2.1. Notational preliminaries

For any function $f\colon X\to Y$ , given a set $X'\subseteq X$ , $f(X')=\{f(x) \mid x\in X'\}\subseteq Y$ is the image of $X'$ w.r.t. f, and for $Y'\subseteq Y$ , $f^{-1}(Y') = \{ x\in X \mid f(x)\in Y'\}$ is the coimage of $Y'$ w.r.t. f.

Throughout the paper we freely use the basic notions from category theory (category, functor, natural transformation, pushout, etc.). Composition in any category is denoted by “ ${\mathord {;}}$ ” (semicolon) and written in the diagrammatic order. For instance, $f\colon A\to B$ is a retraction if for some $g\colon B\to A$ we have $g\mathord {;} f= {id}_B$ , and $f\colon A\to B$ is a coretraction (or section) if for some $g\colon B\to A$ we have $f\mathord {;} g= {id}_A$ . The collection of objects of any category $\textbf {K}$ is written as $|\textbf {K}|$ . The category of sets is denoted by $\mathbf {Set}$ , and the (quasi-)category of classes (or discrete categories) by $\mathbf {Class}$ .

2.2. Institutions

In the area of foundations of software specification and development [Reference Sannella and Tarlecki40] it is standard by now to abstract away from the details of the logical system in use, relying on the formalisation of a logical system as an institution [Reference Goguen and Burstall26]. An institution ${\mathbf {I}}$ consists of:

• • a category $\mathbf {Sig}_{\mathbf {I}}$ of signatures;

• • a functor $\mathbf {Sen}_{\mathbf {I}} \colon \mathbf {Sig}_{\mathbf {I}} \rightarrow \mathbf {Set}$ , giving a set $\mathbf {Sen}_{\mathbf {I}}(\Sigma )$ of $\Sigma $ -sentences for each signature $\Sigma \in |\mathbf {Sig}_{\mathbf {I}}|$ ;

• • a functor $\mathbf {Mod}_{\mathbf {I}} \colon \mathbf {Sig}_{\mathbf {I}}^{\mathit{op}} \rightarrow \mathbf {Class}$ , giving a class (or a discrete category)Footnote ¹ $\mathbf {Mod}_{\mathbf {I}}(\Sigma )$ of $\Sigma $ -models for each signature $\Sigma \in |\mathbf {Sig}_{\mathbf {I}}|$ ; and

• • a family $\langle {{\models _{\mathbf {I},\Sigma }} \subseteq {\mathbf {Mod}_{\mathbf {I}}(\Sigma ) \times \mathbf {Sen}_{\mathbf {I}}(\Sigma )}}\rangle _{\Sigma \in |\mathbf {Sig}_{\mathbf {I}}|}$ of satisfaction relations

such that the reducts $\mathbf {Mod}_{\mathbf {I}}(\sigma ) \colon \mathbf {Mod}_{\mathbf {I}}(\Sigma ') \rightarrow \mathbf {Mod}_{\mathbf {I}}(\Sigma )$ of models and translations $\mathbf {Sen}_{\mathbf {I}}(\sigma ) \colon \mathbf {Sen}_{\mathbf {I}}(\Sigma ) \rightarrow \mathbf {Sen}_{\mathbf {I}}(\Sigma ')$ of sentences induced any signature morphism $\sigma \colon \Sigma \rightarrow \Sigma '$ preserve the satisfaction relation, that is, for any $\varphi \in \mathbf {Sen}_{\mathbf {I}}(\Sigma )$ and $M' \in \mathbf {Mod}_{\mathbf {I}}(\Sigma ')$ the following satisfaction condition holds:

$$\begin{align*}M' \models_{\mathbf{I},\Sigma'} \mathbf{Sen}_{\mathbf{I}}(\sigma)(\varphi) \quad\textrm{iff}\quad \mathbf{Mod}_{\mathbf{I}}(\sigma)(M^{\prime}) \models_{\mathbf{I},\Sigma} \varphi. \end{align*}$$

The subscripts I and $\Sigma $ are typically omitted. For any signature morphism ${\sigma \colon \Sigma \rightarrow \Sigma '}$ , the translation $\mathbf {Sen}(\sigma ) \colon \mathbf {Sen}(\Sigma ) \rightarrow \mathbf {Sen}(\Sigma ')$ is often denoted by ${\sigma \colon \mathbf {Sen}(\Sigma ) \rightarrow \mathbf {Sen}(\Sigma ')}$ , and the reduct $\mathbf {Mod}(\sigma ) \colon \mathbf {Mod}(\Sigma ^{\prime }) \rightarrow \mathbf {Mod}(\Sigma )$ by . For instance, combining this with the notation for image and coimage, for $\Phi \subseteq \mathbf {Sen}(\Sigma )$ , $\sigma (\Phi ) = \{\sigma (\varphi ) \mid \varphi \in \Phi \}\subseteq \mathbf {Sen}(\Sigma ')$ , and for $\mathcal {M}\subseteq \mathbf {Mod}(\Sigma )$ , , and the satisfaction condition may be re-stated as: $M'\models \sigma (\varphi )$ iff .

For any signature $\Sigma $ , the satisfaction relation extends naturally to sets of $\Sigma $ -sentences and classes of $\Sigma $ -models. For any set $\Phi \subseteq \mathbf {Sen}(\Sigma )$ , the class of models of $\Phi $ is ${Mod}(\Phi ) = \{M\in \mathbf {Mod}(\Sigma ) \mid M\models \Phi \}$ (such classes of models are called definable), and for any class $\mathcal {M}\subseteq \mathbf {Mod}(\Sigma )$ , the theory of $\mathcal {M}$ is ${{Th}(\mathcal {M}) = \{\varphi \in \mathbf {Sen}(\Sigma ) \mid \mathcal {M}\models \varphi \}}$ . The latter notation is also used for the theory generated by a set of sentences: for $\Phi \subseteq \mathbf {Sen}(\Sigma )$ , ${Th}(\Phi ) = {Th}({Mod}(\Phi ))$ .

