and, respectively, by (1). Suppose that $t$ is $\sigma(t_{1},\ldots,t_{n})$ for some functional symbol $\sigma$, i.e., one for which we have an axiom $\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$ (Definition 5.4), and for some appropriate term patterns $t_{1}$, …, $t_{n}$. By the induction hypothesis of (2), we have $\vdash\exists y_{1}\,.\,t_{1}=y_{1}$, …, $\vdash\exists y_{n}\,.\,t_{n}=y_{n}$. By the induction hypothesis on (3) with $x$ as $x_{1}$ and $\varphi$ as $\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$, we derive

[TABLE]

Since $\vdash\forall x_{1}\,.\,\exists y\,.\,\sigma(x_{1},\ldots,x_{n})=y$ by the functionality axiom of $\sigma$ and Universal Generalization, we derive $\vdash\exists y\,.\,\sigma(t_{1},x_{2},\ldots,x_{n})=y$. By the induction hypothesis on (3) with $x$ as $x_{2}$ and $\varphi$ as $\exists y\,.\,\sigma(t_{1},x_{2},\ldots,x_{n})=y$, we derive $\vdash(\forall x_{2}\,.\,\exists y\,.\,\sigma(t_{1},x_{2},\ldots,x_{n})=y)\rightarrow\exists y\,.\,\sigma(t_{1},t_{2},\ldots,x_{n})=y$. Since $\vdash\forall x_{2}\,.\,\exists y\,.\,\sigma(t_{1},x_{2},\ldots,x_{n})=y$ by the previous derivation and Universal Generalization, we derive $\vdash\exists y\,.\,\sigma(t_{1},t_{2},x_{3},\ldots,x_{n})=y$. Iterating this process for all the arguments of $\sigma$, we eventually derive $\vdash\exists y\,.\,\sigma(t_{1},\ldots,t_{n})=y$, that is, $\vdash\exists y\,.\,t=y$. The only thing left is to prove $(3)$. We prove it similarly to (1), using (2): in the propositional calculus property at the beginning of the proof, pick $A$ as $\forall x\,.\,\varphi$, $B$ as $\exists y\,.\,t=y$, and $C$ as $\varphi[t/x]$. Then $\vdash A\wedge B\rightarrow C$ by Functional Substitution and $\vdash B$ by (2) above, so $\vdash A\rightarrow C$, i.e., $\vdash(\forall x\,.\,\varphi)\rightarrow\varphi[t/x]$.

Our approach to obtain a sound and complete proof system for matching logic is to build upon its reduction to predicate logic with equality in Section 10. Specifically, to use Proposition 30 and the complete proof system of predicate logic with equality. Given a matching logic signature $(S,\Sigma)$, let $(S,\Pi_{\Sigma})$ be the predicate logic (with equality) signature obtained like in Section 10. Besides the ${\it PL}$ translation there, we also define a backwards translation ${\it ML}$ of predicate logic with equality $(S,\Pi_{\Sigma})$-formulae into $(S,\Sigma)$-patterns:

[TABLE]

Recall from Section 5.2 that we assume equality and membership in all specifications.

Theorem 32**.**

The proof system in Figure 5 is sound and complete: $F\models\varphi$ iff $F\vdash\varphi$.

Proof 11.2**.**

Propositions 2 and 12 showed the soundness of all rules except for Substitution. Corollary 21 showed the soundness of the stronger Term Substitution. To show the soundness of Functional Substitution, we show $\overline{\rho}((\forall x\,.\,\varphi)\wedge(\exists y\,.\,\varphi^{\prime}=y))\subseteq\overline{\rho}(\varphi[\varphi^{\prime}/x])$ for any model $M$ and valuation $\rho:\textit{Var}\rightarrow M$. Let $s$ be the sort of $\varphi$ and $s^{\prime}$ be the sort of $\varphi^{\prime}$. We have $\overline{\rho}((\forall x\,.\,\varphi)\wedge(\exists y\,.\,\varphi^{\prime}=y))=\bigcap\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\mathrel{\cap}\bigcup\{M_{s}\mid\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}},\ \overline{\rho^{\prime}}(\varphi^{\prime})=\{\rho^{\prime}(y)\}\}$. Since $y\not\in{\it FV}(\varphi^{\prime})$, it follows that $\overline{\rho^{\prime}}(\varphi^{\prime})=\overline{\rho}(\varphi^{\prime})$. Therefore, all we have to show is the following: if $\overline{\rho}(\varphi^{\prime})=\{a\}$ for some $a\in M_{s^{\prime}}$ then $\bigcap\{\overline{\rho^{\prime}}(\varphi)\mid\rho^{\prime}\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}=\rho\!\!\upharpoonright_{\textit{Var}\backslash\{x\}}\}\subseteq\overline{\rho}(\varphi[\varphi^{\prime}/x])$. This holds because $\overline{\rho}(\varphi[\varphi^{\prime}/x])=\overline{\rho[a/x]}(\varphi)$.

