Descente Infinie + Deduction

CLAUS-PETER WIRTH, Dept. of Computer Sci., Saarland Univ., D–66123Saarbrücken, Germany.

E-mail: wirth@logic.at

Abstract

Inductive theorem proving in the form of descente infinie was known to the ancient Greeks and is the standard induction method of a working mathematician since it was reinvented in the middle of the 17^{th} century. We present an integration of descente infinie into state-of-the-art free-variable sequent and tableau calculi. It is well-suited for an efficient interplay of human interaction and automation and combines raising, explicit representation of dependence between variables, the liberalized δ-rule, preservation of solutions, and unrestricted applicability of lemmas and induction hypotheses. The semantical requirements are satisfied for a variety of two-valued logics, such as clausal logic, classical first-order logic, and higher-order modal logic.

Keywords: Mathematical Induction, Sequent and Tableau Calculi, Logical Foundations, Formalized Mathematics, Human-Oriented Interactive Automated Theorem Proving

Contents

1  Descente Infinie: An Introduction  3

1.1 What it Is . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1.1 An Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1.2 Axiomatization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1.3 Explicit Induction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.1.4 Descente Infinie in the Working-Mathematician Style . . . . . . . . . . . 6 1.1.5 Descente Infinie versus Explicit Induction . . . . . . . . . . . . . . . . . 7 1.1.6 History and Soundness of Descente Infinie . . . . . . . . . . . . . . . . 7

1.2 How we Do it . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2.1 Design Goals for Inductive Inference Systems . . . . . . . . . . . . . . . 10 1.2.2 Sequent and Tableau Calculi . . . . . . . . . . . . . . . . . . . . . . . . 12 1.2.3 Proof Forests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.2.4 Deductive Inference Rules for Reasoning Within a Proof Tree . . . . . . 13 1.2.5 Skolemization versus Raising in Descente Infinie . . . . . . . . . . . . . 15 1.2.6 Preservation of Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2  Formal Development  17

2.1 Technical Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.1.1 Basic Notions and Notation . . . . . . . . . . . . . . . . . . . . . . . . 17 2.1.2 Dependent Choice, Well-foundedness, and Descente Infinie . . . . . . . 18 2.1.3 Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.1.4 Semantical Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.1.5 The Liberalized δ-rule . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

2.2 The Deductive Machinery . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2.2.1 R-Substitutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 2.2.2 (A, R)-Valuations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

1 L. J. of the IGPL, Vol. 12 No. 1, pp. 1–96 2004 \begin{matrix}c \\ ◯ \end{matrix} Oxford University Press

2.2.3 R-Validity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.2.4 Choice-Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.2.5 (C, R)-Validity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.2.6 Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

2.3 The Inductive Machinery . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.3.1 Weights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.3.2 Counterexamples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.3.3 Groundedness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

2.4 Abstract Sequent and Tableau Calculus . . . . . . . . . . . . . . . . . . . . 34 2.4.1 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 2.4.2 Safeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

2.5 Concrete Sequent and Tableau Calculus . . . . . . . . . . . . . . . . . . . . 38 2.5.1 Expansion Steps Within a Single Tree . . . . . . . . . . . . . . . . . . . 38 2.5.2 Applying Lemmas and Induction Hypotheses . . . . . . . . . . . . . . . 39 2.5.3 Other Concrete Inference Steps . . . . . . . . . . . . . . . . . . . . . . 40

3  Examples  41

3.1 An Example for Lemma Application . . . . . . . . . . . . . . . . . . . . . . 41 3.2 An Example for Mutual Induction . . . . . . . . . . . . . . . . . . . . . . . 43

3.2.1 Induction Ordering in QuodLibet . . . . . . . . . . . . . . . . . . . . 43 3.2.2 The P & Q Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 3.2.3 Sequents versus Tableaus in Descente Infinie . . . . . . . . . . . . . . . 47

3.3 An Example for Eager Hypotheses Generation . . . . . . . . . . . . . . . . 50 3.4 An Example for a Variable Induction Ordering . . . . . . . . . . . . . . . . 53

4  Conclusion  59

A Optimizations 60 A.1 The Low Price and High Value of Choice-Conditions . . . . . . . . . . . . . 60 A.2 Smaller Variable-Condition versus Less Free δ^{+}-Variables . . . . . . . . . . 62 A.3 Improving Multiple γ-Rule Applications and Matrix Calculi . . . . . . . . . 62

B Tools for the Proofs 64 B.1 Technical Lemmas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 B.2 Generalized Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 B.3 Instantiation of Free δ^{+}-Variables . . . . . . . . . . . . . . . . . . . . . . . 66

C The Proofs 68

D Notes 85

E References 93

1 Descente Infinie: An Introduction

1.1 What it Is

1.1.1 An Example

Inductive arguments are omnipresent in mathematics, theoretical computer science, or physics, and every freshman in these subjects is familiar with arguments of the following kind. Suppose we have the axioms:

(nat1)  ∀x. ( x=0 ∨ ∃y. x=s(y) )
(plus1)  ∀x. x + 0 = x
(plus2) ∀x, y. x + s(y) = s(x + y)

where (nat1) says that each natural number is zero or the successor of a natural number, while (plus1) and (plus2) define the function ‘+’, and the signature is as follows: We only have the single type nat of natural numbers. We use zero 0 : nat and successor s : nat → nat as constructors for the type nat. Moreover, + : nat → nat → nat is a defined function on natural numbers, and x, y are variables of the type nat. Given this setting, how do we prove ∀x. 0 + x = x, i.e. that the right-neutral element 0 of (plus1) is also neutral to the left? An informal proof may run like this:

We have to show

0 + x = x. (1)

Using (nat1), we have the following case analysis:

\underline{x = 0:} We have to show

0 + 0 = 0, (1.1)

which follows from (plus1).

\underline{x = s(y):} We have to show

0 + s(y) = s(y). (1.2)

Using (plus2) we can rewrite it into

s(0 + y) = s(y). (1.2.1)

Setting {x↦y} in the induction hypothesis (1), we can rewrite this into the equality axiom

s(y) = s(y). (1.2.1.1)

We still have to find an induction ordering < and some weight w(x) for (1) such that the instance of the applied induction hypothesis is smaller than the induction conclusion we are just proving, i.e. such that w(y) < w(x). By our case assumption this is nothing but

w(y) < w(s(y)). (1.2.1.2)

But this is trivial: We simply set the weight function w to the identity, w(x) := x, and we let the induction ordering < be the ordering of the natural numbers, denoted by the symbol ≺. Now (1.2.1.2) turns into

y ≺ s(y). (1.2.1.2.1)

This is valid and follows from the properties of ≺, which include ∀y. y ≺ s(y) and the wellfoundedness of ≺.

Now, how can this kind of argument be formalized?

First, we have to settle on some specific logical calculus for deductive reasoning and, second, the actual form of the inductive argument has to be fixed within this calculus. We defer the answer to the first problem to § 1.2. The second problem divided the research community into the two schools of explicit and implicit induction, of which the former represents the established mainstream community, which excels in the most powerful computer-based systems today. For comprehensive surveys on explicit induction cf. Walther (1994) and Bundy (1999). Implicit induction, however, evolved from the Knuth–Bendix Completion Procedure and comprises the alternative approaches of proof by consistency (inductionless induction), descente infinie, and syntactical induction orderings. While we are not going to discuss implicit induction here (cf., however, Wirth (2005) for a survey), it seems to be necessary to distinguish descente infinie from mainstream work.

1.1.2 Axiomatization

As will be discussed in more detail in the following § 1.1.6, proof search in the style of descente infinie was already known to the ancient Greeks and is the standard method of a working mathematician since it was reinvented in the fifties of the 17^{th} century by Pierre Fermat.

At Fermat’s time, natural language was still the predominant tool for expressing terms and equations in mathematical writing, and it was too early for a formal axiomatization. Although an axiomatization captures only validity but in general does not induce a method of proof search, we should nevertheless discuss it here. Let us look at natural numbers and arithmetic to state our case:

In the 20^{th} century, Dedekind’s axioms for arithmetic became popular under the name of Peano’s axioms:

(nat2)  ∀x. s(x)≠0
(nat3) ∀x, y. (s(x)=s(y) ⇒ x=y)
(S)  P (0) ∧ ∀y. ( P (y) ⇒ P (s(y)) ) ⇒ ∀x. P (x)

The axiom (S) is called the axiom of structural induction because it follows the structure of the natural numbers built-up inductively by the constructors 0 and s. There are similar versions of structural induction for all inductive data types such as lists or trees. The axiom (S) can be seen either as a first-order scheme in P, or, if prefixed with “∀P. ”, as a second-order axiom.

Theoretically, every theorem of arithmetic now follows from (nat2), (nat3), (S) and function definitions like (plus1), (plus2). Practically, however, it is next to impossible to find all proofs in arithmetic by structural induction, because some of the required instances for P in (S) are too complicated. On the contrary, induction over arbitrary well-founded relations <, often called Noetherian induction after Emmy Noether (1882–1935), is essential, both for search and communication of proofs:

(N) Wellf(<) ∧ ∀v. ( ∀u. (u<v ⇒ P (u)) ⇒ P (v) ) ⇒ ∀x. P (x)

The Theorem of Noetherian Induction (N) follows directly from the definition of well-foundedness Wellf alone.

The well-foundedness of the successor relation λx, y. (s(x)=y) (which implies the well-founded-ness of the ordering ≺ of the natural numbers by Lemma 2.1) means that any nonempty subset B of the natural numbers contains an s-minimal element:

(Wellf(s)) ∀B. ( B ≠ ∅ ⇒ ∃y ∈ B. ∀w ∈ B. s(w)≠y )

Using the Dedekind–Peano axioms (nat2), (nat2), and (S), this can be shown by setting P in (S) to be

λx. ( ∃z ∈ B. s(z)=x ⇒ ∃y ∈ B. ∀w ∈ B. s(w)≠y ).

1.1.3 Explicit Induction

Vice versa, the Dedekind–Peano axioms (nat2), (nat2), and (S) follow from Wellf(s) and (nat1), cf. Pieri (1907/8). Indeed, (nat2) and (nat3) can be shown with the lemma ∀x. ∃n ∈ N. x=s^{n}(0). Moreover, (S) follows from well-foundedness of the successor relation Wellf(s) when we instantiate u<v in (N) with the successor relation and apply the case analysis of (nat1) to v. Indeed,

∀u. (s(u)=0 ⇒ P (u)) ⇒ P (0)

simplifies to P (0) by (nat2).

Such first-order instances of (N) are called induction axioms in the school of explicit induction. Notice that in these induction axioms, the subformula

∀u. (u<v ⇒ P (u))

of (N) is replaced with a conjunction of instances of P (u) with predecessors of v like in (S). The induction axioms of explicit induction must not contain the induction ordering <.

The school of explicit induction was formed by computer scientists who were working on the automation of theorem proving and—inspired by J. Alan Robinson’s resolution method (Robinson (1965))— tried to solve problems of logical inference via reduction to machine-oriented inference systems. Instead of implementing more advanced mathematical induction techniques, they decided to restrict the secondorder Theorem of Noetherian Induction (N) (cf. § 1.1.2) and the inductive Method of Descente Infinie to first-order induction axioms and deductive first-order reasoning in the following fashion:

Guess an induction axiom for which the well-foundedness of < can be automatically derived. Apply the induction axiom backwards. The rest is purely deductive first-order reasoning. If this does not lead to an immediate success, repeat the whole process.

For instance, our introductory example is solved via the induction axiom

0 + 0 = 0 ∧ ∀y. ( 0 + y = y ⇒ 0 + s(y) = s(y) ) ⇒ ∀x. 0 + x = x

Note that the reduct 0 + 0 = 0 ∧ ∀y. ( 0 + y = y ⇒ 0 + s(y) = s(y) ) is valid in all models of (plus1) and (plus2), and can be shown just by deduction. Contrary to this, the conjectured proposition ∀x. 0 + x = x is only inductively valid.

The so-called “waterfall”-method of the pioneers of this approach refines this process into a fascinating heuristic, and their powerful inductive theorem proving system Nqthm (Boyer & Moore (1979), Boyer & Moore (1988)) has shown the success of this reduction approach already a quarter of a century ago. Mainly associated with the development of explicit-induction systems such as Oyster-CLaM (Bundy (1988), Bundy &al. (1990)), λCLaM (Bundy (1999)), and Inka (Autexier &al. (1999)), there was still evidence for considerable improvements over the years (Hutter & Bundy (1999)) until the end of the last century. Since then, explicit induction has become a standard in education in the ✓ eriFun project (Walther & Schweizer (2003)). Today, the application-oriented explicit-induction system Acl2 (Kaufmann &al. (2000)) is still undergoing some minor improvements. Acl2 easily outperforms even a good mathematician on the typical inductive proof tasks that arise in his daily work or as subtasks in software verification. These methods and systems, however, do not seem to scale up to hard mathematical problems, and we believe that there are principled reasons for this shortcoming.

1.1.4 Descente Infinie in the Working-Mathematician Style

In everyday mathematical practice of an advanced theoretical journal the frequent inductive arguments are hardly ever carried out explicitly. Instead, the proof just reads something like “by structural induction on n, q.e.d.” or “by induction on (x, y) over <, q.e.d.”, expecting that the mathematically educated reader could easily expand the proof if in doubt.

In contrast, very difficult inductive arguments, sometimes covering several pages, such as the proofs of Hilbert’s 1^{st}ε-theorem, Gentzen’s Hauptsatz, or confluence theorems like the one in Gramlich & Wirth (1996), still require considerable ingenuity and will be carried out—but in a style that is very different from the explicit-induction method as sketched above! The experienced mathematician engineers his proof more according to the following pattern:

He starts with the conjecture and simplifies it by case analysis. When he realizes that the current goal becomes similar to an instance of the conjecture, he applies the instantiated conjecture just like a lemma, but keeps in mind that he has actually applied an induction hypothesis. Finally, he searches for some well-founded ordering in which all the instances of the conjecture he has applied as induction hypotheses are smaller than the original conjecture.

The hard problems in these proofs are

(i) to find the numerous induction hypotheses (as, e.g., in the proof of Gentzen’s Hauptsatz on Cutelimination in Gentzen (1935)) and

(ii) to construct an induction ordering for the proof, i.e. a well-founded ordering that satisfies the ordering constraints of all these induction hypotheses in parallel. (For instance, this was the hard part in the elimination of the ε-formulas in the proof of the 1^{st}ε-theorem in Hilbert & Bernays(1968/70), Vol. II, and in the proof of the consistency of arithmetic by the ε-substitution method in Ackermann (1940)).

1.1.5 Descente Infinie versus Explicit Induction

Explicit induction unfortunately must solve the hard problems (i) and (ii) of the previous § 1.1.4 already before the proof has actually started. A proper induction axiom must be generated without any information on the structural difficulties that may arise in the proof later on. For this reason, we do not believe that an explicit-induction procedure will ever be able to guess the right induction axioms for very hard proofs in advance. Although the techniques for guessing the right induction axiom by an analysis of the syntax of the conjecture and of the recursive definitions are perhaps the most developed and fascinating applications of heuristic knowledge in artificial intelligence and computer science, even the disciples of explicit induction admit the limitations of this recursion analysis. In Protzen (1994) we find not only small verification examples already showing these limits, but also the conclusion:

“We claim that computing the hypotheses”

[ i.e. the instantiation of ∀u. (u<v ⇒ P (u)) in (N) and the proof of Wellf(<)]

“before the proof is not a solution to the problem and so the central idea for the lazy method is to postpone the generation of hypotheses until it is evident which hypotheses are required for the proof.” [Protzen (1994), p. 43]

This “lazy method” removes only some limitations of explicit induction as compared to descente infinie. It focuses more on efficiency than on a clear separation of concepts, and there is no implementation of it available anymore. The labels “lazy induction” and “lazy hypotheses generation” that were coined in this context are nothing but a reinvention of parts of Fermat’s descente infinie by the explicit-induction community.

Descente infinie and explicit induction do not differ in the task (establishing inductive validity) but in the way the proof search is organized. For simple proofs there is always a straightforward translation between the two. The difference becomes obvious only for proofs of difficult theorems.

While the heuristics developed within the paradigm of explicit induction remain the method of choice for routine tasks, explicit induction is an obstacle to progress in the automation of difficult proofs, where the proper induction axioms cannot be guessed in advance. Shifting to the paradigm of descente infinie overcomes this obstacle without sacrificing previous achievements.