As usual, each satisfaction relation determines (semantic) entailment between sets of sentences: $\Phi \subseteq \mathbf {Sen}(\Sigma )$ entails $\Psi \subseteq \mathbf {Sen}(\Sigma )$ (or $\Psi $ is a consequence of $\Phi $ ), written $\Phi \models \Psi $ , when $\Psi \subseteq {Th}(\Phi )$ . The satisfaction condition implies that the semantic entailment is preserved under translation along signature morphisms: for any $\sigma \colon \Sigma \to \Sigma '$ , if $\Phi \models \Psi $ then $\sigma (\Phi )\models \sigma (\Psi )$ . If the opposite implication holds as well, i.e., $\Phi \models \Psi $ iff $\sigma (\Phi )\models \sigma (\Psi )$ for all $\Phi ,\Psi \subseteq \mathbf {Sen}(\Sigma )$ , we say that $\sigma \colon \Sigma \to \Sigma '$ is conservative. In particular, if the reduct is surjective then $\sigma \colon \Sigma \to \Sigma '$ is conservative.Footnote ²

We typically decorate the names for institution components and for other derived notions by primes, indices, etc., to identify the institution they refer to, and rely on this convention whenever the institution is clear from the context. So, for instance, $\mathbf {Mod}_1$ is the model functor in an institution $\mathbf {I}_1$ , ${\models '}$ is the satisfaction relation (and entailment) in $\mathbf {I}'$ , etc.

Examples of institutions abound, see, for instance, [Reference Diaconescu15, Reference Sannella and Tarlecki40] for detailed definitions of many standard and not so standard logical systems formalised as institutions. Here, let us just sketch three standard examples.

In the above sample institutions $\mathbf {FO}$ , $\mathbf {EQ}$ , and $\mathbf {PL}$ all injective signature morphisms induce surjective reducts, and so are conservative. This need not be the case for non-injective morphisms. However, in $\mathbf {FO}_\emptyset $ in $\mathbf {EQ}_\emptyset $ , the variants of $\mathbf {FO}$ and of $\mathbf {EQ}$ where empty carriers of some sorts are permitted in models, not all injective signature morphisms are conservative.

In the examples above, and in many other standard cases, all the signatures, sentences, and models are quite familiar, and link with many intuitions and implicit assumptions. We should stress though that when exploiting the generality of the concept and working with an arbitrary institution, such connotations should be dropped. All the entities involved (signatures, their morphisms, sentences, models, satisfaction relations) are considered entirely abstract, with completely unknown structure and properties. It is perhaps surprising how far one can go with developments of the foundations for software specification [Reference Sannella and Tarlecki40] and an abstract version of model theory [Reference Diaconescu15] in such an abstract setting.

2.3. Extending institutions by models and sentences

We introduce two basic ways of extending institutions, by adding new “abstract” models, and new “abstract” sentences, respectively. The definitions are shaped after the definition of constraints in [Reference Goguen and Burstall26, Reference Sannella and Tarlecki40]. The basic observation is that when a new sentence is to be added to the set of sentences over a signature, with some predefined notion of satisfaction in the institution models, it must also be “fitted” to other signatures to mimic its translation along signature morphisms with this signature as a source. Hence, together with each new sentence, we also add its “formal translations” along signature morphisms. Then, the satisfaction of the formal translations so added is determined by the satisfaction condition. Similarly, when we want to add new models to the class of models over a signature—apart from the new models themselves, we must also add their “formal reducts”.

Consider an arbitrary institution $\mathbf {I}=\langle {\mathbf {Sig}, \mathbf {Sen}, \mathbf {Mod}, \langle {{\models _\Sigma }}\rangle _{\Sigma \in |\mathbf {Sig}|}}\rangle $ .

Suppose that for each signature we are given a set of (new) “sentences” with predefined satisfaction relation in $\mathbf {I}$ -models, which may be organised as a signature-indexed family of sets with relations between the model classes and these sets: $\mathcal {N\!S}=\langle {\mathcal {N\!S}_\Sigma ,{\models ^{\mathcal {N\!S}}_\Sigma }\subseteq {\mathbf {Mod}(\Sigma )\times \mathcal {N\!S}_\Sigma }}\rangle _{\Sigma \in |\mathbf {Sig}|}$ .Footnote ⁴

We define the extension of $\mathbf {I}$ by sentences $\mathcal {N\!S}$ to be the institution $\mathbf {I}^{+}=\langle {\mathbf {Sig}, \mathbf {Sen}^{+}, \mathbf {Mod}, \langle {{\models ^{+}_\Sigma }}\rangle _{\Sigma \in |\mathbf {Sig}|}}\rangle $ , where for $\Sigma \in |\mathbf {Sig}|$ , $\mathbf {Sen}^{+}(\Sigma ) = \mathbf {Sen}(\Sigma ) \cup \{\lceil \tau (\varphi ')\rceil \mid \varphi '\in \mathcal {N\!S}_{\Sigma '},\tau \colon \Sigma '\to \Sigma \}$ .Footnote ⁵ Then for $M\in \mathbf {Mod}(\Sigma )$ , $M\models ^{+}_{\Sigma }\varphi $ iff $M\models _{\Sigma }\varphi $ for $\varphi \in \mathbf {Sen}(\Sigma )$ , and for $\varphi '\in \mathcal {N\!S}_{\Sigma '}$ , $\tau \colon \Sigma '\to \Sigma $ , we define $M\models ^{+}_{\Sigma }\lceil \tau (\varphi ')\rceil $ to hold iff . Finally, for any signature morphism $\sigma \colon \Sigma \to \Sigma "$ , $\mathbf {Sen}^{+}(\sigma )(\varphi )=\mathbf {Sen}(\sigma )(\varphi )$ for $\varphi \in \mathbf {Sen}(\Sigma )$ , and for $\varphi '\in \mathcal {N\!S}_{\Sigma '}$ , $\tau \colon \Sigma '\to \Sigma $ , we define $\mathbf {Sen}^{+}(\sigma )(\lceil \tau (\varphi ')\rceil )=\lceil (\tau \mathord {;}\sigma )(\varphi ')\rceil $ .