We now show the completeness. First, note that Proposition 30 and the completeness of predicate logic imply that $F\models\varphi$ iff ${\it PL}(F)\vdash_{\it PL}^{=}{\it PL}(\varphi)$. Second, note that ${\it PL}(F)\vdash_{\it PL}^{=}{\it PL}(\varphi)$ implies ${\it ML}({\it PL}(F))\vdash{\it ML}({\it PL}(\varphi))$, because the ${\it ML}$ translation only replaces predicates $\pi_{\sigma}(r_{1},\ldots,r_{n},r)$ with $r\in\sigma(r_{1},\ldots,r_{n})$ and the proof rules of predicate logic, except for Substitution, are a subset of the proof rules in Figure 5, while the predicate logic Substitution is derivable in matching logic ((1) in Proposition 31). Third, notice that the completeness result holds if we can show $F\vdash\varphi$ iff $F\vdash{\it ML}({\it PL}(\varphi))$ for any pattern $\varphi$: indeed, if that is the case then $F\vdash{\it ML}({\it PL}(F))$, which together with ${\it ML}({\it PL}(F))\vdash{\it ML}({\it PL}(\varphi))$ implies $F\vdash{\it ML}({\it PL}(\varphi))$, which further implies $F\vdash\varphi$.

Let us now prove that $F\vdash\varphi$ iff $F\vdash{\it ML}({\it PL}(\varphi))$ for any pattern $\varphi$. We first show $\vdash r\in\varphi={\it ML}({\it PL}_{2}(\varphi,r))$ by induction on $\varphi$. The cases $\varphi\equiv x$, $\varphi\equiv\neg\varphi^{\prime}$, $\varphi\equiv\varphi_{1}\wedge\varphi_{2}$, and $\varphi\equiv\exists y.\varphi^{\prime}$ are immediate consequences of the axioms 9-12 in Figure 5, using the induction hypothesis and Equality Elimination (rule 7). For the case $\varphi\equiv\sigma(\varphi_{1},\ldots,\varphi_{n})$, we can first derive $\vdash{\it ML}({\it PL}_{2}(\varphi,r))=\exists r_{1}\cdots\exists r_{n}\,.\,r_{1}\in\varphi_{1}\wedge\cdots\wedge r_{n}\in\varphi_{n}\wedge r\in\sigma(r_{1},\ldots,r_{n})$ using the induction hypothesis and Equality Elimination, and then $\vdash r\in\varphi=\exists r_{1}\cdots\exists r_{n}\,.\,r_{1}\in\varphi_{1}\wedge\cdots\wedge r_{n}\in\varphi_{n}\wedge r\in\sigma(r_{1},\ldots,r_{n})$ using axiom 13 in Figure 5 and conventional FOL reasoning. Therefore, $\vdash r\in\varphi={\it ML}({\it PL}_{2}(\varphi,r))$. Our result now follows by proof rules 8 in Figure 5, since ${\it ML}({\it PL}(\varphi))\equiv\forall r\,.\,{\it ML}({\it PL}_{2}(\varphi,r))$.

As an example, let us informally use the proof system in Figure 5 together with the axiom patterns in Section 9.2, to derive $(1\mapsto 5*2\mapsto 0*7\mapsto 9*8\mapsto 1)\rightarrow{\it list}(7,9\cdot 5)$. For simplicity, like in separation logic, let us assume that the axioms of commutativity, associativity and idempotence of $\_*\_$ are axiom schemas, so we do not need to explicitly use the substitution rule to instantiate them; in a mechanical verification setting, their soundness as schemas can be proved separately from the basic axioms.