1.1.6 History and Soundness of Descente Infinie

The soundness of the method for engineering hard induction proofs mentioned in § 1.1.4 is easily seen when the argument is structured as a proof by contradiction, assuming a counterexample. For Fermat’s historic reinvention of the method, it is thus just natural that he developed the method itself in terms of assumed counterexamples. He called it “descente infinie ou indéfinie”. Here it is in modern language:

Definition 1.1 (Method of Descente Infinie) A proposition Γ can be proved by descente infinie as follows:

Show that for each assumed counterexample of Γ there is a smaller counterexample of Γ w.r.t. a well-founded ordering <, which does not depend on the counterexamples.

Now, why is this method sound?

The argument is as follows: Let us assume that Γ is not valid. Then there is a counterexample for Γ. Thus, if we are successful in executing the Method of Descente Infinie for the wellfounded ordering <, there must be another counterexample for Γ that is smaller in <. Now we can iterate the last step ad infinitum to get an infinite sequence of counterexamples descending in < (descente infinie),^{1} but this contradicts the well-foundedness of <, q.e.d.

Note that, although we argue in terms of counterexamples here, the positive argumentation of § 1.1.4 in terms of application of induction hypotheses does not result in a different proof search, and the resulting proofs are identical if we abstract their structure from the verbalization. While the exact technical relationship between the positive and the negative argumentation can be found in Definition 2.36, the following negative verbalization of our positively stated example proof from § 1.1.1 should make it intuitively clear:

Well, suppose that there is a counterexample for (1), i.e. some natural number x such that 0 + x = x is not the case. Since we were successful in showing all cases of our proof, the counterexample must have escaped somehow. This is impossible within the deductive reasoning steps because they are sound. Thus, (1.2.1) must still have a counterexample. By our case assumption, this counterexample is the y with x = s(y). As (1.2.1) follows from the valid assertion (1.2.1.1) by a sound rewrite step with the equality 0 + y = y, the same y must be a counterexample for this equality, too. As it is an instance of our original proposition (1), to complete the execution of the Method of Descente Infinie, we only have to find a well-founded ordering in which y is smaller than x, and—starting with (1.2.1.2)—we solved this task.

From a positive viewpoint, however, this inductive proof can also be seen as a program for computing —given a natural number x as input—a purely deductive proof:

This program has to write down the proof with the exception of the part starting with (1.2.1.2) and then to call itself recursively with y as input. The omitted part of the proof, however, guarantees termination. Therefore, we know that after a finite number of recursive calls—although this number of descents may not be known, i.e. indefinite (descente indéfinie)—the program will end up in writing down the base case (1.1).

All in all, it does not really matter whether you prefer to think about descente infinie positively or negatively. What is important, however, is to know how to execute the method of proof search. And already the ancient Greeks knew how to do this:

Although we do not have any original Greek mathematical documents from the 5^{th} century b.c. and only fragments from the following millennium, the first known occurrence of descente infinie in history seems to be the proof of the irrationality of the golden number \frac{1}{2}(1+\sqrt{5}) by the Pythagorean mathematician Hippasus of Metapontum (Italy) in the middle of the 5^{th} century b.c., cf. Fritz (1945). This proof is carried out geometrically in a pentagram, where the golden number gives the proportion of the length of a line to the length of the side of the enclosing pentagon:

Under the assumption that this proportion is given by m : n with natural numbers m and n, it can be shown that the proportion of the length of a line of a new pentagram drawn inside the

inscribed pentagon to the length of the side of this pentagon is m−n : 2n−m, with 0 ≺ m−n ≺ m, and so forth since the new inscribed pentagram is similar to the original one. A myth says that the gods drowned Hippasus in the sea, as a punishment for destroying the Pythagoreans’ belief that everything is given by positive rational numbers; and this even with the pentagram, which was the Pythagoreans’ sign of recognition amongst themselves. The resulting confusion seems to have been one of the reasons for the ancient Greek culture to shift interest in mathematics from theorems to proofs.

In the famous collection “Elements” of Euclid of Alexandria, cf. Euclid (ca. 300 b.c.), we find many occurrences of descente infinie. In the Elements, the verbalization of an inductive proof has the form of a “generalizable example” in the sense that a special concrete counterexample is considered —instead of an arbitrary one—but the existence of a smaller counterexample is actually shown independently of this special choice.

I do not know of descente infinie in the following eighteen centuries (except that Euclid’s Elements where copied again and again), but of structural induction only. Structural induction occurs in a text of Plato (427–347 b.c.) (Athens) (but not in Euclid’s Elements!) and seems to have earlier, probably Pythagorean origin, cf. Acerbi (2000). Structural induction was known to the Muslim mathematicians around the year 1000 and occurs in a Hebrew book of Levi ben Gerson (1288–1344) (Orange and Avignon) in 1321, cf. Katz (1998). Blaise Pascal (1623–1662) (Paris) knew structural induction from “Arithmeticorum Libri Duo” of Francisco Maurolico (Maurolycus) (1494–1575) (Messina) written in 1557 and published posthumously in 1575 in Venice, cf. Bussey (1917). Pascal used structural induction for the proofs of his Arithmetical Triangle written in 1654 and published posthumously in 1665. While these inductive proofs are still presented as “generalizable examples”, in the demonstration of “Conséquence XII” we find—for the first time in known history—a correct verbalization of the related instance of the axiom of structural induction, cf. Pascal (1954), p. 103. Moreover, in the 1650s Pascal exchanged letters on probability theory and descente infinie with Pierre Fermat (1607?–1665) (Toulouse), who was the first to describe the Method of Descente Infinie explicitly, cf. Bussotti (2006).

François Viète (1540–1603) (Paris) had already given a new meaning to the word analysis by extending the analysis of concrete mathematical problems to the algebraic analysis of the process of their solution. Fermat improved on Viète: Instead of a set of rules that sometimes did find a single solution to the “double equations” of Diophantus of Alexandria (3^{rd}century?) and sometimes did not, he invented a method to enumerate an infinite set of solutions described in the “Inventum Novum” by Pére Jacques de Billy; for a French translation cf. Fermat(1891ff.), Vol. III, pp. 325–398; for a discussion cf. Mahoney (1994), § VI.III.B. Much more than that, Fermat was the first who—instead of just proving a theorem— analyzed the method of proof search. This becomes obvious from the description of the Method of Descente Infinie in a letter for Christiaan Huygens (1629–1695) (Den Haag) entitled “Relation des nouvelles découvertes en la science des nombres” sent to Pierre de Carcavi in August 1659; cf. Fermat (1891ff.), Vol. II, pp. 431–436; Bussotti (2006). Besides, Fermat was also the first to provide a correct verbalization of proofs by descente infinie and to overcome the presentation of inductive proofs as “generalizable examples”, which we would not accept as proper proofs from our students today.

As the competent lawyer and devoted judge Pierre de Fermat (cf. Barner (2001)) was reluctant to release his theorems and is still famous for omitting his proofs, we should be glad that he was generous enough to leave us some of his methods. Indeed, methodological considerations seem to have been his primary concern, cf. Bussotti (2006).

1.2 How we Do it

1.2.1 Design Goals for Inductive Inference Systems

Three decades of experience with automated inductive theorem provers, such as Nqthm, Inka, Rrl, Unicom, Spike, Expander, &c., cf. Boyer & Moore (1979), Biundo &al. (1986), Kapur & Zhang (1989), Gramlich & Lindner (1991), Bouhoula & Rusinowitch (1995), Padawitz (1998), respectively, leave us with one important message: Successful application of an inductive theorem prover in “reallife” domains requires a knowledgeable human user who can interact with the system at various levels of abstraction. Hence, the development of a new theorem prover—including its inference system—should have an emphasis on its potential for user interaction. Therefore, the following two requirements are main design goals for our inductive inference systems:

I. We want the inference system to comply with natural human proof techniques and to support the user in stating his proof ideas.

II. The user should have no difficulties in understanding and searching for proofs represented within this inference system.

Refining the first design goal we obtain the following requirements:

I.1. All proof problems and sub-problems, the definitions, lemmas, as well as the induction hypotheses should be homogeneously represented, i.e. expressed in the same language.

I.2. The inference system should include inference rules for all natural proof steps (including the repeated application of induction hypotheses on the fly) such that the user can easily formulate his ideas and force the system to follow his proof ideas as closely as possible.

Refining the second design goal we obtain the following requirements:

II.1. The inference system should support a natural flow of information in the sense that a decision can be delayed or a commitment deferred, until the state of the proof attempt provides sufficient information for a successful choice. Examples for an unnatural flow of information are:

(a) Instantiating the induction hypotheses in explicit induction long before the hypotheses become applicable, cf. Protzen (1994).

(b) The γ-rule of a sequent or tableau calculus (without free variables) where an instance has to be guessed long before it becomes apparent whether it will be a successful one or not.

(c) The rules of indirect proof (⊥_{c} or A∨¬A) and ∨-introduction (∨I) in Natural Deduction calculi for classical logic: The former requires a decision of when to start an indirect proof. The latter requires a critical decision for one of two disjunctive alternatives \frac{A}{A ∨ B} and \frac{B}{A ∨ B}, which

becomes uncritical if we use ^{\frac{\begin{matrix}[ & \overline{B} & ] \\ A \end{matrix}}{A ∨ B}} and ^{\frac{\begin{matrix}[ & \overline{A} & ] \\ B \end{matrix}}{A ∨ B}} instead.

II.2. Another important requirement for theorem proving is goal-directedness, which means that every problem in the graph of a proof attempt is connected to the theorem to be proved. For inductive theorem proving this is even more important than for deductive theorem proving as new lemmas often have to be invented to close the gap between the induction conclusion and the induction hypotheses. This step is usually guided by the user’s knowledge of the domain, the applicable lemmas, the (expanded) induction conclusion, and the induction hypotheses. Without goaldirectedness, i.e. without the connection to the induction conclusion and the induction hypotheses, the missing lemmas can hardly be guessed. Note that such “creative steps” are not necessary for deductive theorem proving. By Gentzen’s Hauptsatz on Cut elimination there is no need to invent new formulas in a proof of a deductive theorem. Indeed, such a proof can be restricted to “sub”-formulas of the theorem under consideration. In contrast to the lemma application (i.e. Cut) in a deductive proof tree, the application of induction hypotheses and lemmas inside an inductive reasoning cycle cannot generally be eliminated, cf. Kreisel (1965). Thus, for inductive theorem proving, “creativity” cannot be restricted to finding just the proper instances, but may require the invention of new lemmas.

In the spirit of the above design goals, we have an inference system in mind that explicitly provides the concepts of induction hypothesis and induction ordering and associated means of generating induction ordering conditions with sufficient expressiveness and flexibility, i.e. explicit weights. We also want an inference system that does not “hide” repeated applications of induction hypotheses in a single inference step, but instead it should include inference rules that explicitly provide or apply induction hypotheses, given that certain ordering conditions can be met. The inference system must be capable of representing an induction hypothesis as a whole and in a natural and recognizable form. No input normalization may decompose the inductive theorems into “sub”-formulas before the induction hypotheses have been extracted.

1.2.2 Sequent and Tableau Calculi

Obtaining an inference system for explicit induction is quite simple: Since the inductive argument is captured in the application of a single inference rule preceeding the call of the first-order deductive machinery, this “induction rule” can just be added to any deductive inference system.

When integrating descente infinie, however, the whole inference system is affected and soundness becomes a global problem. Thus, to go beyond a philosophical discussion, the soundness of this integration has to be proved with mathematical rigor.

Notice that we do not provide a proof of the completeness of our inference systems because there is no appropriate and comprehensive notion of completeness yet: As the theory of arithmetic is not enumerable (Gödel (1931)), completeness w.r.t. the standard notion of validity cannot be achieved. And the common notions of validity for which completeness can be achieved (such as validity in Henkin models) are not sufficient for our goals in this paper, because we are actually interested not just in validity and the mere existence of proofs, but instead our true deeper interest is in proof search. Therefore, for our intended notion of completeness the proofs would have to exist in a special intentional form.

The considerations of the previous § 1.2.1 provide some guidance for an answer to the following question:

Which deductive inference system is best suited for the integration of descente infinie?

Most Hilbert-style and Natural Deduction calculi are not well-suited for proof search. The generalized version of the Hilbert-style calculus of Jacques Herbrand described in Wirth &al. (2008) lacks case analysis, and the other well-known Hilbert-style calculi suffer from an unnatural flow of information. Natural Deduction is particularly problematic for descente infinie because the proofs are augmented with assumptions that conflict with our concept of induction hypothesis.

Neither Sergey Yu. Maslov’s inversion technique nor non-refutational resolution seem to be appropriate for proof search, because they lack goal-directedness.^{2} Thus, a reasonable integration of descente infinie into resolution must be refutational. The only example of such an integration, however, seems to be the inductive theorem prover Expander.^{3}

Our choice of a deductive inference system is that of a sequent (Gentzen (1935), Lifschitz (1971)), tableau (Smullyan (1968), Fitting (1996)), or matrix calculus (Andrews (1981), Bibel (1987), Wallen (1990)). While matrix calculi have implementational advantages (cf. § A.3), for simplicity of presentation we consider only sequent and tableau calculi in this paper.

1.2.3 Proof Forests

Now the search for a proof proceeds as follows: Starting with a conjectured sequent, the problem of proving this goal is reduced to the problem of proving a set of other sequents as sub-goals. The recursive application of such reduction steps results in a tree-like sub-proof structure t_{i} for each proposition Γ_{i}. The whole proof consists of a forest of such trees, which are connected by applications of the propositions. Let us defer the discussion of the standard deductive steps within a single tree to § 1.2.4, and have a look now at the new kind of proof steps establishing the connection between the trees.

Suppose we have a huge proof tree of a non-trivial theorem Γ_{0}. A mathematician organizes such a proof with the help of lemmas. Having identified a lemma Γ_{1} in the proof tree, we can cut off (possibly several occurrences of) the subtree rooted by Γ_{1}, yielding two trees: one for Γ_{1} as a new proposition and one for the original theorem Γ_{0}. Since the latter tree t_{0} is incomplete now, we connect it to the new proposition by an inter-tree edge (1, 0), which we call a lemma application. Even better than cutting a huge tree into pieces is to follow human practice and to apply lemmas whenever it seems appropriate, and prove them later. Thus, we should not let our tree grow too large. This can be prevented by our rule for lemma application when it introduces a yet unproved proposition as an open lemma with a trivial uncompleted proof tree.

While the graph of lemma application has to be acyclic for soundness, this is not the case for a more important but similar proof rule called induction-hypothesis application. The application of a proposition Γ_{j} to a proof tree t_{i} as an induction hypothesis looks just like its application as a lemma, but starts a new extra sub-tree in t_{i}. The task of this sub-tree is to prove that the instance of the applied proposition Γ_{j} (induction hypothesis) is smaller in some well-founded ordering than the proposition Γ_{i} (induction conclusion) of the proof tree t_{i}. Moreover—and this is the advantage of the application as an induction hypothesis in comparison to a lemma—the graph of induction-hypothesis application may be cyclic, as long as we still have a well-founded ordering on it. In the simplest case of i=j, an induction hypothesis is applied to its own proof tree as in the introductory example of § 1.1.1. If several trees are involved in a cycle of the application graph, we have mutual induction as in the example of § 3.2.

1.2.4 Deductive Inference Rules for Reasoning Within a Proof Tree

The following concrete inference rules for deductive reasoning within a tree are presented in sequent style and may clear away some fog. They will be considered in more detail in § 2.5. Note that in the good old days when trees grew upwards, Gerhard Gentzen would have inverted the inference rules such that passing the line means consequence. In our case, passing the line means reduction, and trees grow downwards. The inference rules are classified as α-, β-, γ-, and δ-rules (Smullyan (1968)):

α-rules describe the simple and

β-rules the case-splitting (or \underline{b}ranching) propositional proof steps.

γ-rules show existential properties, either by exhibiting a term witnessing the existence or else by introducing a special kind of variable, called “dummy” in Prawitz (1960) and Kanger (1963), “free” in Fitting (1996) and in footnote 11 of Prawitz (1960), and “meta” in the field of planning and constraint solving. It may be used to delay the choice of a witnessing term until the state of the proof search provides more information. In this paper, however, as these names would be misleading, we call such a variable a free γ-variable.