This defines an institution, where for $\Sigma \in |\mathbf {Sig}|$ , the new sentences $\varphi \in \mathcal {N\!S}_\Sigma $ are present as $\lceil {id}_\Sigma (\varphi )\rceil $ . Clearly, such an extension does not affect semantic entailments between sets of sentences of the original institution.

Institution extensions by new sentences compose in the following sense: if $\mathbf {I}^{{+}\!\!{+}}$ is an extension by new sentences of an extension $\mathbf {I}^{+}$ of $\mathbf {I}$ by new sentences then $\mathbf {I}^{{+}\!\!{+}}$ is an extension of $\mathbf {I}$ by sentences (the union of the sets of new sentences added in each step should be used for each signature). Note also that $\mathbf {I}$ is its own extension by (the empty set of) new sentences.

Suppose then that for each signature we are given a class of (new) “models” with predefined satisfaction relation for $\mathbf {I}$ -sentences, organised as a signature-indexed family of classes with relations between these classes and the sets of sentences: $\mathcal {N\!M}=\langle {\mathcal {N\!M}_\Sigma ,{\models ^{\mathcal {N\!M}}_\Sigma }\subseteq {\mathcal {N\!M}_\Sigma \times \mathbf {Sen}(\Sigma )}}\rangle _{\Sigma \in |\mathbf {Sig}|}$ .

Then we define the extension of $\mathbf {I}$ by models $\mathcal {N\!M}$ to be the institution $\mathbf {I}^{+}=\langle {\mathbf {Sig}, \mathbf {Sen}, \mathbf {Mod}^{+}, \langle {{\models ^{+}_\Sigma }}\rangle _{\Sigma \in |\mathbf {Sig}|}}\rangle $ , where for $\Sigma \in |\mathbf {Sig}|$ , .Footnote ⁶ Then for $\varphi \in \mathbf {Sen}(\Sigma )$ , $M\models ^{+}_{\Sigma }\varphi $ iff $M\models _{\Sigma }\varphi $ for $M\in \mathbf {Mod}(\Sigma )$ , and for $M'\in \mathcal {N\!M}_{\Sigma '}$ , $\tau \colon \Sigma \to \Sigma '$ , we define to hold iff $M'\models ^{\mathcal {N\!M}}_{\Sigma '}\tau (\varphi )$ . Finally, for any signature morphism $\sigma \colon \Sigma "\to \Sigma $ , for $M\in \mathbf {Mod}(\Sigma )$ , and for $M'\in \mathcal {N\!S}_{\Sigma '}$ , $\tau \colon \Sigma \to \Sigma '$ , we define .

This defines an institution, where for $\Sigma \in |\mathbf {Sig}|$ , the new models $M\in \mathcal {N\!M}_\Sigma $ are present as . Clearly, such an extension mail spoil some of the semantic entailments between sets of sentences of the original institution: for $\Sigma \in |\mathbf {Sig}|$ , $\Phi ,\Psi \subseteq \mathbf {Sen}(\Sigma )$ if $\Phi \models ^{+}\Psi $ then $\Phi \models \Psi $ but the opposite may fail in general (this is in contrast with institution extensions by sentences).

Institutions extensions by new models compose in the following sense: if $\mathbf {I}^{{+}\!\!{+}}$ is an extension by new models of an extension $\mathbf {I}^{+}$ of $\mathbf {I}$ by new models then $\mathbf {I}^{{+}\!\!{+}}$ is an extension of $\mathbf {I}$ by models (the union of the classes of new models added in each step should be used for each signature). Note also that $\mathbf {I}$ is its own extension by (the empty class of) new models.

In the rest of this paper we will use the above constructions presenting new sentences $\mathcal {N\!S}$ and new models $\mathcal {N\!M}$ somewhat informally, avoiding much of the notational burden. In particular, we will disregard the formal distinction between $\varphi \in \mathcal {N\!S}_\Sigma $ and $\lceil {id}_\Sigma (\varphi )\rceil $ , as well as between $M\in \mathcal {N\!M}_\Sigma $ and . For $\Sigma \in |\mathbf {Sig}|$ , we may also define the satisfaction relations ${\models ^{\mathcal {N\!S}}_\Sigma }$ indirectly by defining ${Mod}^{+}(\varphi )\subseteq \mathbf {Mod}(\Sigma )$ for each $\varphi \in \mathcal {N\!S}_\Sigma $ (then for $M\in \mathbf {Mod}(\Sigma )$ , $M\models ^{\mathcal {N\!S}}_\Sigma \varphi $ iff $M\in {Mod}^{+}(\Sigma )$ ), and ${\models ^{\mathcal {N\!M}}_\Sigma }$ by defining ${Th}^{+}(M)\subseteq \mathbf {Sen}(\Sigma )$ for each $M\in \mathcal {N\!M}_\Sigma $ (then for $\varphi \in \mathbf {Sen}(\Sigma )$ , $M\models ^{\mathcal {N\!M}}_\Sigma \varphi $ iff $\varphi \in {Th}^{+}(M)$ ).

2.4. Institution morphisms

There are a number of standard notions to capture relationships between different institutions, with institution morphisms [Reference Goguen and Burstall26] and comorphisms [Reference Goguen and Roşu27] (plain maps [Reference Meseguer and Ebbinghaus29] or representations [Reference Tarlecki, Haveraaen, Owe and Dahl43]) perhaps the most common.