Recall the following axiom patterns about linked lists with data from Section 9.2:

[TABLE]

Using the left axioms, axioms for sequences in Section 6.1, and axioms of maps, by Functional Substitution and Equality Elimination (Figure 5) we derive $\vdash 1\mapsto 5*2\mapsto 0=1\mapsto[5,0]$ and $\vdash 7\mapsto 9*8\mapsto 1=7\mapsto[9,1]$, respectively. By the first axiom for ${\it list}$ above, $\vdash{\it list}(0,\epsilon)={\it emp}$. Note that Functional Substitution is equivalent to $\vdash\varphi[\varphi^{\prime}/y]\wedge(\exists y\,.\,\varphi^{\prime}=y)\rightarrow(\exists x\,.\,\varphi)$ (by propositional reasoning, e.g., $A\rightarrow B=\neg B\rightarrow\neg A$), so we get $\vdash 1\mapsto[5,0]*{\it list}(0,\epsilon)\rightarrow(\exists z\,.\,1\mapsto[5,z]*{\it list}(z,\epsilon))$, which by the second axiom of ${\it list}$ above yields $\vdash 1\mapsto[5,0]*{\it list}(0,\epsilon)\rightarrow{\it list}(1,5)$. Following similar reasoning for the other binding, we can construct the following (informal) proof derivation:

[TABLE]

When applying structural framing (Proposition 3) above, we assumed the completeness of the matching logic proof system (Theorem 32). It is an insightful exercise to directly prove Proposition 3 with $\vdash$ instead of $\models$, without using the completeness theorem but only the proof rules in Figure 5 (hint: use the membership rules).

The example proof above was neither difficult nor unexpected, and it followed almost the same steps as the corresponding separation logic proof. Indeed, in spite of matching logic’s simplicity (recall that its syntax is even simpler than that of FOL: Definition 2.1) and domain-independence, it has the necessary expressiveness and capability to carry out proof derivations for particular domains given as matching logic specifications that are as abstract and intuitive as in logics specifically crafted for those domains. Additionally, its patterns are expressive enough to capture complex structural and logical properties about program configurations, at the same time giving us the peace of mind that any such properties are derivable with a uniform, domain-independent proof system.

12. Additional Related Work

Matching logic builds upon intuitions from and relates to at least five important logical frameworks: (1) Relation algebra (RA) (see, e.g., [88]), noticing that our interpretations of symbols as functions to powersets are equivalent to relations; although our interpretation of symbols captures better the intended meaning of pattern and matching, and our proof system is quite different from that of RA, like with FOL we expect a tight relationship between matching logic and RA, which is left as future work; (2) Partial FOL (see, e.g., [34] for a recent work and a survey), noticing that our interpretations of symbols into powersets are more general than partial functions (Section 5.2 shows how we defined definedness); (3) Separation logics (SL) (see, e.g.,[67]), which we discussed in Section 9; and (4) Precursors of matching logic in [80, 83, 84, 85, 79, 27], which proposed the pattern idea by extending FOL with particular “configuration” terms (grayed box below is the only change to FOL):

[TABLE]

where $T_{\Sigma,{\it Cfg}}(X)$ is the set of terms of a special sort $\it Cfg$ (from “configurations”) over variables in set $X$. To avoid terminology conflicts, we here strengthen the proposal in [78] to call the variant above topmost matching logic from here on. Topmost matching logic can trivially be desugared into FOL with equality by regarding a particular pattern predicate $t\in T_{\Sigma,{\it Cfg}}(X)$ as syntactic sugar for “(current state/configuration is) equal to $t$”, i.e., $\square=t$. One major limitation of topmost matching logic, which motivated the generalization in [78] with full details added in this paper, is that its restriction to patterns of sort Cfg prevented us to define local patterns (e.g., the heap list pattern) and perform local reasoning. They had to be defined globally, as patterns of sort $\it Cfg$ with structural frames for everything else except their target cell (e.g., the heap), which was not only more verbose but also less modular.

The basic idea of regarding terms with variables as sentences/patterns that are satisfied/matched by ground terms, goes back to [58] and it was further studied in [57, 87, 35, 73, 61]. Furthermore, terms enriched with Boolean conditions over their variables, called constrained terms, were studied in [23], together with their relation to narrowing. These approaches allow certain Boolean algebra operations to be applied to patterns, and study the expressiveness of such operations w.r.t. the languages of ground terms that they define, in particular conditions under which negation can be eliminated. In addition to Boolean algebra operations and conditions on terms with variables, matching logic also allows quantification over variables, as well as using the resulting patterns nested inside other patterns. The richer syntax of patterns in matching logic is motivated by needs to specify complex structures with mixed constraints over program configurations, as shown in Section 2.2. Also, matching logic allows models with any data, not only term models, interprets symbols as relations with the axiomatic capability to constrain them as functions, and organizes the patterns and their models in a logic that admits a sound and complete proof system.