δ-rules show universal properties using a new symbol, called a “parameter” or an “eigenvariable”, about which nothing is known. We use nullary parameters called free δ-variables. These variables are not free in the sense that the terms to replace them may be chosen freely, but in the sense that their occurrences must not be bound by a quantifier or binder. The free δ-variables subdivide into the ordinary free δ^{−}-variables introduced by standard δ-steps (or δ^{−}-steps) and the free δ^{+}-variables introduced together with a constraint (attached to the upper right of the rules) by liberalized δ-steps (δ^{+}-steps, cf. § 2.1.5). Liberalized δ-rules differ from standard ones in the variable-conditions they introduce (attached to the lower right of the rules). Variable-conditions represent the dependence between free variables, cf. Prawitz (1960), Kanger (1963), Bibel (1987), Kohlhase (1995).

Other rules may be added for an appropriate treatment of frequent reasoning patterns such as rewriting with equalities or logical equivalences, unification, or the Cut.

Let \overline{A} denote the conjugate of the formula A, i.e. B if A is of the form ¬B, and ¬A otherwise. Let A and B be formulas, Γ, Π, and Λ be sequents, i.e. disjunctive lists of formulas. Let x ∈ V_{bound} be a bound variable, and let F be the current proof forest, such that V(F) contains all variables already in use, especially those from Γ, Π, and A:

α-rules: \frac{Γ ¬¬A Π}{A Γ Π} \frac{Γ (A∨B) Π}{A B Γ Π} \frac{Γ ¬(A∧B) Π}{\overline{A} \overline{B} Γ Π} \frac{Γ (A⇒B) Π}{\overline{A} B Γ Π} \frac{Γ (A⇐B) Π}{A \overline{B} Γ Π}

β-rules: In the following rules we may choose to fold down none or one, but not both of the side formulas in the optional brackets [⋯]. For example, if we choose the first lower sequent of the first rule to be A \overline{B} Γ Π then its second lower sequent must be B Γ Π.

\begin{matrix}Γ (A∧B) Π \\ A [ \overline{B} ] Γ Π  B [ \overline{A} ] Γ Π \end{matrix}  \begin{matrix}Γ ¬(A∨B) Π \\ \overline{A} [ B ] Γ Π  \overline{B} [ A ] Γ Π \end{matrix}

\begin{matrix}Γ ¬(A⇒B) Π \\ A [ B ] Γ Π  \overline{B} [ \overline{A} ] Γ Π \end{matrix}  \begin{matrix}Γ ¬(A⇐B) Π \\ \overline{A} [ \overline{B} ] Γ Π  B [ A ] Γ Π \end{matrix}

\begin{matrix}Γ (A⇔B) Π \\ \overline{A} B Γ Π  A \overline{B} Γ Π \end{matrix}  \begin{matrix}Γ ¬(A⇔B) Π \\ A B Γ Π  \overline{A} \overline{B} Γ Π \end{matrix}

γ-rules: Let t be any term:

\begin{matrix}Γ ∃x.A Π \\ A\{x↦t\} Γ ∃x.A Π \end{matrix}  \begin{matrix}Γ ¬∀x.A Π \\ \overline{A\{x↦t\}} Γ ¬∀x.A Π \end{matrix}

δ-rules (δ^{−}-rules): Let x^{δ} ∈ V_{δ} \ V(F) be a new^{4} free δ^{−}-variable. Let ℶ denote a possible context of the upper sequent, which is not relevant for the semantics of the sequent itself, but for the soundness of the inductive inference system, such as a weight term of § 2.3.1:

\begin{matrix}Γ ∀x.A Π \\ A\{x↦x^{δ} \} Γ Π & V_{γδ^{+}}(Γ ∀x.A Π, ℶ) × \{x^{δ} \} \end{matrix}

\begin{matrix}Γ ¬∃x.A Π \\ \overline{A\{x↦x^{δ} \}} Γ Π & V_{γδ^{+}}(Γ ¬∃x.A Π, ℶ) × \{x^{δ} \} \end{matrix}

Liberalized δ-rules (δ^{+}-rules): Let x^{δ^{+}} ∈ V_{δ^{+}} \ V(F) be a new^{5} free δ^{+}-variable:

\begin{matrix}Γ ∀x.A Π & \{(x^{δ^{+}}, \overline{A\{x↦x^{δ^{+}}\}})\} \\ A\{x↦x^{δ^{+}}\} Γ Π & V_{free}( ∀x.A) × \{x^{δ^{+}}\} \end{matrix}

\begin{matrix}Γ ¬∃x.A Π & \{(x^{δ^{+}}, A\{x↦x^{δ^{+}}\})\} \\ \overline{A\{x↦x^{δ^{+}}\}} Γ Π & V_{free}(¬∃x.A) × \{x^{δ^{+}}\} \end{matrix}

Rewrite-Rules: Let s and t be terms (of the same type). Let B be one of the formulas (s≠t) or (t≠s). Let A[t] denote the formula A[s] with some occurrences of s replaced with t:

\begin{matrix}Γ A[s] Π B Λ \\ A[t] Γ Π B Λ \end{matrix}  \begin{matrix}Γ B Π A[s] Λ \\ A[t] Γ B Π Λ \end{matrix}

Cut:  \begin{matrix}Γ \\ A Γ  \overline{A} Γ \end{matrix}

1.2.5 Skolemization versus Raising in Descente Infinie

Contrary to most first-order deductive frameworks, Skolemization is not appropriate for descente infinie, whereas a dual of Skolemization called raising is unproblematic just as in Miller (1992), but for additional reasons. The problematic aspects of Skolemization in the context of descente infinie are the following two:

Firstly, Skolemization enriches the signature. Unless special care is taken, this may introduce objects into empty universes, change the notions of Herbrand and Henkin models and of inductive validity (cf. Wirth & Gramlich (1994b)), and it may imply the Axiom of Choice even if it is not part of the original theory. Apart from that, Skolem functions that cannot be translated back into the original signature may occur in answers to queries or in solutions of constraints.

Secondly, Skolemization destroys the locality of counterexamples we need for descente infinie. To see this, consider the following example: When we apply (outer) validity-invariant Skolemization to

∃w. ∀x. ∃y. ∀z. Γ (w, y, x, z)

we get

∃w. ∃y. Γ (w, y, x′(w), z′(w, y)),

where x′ and z′ are the new Skolem functions for x and z, respectively. Note that the dual unsatisfiabilityinvariant form of Skolemization applied in refutational resolution and tableau calculi would introduce Skolem functions for w and y instead. The validity of the latter formula is equivalent to the validity of the formula

∀x′. ∀z′. ∃w. ∃y. Γ (w, y, x′(w), z′(w, y)).

Seen abstractly and independently from proving validity or unsatisfiability, Skolemization is the operation that moves the quantifiers of all δ-variables to the very left and gives them some γ-variables as arguments. Thus, Skolemization results in the following simplified quantificational structure:

For all Skolem functions u there are solutions to the γ-variables e such that the quantifier-free theorem Γ (e, u) is valid (i.e. ∀u. ∃e. Γ (e, u)).

When the state of the proof search is represented as the conjunction of the branches of a tree (as in sequent or tableau calculi), the γ-variables become “rigid” or “global”, i.e. a solution for a γ-variable must solve all occurrences of this variable in the whole proof tree. This is unfortunately so, because, if B_{0}, …, B_{n} denote the branches of a proof tree for Γ (e, u), then

∀u. ∃e. ( B_{0} ∧ … ∧ B_{n} )

is strictly stronger than

∀u. ( ∃e. B_{0} ∧ … ∧ ∃e. B_{n} )

Considering this tree structure, it can be easily seen that the quantificational structure resulting from Skolemization makes descente infinie impossible, because different applications of induction hypotheses may destroy the counterexample:

Suppose we have some counterexample u for Γ (e, u) (i.e. there is no e such that Γ (e, u) is valid) then, for different e, different branches B_{i} in the proof tree may cause the invalidity of the conjunction. If we have applied induction hypotheses in more than one branch, for different e we get different smaller counterexamples for different branches. What we would need, however, is one single smaller counterexample for all e.

These problematic aspects are no longer present when Skolemization is replaced with raising (cf. Miller (1992)), which simplifies the quantificational structure to:

There are raising functions e such that for all possible values of the free δ-variables u the quantifier-free theorem Γ (e, u) is valid (i.e. ∃e. ∀u. Γ (e, u)).

The inverted order of universal and existential quantification of raising (compared to Skolemization) is advantageous in our case because now applications of induction hypotheses work well:

When, for some—fixed—e_{0}, we have some counterexample u for Γ (e_{0}, u) then one single branch B_{i} in the proof tree must cause the invalidity of the conjunction. If this branch is closed, then it contains the application of an induction hypothesis that is invalid for the u′ resulting from the instantiation of the hypothesis. Thus, u′ together with the induction hypothesis provides the strictly smaller counterexample we are looking for.

1.2.6 Preservation of Solutions

Question answering systems, such as Prolog, compute answers to queries that contain free γ-variables to be instantiated. When the proof search is successfully completed, the existentially quantified query is known to be valid. Moreover, the substitution computed for the free γ-variables solves the query in the sense that its instance is a valid answer. Since the knowledge of mere existence is less useful than the knowledge of concrete witnesses, theorem proving should—if possible without overhead—always provide these solutions.

Regarding descente infinie, however, the following closely related property is not only desirable, but necessary for soundness.

All substitutions of free γ-variables that close a proof attempt for a proposition are also solutions of the original proposition. (Preservation of Solutions)

Why do we need this property?

Well, suppose that our original input theorem Γ (e, u) (cf. the discussion in the previous § 1.2.5) has been reduced to G(e, u) representing the state of the proof search. Furthermore, suppose that we have found some instance e_{0} such that, for each counterexample u of G(e_{0}, u), there is a counterexample u′ for the original theorem (i.e. Γ (e_{0}, u′) is invalid) and that this u′ is strictly smaller than u in some well-founded ordering. In this case we have proved Γ (e_{0}, u) (and thus Γ (e, u)) only if

each counterexample u for Γ (e_{0}, u) is also a counterexample for G(e_{0}, u).

The latter is the contrapositive—and therefore an equivalent—of the following property given by “preservation of solutions”:

G(e_{0}, u) implies Γ (e_{0}, u) for each u.

2 Formal Development

2.1 Technical Prerequisites

2.1.1 Basic Notions and Notation

‘N’ denotes the set of natural numbers and ‘≺’ the ordering on N. Let N_{+} := { n ∈ N | 0 ≠ n }. ‘Z’ denotes the set of integers. We use ‘⊎’ for the union of disjoint classes and ‘id’ for the identity function. For classes R, A, and B we define:

dom(R) := {a | ∃b. (a, b) ∈ R}  domain
A↿R := {(a, b) ∈ R | a ∈ A}  restriction to A
⟨A⟩R := {b | ∃a ∈ A. (a, b) ∈ R} image ofA, i.e. ⟨A⟩R = ran(_{A}↿R)

And the dual ones:

ran(R) := {b | ∃a. (a, b) ∈ R}  range
R↾_{B} := {(a, b) ∈ R | b ∈ B }  range-restriction to B
R⟨B⟩ := {a | ∃b ∈ B. (a, b) ∈ R} reverse-image of B, i.e. R⟨B⟩ = dom(R↾_{B})

Furthermore, we use ‘∅’ to denote the empty set as well as the empty function. Functions are (right-) unique relations and the meaning of ‘f∘g’ is extensionally given by (f∘g)(x) = g(f(x)). Note that we take the operator ‘∘’ to have higher precedence than the operators ‘∪’ and ‘⊎’. The class of total functions from A to B is denoted as A → B. The class of (possibly) partial functions from A to B is denoted as A ⇝ B. Both → and ⇝ associate to the right, i.e. A ⇝ B → C reads A ⇝ (B → C).

Let R be a binary relation. R is said to be a relation on A if

dom(R) ∪ ran(R) ⊆ A.

R is irreflexive if id ∩ R = ∅. It is A-reflexive if _{A}↿id ⊆ R. Speaking of a reflexive relation we refer to the largest A that is appropriate in the local context, and referring to this A we write R^{0} to ambiguously denote _{A}↿id. With R^{1} := R, and R^{n+1} := R^{n}∘R for n ∈ N_{+}, R^{m} denotes the m-step relation for R. The transitive closure of R is R^{+} := ⋃_{n∈N_{+}} R^{n}. The reflexive & transitive closure of R is R^{∗} := ⋃_{n∈N} R^{n}.

The reverse of R is R^{−1} := { (b, a) | (a, b) ∈ R }. A sequence (s_{i})_{i∈N} is non-terminating in R if s_{i} R s_{i+1} for all i ∈ N. R is terminating if there are no non-terminating sequences in R. A relation R (on A) is well-founded if any non-empty class B (⊆A) has an R-minimal element, i.e. ∃a ∈ B. ¬∃a′ ∈ B. a′R a.

A quasi-ordering ‘≲’ on a class A is an A-reflexive and transitive (binary) relation on A, and we define a≳b if b≲a. By an (irreflexive) ordering ‘<’ we mean an irreflexive and transitive relation, called “strict partial ordering” by some authors. A reflexive ordering ‘≤’ on A is an A-reflexive, antisymmetric, and transitive relation on A. The ordering < of a quasi-ordering or a reflexive ordering ≲ is ≲\≳, and ≲ is called well-founded if < is well-founded.

Lemma 2.1 For a binary relation R we have the following equivalence: R is well-founded iff R^{+} is a well-founded ordering.

2.1.2 Dependent Choice, Well-foundedness, and Descente Infinie

It is well-known that the Axiom of Foundation and the Axiom of Choice do not destroy the consistency of set theory (cf. Gödel (1986ff.), Vol. II), but it is not always appropriate to assume their validity. As the Axiom of Choice implies all known forms of induction, its inclusion is inappropriate for a comparison of the logical strength of different forms of induction. A weak form (or proper logical consequence) of the Axiom of Choice is the following (cf. Rubin & Rubin (1985), p. 19; Howard & Rubin (1998), Form 43, p. 30):

Definition 2.2 (Principle of Dependent Choice) If R is a binary relation with ran(R) ⊆ dom(R) ≠ ∅, then R is not terminating.

In this paper, we define well-foundedness via the existence of minimal elements in classes, but a wellknown alternative is to define it as termination of the reverse relation. While the converse of the following principle is tautological, the principle itself is not, and it makes well-foundedness independent of the actual choice of its definition (cf. Howard & Rubin (1998), Form 43 R, p. 32):

Definition 2.3 (Principle of Well-foundedness) If < is an ordering and > is terminating, then < is well-founded.

Definition 2.4 (Principle of Descente Infinie) If < is an ordering and the class A has no <-minimal elements and either

(i) > ∩ (A×A) is terminating, or

(ii) each C ⊆ A that is totally ordered by < has a <-minimal element

then A is empty.

Independently of the alternatives of well-foundedness and termination of the reverse relation, the soundness of the Method of Descente Infinie of Definition 1.1 is achieved by setting A in (i) of Definition 2.4 to be the class of counterexamples of Γ.^{6} This version appears to be slightly stronger than (ii), which is listed in Howard & Rubin (1998), p. 31, as Form 43 K (formerly Form 43 W (Wirth?) in Note 146, p. 317f.). However, in fact, all these principles are equivalent:

Lemma 2.5 The Principles of Dependent Choice, Well-foundedness, and Descente Infinie (both (i) and (ii)) are logically equivalent in set theory, even without the axioms of Choice, Foundation, or Power-Set.

Finally, it deserves mentioning that it is theoretically possible to use, instead of the Principle of Dependent Choice, the strictly stronger Axiom of Choice (or Zorn’s Lemma) to obtain a soundness principle for a stronger induction method than the Method of Descente Infinie. For this we would replace “ > ∩ (A×A) is terminating” in (i) of Definition 2.4 with “each non-terminating sequence in > ∩ (A×A) has a < ∩ (A×A) -lower bound”, cf. Geser (1995).

2.1.3 Syntax

To avoid the problem of binders capturing free variables (cf. below) and in the tradition of Gentzen (1935), Hilbert & Bernays(1968/70), and Snyder & Gallier (1989), we assume the following four sets of symbols to be disjoint:

V_{γ}  free γ-variables, i.e. the free variables of Fitting (1996)
V_{δ}  free δ-variables, i.e. nullary parameters, instead of Skolem functions
V_{bound} bound variables, i.e. variables to be bound, cf. below
Σ  constants, i.e. the function (and predicate) symbols from the signature

We partition the free δ-variables V_{δ} into free δ^{−}-variables V_{δ} that are introduced by the (non-liberalized) δ-rules; and free δ^{+}-variables V_{δ^{+}} that are introduced by the liberalized δ-rules (δ^{+}-rules), cf. § 1.2.4 or § 2.1.5:

V_{δ} = V_{δ} ⊎ V_{δ^{+}}

We define the free variables by

V_{free} := V_{γ} ⊎ V_{δ}

and the variables by

V := V_{bound} ⊎ V_{free}

Finally, the rigid variables by

V_{γδ^{+}} := V_{γ} ⊎ V_{δ^{+}}

We use ‘V_{k}(Γ)’ to denote the set of variables from V_{k} occurring in Γ.