Let ${\mathbf {I}} = \langle {\mathbf {Sig}}, {\mathbf {Sen}}, {\mathbf {Mod}}, \langle {{\models _\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}\rangle $ and ${\mathbf {I}}' = \langle {\mathbf {Sig}}', {\mathbf {Sen}}', {\mathbf {Mod}}', \langle {{\models _{\Sigma '}^{\prime }}}\rangle _{\Sigma '\in |{\mathbf {Sig}}'|}\rangle $ be institutions. An institution morphism $\mu \colon {\mathbf {I}} \rightarrow {\mathbf {I}}'$ consists of:

• • a functor $\mu ^{{Sig}} \colon {\mathbf {Sig}} \rightarrow {\mathbf {Sig}}'$ ,

• • a natural transformation $\mu ^{{Sen}} \colon \mu ^{{Sig}}\mathord {;}{\mathbf {Sen}}' \rightarrow {\mathbf {Sen}}$ , i.e., a family of functions $\mu ^{{Sen}}_\Sigma \colon {\mathbf {Sen}}'(\mu ^{{Sig}}(\Sigma )) \rightarrow {\mathbf {Sen}}(\Sigma )$ natural in $\Sigma \in |{\mathbf {Sig}}|$ , and

• • a natural transformation $\mu ^{{Mod}} \colon {\mathbf {Mod}} \rightarrow (\mu ^{{Sig}})^{\mathit{op}}\mathord {;}{\mathbf {Mod}}'$ , i.e., a family of functions $\mu ^{{Mod}}_\Sigma \colon {\mathbf {Mod}}(\Sigma ) \rightarrow {\mathbf {Mod}}'(\mu ^{{Sig}}(\Sigma ))$ natural in $\Sigma \in |{\mathbf {Sig}}|$

such that for any signature $\Sigma \in |{\mathbf {Sig}}|$ , $\varphi '\in {\mathbf {Sen}}'(\mu ^{{Sig}}(\Sigma )),$ and $M\in {\mathbf {Mod}}(\Sigma )$ , $M\models _\Sigma \mu ^{{Sen}}_\Sigma (\varphi ')$ iff $\mu ^{{Mod}}_\Sigma (M)\models ^{\prime }_{\mu ^{{Sig}}(\Sigma )}\varphi '$ (this is referred to as the satisfaction condition for  $\mu $ ).

To simplify the notation, all three components of an institution morphism $\mu $ are typically denoted by $\mu $ as well, omitting the superscripts whenever they are clear from the context.

It follows that semantic entailment is preserved by translation under institution morphisms: for any signature $\Sigma \in |{\mathbf {Sig}}|$ and sets of sentences $\Phi ',\Psi '\subseteq {\mathbf {Sen}}'(\mu (\Sigma ))$ , if $\Phi '\models '\Psi '$ then $\mu _\Sigma (\Phi ')\models \mu _\Sigma (\Psi ')$ . Moreover, if the translation of models $\mu _\Sigma \colon {\mathbf {Mod}}(\Sigma )\to {\mathbf {Mod}}'(\mu (\Sigma ))$ is surjective then the opposite implication holds as well, that is, $\Phi '\models '\Psi '$ iff $\mu _\Sigma (\Phi ')\models \mu _\Sigma (\Psi ')$ .

For instance, there is an obvious institution morphisms from the institution ${\mathbf {FO}}$ of first-order logic to the institution ${\mathbf {PL}}$ of propositional logic (removing from signatures everything but nullary predicates). For further examples of institution morphisms spelled out in detail we refer to [Reference Diaconescu15, Reference Sannella and Tarlecki40].

Throughout this paper we deal with a special case of institution morphisms that leave the signature category intact, that is, where the signature functor is the identity. This also allows us to disregard institution comorphisms, since in this case the two notions are essentially the same (institution morphisms from ${\mathbf {I}}$ to ${\mathbf {I}}'$ with the identity signature functor coincide with comorphisms from ${\mathbf {I}}'$ to ${\mathbf {I}}$ with the identity signature functor).

An institution morphism $\mu \colon {\mathbf {I}} \rightarrow {\mathbf {I}}'$ is logically trivial if it is the identity on signatures and surjective on sentences and models, that is, ${\mathbf {Sig}}'={\mathbf {Sig}}$ and ${\mu ^{{Sig}}={id}_{\mathbf {Sig}}}$ , and for all signatures $\Sigma \in |{\mathbf {Sig}}|$ , the functions $\mu _\Sigma \colon {\mathbf {Sen}}'(\Sigma ) \to {\mathbf {Sen}}(\Sigma )$ and $\mu _\Sigma \colon {\mathbf {Mod}}(\Sigma ) \to {\mathbf {Mod}}'(\Sigma )$ are surjective.

Special institution morphisms relate institutions with their extensions by new sentences and by new models, respectively, introduced in Section 2.3.

Let ${\mathbf {I}}^{+}_{\mathcal {N\!S}}$ be the extension of institution ${\mathbf {I}}=\langle {{\mathbf {Sig}}, {\mathbf {Sen}}, {\mathbf {Mod}}, \langle {{\models _\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ by sentences $\mathcal {N\!S}=\langle {\mathcal {N\!S}_\Sigma ,{\models ^{\mathcal {N\!S}}_\Sigma }\subseteq {\mathbf {Mod}}(\Sigma )\times \mathcal {N\!S}_\Sigma }\rangle _{\Sigma \in |{\mathbf {Sig}}|}$ , as defined in Section 2.3. Then there is an obvious institution morphism $\mu _{\mathcal {N\!S}}\colon {\mathbf {I}}^{+}_{\mathcal {N\!S}}\to {\mathbf {I}}$ , where $\mu ^{{Sig}}_{\mathcal {N\!S}}$ and $\mu ^{{Mod}}_{\mathcal {N\!S}}$ are identities (the former is the identity functor on ${\mathbf {Sig}}$ , the latter is the identity natural transformation on ${\mathbf {Mod}}\colon {\mathbf {Sig}}^{\mathit{op}}\to \mathbf {Class}$ ), and for $\Sigma \in |{\mathbf {Sig}}|$ , $(\mu ^{{Sen}}_{\mathcal {N\!S}})_\Sigma \colon {\mathbf {Sen}}(\Sigma )\to {\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma )$ are inclusions. Somewhat ambiguously, we refer to this institution morphism as the extension of ${\mathbf {I}}$ by $\mathcal {N\!S}$ as well.