The idea of regarding terms as patterns is also reminiscent of pattern calculus [52], although note that matching logic’s patterns are intended to express and reason about static properties of data-structures or program configurations, while pattern calculi are aimed at generally and compactly expressing computations and dynamic behaviors of systems. So far we used rewriting to define dynamic semantics; it would be interesting to explore the combination of pattern calculus and matching logic for language semantics and reasoning.

13. Conclusion and Future Work

Matching logic is a sound and complete FOL variant that makes no distinction between function and predicate symbols. Its formulae, called patterns, mix symbols, logical connectives and quantifiers, and evaluate in models to sets of values, those that “match” them, instead of just one value as terms do or a truth value as predicates do in FOL. Equality can be defined and several important variants of FOL fall as special fragments. Separation logic can be framed as a matching logic theory within the particular model of partial finite-domain maps, and heap patterns can be elegantly specified using equations. Matching logic allows spatial specification and reasoning anywhere in a program configuration, and for any language, not only in the heap or other particular and fixed semantic components.

We made no efforts to minimize the number of rules in our proof system (Figure 5), because our main objective in this paper was to include the proof system for FOL with equality as part of our proof system, to indicate that conventional reasoning remains valid and thus automated provers can be used unchanged. It is likely, however, that a minimal proof system working directly with the definedness symbols $\lceil\_\rceil$ can be obtained such that the equality and membership axioms and rules in Figure 5 can be proved as lemmas.

Our completeness result in Section 11 relies heavily on equality and on membership patterns, whose definitions require the existence of the definedness symbols $\lceil\_\rceil$. On the other hand, Proposition 30 translates arbitrary matching logic validity to validity in predicate logic with equality, even when there are no definedness symbols. Since predicate logic with equality admits complete deduction, we conjecture that matching logic must admit an alternative complete proof system which does not rely on definedness symbols.

We have not discussed any computationally effective fragments of matching logic or heuristics to automate matching logic deduction. These are crucial for the development of practical provers and program verifiers. The systematic study of such fragments and heuristics is left for future work. Also, complexity results in the style of [21, 1, 16, 50] for separation logic can likely also be obtained for fragments of matching logic.

Many of the results related to localizing/globalizing reasoning, such as Propositions 3, 13, and 4, extend to monotone/positive contexts, that is, to ones without negations on the path to the placeholder. While non-monotonic contexts do not seem to occur frequently in program verification efforts, it would nevertheless be worthwhile investigating techniques for the elimination of negation, likely generalizing those in [57, 87, 35], or intuitionistic variants of matching logic where negation is not allowed at all in patterns.

Finally, the main application of matching logic so far was as a pattern language for reachability logic [28, 27, 79, 84], where reachability rules, which are pairs of patterns $\varphi\mathbin{\Rightarrow}\varphi^{\prime}$, can be used to specify both operational semantics rules and properties to prove about programs. Reachability logic has its own (language independent) sound and relatively complete proof system. We conjecture that we can capture reachability logic as an instance of matching logic, too, in a similar vein to how we did it for modal logic in Section 8: add some new symbols with their (axiomatized) semantics and then prove the proof rules of reachability logic as lemmas/corollaries. For example, we can extend the world models $M$ in Section 8 with a Kripke transition relation $w\,R\,w^{\prime}$ by adding a symbol $\circ\_\in\Sigma_{{\it World},{\it World}}$ and assuming $w\,R\,w^{\prime}$ iff $w\in\circ_{M}(w^{\prime})$, then define $\Diamond$ and other CTL or even CTL∗ operators as least fixed points, and finally the reachability rules as sugar.

Acknowledgments. This is an extended version of an RTA’15 invited paper [78]. The author warmly thanks the RTA’15 program committee for the invitation and to the anonymous reviewers. The author also expresses his deepest thanks to the $\mathbb{K}$ team (http://kframework.org), who share the belief that programming languages should have only one semantics, which should be executable, and formal analysis tools, including fully fledged deductive program verifiers, should be obtained from such semantics at little or no extra cost. I would like to also warmly thank the following colleagues and friends for their comments and criticisms on previous drafts of this paper: Nikolaj Bjorner, Xiaohong Chen, Claudia-Elena Chiriţă, Maribel Fernández, Ioana Leuştean, Dorel Lucanu, José Meseguer, Brandon Moore, Daejun Park, Cosmin Rădoi, Traian Florin Şerbănuţă, and Andrei Ştefănescu.