We define a sequent to be a list of formulas. The conjugate of a formula A (written: \overline{A} ) is the formula B if A is of the form ¬B, and the formula ¬A otherwise. In the tradition of Hilbert & Bernays (1968/70), we do not permit binding of variables that already occur bound in a term or formula; that is: ∀x. A is only a formula if no binder on x already occurs in A. The simple effect is that our formulas are easier to read and our γ- and δ-rules (and λβ-reduction) can replace all occurrences of x. Moreover, we assume that all binders have minimal scope, e.g. ∀x, y. A ∧ B reads (∀x. ∀y. A) ∧ B.

Let σ be a substitution. We say that σ is a substitution on X if dom(σ) ⊆ X. We denote with ‘Γ σ’ the result of replacing each occurrence of a variable x ∈ dom(σ) in Γ with σ(x). Unless otherwise stated, we tacitly assume that all occurrences of variables from V_{bound} in a term or formula or in the range of a substitution are bound occurrences (i.e. that a variable x ∈ V_{bound} occurs only in the scope of a binder on x) and that each substitution σ satisfies dom(σ) ⊆ V_{free}, so that no bound occurrences of variables can be replaced and no additional variable occurrences can become bound (i.e. captured) when applying σ.

2.1.4 Semantical Requirements

Instead of defining validity from scratch, we just require some abstract properties as stated below, which typically hold in all two-valued semantics, such as in classical first-order, intensional, modal, or higherorder logic.

Validity is given relative to some Σ-structure A, assigning a non-empty universe (or “carrier”) to each type. For X ⊆ V we denote the set of total A-valuations of X (i.e. functions mapping variables to objects of the universe of A (respecting types)) with

X → A

and the set of (possibly) partial A-valuations of X with

X ⇝ A

For τ : X → A we denote with ‘A⊎τ’ the extension of A to the variables of X. More precisely, we assume the existence of some evaluation function ‘eval’ such that eval(A⊎τ) maps any term whose constants and free occurring variables are from Σ⊎X into the universe of A (respecting types) such that for all x ∈ X:

eval(A⊎τ)(x) = τ(x)

Moreover, eval(A⊎τ) maps any formula B whose constants and free occurring variables are from Σ⊎X to TRUE or FALSE, such that

B is valid in A⊎τ iff eval(A⊎τ)(B) = TRUE

Notice that we leave open what our formulas and what our Σ-structures exactly are. The latter can range from a first-order Σ-structure to a higher-order^{7} modal^{8} Σ-model, provided that the following two properties are satisfied:

Explicitness-Lemma

(Andrews (1972), Lemma 2; Andrews (2002), Proposition 5400; Fitting (2002), Proposition 2.30)

Let B be a term or formula (possibly with some unbound occurrences of variables from V_{bound}). Let A be a Σ-structure with valuation τ : V ⇝ A.

The value of the evaluation function on B depends only on the valuation of those variables that actually occur free in B; formally:

For X being the set of variables that occur free in B, if X ⊆ dom(τ), then:

eval(A⊎τ)(B) = eval(A ⊎ _{X}↿τ)(B).

Substitution-Lemma

(also called “Substitution-Value-Lemma”; Andrews (1972), Lemma 3; Andrews (2002), Lemma 5401(a); Enderton (1973), p. 127; Fitting (1996), p. 120; Fitting (2002), Proposition 2.31)

Let B be a term or formula (possibly with some unbound occurrences of variables from V_{bound}). Let σ be a substitution. Let A be a Σ-structure with valuation τ : V ⇝ A.

If the variables that occur free in Bσ belong to dom(τ), then:

eval(A⊎τ)(Bσ) = eval( A ⊎ ( σ ⊎ _{V\dom(σ)}↿id ) ∘ eval(A⊎τ) )( B ).

2.1.5 The Liberalized δ-rule

While the benefit of free γ-variables in γ-rules is to delay the choice of a witnessing term, it is sometimes unsound to instantiate a free γ-variable x^{γ} with a term containing a free δ-variable y^{δ} that was introduced later than x^{γ}:

Example 2.6 The formula ∃x. ∀y. (x = y) is not generally valid. We can start a proof attempt as follows:

γ-step: ∀y. (x^{γ} = y), ∃x. ∀y. (x = y)

δ-step: (x^{γ} = y^{δ}), ∃x. ∀y. (x = y)

Now, if the free γ-variable x^{γ} could be substituted by the free δ-variable y^{δ}, we would get the tautology (y^{δ} = y^{δ}), i.e. we would have proved an invalid formula. To prevent this, the δ-step has to record (x^{γ}, y^{δ}) in a variable-condition, where (x^{γ}, y^{δ}) means that x^{γ} is older than y^{δ}, so that we must not instantiate the free γ-variable x^{γ} with a term containing the free δ-variable y^{δ}.

Definition 2.7 (Variable-Condition) A variable-condition is a subset of V_{free} × V_{free}.

To restrict the possible instantiations as little as possible, we should keep our variable-conditions as small as possible. Kanger (1963), Bibel (1987), and Wallen (1990) are quite generous in that they let their variable-conditions grow too much:

Example 2.8 The valid formula ∃x. ( ∀y. ¬P(y) ∨ P(x) ) can be proved the following way:

γ-step: ∀y. ¬P(y) ∨ P(x^{γ}), ∃x. ( ∀y. ¬P(y) ∨ P(x) )

α-step: ∀y. ¬P(y), P(x^{γ}), ∃x. ( ∀y. ¬P(y) ∨ P(x) )
Liberalized δ-step: ¬P(y^{δ^{+}}), P(x^{γ}), ∃x. ( ∀y. ¬P(y) ∨ P(x) )
Instantiation step: ¬P(y^{δ^{+}}), P(y^{δ^{+}}), ∃x. ( ∀y. ¬P(y) ∨ P(x) )

The final step is not allowed in the works cited above, so yet another γ-step must be applied to the original formula. Our instantiation step, however, is perfectly sound in classical logic: Since x^{γ} does not occur in ∀y. ¬P(y), the free variables x^{γ} and y^{δ^{+}} are independent and there is no reason to insist on x^{γ} being older than y^{δ^{+}}. Indeed, we can execute the δ-step introducing y^{δ^{+}} before the γ-step introducing x^{γ}, when we begin with moving-in the existential quantifier, transforming the original formula into the logically equivalent formula ∀y. ¬P(y) ∨ ∃x. P(x).

Keeping the variable-conditions small may lead to an exponential and even non-elementary reduction of the size of the smallest proof. The “liberalization of the δ-rule” and its reduction in the size of the smallest proof has the following history: Smullyan (1968), Hähnle & Schmitt (1994) (δ^{+}), Beckert &al. (1993) (δ^{+^{+}}), Baaz & Fermüller (1995) (δ^{∗}), Giese & Ahrendt (1999) (δ^{ε}), Cantone & Nicolosi-Asmundo (2000) (δ^{∗^{∗}}). The step from δ^{+} to δ^{+^{+}} (like the one from δ^{+^{+}} to δ^{ε}) does not reduce the variable-condition (as all others do) but reduces the number of Skolem symbols (just like the step from δ^{∗} to δ^{∗^{∗}}). While already the earliest liberalized δ-rule of Smullyan (1968) proves the formula of Example 2.8 with a single γ-step, it is much more restrictive than the δ^{+}-rule which can be applied in the presence of free γ-variables.

Important for our goals in proof search, however, is that the liberalization of the δ-rule provides additional proofs that are not only shorter but also more natural and easier to find in the sense of the discussion in § 1.2.1. The problematic step in our case is the one from the non-liberalized δ-rule to the liberalized δ^{+}-rule, because it destroys the preservation of solutions (cf. § 1.2.6) as will be discussed in § 2.2.4. Some further improvements on δ^{+} will be discussed in § A.

Note that the liberalization of the δ-rule is not as simple as it may seem, because it may lead to an unsound calculus, cf. Kohlhase (1995) w.r.t. our Example 2.9 and Kohlhase (1998) w.r.t. our Example 2.50. The difficulty is with instantiation steps that relate previously unrelated variables:

Example 2.9

The formula ∃x. ∀y. Q(x, y) ∨ ∃u. ∀v. ¬Q(v, u)

is not generally valid (to wit, let Q be the identity relation on a non-trivial universe). Consider the following proof attempt: One α-, two γ-, and two δ^{+}-steps result in

(2.9.1) Q(x^{γ}, y^{δ^{+}}), ¬Q(v^{δ^{+}}, u^{γ}), ∃x. ∀y. Q(x, y), ∃u. ∀v. ¬Q(v, u)

with variable-condition

(2.9.2) R := {(x^{γ}, y^{δ^{+}}), (u^{γ}, v^{δ^{+}})}

Notice that the non-liberalized δ^{−}-rule would additionally have introduced (x^{γ}, v^{δ^{+}}) or (u^{γ}, y^{δ^{+}}) or both into R, depending on the order of the proof steps. When we now instantiate x^{γ} with v^{δ^{+}}, we relate the previously unrelated variables u^{γ} and y^{δ^{+}}. Thus, our new goal

Q(v^{δ^{+}}, y^{δ^{+}}), ¬Q(v^{δ^{+}}, u^{γ}), ∃x. ∀y. Q(x, y), ∃u. ∀v. ¬Q(v, u)

must be equipped with the new variable-condition (u^{γ}, y^{δ^{+}}). Otherwise we could instantiate u^{γ} with y^{δ^{+}}, resulting in the tautology

Q(v^{δ^{+}}, y^{δ^{+}}), ¬Q(v^{δ^{+}}, y^{δ^{+}}), ∃x. ∀y. Q(x, y), ∃u. ∀v. ¬Q(v, u)

Notice that in the standard framework of Skolemization and unification, this new variable-condition is automatically generated by the occur-check of unification: When we instantiate x^{γ} with v^{δ^{+}}(u^{γ}) in

Q(x^{γ}, y^{δ^{+}}(x^{γ})), ¬Q(v^{δ^{+}}(u^{γ}), u^{γ}), …

we get

Q(v^{δ^{+}}(u^{γ}), y^{δ^{+}}(v^{δ^{+}}(u^{γ}))), ¬Q(v^{δ^{+}}(u^{γ}), u^{γ}), …

which cannot be reduced to a tautology because y^{δ^{+}}(v^{δ^{+}}(u^{γ})) and u^{γ} cannot be unified. When we instantiate the variables x^{γ} and u^{γ} in the sequence (2.9.1) in parallel via

(2.9.3) σ := {x^{γ}↦v^{δ^{+}}, u^{γ}↦y^{δ^{+}}},

we have to check whether the newly imposed variable-conditions are consistent with the substitution itself. In particular, a cycle as

x^{γ}  _{R}  v^{δ^{+}}^{σ^{−1}} u^{γ}  _{R} y^{δ^{+}}_{σ^{−1}}

(for the R of (2.9.2)) has to be disallowed by definition.

2.2 The Deductive Machinery

2.2.1 R-Substitutions

Several binary relations on free variables will be introduced in the following. The overall idea is that when (x, y) occurs in such a relation this means something like “x is necessarily older than y” or “the value of y depends on or is described in terms of x”.

Definition 2.10 (Γ_{σ}, Δ_{σ}) For a substitution σ we define the Γ-relation to be

Γ_{σ} := { (z^{γ}, x) | x ∈ dom(σ) ∧ z^{γ} ∈ V_{γ}(σ(x)) },

and the Δ-relation to be

Δ_{σ} := { (y^{δ}, x) | x ∈ dom(σ) ∧ y^{δ} ∈ V_{δ}(σ(x)) }.

Definition 2.11 (R-Substitution) Let R be a variable-condition according to Definition 2.7. σ is an R-substitution if σ is a substitution and R ∪ Γ_{σ} ∪ Δ_{σ} is well-founded.

Note that, regarding syntax, (x, z^{γ}) ∈ R is intended to mean that an R-substitution σ must not replace x with a term in which z^{γ} occurs, roughly speaking because x must have some meaning already before z^{γ} comes into existence. To block this replacement, we have to disallow (z^{γ}, x) ∈ Γ_{σ}. To this end, we require well-foundedness of R ∪ Γ_{σ} in Definition 2.11.

As another example, take from Example 2.9 the variable-condition R of (2.9.2) and the σ of (2.9.3). As explained there, σ must not be an R-substitution because the cycle

x^{γ}  _{R}  v^{δ^{+}}^{Δ_{σ}} u^{γ}  _{R} y^{δ^{+}}_{Δ_{σ}}

contradicts the well-foundedness of R ∪ Δ_{σ}.

Note that in practice w.l.o.g., R, Γ_{σ}, and Δ_{σ} can always be chosen to be finite. In this case,

R ∪ Γ_{σ} ∪ Δ_{σ} is well-founded iff it is acyclic.

After application of an R-substitution σ, in case of (x, y^{δ}) ∈ R, we have to update our variable-con-dition R to ensure that x is not replaced with a term containing y^{δ} via a future application of another R-substitution that replaces a free variable say u^{γ} occurring in σ(x) with y^{δ}. In this case, the transitive closure of the updated variable-condition has to contain (u^{γ}, y^{δ}). But we have u^{γ} Γ_{σ} x R y^{δ}. This means that R∪Γ_{σ} must be a subset of the updated variable-condition. Besides this, we have to add steps with Δ_{σ} again.

Definition 2.12 (σ-Update) Let R be a variable-condition and σ be a substitution. The σ-update of R is R ∪ Γ_{σ} ∪ Δ_{σ}.

Example 2.13 In the proof attempt of Example 2.9, in a state with variable-condition

R = {(x^{γ}, y^{δ^{+}}), (u^{γ}, v^{δ^{+}})},

we applied the R-substitution σ′ := {x^{γ}↦v^{δ^{+}}}. Note that Δ_{σ′} = {(v^{δ^{+}}, x^{γ})} and Γ_{σ′} = ∅. Thus, the σ′-update R′ of R is given by the following finite acyclic graph, which means that R′ is well-founded.

x^{γ}  _{R}  v^{δ^{+}}^{Δ_{σ}} u^{γ}  _{R} y^{δ^{+}}

Our treatment of variable-conditions has the following characteristics.

• As explained already in § 2.1.5, the alternative approaches to variable-conditions in the literature restrict the construction of proofs either too much to admit short straightforward proofs, or not enough to guarantee soundness. Our solution, however, is less complicated and provides us with the proper level of restrictiveness.

• The possibility to represent Henkin quantifiers (or Jaakko Hintikka’s IF logic, cf. Hintikka (1996)) was sacrificed for the liberalization of the δ-rule, cf. our § 2.1.5 here as well as § 6.4 of Wirth (2006b). While it is possible to make the alternative choice,^{9} to my knowledge there is no sound approach to variable-conditions that combines the Henkin quantifier with the liberalized δ-rule.

• For efficiency, we never compute transitive closures, but simply keep adding new edges to a graph. The relevant well-foundedness-checks can then be performed as acyclicity-checks whose time complexity is linear in the number of edges. As in any possible implementation each edge must necessarily be inspected, this is an optimal asymptotic time complexity.

• To simplify the definitions, the proofs, and the implementation, we do not permit re-use and permutation of free γ-variables like the substitution {x^{γ}↦u^{γ}, u^{γ}↦x^{γ}}. Indeed, these substitutions have a cyclic Γ-relation and thus are no R-substitutions according to the above Definition 2.11. Re-use and permutation of free γ-variables are problematic in practice, because we would need an additional time reference to retrieve the solutions of these variables in the sense of § 1.2.6. Nevertheless, in a sequence of notes^{10} we have developed an alternative technical solution that admits re-use and permutation of variables and could be more efficient in practice—even if no variables are re-used.

2.2.2 (A, R)-Valuations

Let A be some Σ-structure. We now define semantical counterparts of our R-substitutions on V_{γ}, which we will call “(A, R)-valuations”.