Similarly, let ${\mathbf {I}}^{+}_{\mathcal {N\!M}}$ be the extension of ${\mathbf {I}}=\langle {{\mathbf {Sig}}, {\mathbf {Sen}}, {{\mathbf {Mod}}}, \langle {{\models _\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ by models $\mathcal {N\!M}=\langle {\mathcal {N\!M}_\Sigma ,{\models ^{\mathcal {N\!M}}_\Sigma }\subseteq {\mathcal {N\!M}_\Sigma \times {\mathbf {Sen}}(\Sigma )}}\rangle _{\Sigma \in |{\mathbf {Sig}}|}$ , as defined in Section 2.3. There is an obvious institution morphism $\mu _{\mathcal {N\!M}}\colon {\mathbf {I}}\to {\mathbf {I}}^{+}_{\mathcal {N\!M}}$ , where $\mu ^{{Sig}}_{\mathcal {N\!M}}$ and $\mu ^{{Sen}}_{\mathcal {N\!M}}$ are identities, and for $\Sigma \in |{\mathbf {Sig}}|$ , $(\mu ^{{Mod}}_{\mathcal {N\!M}})_\Sigma \colon {\mathbf {Mod}}(\Sigma )\to {\mathbf {Mod}}^{+}_{\mathcal {N\!M}}(\Sigma )$ are inclusions. We also refer to this institution morphism as the extension of ${\mathbf {I}}$ by $\mathcal {N\!M}$ .

Institution morphisms compose in the obvious, component-wise manner [Reference Goguen and Burstall26].

Proposition 2.7. Consider institutions ${\mathbf {I}}'=\langle {{\mathbf {Sig}}, {\mathbf {Sen}}', {\mathbf {Mod}}', \langle {{\models _{\Sigma }'}}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ and ${\mathbf {I}}"=\langle {{\mathbf {Sig}}, {\mathbf {Sen}}", {\mathbf {Mod}}", \langle {{\models _{\Sigma }"}}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ with a common signature category, and an institution morphism $\mu \colon {\mathbf {I}}'\to {\mathbf {I}}"$ with $\mu ^{{Sig}}={id}_{{\mathbf {Sig}}}$ . Then for some institution ${\mathbf {I}}$ , extension ${\mathbf {I}}^{+}_{\mathcal {N\!S}}$ of ${\mathbf {I}}$ by new sentences, extension ${\mathbf {I}}^{+}_{\mathcal {N\!M}}$ of ${\mathbf {I}}$ by new models, and logically trivial institution morphisms $\mu '\colon {\mathbf {I}}'\to {\mathbf {I}}^{+}_{\mathcal {N\!S}}$ and $\mu "\colon {\mathbf {I}}^{+}_{\mathcal {N\!M}}\to {\mathbf {I}}"$ we have $\mu =\mu '\mathord {;}\mu _{\mathcal {N\!S}}\mathord {;}\mu _{\mathcal {N\!M}}\mathord {;}\mu"$ :

$$\begin{align*}\underbrace{{\mathbf{I}}' \stackrel{\mu'}{\longrightarrow} {\mathbf{I}}^{+}_{\mathcal{N\!S}} \xrightarrow{\mu_{\mathcal{N\!S}}} {\mathbf{I}} \xrightarrow{\mu_{\mathcal{N\!M}}} {\mathbf{I}}^{+}_{\mathcal{N\!M}} \stackrel{\mu"}{\longrightarrow} {\mathbf{I}}"}_{\mu} \end{align*}$$

Proof First, define ${\mathbf {I}}=\langle {{\mathbf {Sig}},{\mathbf {Sen}}",{\mathbf {Mod}}',\langle {{\models _\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ , where for $\Sigma \in {\mathbf {Sig}}$ , $M'\in {\mathbf {Mod}}'(\Sigma )$ and $\varphi "\in {\mathbf {Sen}}"(\Sigma )$ , we define $M'\models _\Sigma \varphi "$ to hold iff $M'\models ^{\prime }_\Sigma \mu _\Sigma (\varphi ")$ , or equivalently (by the satisfaction condition for $\mu $ ) iff $\mu _\Sigma (M^{\prime })\models ^{\prime \prime }_\Sigma \varphi "$ . This indeed defines an institution, since the satisfaction condition for ${\mathbf {I}}$ follows from the satisfaction condition for ${\mathbf {I}}'$ and naturality of $\mu ^{{Sen}}$ (or the satisfaction condition for ${\mathbf {I}}"$ and naturality of $\mu ^{{Mod}}$ ).