As an (A, R)-valuation plays the rôle of a raising function as defined in § 1.2.5, it does not simply map each free γ-variable directly to an object of A (of the same type), but may additionally read the values of some free δ-variables under an A-valuation δ : V_{δ} → A. More precisely, an (A, R)-valua-tion e takes some restriction of δ as a second argument, say δ′ : V_{δ} ⇝ A with δ′ ⊆ δ. In short:

e : V_{γ} → (V_{δ} ⇝ A) ⇝ A.

Moreover, for each free γ-variable x^{γ}, we require that the set dom(δ′) of free δ-variables read by e(x^{γ}) is identical for all δ. This identical set will be denoted with S_{e}⟨{x^{γ}}⟩ below. Technically, we require that there is some “semantical relation” S_{e} ⊆ V_{δ}×V_{γ} such that for all x^{γ} ∈ V_{γ}:

e(x^{γ}) : (S_{e}⟨{x^{γ}}⟩ → A) → A.

Note that, for each e : V_{γ} → (V_{δ} ⇝ A) ⇝ A, at most one semantical relation exists, namely

S_{e} := { (y^{δ}, x^{γ}) | x^{γ} ∈ V_{γ} ∧ y^{δ} ∈ dom(⋃(dom(e(x^{γ})))) }.

In the following definitions we are slightly more general because we want to apply the terminology not only to free γ-variables but also to free δ^{+}-variables.

Definition 2.14 (Semantical Relation (S_{e})) The semantical relation for e is

S_{e} := { (y, x) | x ∈ dom(e) ∧ y ∈ dom(⋃(dom(e(x)))) }.

e is semantical if e is a partial function on V such that for all x ∈ dom(e):

e(x) : (S_{e}⟨{x}⟩ → A) → A.

Definition 2.15 ((A, R)-Valuation) Let R be a variable-condition and let A be a Σ-structure. e is an (A, R)-valuation if e : V_{γ} → (V_{δ} ⇝ A) ⇝ A, e is semantical, and R ∪ S_{e} is well-founded.

Finally, we need the technical means to turn an (A, R)-valuation e together with a valuation δ of the free δ-variables into a valuation ϵ(e)(δ) of the free γ-variables:

Definition 2.16 (ϵ) We define the function

ϵ : (V ⇝ (V ⇝ A) ⇝ A) → (V ⇝ A) → V ⇝ A

for e : V ⇝ (V ⇝ A) ⇝ A, δ : V ⇝ A, x ∈ V

by ϵ(e)(δ)(x) := e(x)(_{S_{e}⟨{x}⟩}↿δ).

2.2.3 R-Validity

Assuming that validity of formulas is already given as described in § 2.1.4, we are now going to define a new notion of validity (of sets of sequents) that provides the free γ-variables with an existential semantics. As this new kind of validity depends on a variable-condition R, it is called “R-validity”.

Definition 2.17 (R-Validity, K) Let R be a variable-condition. Let A be a Σ-structure with valuation δ : V ⇝ A. Let G be a set of sequents. G is R-valid in A if there is an (A, R)-valuation e such that G is (e, A)-valid. G is (e, A)-valid if G is (δ′, e, A)-valid for all δ′ : V_{δ} → A. G is (δ, e, A)-valid if G is valid in A ⊎ ϵ(e)(δ) ⊎ δ. G is valid in A⊎δ if Γ is valid in A⊎δ for all Γ ∈ G. A sequent Γ is valid in A⊎δ if there is some formula listed in Γ that is valid in A⊎δ. Validity in a class of Σ-structures is understood as validity in each of the Σ-structures of that class. If we omit the reference to a special Σ-structure we mean validity in some fixed class K of Σ-structures, e.g. the class of all Σ-structures or the class of Herbrand Σ-structures, cf. Wirth & Gramlich (1994b) for more interesting classes for establishing inductive validity.

Example 2.18 (R-Validity) For x^{γ} ∈ V_{γ}, y^{δ} ∈ V_{δ}, the sequent x^{γ}=y^{δ} is ∅-valid in any A because we can choose S_{e} := V_{δ}×V_{γ} and e(x^{γ})(δ) := δ(y^{δ}) for δ : V_{δ} → A, resulting in

ϵ(e)(δ)(x^{γ}) = e(x^{γ})(_{S_{e}⟨{x^{γ}}⟩}↿δ) = e(x^{γ})(_{V_{δ}}↿δ) = δ(y^{δ}).

This means that ∅-validity of x^{γ}=y^{δ} is the same as the validity of ∀y. ∃x. x=y. Moreover, note that ϵ(e)(δ) has access to the δ-value of y^{δ} just as a raising function f for x in the raised (i.e. dually Skolemized) version f(y^{δ})=y^{δ} of ∀y. ∃x. x=y.

Contrary to this, for R := V_{γ}×V_{δ}, the same formula x^{γ}=y^{δ} is not R-valid in general because then the required well-foundedness of R ∪ S_{e} implies S_{e} = ∅, and the value of x^{γ} cannot depend on δ(y^{δ}) anymore, due to e(x^{γ})(_{S_{e}⟨{x^{γ}}⟩}↿δ) = e(x^{γ})(_{∅}↿δ) = e(x^{γ})(∅). This means that (V_{γ}×V_{δ})-validity of x^{γ}=y^{δ} is the same as the validity of ∃x. ∀y. x=y. Moreover, note that ϵ(e)(δ) has no access to the δ-value of y^{δ} just as a raising function c for x in the raised version c=y^{δ} of ∃x. ∀y. x=y.

For a more general example let G = { A_{i,0} … A_{i,n_{i}−1} | i ∈ I }, where for i ∈ I and j ≺ n_{i} the A_{i,j} are formulas with free γ-variables from e and free δ-variables from u. Then (V_{γ}×V_{δ})-validity of G means ∃e. ∀u. ∀i ∈ I. ∃j ≺ n_{i}. A_{i,j} whereas ∅-validity of G means ∀u. ∃e. ∀i ∈ I. ∃j ≺ n_{i}. A_{i,j}

Also each other sequence of universal and existential quantifiers can be represented by a variablecondition R, starting from the empty set and applying the δ-rules from § 1.2.4. A translation of a variable-condition R into a sequence of quantifiers may, however, require a strengthening of dependences, in the sense that a backwards translation would result in a variable-condition R′ with R ⊊ R′. This means that our variable-conditions can express logical dependences more fine-grained than standard quantifiers.

2.2.4 Choice-Conditions

Roughly speaking, a set G_{0} of sequents reduces to a set G_{1} of sequents if validity of G_{1} implies validity of G_{0}. This is too weak for our purpose, however, because we are not only interested in validity but also in preserving the solutions for the free γ-variables. As explained in § 1.2.6, it is important that the solutions of G_{1} are also solutions for G_{0}. Thus, a more appropriate definition would be: G_{0} R-reduces to G_{1} if (e, A)-validity of G_{1} implies (e, A)-validity of G_{0} for each (A, R)-valuation e. This definition works well with all inference rules of § 1.2.4, with the exception of the liberalized δ-rules.

The additional solutions (i.e. R-substitutions on V_{γ}) resulting from the liberalization of the δ-rule admit additional proofs, which are shorter, more natural, and easier to find. These additional solutions do not impose any difficulty when interest is in validity only, cf. Hähnle & Schmitt (1994). But when the preservation of solutions is required, they pose problems because they may move some free δ^{+}-variable, say y^{δ^{+}}, out of its context, namely out of the scope of the quantifier eliminated by y^{δ^{+}}:

Example 2.19 (Reduction & Liberalized δ-Steps) In Example 2.8 a liberalized δ-step reduces ∀y. ¬P(y), P(x^{γ}), … to ¬P(y^{δ^{+}}), P(x^{γ}), … with the empty variable-condition R := ∅. The lower sequent is (e, A)-valid for the (A, R)-valuation e given by e(x^{γ})(δ) := δ(y^{δ^{+}}). The upper sequent, however, is not (e, A)-valid when P^{A}(a) is TRUE and P^{A}(b) is FALSE for some a, b from the universe of A. To see this, take some valuation δ with δ(y^{δ^{+}}) := b.

How can we solve this problem, i.e. how can we change the notion of reduction such that the liberalized δ-step becomes a reduction step?

The^{11} appropriate solution to the problem of the above Example 2.19 is the following: We disallow the value b for δ(y^{δ^{+}}) via a choice-condition C(y^{δ^{+}}) that forces us to choose a value for y^{δ^{+}} such that P(y^{δ^{+}}) becomes true—if possible. Technically, this is achieved by setting C(y^{δ^{+}}) := P(y^{δ^{+}}) and requiring the valuations to fulfill a compatibility condition. In the general case, the choice of a value for y^{δ^{+}} will depend on the free variables of the formula C(y^{δ^{+}}). Therefore, we require the inclusion of this dependence into the reflexive & transitive closure of the variable-condition R in the following definition:

Definition 2.20 (Choice-Condition) C is an R-choice-condition if R is a well-founded variable-condition, C is a partial function from V_{δ^{+}} into the set of formulas, and z R^{∗} y^{δ^{+}} for all y^{δ^{+}} ∈ dom(C) and z ∈ V_{free}(C(y^{δ^{+}})).

After global application of an R-substitution σ we now have to update both R and C:

Definition 2.21 (Extended σ-Update) Let C be an R-choice-condition and let σ be a substitution. The extended σ-update (C′, R′) of (C, R) is given by:

C′ := { (x, Bσ) | (x, B) ∈ C ∧ x ∉ dom(σ) },
R′ is the σ-update of R, cf. Definition 2.12.

Lemma 2.22 If C is an R-choice-condition, σ an R-substitution, and if (C′, R′) is the extended σ-update of (C, R), then C′ is an R′-choice-condition.

We now split our valuation δ : V_{δ} → A; while τ : V_{δ} → A valuates the free δ^{−}-variables, π valuates the remaining free δ^{+}-variables. As the choices of π may depend on τ, the technical realization is similar to that of the dependence of the (A, R)-valuations on the free δ-variables, as described in § 2.2.2.

Definition 2.23 (Compatibility) Let C be an R-choice-condition, A a Σ-structure, and e an (A, R)-valuation. π is (e, A)-compatible with (C, R) if

1. π : V_{δ^{+}} → (V_{δ} ⇝ A) ⇝ A is semantical (cf. Definition 2.14) and R ∪ S_{e} ∪ S_{π} is well-founded.

2. For all y^{δ^{+}} ∈ dom(C), for all τ : V_{δ} → A, and for all η : {y^{δ^{+}}} → A, setting B := C(y^{δ^{+}}), δ := ϵ(π)(τ) ⊎ τ, and δ′ := η ⊎_{V\{y^{δ^{+}}}}↿δ (i.e. δ′ is the η-variant of δ):

If B is (δ′, e, A)-valid, then B is also (δ, e, A)-valid.

Roughly speaking, Item 1 of this definition says that the flow of information between variables expressed in R, e, and π is acyclic. We need this to be able to instantiate the free δ^{−}-variables in lemma applications.

To understand Item 2, let us consider an R-choice-condition C := {(y^{δ^{+}}, B)}, which restricts the value of the single variable y^{δ^{+}} with the formula B. Then C simply requires that a different choice for the ϵ(π)(τ)-value of y^{δ^{+}} cannot give rise to the validity of the formula B in A ⊎ ϵ(e)(δ) ⊎ δ. Or—in other words—that ϵ(π)(τ)(y^{δ^{+}}) is chosen such that B becomes valid, whenever such a choice is possible.

This is closely related to Hilbert’s ε-operator in the sense that y^{δ^{+}} is given the value of

εy. (B{y^{δ^{+}}↦y})

for a fresh bound variable y. For a motivational introduction to choice-conditions as an indefinite semantics for Hilbert’s ε-terms, cf. Wirth (2008). For the technical treatment cf. § B.2.

Note that the empty function ∅ is an R-choice-condition for any well-founded variable-condition R. Furthermore, any π with π : V_{δ^{+}} → {∅} → A is (e, A)-compatible with (∅, R) due to S_{π} = ∅. Indeed, a compatible π always exists:

Lemma 2.24 If C is an R-choice-condition, A a Σ-structure, and e an (A, R)-valuation, then there is some π that is (e, A)-compatible with (C, R).

Just like the variable-condition R, the R-choice-condition C grows during proofs. This kind of extension together with a simple soundness condition plays an important rôle:

Definition 2.25 (Extension) (C′, R′) is an extension of (C, R) if C is an R-choice-condition, C′ is an R′-choice-condition, C⊆C′, and R⊆R′.

Lemma 2.26 Let (C′, R′) be an extension of (C, R). If e is an (A, R′)-valuation and π is (e, A)-compatible with (C′, R′), then e is also an (A, R)-valuation and π is also (e, A)-compatible with (C, R).

2.2.5 (C, R)-Validity

While the notion of R-validity (cf. Definition 2.17) already provides the free γ-variables with an existential semantics, it fails to give the free δ^{+}-variables the proper semantics according to an R-choice-condition C. This deficiency is overcome in the following notion of “(C, R)-validity”, which—roughly speaking—requires the following: For arbitrary values of the free δ^{−}-variables, we must be able to choose values for the free δ^{+}-variables satisfying C and then arbitrary values for the free γ-variables such that the formula becomes valid. Note that the dependences of these choices are restricted by R. In a formal top down representation, this reads:

Definition 2.27 ((C, R)-Validity) Let C be an R-choice-condition, let A be a Σ-structure, and let G be a set of sequents. G is (C, R)-valid in A if G is (π, e, A)-valid for some (A, R)-valuation e and some^{12} π that is (e, A)-compatible with (C, R). G is (π, e, A)-valid if G is ( ϵ(π)(τ) ⊎ τ, e, A )-valid for each τ : V_{δ} → A.

Notice that the notion of (π, e, A)-validity with π : V_{δ^{+}} → (V_{δ} ⇝ A) ⇝ A differs from (δ, e, A)- validity with δ : V ⇝ A as given in Definition 2.17. Notice that (C, R)-validity treats the free δ^{+}-vari-ables properly, whereas R-validity of Definition 2.17 does not. The logical strength of the two cannot be compared easily, but we do not need to know more than the following two lemmas.

Lemma 2.28 (From R- to (C, R)-Validity) Let C be an R-choice-condition, A a Σ-structure, and let G be a set of sequents. If G is (V_{γ}×V_{δ})-valid in A, then G is R-valid and (C, R)-valid in A.

On the other hand, from (C, R)-validity of a set of sequents G we can infer (∅, R′)-validity and R′-validity for some R′ when we rename the free δ^{+}-variables in G to some new free γ-variables:

Lemma 2.29 (From (C, R)- to R-Validity) Let C be an R-choice-condition, A a Σ-structure, and let G be a set of sequents. Let ς : V_{δ^{+}}(G) → (V_{γ}\V(G)) be injective. If G is (C, R)-valid in A, then Gς is (∅, R′)-valid and R′-valid in A for any R′ with

R′ ⊆ (_{V_{δ} ∪V_{γ}\ran(ς)}↿id ⊎ ς^{−1}) ∘ R^{+}↾_{V_{δ} ∪V_{γ}\ran(ς)} ⊎ V_{γ}×V_{δ^{+}}.

2.2.6 Reduction

Reduction is the reverse of consequence. It is the backbone of logical reasoning, especially of abduction and goal-directed deduction. Our version of reduction does not only reduce a set of problems to another set of problems but also guarantees that the solutions of the latter also solve the former; where “solutions” means the valuations for the rigid variables, i.e. for the free γ-variables and the free δ^{+}-variables.

Definition 2.30 (Reduction) Let C be an R-choice-condition, A a Σ-structure, and let G_{0} and G_{1} be sets of sequents. G_{0} (C, R)- reduces to G_{1} in A if for each (A, R)-valuation e and each π that is (e, A)-compatible with (C, R):

if G_{1} is (π, e, A)-valid, then G_{0} is (π, e, A)-valid.

Lemma 2.31 (Reduction) Let C be an R-choice-condition; A a Σ-structure; G_{0}, G_{1}, G_{2}, and G_{3} sets of sequents.

1. (Validity)

If G_{0} (C, R)-reduces to G_{1} in A and G_{1} is (C, R)-valid in A,

then G_{0} is (C, R)-valid in A, too.

2. (Reflexivity) In case of G_{0}⊆G_{1}: G_{0} (C, R)-reduces to G_{1} in A.

3. (Transitivity) If G_{0} (C, R)-reduces to G_{1} in A and G_{1} (C, R)-reduces to G_{2} in A, then G_{0} (C, R)-reduces to G_{2} in A.

4. (Additivity)

If G_{0} (C, R)-reduces to G_{2} in A and G_{1} (C, R)-reduces to G_{3} in A, then G_{0}∪G_{1} (C, R)-reduces to G_{2}∪G_{3} in A.

5. (Monotonicity) For (C′, R′) being an extension of (C, R):

(a) If G_{0} is (C′, R′)-valid in A, then G_{0} is (C, R)-valid in A.

(b) If G_{0} (C, R)-reduces to G_{1} in A, then G_{0} (C′, R′)-reduces to G_{1} in A.

6. (Instantiation) For an R-substitution σ on V_{γ} and the extended σ-update (C′, R′) of (C, R):

(a) If G_{0}σ is (C′, R′)-valid in A, then G_{0} is (C, R)-valid in A.

(b) If G_{0} (C, R)-reduces to G_{1} in A, then G_{0}σ (C′, R′)-reduces to G_{1}σ in A.

2.3 The Inductive Machinery

2.3.1 Weights

Weights control the inductive reasoning cycles. While their syntax is given in the following definition, their semantics will be explained below.

Definition 2.32 (Weight) A weight is a triple (w, <, ≲) consisting of the following three terms

Term Name  In case our language is typed:
w weight term  Let α be the type of w, i.e. w : α
< induction ordering  < : α → α → bool or < : α×α
≲ induction quasi-ordering ≲ : α → α → bool or ≲ : α×α

While we use upper case Greek letters for sequences, we denote our weights with the Hebrew letters ℵ aleph, ℶ beth, and ℸ daleth. While formulas and sequents are sufficient for deductive theorem proving, weighted sequences are the basic data structure for the formalization of descente infinie:

Definition 2.33 (Weighted Sequent, Seq()) A weighted sequent is a pair (Γ, ℵ) consisting of a sequent Γ and a weight ℵ. The function ‘Seq’ extracts the sequents from a set G of weighted sequents: Seq(G) := dom(G). Concrete instances of weighted sequents are written as Γ; w, <, ≲ instead of (Γ, (w, <, ≲)).

Initially, the induction ordering < and quasi-ordering ≲ of the weight ℵ of a weighted sequent (Γ, ℵ) should be new free γ-predicate variables <^{γ} and ≲^{γ}, respectively. Moreover, the initial weight term of ℵ should be the application w^{γ}(x0^{δ} , …, xn−1^{δ}) of a new free γ-variable w^{γ} to the list x0^{δ}, …, xn−1^{δ} of the free δ^{−}-variables of its sequent Γ. In our introductory example of § 1.1.1, the initial sequent was (1) and the weight term was w(x). In our notation here this is written as the weighted sequent

0 + x^{δ} = x^{δ} ; w^{γ}(x^{δ} ), <^{γ}, ≲^{γ} (1)

and within the proof we apply the R-substitution { w^{γ} ↦ λx. x, <^{γ} ↦ ≺ }.

Notice that, although the terms of the induction ordering and quasi-ordering of a weight of a weighted sequent may be (free γ-) predicate variables or λ-terms, the sequents themselves can be restricted to first order because the weights have to interact with the sequents only after they have been instantiated and applied (λβ-reduced), just as in our introductory example.

Furthermore, note that the definition of a weight could be simplified by requiring ≲ to be a wellfounded quasi-ordering and < to be its ordering. However, for proof-technical convenience and for reasoning on the induction ordering itself, we prefer weaker requirements.

For example, if we want to prove formally that well-foundedness of a—possibly non-transitive— relation R implies termination of the transitive closure of its reverse, it should be possible to set <^{γ} and ≲^{γ} to terms denoting R and the empty relation, respectively.

So we decided to have no requirements on the two terms < and ≲ of a weight (w, <, ≲) at all (besides on their types in case of a typed language), but instead we introduce the minimal set of necessary requirements (such as well-foundedness) on < and ≲ when counterexamples are compared, cf. Definition 2.35.

Moreover, notice that, although the term ≲ of the induction quasi-ordering is not visible in the example proof, it may be non-trivial and necessary for simplification in other proofs.^{13} Furthermore, even the term < of the induction ordering is not always needed: With very few exceptions,^{14} inductive theorem proving systems admit only a single built-in well-founded induction ordering. In this case, the only part of a weight that has to be implemented is the weight term, and we indeed omitted the induction ordering and quasi-ordering in the implementation of the QuodLibet system, cf. § 3.2.1. Nevertheless, to cover all cases, the general concept of a weight has to include both < and ≲.

2.3.2 Counterexamples

The weight of an induction hypothesis (Δ, ℶ) must be smaller than the weight of the goal (Γ, ℵ), and for powerful inductive theorem proving, we have to be able to restrict this test to the special case semantically described by the sequence Γ. This can be achieved by considering only such instances of ℵ and ℶ that invalidate Γ. Aweighted sequent (cf. Definition 2.33) augmented with such a valuation providing extra information on the invalidity of its sequent in some Σ-structure A is our formal means to capture the notion of “counterexample”.

Definition 2.34 (Counterexample) Let A be a Σ-structure from K, let C be an R-choice-condition and e be an (A, R)-valuation, and finally let π be (e, A)-compatible with (C, R). (S, τ) is an (π, e, A)-counterexample (for S) if S is a weighted sequent, τ : V_{δ} → A, and Seq({S}) is not ( ϵ(π)(τ) ⊎ τ, e, A )-valid, cf. Definition 2.17.

Thus, for a weighted sequent (Γ, ℵ), the sequent Γ is (π, e, A)-valid (cf. Definition 2.27) iff (Γ, ℵ) has no (π, e, A)-counterexamples.

Definition 2.35 (Ordering on Counterexamples) Let A be a Σ-structure from K, let C be an R-choice-condition and e be an (A, R)-valuation, and finally let π be (e, A)-compatible with (C, R). Let (S_{0}, τ_{0}) and (S_{1}, τ_{1}) be (π, e, A)-counterexamples. Then, for i ∈ {0, 1}, their weighted sequents are of the form S_{i} = (Γ_{i}, (w_{i}, <_{i}, ≲_{i})) and we set δ_{i} := ϵ(π)(τ_{i}) ⊎ τ_{i}, B_{i} := A ⊎ ϵ(e)(δ_{i}) ⊎ δ_{i}, w̄_{i} := eval(B_{i})(w_{i}), ⊲_{i} := eval(B_{i})(<_{i}), and ⊲ ∼_{i} := eval(B_{i})(≲_{i}). As the following two notions hold only for the case that ⊲_{0} = ⊲_{1} and ⊲ ∼_{0} = ⊲ ∼_{1}, we write ⊲ for ⊲ ∼_{0} and ⊲ ∼_{1} as well as ⊲ ∼ for ⊲ ∼_{0} and ⊲ ∼_{1}: (S_{1}, τ_{1}) is (π, e, A)-smaller than (S_{0}, τ_{0}) if w̄_{1} (⊲ ∼ ∪ ⊲)^{∗} w̄_{0}. (S_{1}, τ_{1}) is strictly (π, e, A)-smaller than (S_{0}, τ_{0}) if w̄_{1}⊲^{+}w̄_{0}, ⊲∘⊲ ∼ ⊆ ⊲^{+}, and ⊲ is well-founded.

Note that in case of “<_{i}” and “≲_{i}” being no proper terms of our (possibly first-order) logic language, “eval(B_{i})(<_{i})” is to be taken a shorthand for

{ (a, b) eval( B_{i} ⊎ {x↦a, y↦b} )( x <_{i} y ) = TRUE },

for two new distinct variables x, y ∈ V_{bound}\V(<_{i}).

Moreover, note that our induction ordering is semantical in the sense that it does not depend on the syntactical term structure of a weight w, but only on the value of w under the evaluation function, cf. Definition 13.7 of Wirth (1997). In Wirth (1997) we have investigated the price one has to pay for the possibility to have induction orderings also depending on the syntax of weights. For powerful concrete inference systems this price turned out to be surprisingly high. Besides this, after improving the ordering information in descente infinie by our introduction of explicit weights (cf. Wirth & Becker (1995)), contrary to Bachmair (1988) we no longer feel the need for sophisticated induction orderings that exploit the term structure.

2.3.3 Groundedness

The notion of groundedness^{15} is for induction as crucial as the notion of reduction is for deduction.

Groundedness is defined in terms of counterexamples, according to the somehow negative argumentation of the Method of Descente Infinie as presented in Definition 1.1. Nevertheless, it captures the positive view on descente infinie via application of induction hypotheses.

The notion of groundedness (as given in Definition 2.36 below) is sufficiently general to cover the practical and technical requirements of a variety of application domains and inference systems. It also bridges the gap between the technical concrete notion of counterexamples and the simple and clear abstract view on induction given in Lemma 2.37, which abstracts the algebraic structure we need in the following § 2.4 from the concrete representation in this § 2.3.3.

For the benefit of the reader’s intuition of groundedness, consider the metaphor of building a supporting frame in a swamp.

Note that in the following ‘H’ stands for the induction \underline{h}ypotheses, ‘G_{1}’ for the sub-\underline{g}oals of the \underline{g}oals ‘G_{0}’, and ‘L’ for the \underline{l}emmas of the proof.

We can fix a construction element G_{0} to a construction element (G_{1}, L) on the same or lower level of the supporting frame resulting in the construction

G_{0} → (G_{1}, L)

In the world of induction this means that if an element of G_{0} has a counterexample, then there is a counterexample for an element of G_{1} or L. Moreover, if this counterexample is from G_{1}, then it has to be smaller or equal in the induction quasi-ordering ≲ that must be identical for both counterexamples.

We can fix a construction element G_{0} partly to a construction element (G_{1}, L) on the same or lower level and partly to a construction element H on a strictly lower level of the supporting frame resulting in the construction

\begin{matrix}G_{0} → (G_{1}, L) \\ ↓ \\ H \end{matrix}

for which we write G_{0} → ↓ (H, G_{1}, L). In the world of induction this means that if an element of G_{0} has a counterexample, then there is a counterexample for an element of H, G_{1}, or L. Moreover, if this counterexample is from H then it has to be strictly smaller and if it is from G_{1} it has to be equal or smaller than the original counterexample from G_{0} in the induction ordering they share.

Now, if we have a supporting frame of the form H → ↓ (H, G_{1}, L), i.e.

H → (G_{1}, L) ; ↓ ; H → (G_{1}, L) ; ↓ ; ⋮

and we know that the swamp is well-founded (i.e. we find solid ground eventually if we only go deep enough) then we know that H is sufficiently supported—and hence will not sink—by the element (G_{1}, L) alone, i.e. H → (G_{1}, L). In the world of induction this means that all sequents of the elements of the set H are inductively valid provided that the base cases in G_{1} and the lemmas in L are, cf. Lemma 2.37(7).

Note that {S} → ↓ (H, ∅, ∅) ∨ {S} → (G_{1}, L) implies {S} → ↓ (H, G_{1}, L) for a weighted sequent S, but the converse does not hold in general, because different counterexamples for S may have smaller counterexamples in different sets.

Definition 2.36 (Groundedness) Let C be an R-choice-condition. Let G_{0}, G_{1}, H, L be sets of weighted sequents. G_{0} is (C, R)-grounded on (H, G_{1}, L) (denoted by G_{0} → ↓ _{C,R} (H, G_{1}, L)) if for any Σ-structure A from K, for any (A, R)-valuation e, for any π that is (e, A)-compatible with (C, R), and for any (π, e, A)-counterexample (S_{0}, τ_{0}) with S_{0} ∈ G_{0}, there is an (π, e, A)-counterexample (S_{1}, τ_{1}) satisfying one of the following cases:

Induction Hypothesis: S_{1}∈ H and (S_{1},τ_{1}) is strictly (π,e,A)-smaller than (S_{0},τ_{0}).
Sub-Goal: S_{1}∈ G_{1} and (S_{1},τ_{1}) is (π, e, A)-smaller than (S_{0},τ_{0}).
Lemma: S_{1}∈ L.

Finally, we write G_{0} →_{C,R} (G_{1}, L) as a shorthand for G_{0} → ↓ _{C,R} (∅, G_{1}, L).

Note that H →_{C,R} (∅, L) iff Seq(H) (C, R)-reduces to Seq(L) in all A ∈ K.

Finally, note that the following § 2.4 depends only on the general properties of groundedness given in the following Lemma 2.37. It is is similar to Lemma 2.31, but it extends reduction to groundedness.

Lemma 2.37 (Groundedness) Let C be an R-choice-condition, and let G_{i}, G′_{i}, H_{i}, L_{i} be sets of weighted sequents.

1. (Validity)

Assume G_{0} →_{C,R} (G_{1}, L_{1}). Let A ∈ K.

(a) If Seq(G_{1}∪L_{1}) is (C, R)-valid in A, then Seq(G_{0}) is (C, R)-valid in A, too.

(b) Let e be an (A, R)-valuation and let π be (e, A)-compatible with (C, R). If Seq(G_{1}∪L_{1}) is (π, e, A)-valid, then Seq(G_{0}) is (π, e, A)-valid, too.

2. (Reflexivity)

In case of G_{0} ⊆ G_{1}∪L_{1}: G_{0} → ↓ _{C,R} (H_{1}, G_{1}, L_{1}).

3. (Transitivity)

(a) If G_{0} →_{C,R} (G_{1}, L_{1}) and G_{1} → ↓ _{C,R} (H_{2}, G_{2}, L_{2}), then G_{0} → ↓ _{C,R} (H_{2}, G_{2}, L_{1}∪L_{2}).

(b) If G_{0} →_{C,R} (G_{1}, L_{1}) and L_{1} →_{C,R} (G_{2}, L_{2}), then G_{0} →_{C,R} (G_{1}, G_{2}∪L_{2}).

4. (Additivity)

If G_{i} → ↓ _{C,R} (H_{i}, G′_{i}, L_{i}) for all i ∈ I,

then ⋃_{i∈I} G_{i} → ↓ _{C,R} ( ⋃_{i∈I} H_{i} , ⋃_{i∈I} G′_{i} , ⋃_{i∈I} L_{i} ).

5. (Monotonicity) For (C′, R′) being an extension of (C, R): If G_{0} →_{C,R} (G_{1}, L_{1}), then G_{0} →_{C′,R′} (G_{1}, L_{1}).

6. (Instantiation)

For an R-substitution σ on V_{γ} and the extended σ-update (C′, R′) of (C, R):

If G_{0} →_{C,R} (G_{1}, L_{1}), then G_{0}σ →_{C′,R′} (G_{1}σ, L_{1}σ).

7. (Descente Infinie) If H_{1} → ↓ _{C,R} (H_{1}, G_{1}, L_{1}), then H_{1} →_{C,R} (G_{1}, L_{1}).

2.4 Abstract Sequent and Tableau Calculus

Now we are going to describe an abstract sequent and tableau calculus for descente infinie. The standard state-of-the-art deductive calculi are instances of this calculus, and its design is not as ad hoc as it may seem, cf. Wirth & Becker (1995), Wirth (1997) for a discussion of alternatives. The benefit of an abstract calculus is that each instance is automatically sound. For the design of purely deductive calculi, such an abstract calculus is not really helpful because their soundness is a local property of each inference rule. For descente infinie, however, soundness becomes a global problem of the whole inference system. Moreover, the inference rules usually have to be improved over a long period of practical testing until they meet the design goals of § 1.2.1. And in this setting, such an abstract calculus turned out to be very useful indeed, cf. Wirth (1997).

Definition 2.38 (AX) The set AX of axioms may be any set of sequents that is (V_{γ}×V_{δ})-valid in all A ∈ K.

By Lemma 2.28, this means that AX is R-valid and (C, R)-valid for any R-choice-condition C. For the meaning of K cf. the last sentence in Definition 2.17. Typically, AX contains all sequents of the forms Γ A Π \overline{A} Λ and Γ (s=s) Π for sequents Γ, Π, Λ, formulas A, and terms s.

In inductive proof trees, each sequent has a weight which controls the inductive loops, i.e. the sequents of deductive calculi are replaced with weighted sequents. Inductive tableau trees differ from deductive tableau trees in that each root is labeled with a weight instead of a formula.

Both sequent and tableau trees will be used in the following. In the definitions we describe the sequent version and add the alternative text for the tableau version enclosed in double parenthesis, as in the following definition.

Definition 2.39 (Proof Forest) An inductive proof forest is a quintuple

(F, C, R, L, H)

where C is an R-choice-condition, L, H ⊆ N_{+}×N_{+}, and F is a partial function from N_{+} into the set of pairs (S, t), where S is a weighted sequent and t is a tree whose nodes are labeled with weighted sequents ((t is a tree whose root is labeled with a weight and whose other nodes are labeled with formulas)).