Consider “new” sentences $\mathcal {N\!S}=\langle {\mathcal {N\!S}_\Sigma ,{\models ^{\mathcal {N\!S}}_\Sigma }\subseteq {{\mathbf {Mod}}'(\Sigma )\times \mathcal {N\!S}_\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}$ , where for $\Sigma \in |{\mathbf {Sig}}|$ , $\mathcal {N\!S}_\Sigma = {{\mathbf {Sen}}'(\Sigma )\setminus \mu _\Sigma ({\mathbf {Sen}}"(\Sigma ))}$ and ${\models ^{\mathcal {N\!S}}_\Sigma }$ is the restriction of ${\models ^{\prime }_\Sigma }$ to $\mathcal {N\!S}_\Sigma $ . Let ${\mathbf {I}}^{+}_{\mathcal {N\!S}}$ be the extension of ${\mathbf {I}}$ by sentences $\mathcal {N\!S}$ , as defined in Section 2.3, with the institution morphism $\mu _{\mathcal {N\!S}}\colon {\mathbf {I}}^{+}_{\mathcal {N\!S}}\to {\mathbf {I}}$ defined above.Footnote ⁷ Then define the institution morphism $\mu '\colon {\mathbf {I}}'\to {\mathbf {I}}^{+}_{\mathcal {N\!S}}$ to be the identity on signatures and models, with $\mu ^{\prime }_\Sigma \colon {\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma )\to {\mathbf {Sen}}'(\Sigma )$ , for $\Sigma \in |{\mathbf {Sig}}|$ , defined as $\mu _\Sigma \colon {\mathbf {Sen}}"(\Sigma )\to {\mathbf {Sen}}'(\Sigma )$ on ${\mathbf {Sen}}"(\Sigma )\subseteq {\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma )$ , and for $\tau \colon \Sigma '\to \Sigma $ in ${\mathbf {Sig}}$ and $\varphi '\in \mathcal {N\!S}_{\Sigma '}\subseteq {\mathbf {Sen}}'(\Sigma ')$ , $\mu ^{\prime }_\Sigma (\lceil \tau (\varphi ')\rceil )={\mathbf {Sen}}'(\tau )(\varphi ')\in {\mathbf {Sen}}'(\Sigma )$ .

The translations of sentences so defined are indeed natural in $\Sigma $ : for any ${\sigma \colon \Sigma _1\to \Sigma _2}$ , we have to check that $\mu ^{\prime }_{\Sigma _1}\mathord {;}{\mathbf {Sen}}'(\sigma )={\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\sigma )\mathord {;}\mu ^{\prime }_{\Sigma _2}$ as functions from ${\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma _1)$ to ${\mathbf {Sen}}'(\Sigma _2)$ . For sentences in ${\mathbf {Sen}}"(\Sigma _1)$ this follows directly from the naturality of $\mu ^{{Sen}}$ . For sentences of the form $\lceil \tau (\varphi ')\rceil \in {\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma _1)$ , where $\tau \colon \Sigma '\to \Sigma _1$ and $\varphi '\in \mathcal {N\!S}_{\Sigma '}$ , we have

$$ \begin{align*} {\mathbf{Sen}}'(\sigma)(\mu^{\prime}_{\Sigma_1}(\lceil\tau(\varphi')\rceil)) &= {\mathbf{Sen}}'(\sigma)({\mathbf{Sen}}'(\tau)(\varphi')) = {\mathbf{Sen}}'(\tau\mathord{;}\sigma)(\varphi') = \\[-1ex] &\kern4pt\quad \mu^{\prime}_{\Sigma_2}(\lceil(\tau\mathord{;}\sigma)(\varphi')\rceil) = \mu^{\prime}_{\Sigma_2}({\mathbf{Sen}}^{+}_{\mathcal{N\!S}}(\sigma)(\lceil\tau(\varphi')\rceil)). \end{align*} $$

To check the satisfaction condition for $\mu '$ , consider $\Sigma \in |{\mathbf {Sig}}|$ , $M'\in {\mathbf {Mod}}'(\Sigma )$ and $\varphi \in {\mathbf {Sen}}^{+}_{\mathcal {N\!S}}(\Sigma )$ . We have to show that $M'\models ^{\prime }_\Sigma \mu ^{\prime }_\Sigma (\varphi )$ iff $M'\models ^{+}_{\mathcal {N\!S},\Sigma }\varphi $ . For ${\varphi \in {\mathbf {Sen}}"(\Sigma )}$ , this follows from the satisfaction condition for $\mu $ and our definitions: $M'\models ^{\prime }_\Sigma \mu ^{\prime }_\Sigma (\varphi )$ is then the same as $M'\models ^{\prime }_\Sigma \mu _\Sigma (\varphi )$ , which is equivalent to $\mu _\Sigma (M^{\prime })\models ^{\prime \prime }_{\Sigma }\varphi $ , which in turn defines $M'\models _{{\mathbf {I}},\Sigma }\varphi $ and $M'\models ^{+}_{\mathcal {N\!S},\Sigma }\varphi $ . For $\varphi $ of the form $\lceil \tau (\varphi ')\rceil $ , where $\tau \colon \Sigma '\to \Sigma $ and $\varphi '\in \mathcal {N\!S}_{\Sigma '}$ , this follows as well, since $M'\models ^{\prime }_\Sigma \mu ^{\prime }_\Sigma (\lceil \tau (\varphi ')\rceil )$ coincides with $M'\models ^{\prime }_\Sigma {\mathbf {Sen}}'(\tau )(\varphi ')$ , which is the same as $M'\models ^{\mathcal {N\!S}}_\Sigma {\mathbf {Sen}}'(\tau )(\varphi ')$ , which in turn defines $M'\models ^{+}_{\mathcal {N\!S},\Sigma }\lceil \tau (\varphi ')\rceil $ .

Consider now “new” models $\mathcal {N\!M}=\langle {\mathcal {N\!M}_\Sigma ,{\models ^{\mathcal {N\!M}}_\Sigma }\subseteq {\mathcal {N\!M}_\Sigma \times {\mathbf {Sen}}"(\Sigma )}}\rangle _{\Sigma \in |{\mathbf {Sig}}|}$ , where for $\Sigma \in |{\mathbf {Sig}}|$ , $\mathcal {N\!M}_\Sigma = {\mathbf {Mod}}"(\Sigma )\setminus \mu _\Sigma ({\mathbf {Mod}}'(\Sigma ))$ and ${\models ^{\mathcal {N\!M}}_\Sigma }$ is the restriction of ${\models ^{\prime \prime }_\Sigma }$ to $\mathcal {N\!M}_\Sigma $ . Let ${\mathbf {I}}^{+}_{\mathcal {N\!M}}$ be the extension of ${\mathbf {I}}$ by models $\mathcal {N\!M}$ , as defined in Section 2.3, with institution morphism $\mu _{\mathcal {N\!M}}\colon {\mathbf {I}}\to {\mathbf {I}}^{+}_{\mathcal {N\!M}}$ defined above. Then let the institution morphism $\mu "\colon {\mathbf {I}}^{+}_{\mathcal {N\!M}}\to {\mathbf {I}}"$ be the identity on signatures and sentences, with $\mu ^{\prime \prime }_\Sigma \colon {\mathbf {Mod}}^{+}_{\mathcal {N\!M}}(\Sigma )\to {\mathbf {Mod}}"(\Sigma )$ , for $\Sigma \in |{\mathbf {Sig}}|$ , defined as $\mu _\Sigma \colon {\mathbf {Mod}}'(\Sigma )\to {\mathbf {Mod}}"(\Sigma )$ on ${\mathbf {Mod}}'(\Sigma )\subseteq {\mathbf {Mod}}^{+}_{\mathcal {N\!M}}(\Sigma )$ , and for $\tau \colon \Sigma \to \Sigma '$ in ${\mathbf {Sig}}$ and $M'\in \mathcal {N\!M}_{\Sigma '}\subseteq {\mathbf {Mod}}"(\Sigma )$ , . By similar arguments as for $\mu '\colon {\mathbf {I}}'\to {\mathbf {I}}^{+}_{\mathcal {N\!S}}$ , it follows that $\mu ^{\prime \prime }_\Sigma \colon {\mathbf {Mod}}^{+}_{\mathcal {N\!M}}(\Sigma )\to {\mathbf {Mod}}"(\Sigma )$ , $\Sigma \in |{\mathbf {Sig}}|$ , are natural in $\Sigma $ , and the satisfaction condition holds for $\mu "$ .

It is easy now to check directly that indeed $\mu =\mu '\mathord {;}\mu _{\mathcal {N\!S}}\mathord {;}\mu _{\mathcal {N\!M}}\mathord {;}\mu "$ .

3.1. Classical interpolation

The Craig interpolation theorem [Reference Craig13] states that if an implication between two first-order formulae $\varphi \mathbin {\Rightarrow }\psi $ holds then there is a formula $\theta $ that uses only the symbols common to $\varphi $ and $\psi $ such that both $\varphi \mathbin {\Rightarrow }\theta $ and $\theta \mathbin {\Rightarrow }\psi $ hold; $\theta $ is then called an interpolant for $\varphi $ and $\psi $ . This is one of the key properties of first-order logic, with numerous applications, including simpler proofs of similarly famous and important results like the Robinson consistency [Reference Robinson36] and Beth definability [Reference Beth4] theorems. The original proof in [Reference Craig13] relied on proof-theoretic arguments, even though many of the applications (as well as some later proofs) of the result have been model-theoretic in nature. The interpolation property has been investigated (and proved or disproved) for many standard extensions (and fragments) of first-order logic [Reference Väänänen48] as well as for other logical systems, for instance for various modal and intuitionistic logics [Reference Gabbay and Maksimova22].

The above statement of the interpolation property implicitly involves the following union/intersection square of signatures:

where $\Sigma _{{p}}$ and $\Sigma _{{c}}$ are (first-order) signatures for $\varphi $ and $\psi $ , respectively, and the arrows indicate signature inclusions.

As recalled in Section 1, interpolation proved indispensable for many foundational aspects of computer science and software engineering, in particular, in the foundations of software specification and development [Reference Sannella and Tarlecki40]. However, the classical formulation of Craig’s interpolation for many applications in this area requires some generalisations, which perhaps do not bring much new insight for this property in the framework of first-order logic, but may be important when other logical systems are considered.

To begin with, the use of implication should be replaced by entailment. Then, we should deal with entailments between sets of sentences, rather than between individual sentences (strictly speaking, this is needed for the premise $\varphi $ and especially for the interpolant $\theta $ —for notational symmetry, we do this for the conclusion $\psi $ as well). Both these generalisations are irrelevant for first-order logic, where implication captures semantic entailment, and a set of sentences in the premise of each single-conclusion entailment may always be replaced by a single sentence (since we have finite conjunctions and the logic is compactFootnote ⁸ ). However, for instance, working in equational logic we have no implication available, and an interpolant cannot be always expressed as a single equation—even though the interpolation property holds if a set of equations is permitted as an interpolant [Reference Rodenburg37].

Perhaps most importantly, for instance in applications where parameterised specifications and their “pushout-style” instantiations [Reference Ehrig, Kreowski, Thatcher, Wagner and Wright21] are involved, we have to go beyond union/intersection squares of signatures and beyond inclusions to relate the signatures. More general classes of signature squares are needed, with non-injective signature morphisms necessary to capture for instance morphisms from the formal to actual parameters, used to “fit” the latter into the mould given by the former. Typically in applications at least pushouts of signature morphism are involved, sometimes additionally restricted to indicated classes of morphisms permitted at the “bottom-left” and “bottom-right” of the squares, respectively [Reference Borzyszkowski6, Reference Diaconescu15, Reference Popescu, Şerbănuţă and Roşu34, Reference Veloso49, Reference Veloso and Maibaum50]. However, for the purposes of this paper we will consider interpolation properties for an arbitrary commuting square of signature morphisms.

The above remarks lead to a general definition of the interpolation property in an arbitrary institution.