Here L records the lemma applications and H the induction-hypothesis applications, and the tree t represents a proof attempt for the proposition S. In case of a tableau tree, the nodes of t are labeled with formulas; the root, however, with a weight. In case of a sequent tree, all nodes are labeled with weighted sequents.

While the weighted sequents at the leaves of a sequent tree represent its goals, in a tableau tree we have to collect all ancestors to make up a weighted sequent, and—moreover—the labeling formulas are in negated form:

Definition 2.40 (Goals(), Closedness) Let T be a set of trees. ‘Goals(T)’ denotes the set of weighted sequents labeling the leaves of the trees in T ((the set of weighted sequents (Δ, ℶ) where Δ results from listing the conjugates of the formulas labeling a branch from a leaf to the root (exclusively) in a tree t in T and ℶ is the label of the root of the tree t)). A tree t is closed if Seq(Goals({t})) ⊆ AX .

What is the conceptual reason for a forest instead of a single proof tree? We want to separate lemma and induction-hypothesis application from the standard reductive proof steps. This has already been explained in detail in § 1.2.3. In our formalization, lemma and induction-hypothesis application now look as follows:

Suppose that we have two proof trees

F (i) = ((Γ, ℵ), t)

and

F (i′) = ((Γ′, ℵ′), t′).

We can apply Γ′ instantiated with a substitution ϱ on V_{δ} as a lemma in the tree t of (Γ, ℵ). Then we have to record this lemma application by inserting (i′, i) into L.

Similarly, we can also apply (Γ′, ℵ′)ϱ as an induction hypothesis in the tree t of (Γ, ℵ) and record this induction hypothesis application by inserting (i′, i) into H. Then we additionally have to implant a new branch into t whose goals express that the weight term of ℵ′ϱ is strictly smaller than the weight term of ℵ and that the induction (quasi-) orderings of ℵ′ϱ and ℵ are identical.

Notice that we do not have lemmas on the one hand and induction hypotheses on the other, but that the same proposition of a proof tree may be applied as a lemma in one case and as an induction hypothesis in the other. Indeed, the sets L and H are not sets of lemmas and induction hypotheses, but sets of applications as lemmas and as induction hypotheses.

If the lemma-application relation L∘H^{∗} is well-founded and all trees t′′ with F (i′′) = (S′′, t′′) and i′′ (L∪H)^{∗} i are closed, we have successfully proved that Γ is (C, R)-valid.

The following definition introduces the abstract and mnemonic ‘Propos()’ and ‘Trees()’ for the ‘dom()’ and ‘ran()’ of our concrete representation.

Definition 2.41 (Propos(), Trees()) For A being a set of pairs (S, t) consisting of a weighted sequent S and a tree t, we define the propositions of A by Propos(A) := dom(A) and the trees of A by Trees(A) := ran(A).

The following definition is based on three abstract proof steps: an Instantiation step globally instantiates some free variables in the proof forest; a Hypothesizing step starts a new proof tree for a newly conjectured proposition; and an Expansion step expands a proof tree.

Definition 2.42 (Abstract Sequent and Tableau Calculus) We start with the empty proof forest (F, C, R, L, H) := (∅, ∅, ∅, ∅, ∅) and then iterate the following modifications of (F, C, R, L, H), resulting in (F′, C′, R′, L′, H′):

Instantiation: Let σ be an R-substitution on V_{γ}. Let (C′, R′) be the extended σ-update of (C, R).

Set L′ := L, H′ := H, and

F′ := { ( i, ((Γ σ, ℵσ), tσ) ) ( i, ((Γ, ℵ), t) ) ∈ F }.

Hypothesizing: Let i ∈ N_{+} \ dom(F). Let (Γ, ℵ) be a weighted sequent.

Let t be a new tree with a single node, and label this node with (Γ, ℵ).

((Let t be a new tree with a single branch, such that Γ is the list of the conjugates of the formulas labeling the branch from the leaf to the root (exclusively) and ℵ is the label of the root.)) Let (C′, R′) be an extension of (C, R). Set L′ := L, H′ := H, and F′ := F ∪ { ( i, ((Γ, ℵ), t) ) }.

Expansion: Let (i, (S, t)) ∈ F, let l be a leaf in t, let (Δ, ℶ) be the label of l ((let (Δ, ℶ) result from listing the conjugates of the formulas labeling the branch from l to the root (exclusively) and let ℶ be the label of the root of t)). Let G be a set of weighted sequents ((let M be a set of sequents and set G := { (ΠΔ, ℶ) | Π ∈ M })). Let (C′, R′) be an extension of (C, R), and let N_{L}, N_{H} ⊆ dom(F), such that

{(Δ, ℶ)} → ↓ _{C′,R′} ( Propos(⟨N_{H}⟩F), G, Propos(⟨N_{L}⟩F) ). ($)

Set L′ := L ∪ N_{L}×{i}, H′ := H ∪ N_{H}×{i}, and

F′ := ( F \{(i, (S, t))} ) ∪ {(i, (S, t′))},

where t′ results from t by adding, for each weighted sequent S′ in G, a new child node labeled with S′ to the former leaf l ((by adding, for each sequent Π in M, a new child branch to the former leaf l, such that Π is the list of the conjugates of the formulas labeling the branch from the leaf to the new child node of l)).

Expansion steps are parameterized with a goal (Δ, ℶ), with two sets N_{H}, N_{L} of numbers of proof trees, and with a set of sequents G such that ($) holds. Propos(⟨N_{H}⟩F) and Propos(⟨N_{L}⟩F) contain the propositions of the proof trees that are applied as induction hypotheses and lemmas, respectively. For the ⟨…⟩F notation cf. § 2.1.1. The weighted sequents in G become the new child nodes of the former leaf node labeled with (Δ, ℶ). For tableau trees, however, this set G of weighted sequents must actually have the form of { (ΠΔ, ℶ) | Π ∈ M }, because an Expansion step cannot remove formulas from ancestor nodes (as they are also part of the goals associated with other leaves in the proof tree).

To be precise, in addition to the standard notion of a tree (cf. Knuth (1997f.), Vol. I), we assume an explicit representation of leaves, so that, when we add the elements of G as children to the leaf node l, this l is no longer a leaf, even if G is empty. Finally note that an Instantiation step can actually apply a substitution even on V_{γ} ∪ V_{δ^{+}} instead of just V_{γ}, cf. § B.3 in the appendix as well as Wirth (2008).

2.4.1 Soundness

The following invariant captures the soundness of our proof trees. Roughly speaking, the validity of the goals of a tree imply the validity of the sequent of this tree; i.e.: “The leaves imply the root.”

Definition 2.43 (Invariant for Soundness) The invariant for soundness of (F, C, R, L, H) is that (F, C, R, L, H) is a proof forest and that, for all (i, (S, t)) ∈ F,

{S} →_{C,R} ( Goals(Trees(⟨I⟩F)), Propos(⟨L⟨I⟩⟩F) ) for I := H^{∗}⟨{i}⟩.

Note that I is the set of the number i plus the numbers of the proof trees whose propositions have been applied in the tree t as induction hypotheses. Goals(Trees(⟨I⟩F)) is the set of goals of these proof trees. Moreover,

Propos(⟨L⟨I⟩⟩F) = { S′ i ∈ I ∧ i′Li ∧ F (i′) = (S′, t′) }

is the set of the lemmas S depends on.

Theorem 2.44 (Soundness) The invariant for soundness is always satisfied for the abstract sequent and tableau calculus of Definition 2.42.

Theorem 2.45 (Successful Proof) Suppose the invariant for soundness of (F, C, R, L, H) holds. Let (i, ((Γ, ℵ), t)) ∈ F. If all trees in Trees(⟨(L∪H)^{∗}⟨{i}⟩⟩F) are closed and if L∘H^{∗} is well-founded, then Γ is (C, R)-valid.

Note that

Trees(⟨(L∪H)^{∗}⟨{i}⟩⟩F) = { t′ | i′ (L∪H)^{∗} i ∧ F (i′) = (S′, t′) }

is the set of all trees involved in the proof of Γ. In case of the inductive theorem prover QuodLibet (cf. Avenhaus &al. (2003)) it has turned out to be most useful in practice to consider also a validity that is relative to the directly applied, possibly open lemmas of (L∘H^{∗})⟨{i}⟩, for which we have to replace (L∪H)^{∗} with H^{∗} in Theorem 2.45.

Notice that (C, R)-validity of Γ implies (∅, R′)- and R′-validity of Γ ς, for R′ and ς satisfying the requirements of Lemma 2.29.

2.4.2 Safeness

While the invariant for soundness (“the leaves imply the root”) is essential, its converse, namely “the root implies the leaves”, which we call safeness, is useful in practice for failure detection.

Failure detection is especially important for inductive theorem proving as the standard technique to generalize (i.e. to strengthen) induction hypotheses easily leads to over-generalization. As a valid input theorem easily produces an invalid sub-goal by over-generalization, the early and localized detection of this invalidity is of major practical importance, cf. also § 3.2.3.

Definition 2.46 (Invariant for Safeness) The invariant for safeness of (F, C, R, L, H) is that, for all (i, ((Γ, ℵ), t)) ∈ F, Seq(Goals({t})) (C, R)-reduces to {Γ }.

We extend Definition 2.42 of the abstract sequent and tableau calculus as follows:

Definition 2.47 (Safeness of Steps and Sub-rules) Instantiation^{16} and Hypothesizing steps are always safe. Also Expansion steps in a tableau tree are always safe. An Expansion step in a sequent tree is safe if Seq(G) (C′, R′)-reduces to {Δ}. A sub-rule of the Expansion rule is safe if it describes only safe Expansion steps.

Theorem 2.48 (Safeness) The invariant for safeness is always satisfied for the abstract sequent and tableau calculus, provided the individual steps are safe.

Suppose we have disproved a goal of a tree t with (i, ((Γ, ℵ), t)) ∈ F, i.e. we have found out that the goal is invalid. In this case we should backtrack to a possibly unsafe step that may have caused this invalidity. If, however, all steps in t are safe, then the proposition Γ is invalid. This may have two reasons: Either a Hypothesizing step introduced an invalid proposition, or the proposition was modified later by an invalidating Instantiation step:

• If there have been no Instantiation steps affecting the sequent Γ, then we should remove (i, ((Γ, ℵ), t)) from the proof forest F and undo all its applications as a lemma or as an induction hypothesis, i.e. the Expansion steps where i occurs in the sets N_{L}, N_{H}.

• Otherwise, we should undo an Instantiation step affecting the sequent Γ, and then see whether we can still detect a failure by disproving the disinstantiated goal.

2.5 Concrete Sequent and Tableau Calculus

The concrete sequent and tableau calculus we will describe here results from the abstract sequent and tableau calculus of the previous § 2.4 by presenting concrete sub-rules of the Expansion rule.

2.5.1 Expansion Steps Within a Single Tree

The α-, β-, γ-, δ-rules as well as the liberalized δ-, Rewrite-, and Cut-rules of § 1.2.4 can be modeled as safe Expansion steps as follows: Let F = (F, C, R, L, H). Let

\begin{matrix}Δ & C′′ \\ Π_{0} … Π_{n−1} & R′′ \end{matrix}

denote a sub-rule of the Expansion rule in sequent trees of the abstract sequent and tableau calculus of Definition 2.42 where N_{L} := N_{H} := ∅ (i.e. no application of lemmas or induction hypotheses), G := {(Π_{0}, ℶ), …, (Π_{n−1}, ℶ)}, C′ := C ∪ C′′, and R′ := R ∪ R′′. If C′′ and R′′ are not explicitly denoted, this stands for the special case of C′′ = R′′ = ∅.

The respective rules for tableau trees differ only in that M consists of the sub-sequents containing the new (i.e. the first one or two) formulas of the sequents below the bar.

For such a rule being a safe sub-rule of the Expansion rule of the abstract sequent and tableau calculus of Definition 2.42 we have to show that C′ is an R′-choice-condition, that {(Δ, ℶ)} →_{C′,R′} (G, ∅), and that Seq(G) (C′, R′)-reduces to {Δ}.

Theorem 2.49 The α-, β-, γ-, δ-rules as well as the liberalized δ-, Rewrite-, and Cut-rules of § 1.2.4 are safe sub-rules of the Expansion rule of the abstract sequent and tableau calculus of Definition 2.42.

The following example shows that R′′ of the liberalized δ-rule of § 1.2.4 must indeed contain V_{δ}(A) × {x^{δ^{+}}} besides V_{γ}(A) × {x^{δ^{+}}}, and that the transitive closure over R′ must be considered for an R′-sub-stitution on V_{γ}.

Example 2.50 The formula ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) is not generally valid (to wit, let Q be the identity relation on a non-trivial universe). γ-step: ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y^{γ}) ), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) Liberalized or non-liberalized δ-step:

( ∀z. Q(x^{δ}, z) ∨ ¬Q(x^{δ}, y^{γ}) ), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

with variable-condition R := {(y^{γ}, x^{δ})}. α-step: ∀z. Q(x^{δ}, z), ¬Q(x^{δ}, y^{γ}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) Liberalized δ-step: Q(x^{δ}, z^{δ^{+}}), ¬Q(x^{δ}, y^{γ}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) with additional choice-condition C′′ := {(z^{δ^{+}}, ¬Q(x^{δ}, z^{δ^{+}}))} and additional variable-condition R′′ := {(x^{δ}, z^{δ^{+}})}, i.e. the current variable-condition R′ is given by

y^{γ}  _{R} x^{δ}  _{R′′} z^{δ^{+}}

Note that now we have y^{γ} R′^{+} z^{δ^{+}} although y^{γ} does not appear in Q(x^{δ}, z).

Thus, both the inclusion of the free δ-variable x^{δ} of the principal formula ∀z. Q(x^{δ}, z) into the domain of the variable-condition R′′ and its transitive closure together with R are necessary for guaranteeing that σ := {y^{γ}↦z^{δ^{+}}} is not an R′-substitution in our state of proof. The latter fact, however, is essential for soundness, because without it we could complete the proof attempt by application of σ in an Instantiation step, leading to the tautology

Q(x^{δ}, z^{δ^{+}}), ¬Q(x^{δ}, z^{δ^{+}}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

2.5.2 Applying Lemmas and Induction Hypotheses

Now we present two rules for applying (Φ, ℸ) as a lemma or as an induction hypothesis to expand a goal (Δ, ℶ) of a proof tree t. We formulate them as Expansion steps in tableau trees (sequent trees analogously) of the abstract sequent and tableau calculus of Definition 2.42 as follows.

Let (F, C, R, L, H), i, and (Δ, ℶ) be given as in the Expansion rule.

As there is no reason for updating the variable-condition R or the R-choice-condition C, set (C′, R′) := (C, R).

Let (j, ((Φ, ℸ), t′′)) ∈ F be the proof tree whose proposition we want to apply.

Set Y := { y^{δ} ∈ V_{δ} (Φ, ℸ) V_{γδ^{+}}(Φ, ℸ) × {y^{δ} } ⊆ R′ }. Note that Y contains exactly those free δ^{−}-variables of (Φ, ℸ) that have neither free γ-variables nor free δ^{+}-variables of (Φ, ℸ) in their “R′-scope”. In other words, the variables in Y are those free δ^{−}-variables upon which neither a solution for the free γ-variables nor a choice-condition for the free δ^{+}-variables in (Φ, ℸ) depends. Therefore, the variables in Y are those which we can instantiate when applying (Φ, ℸ).^{17}

Thus, let ϱ be a substitution on Y.

To complete the description of a sub-rule of the Expansion rule in a tableau tree we have to present the sets N_{L} (applied lemmas), N_{H} (applied induction hypotheses), and M (sequents generating the subgoals). These sets differ for lemma and induction-hypothesis application. A lemma is simply added to the context of the goal (Δ, ℶ). In case of an induction hypothesis, we also have to add sub-goals which express that (2) the instantiated induction hypothesis is smaller than the goal, (3) the induction ordering is well-founded, (4) the induction orderings and (5) the induction quasi-orderings of the instantiated hypothesis and the goal are identical and (6) compatible.

Lemma Application: Set N_{L} := {j} and N_{H} := ∅. As it would be fatal to destroy the well-founded-ness of L∘H^{∗} required in Theorem 2.45, it is reasonable to forbid i (L∪H)^{∗} j. Let M be the set containing the single-formula sequents \overline{Bϱ} for each formula B listed in the sequent Φ.