3.2. Interpolation in an institution

Throughout the rest of this paper, we consider an institution ${\mathbf {I}}=\langle {{\mathbf {Sig}}, {\mathbf {Sen}}, {\mathbf {Mod}}, \langle {{\models _\Sigma }}\rangle _{\Sigma \in |{\mathbf {Sig}}|}}\rangle $ , and study interpolation properties over the following commutative square $(\ast )$ of signature morphisms:Footnote ⁹

Let $\Phi \subseteq {\mathbf {Sen}}(\Sigma _{{p}})$ and $\Psi \subseteq {\mathbf {Sen}}(\Sigma _{{c}})$ be such that $\sigma _{{\!pu}}(\Phi )\models _{\Sigma _{{u}}}\sigma _{{\!cu}}(\Psi )$ . An interpolant for $\Phi $ and $\Psi $ (over diagram $(\ast )$ ) is a set $\Theta \subseteq {\mathbf {Sen}}(\Sigma _{{i}})$ of $\Sigma _{{i}}$ -sentences such that $\Phi \models _{\Sigma _{{p}}}\sigma _{{\!ip}}(\Theta )$ and $\sigma _{{\!ic}}(\Theta )\models _{\Sigma _{{c}}}\Psi $ .

To simplify some further statements, if $\sigma _{{\!pu}}(\Phi )\not \models _{\Sigma _{{u}}}\sigma _{{\!cu}}(\Psi )$ then we say that any set $\Theta \subseteq {\mathbf {Sen}}(\Sigma _{{i}})$ is an interpolant for $\Phi $ and $\Psi $ (over diagram $(\ast )$ ).

A commutative square $(\ast )$ of signature morphisms admits interpolation if all sets $\Phi \subseteq {\mathbf {Sen}}(\Sigma _{{p}})$ and $\Psi \subseteq {\mathbf {Sen}}(\Sigma _{{c}})$ such that $\sigma _{{\!pu}}(\Phi )\models _{\Sigma _{{u}}}\sigma _{{\!cu}}(\Psi )$ have an interpolant.

It is well known that the interpolation property of a logical system is fragile. When the logic is strengthened or weakened, when new models or sentences are added, the interpolation property may easily be spoiled. Clearly, this may happen when entirely new signatures are added, with new models and sentences over them. Therefore, we will consider the category of signatures to be fixed, and consider only such extensions of institutions that preserve it.

Throughout the rest of the paper we study in some detail how the interpolation property may be spoiled by adding new models or sentences. This will be done from a “local” perspective, for particular commutative squares of signature morphisms, as well as for particular interpolants.

We say that an interpolant $\Theta \subseteq {\mathbf {Sen}}(\Sigma _{{i}})$ for $\Phi \subseteq {\mathbf {Sen}}(\Sigma _{{p}})$ and $\Psi \subseteq {\mathbf {Sen}}(\Sigma _{{c}})$ (over diagram $(\ast )$ ) is stable under extensions of the institution by models if for every extension ${\mathbf {I}}^{+}$ of ${\mathbf {I}}$ by new models, $\Theta $ is an interpolant for $\Phi $ and $\Psi $ in ${\mathbf {I}}^{+}$ ; otherwise we say that the interpolant $\Theta $ is fragile.

While adding new models may spoil existing interpolants, it cannot create new non-trivial ones: in all extensions ${\mathbf {I}}^{+}$ of ${\mathbf {I}}$ by new models, if $\sigma _{{\!pu}}(\Phi )\models ^{+}_{\Sigma _{{u}}}\sigma _{{\!cu}}(\Psi )$ then any interpolant for $\Phi $ and $\Psi $ in ${\mathbf {I}}^{+}$ is an interpolant for $\Phi $ and $\Psi $ in ${\mathbf {I}}$ . Adding new sentences cannot spoil a particular interpolant, but may spoil interpolation property for a given diagram (there may be no interpolant for new sentences, or sets of sentences that contain them), and may create new interpolants (involving some new sentences).

To begin with, we identify some special cases where interpolation is ensured and is stable under any extension of the institution.

3.3. Interpolants may be stable

A trivial special case here is when $\sigma _{{\!ip}}$ and $\sigma _{{\!cu}}$ , or $\sigma _{{\!ic}}$ and $\sigma _{{\!pu}}$ , are isomorphisms, which can be further refined as follows:

This shows that if the signature morphisms in $(\ast )$ satisfy the premises of Corollary 3.3 then the diagram enjoys a stable interpolation property, which cannot be spoiled by any institution extension that leaves the category of signatures unchanged! No matter how we add new models or sentences, the interpolation property is ensured by the properties of the signature morphisms involved and the implied properties of the translations of sentences and reducts of models they induce in the institution and in any of its extensions.

The conditions stated in Corollary 3.3 are in fact quite strong and in many practical situations do not depart too far from the trivial case when $\Sigma _{{p}}$ is (up to isomorphism) included in $\Sigma _{{c}}$ or vice versa. Namely, when the diagram $(\ast )$ is a pushout then condition 1 implies that $\sigma _{{\!cu}}\colon \Sigma _{{c}}\to \Sigma _{{u}}$ is an isomorphism, and condition 2 implies that $\sigma _{{\!pu}}\colon \Sigma _{{p}}\to \Sigma _{{u}}$ is an isomorphism. Dually, when $(\ast )$ is a pullback then condition 1 implies that $\sigma _{{\!ip}}\colon \Sigma _{{i}}\to \Sigma _{{p}}$ is an isomorphism, and condition 2 implies that ${\sigma _{{\!ic}}\colon \Sigma _{{i}}\to \Sigma _{{c}}}$ is an isomorphism.

Somewhat similarly, interpolation is preserved and reflected by logically trivial institution morphisms:

Propositions 2.7 and 3.4 imply that institution extensions by new models and by new sentences are of primary importance for our study of the fragility of interpolation.