Induction-Hypothesis Application: Set N_{L} := ∅ and N_{H} := {j}. As it would be fatal to destroy the well-foundedness of L∘H^{∗} required in Theorem 2.45, it is reasonable to forbid i H^{∗}∘(L∘H^{∗})^{+} j. Set (w, <, ≲) := ℶ and (w′, <′, ≲′) := ℸ. Let α be the common type of w and w′. Let M be the set containing the following single-formula sequents:

(1) \overline{Bϱ} for each formula B listed in the sequent Φ

(2) w′ϱ < w

(3) ∀p : α → bool. ( ∃a:α. p(a) ⇒ ∃a:α. ( p(a) ∧ ¬∃a′:α. (p(a′) ∧ a′<a) ) ) ^{18}
(4) ∀x, y : α. ( x < y ⇔ x (<′ϱ) y )
(5) ∀x, y : α. ( x ≲ y ⇔ x (≲′ϱ) y )
(6) ∀x, y, z : α. ( (x < y ∧ y ≲ z) ⇒ x < z )

Each of the above sequents (3)–(6) can be omitted if the following holds, respectively, for any A ∈ K, (A, R′)-valuation e, and π and τ such that π is (e, A)-compatible with (C′, R′) and ((Δ, ℶ), τ) is an (π, e, A)-counterexample, and for δ := ϵ(π)(τ) ⊎ τ, ⊲ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<), and ⊲ ∼ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲) :

(3) ⊲ is well-founded

(4) ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ)

(5) ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ)

(6) ⊲ ∘ ⊲ ∼ ⊆ ⊲^{+}

Thus, the sequents (3)–(6) can be omitted if we have a fixed well-founded induction (quasi-) ordering, as described at the end of § 2.3.1. The sequents (5) and (6) can also be omitted in the important special case (cf. § 3.4) that the third component ⊲ ∼ of the weights is restricted to be the empty relation ∅.

Theorem 2.51 The rules for lemma and induction-hypothesis application described above are safe sub-rules of the Expansion rule of the abstract sequent and tableau calculus.

Detailed examples showing how Theorem 2.51 should be used are given in § 3.1 (lemma application) and § 3.2 ff. (induction-hypothesis application).

Note that there is no analogon of Theorem 2.51 instantiating a set of free δ^{+}-variables instead of the set Y of free δ^{−}-variables. Thus, free δ^{−}-variables are necessary even if we are not interested in non-liberalized δ-steps. As will be explained in § 3.1, we should always use free δ^{−}-variables in Hypothesizing steps. Moreover, to have more useful lemmas and induction hypotheses, we sometimes have to split a tree at an inner position with a Hypothesizing step introducing a new proposition with free δ^{−}-variables replacing the free δ^{+}-variables and apply this new proposition as a lemma to the new leaf of the old tree, closing this branch, cf. the discussion at the end of § 3.2.3.

2.5.3 Other Concrete Inference Steps

More specialized sub-rules of the Expansion rule are appropriate for practical inference systems such as the one presented in Wirth (1997), Kühler (2000), Avenhaus &al. (2003), Schmidt-Samoa (2006a), Schmidt-Samoa (2006b), Schmidt-Samoa (2006c), but for our purposes here, the basic rules of Theorem 2.49 and Theorem 2.51 are sufficient.

3 Examples

3.1 An Example for Lemma Application

In this example, the proofs are presented as tableau trees, which we do not depict because they all have branching degree 1. As there are no inductive proofs, we omit the weights completely. As no liberalized δ-rules are applied, the choice-conditions are always empty. Assume that in the signature Σ we have the operator ∗, the constant 1, and the inverse function inv.

We begin with the empty proof forest (F, C, R, L, H) := (∅, ∅, ∅, ∅, ∅).

Then we start a new proof tree with number 1 for the associativity of ∗ as

(1) x1^{δ} ∗ (y1^{δ} ∗ z1^{δ} ) = (x1^{δ} ∗ y1^{δ} ) ∗ z1^{δ}

by a Hypothesizing step in the tableau calculus of Definition 2.42, just as two new proof trees for

(2) 1 ∗ x2^{δ} = x2^{δ}

(3) inv(x3^{δ}) ∗ x3^{δ} = 1

With these three trees we have the axioms of group theory at hand via lemma application.

Now we really want to prove something. We start the new proof tree number 4 for

(4) ∀x. x ∗ inv(x) = 1 by a Hypothesizing step. The the root of proof tree 4 is labeled with

¬∀x. x ∗ inv(x) = 1

A δ-step (cf. Theorem 2.49) adds the child

x4^{δ} ∗ inv(x4^{δ}) ≠ 1

Our variable-condition is still empty because no free variables occur in ¬∀x. x ∗ inv(x) = 1. Applying the sequent of proof tree 3 in the way of Theorem 2.51 with ϱ := {x3^{δ} ↦ y1^{γ}} adds the new child

inv(y1^{γ}) ∗ y1^{γ} = 1

to proof tree 4 and inserts the pair (3, 4) into L. A Rewrite step (cf. Theorem 2.49) with this equality from right to left produces the new child

x4^{δ} ∗ inv(x4^{δ}) ≠ inv(y1^{γ}) ∗ y1^{γ}

Applying the sequent of proof tree 2 in the way of Theorem 2.51 with ϱ := {x2^{δ} ↦ y1^{γ}} adds the new child

1 ∗ y1^{γ} = y1^{γ}

to proof tree 4 and inserts the pair (2, 4) into L. This new child can be used for a Rewrite step from right to left adding the child

x4^{δ} ∗ inv(x4^{δ}) ≠ inv(y1^{γ}) ∗ (1 ∗ y1^{γ})

Applying the sequent of proof tree 3 in the way of Theorem 2.51 adds the new child

inv(y2^{γ}) ∗ y2^{γ} = 1

A Rewrite step (cf. Theorem 2.49) with this equality from right to left produces the new child

x4^{δ} ∗ inv(x4^{δ}) ≠ inv(y1^{γ}) ∗ ((inv(y2^{γ}) ∗ y2^{γ}) ∗ y1^{γ})

With two applications of the sequent of proof tree 1, this can be rewritten into

x4^{δ} ∗ inv(x4^{δ}) ≠ (inv(y1^{γ}) ∗ inv(y2^{γ})) ∗ (y2^{γ} ∗ y1^{γ})

Note that now L = {1, 2, 3} × {4}. Applying the sequent of proof tree 3 in the way of Theorem 2.51 adds the new child

inv(y3^{γ}) ∗ y3^{γ} = 1

While the proof up to now required some ingenuity, the following can be easily automated. To use the latter new child for a Rewrite step from left to right at the position 1 of the right-hand side of the previous one, we apply the unifier σ := {y1^{γ}↦inv(y2^{γ}), y3^{γ}↦inv(y2^{γ})} to the whole proof forest and— after the Rewrite step—get the new child

x4^{δ} ∗ inv(x4^{δ}) ≠ 1 ∗ (y2^{γ} ∗ inv(y2^{γ}))

Note that σ is an R-substitution on V_{γ} in our proof state with R = ∅, and that the σ-update R′ of R

is given by y1^{γ}  y2^{γ}^{Γ_{σ}}_{Γ_{σ}} y3^{γ}  . After global application of σ, the free γ-variables y1^{γ} and y3^{γ} do not occur

anywhere in our current proof forest. Thus, even the updated variable-condition does not put any restrictions on R-substitutions on V_{γ}, unless we would re-use y1^{γ} or y3^{γ}.^{19} With an application of the sequent of proof tree 2, the formula of the last new node can be rewritten into

x4^{δ} ∗ inv(x4^{δ}) ≠ y2^{γ} ∗ inv(y2^{γ})

An Instantiation step applying {y2^{γ} ↦ x4^{δ} } turns this into

x4^{δ} ∗ inv(x4^{δ}) ≠ x4^{δ} ∗ inv(x4^{δ})

Now the tree is closed because all sequents of the form (t = t) Λ are assumed to be in our axioms AX. By Theorem 2.45 we now know that ∀x. x ∗ inv(x) = 1 is ∅-valid, provided that the proof trees 1, 2, and 3 are closed, which is the case when we assume their sequents to be in AX.

Now we start proof tree 5 for

(5) x5^{δ} ∗ inv(x5^{δ}) = 1

by a Hypothesizing step. Note that the sequent is not really different from that of proof tree 4. We prefer the form of proof tree 5 because it will be more useful for descente infinie. For purely deductive theorem proving, the two only differ in that the form of proof tree 5 is handier for lemma application. To see this, we will prove each with the help of the other. A lemma application according to Theorem 2.51 of the sequent of proof tree 4 to proof tree 5 whose root is labeled with x5^{δ} ∗ inv(x5^{δ}) ≠ 1 adds the child

∀x. x ∗ inv(x) = 1.

A γ-step adds the child

x5^{δ} ∗ inv(x5^{δ}) = 1.

Now proof tree 5 is closed because all sequents of the form A Λ \overline{A} are assumed to be in our axioms AX. Finally, we start another proof tree number 6 for the sequent of proof tree 4. The root is again labeled with

¬∀x. x ∗ inv(x) = 1

A δ-step adds the child

x6^{δ} ∗ inv(x6^{δ}) ≠ 1

Applying the sequent of proof tree 5 in the way of Theorem 2.51 adds the new child

x6^{δ} ∗ inv(x6^{δ}) = 1

Now proof tree 6 is also closed because all sequents of the form A \overline{A} Λ are assumed to be in our axioms AX. Note that finally we have L = {1, 2, 3} × {4} ∪ {(4, 5), (5, 6)} and H = ∅, so that L∘H^{∗} is well-founded and Theorem 2.45 can be applied indeed.

3.2 An Example for Mutual Induction

3.2.1 Induction Ordering in QuodLibet

While for general descente infinie—as described in § 2.3.1—not only the weights but also the induction ordering can be chosen for each proof differently, in QuodLibet, a tactic-based inductive theorem proving system for clausal logic, cf. Wirth (1997), Kühler (2000), Avenhaus &al. (2003), it has turned out to be adequate to use the following fixed well-founded quasi-ordering depending on the signature Σ:

The semantical length of a ground term is the syntactical length of a constructor ground term equal to it. The admissibility conditions guarantee that there is at most one such term. The lexicographic extension up to a fixed finite length^{20} of the lifting of the semantical length results in a well-founded quasi-ordering on the objects of each of the models that establish the inductive validity of QuodLibet (i.e. type-C in Wirth & Gramlich (1994b)).

Although the induction ordering is fixed, the lazy substitution of the second-order weight variables during the proofs provides sufficient flexibility for the intended application domain of partially defined recursive functions, cf. Kühler & Wirth (1996), Wirth & Gramlich (1994a).

3.2.2 The P & Q Example

The toy example of this § illustrates how mutual induction works in our framework. As the proof requires mutual induction with non-trivial weights, it cannot be performed in many inductive theorem proving systems or the lean induction calculus of Baaz &al. (1997). The signature is the one presented in § 1.1.1, enriched with the predicates P : nat → bool and Q : nat → nat → bool. Besides the axiom (nat1) of § 1.1.1, we have the following axioms, defining the special predicates of our example.

(P1)  P(0)
(P2) ∀x. ( P(s(x)) ⇐ ( P(x) ∧ Q(x, s(x)) ) )

\begin{matrix}(Q1) & ∀x. & Q(x, 0) \\ (Q2) & ∀x, y. & ( Q(x, s(y)) ⇐ ( Q(x, y) ∧ P(x) ) ) \end{matrix}

We want to show that both predicates are tautological:

\begin{matrix}(1) & P(x0^{δ}); w1^{γ}(x0^{δ}) \\ (2) & Q(y0^{δ} , z0^{δ} ); w2^{γ}(y0^{δ} , z0^{δ} ) \end{matrix}

Note that weights consist only of weight terms (like w1^{γ}(x0^{δ}) in (1)) because we fix the induction (quasi-) ordering to be the single one of the QuodLibet system, as discussed in § 3.2.1. Therefore—as discussed in § 2.5—the items (3)–(6) of Theorem 2.51 can be omitted in the following.

In the Hypothesizing steps for (1) and (2) we introduce the variable-condition

R := \binom{V_{γδ^{+}}((1)) × V_{δ} ((1))}{∪ V_{γδ^{+}}((2)) × V_{δ} ((2))} = \binom{\{w1^{γ}\} × \{x0^{δ} \}}{∪ \{w3^{γ}\} × \{y0^{δ} , z0^{δ} \}}

to have all free δ^{−}-variables of (1) or (2) in the set Y of Theorem 2.51. After several inference steps, QuodLibet presents a sequent tree for (1) similar to following:

(1) P(x0^{δ}); w1^{γ}(x0^{δ})

(nat1), γ, β, δ, Rewrite^{+}

(1.1) P(0); w1^{γ}(0) (1.2) P(s(x1^{δ})); _{w1^{γ}(s(x1^{δ}))}

(P1) (P2), γ, β, β

(1.2.1) \begin{matrix}P(x1^{δ}) & , \\ P(s(x1^{δ})) & ; & w1^{γ}(s(x1^{δ})) \end{matrix} (1.2.2) \begin{matrix}Q(x1^{δ} , s(x1^{δ})), ¬P(x1^{δ}), \\ P(s(x1^{δ})) & ; & w1^{γ}(s(x1^{δ})) \end{matrix}

induction-hypothesis appl. of

(1){x0^{δ} ↦x1^{δ} }

induction hypothesis application of

(2){y0^{δ} ↦x1^{δ} , z0^{δ} ↦s(x1^{δ})}

(1.2.1.1) \begin{matrix}w1^{γ}(x1^{δ}) & < & w1^{γ}(s(x1^{δ})) & , \\ P(x1^{δ}) & , \\ P(s(x1^{δ})) & ; & w1^{γ}(s(x1^{δ})) \end{matrix} (1.2.2.1) w2^{γ}(x1^{δ} , s(x1^{δ}))<w1^{γ}(s(x1^{δ})), Q(x1^{δ} , s(x1^{δ})), ¬P(x1^{δ}), P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))

The square boxes are the nodes of the proof tree, whereas the round-edged boxes show applications of inference rules of Theorem 2.49 and Theorem 2.51, which are more elementary than the inference rules in QuodLibet. We can check whether the tree is closed simply by realizing that all leaves are roundedged nodes. This is not only useful for implementation purposes (where we have to record somewhere why a branch is closed) but also immediately realizes the explicit representation of leaves required by Definition 2.42.

For example, “ (nat1), γ, β, δ, Rewrite^{+} ” in the first round-edged box means that we use the axiom (nat1) as a lemma in Theorem 2.51, and then apply a γ-, a β-, and a δ-step and several Rewritesteps of Theorem 2.49 to get the following proof tree below, where in the last inference steps (resulting in (1.1) and (1.2)) the left-most literals of the parents of the leaf nodes are safely (cf. § 2.4.2) removed because x0^{δ} is in solved^{21} form.

(1) ¬∀x. ( x=0 ∨ ∃y. x=s(y) ), P(x0^{δ}); w1^{γ}(x0^{δ}) ¬( x0^{δ} =0 ∨ ∃y. x0^{δ} =s(y) ), P(x0^{δ}); w1^{γ}(x0^{δ}) x0^{δ} ≠0, P(x0^{δ}); w1^{γ}(x0^{δ})  ¬∃y. x0^{δ} =s(y), P(x0^{δ}); w1^{γ}(x0^{δ})_{x0^{δ} ≠s(x1^{δ}), P(x0^{δ}); w1^{γ}(x0^{δ})} x0^{δ} ≠0, P(0); w1^{γ}(0)  _{x0^{δ} ≠s(x1^{δ}), P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))} (1.1)  (1.2)

Let us have a closer look at the inference below (1.2). The defining formula (P2) is applied as a lemma in Theorem 2.51, i.e. its single formula is added in negated form. Thus, the round-edged node labeled with “(P2), γ, β, β” can be replaced with the following subtree. Note that the leftmost leaf of the tree below is closed and can be omitted in the global tree.

(1.2)

¬∀x. ( P(s(x)) ⇐ ( P(x) ∧ Q(x, s(x)) ) ),

P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))

¬( P(s(x1^{δ})) ⇐ ( P(x1^{δ}) ∧ Q(x1^{δ} , s(x1^{δ})) ) ),

P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))

\begin{matrix}¬P(s(x1^{δ})), \\ P(s(x1^{δ})) & ; & w1^{γ}(s(x1^{δ})) \end{matrix} \begin{matrix}( P(x1^{δ}) ∧ Q(x1^{δ} , s(x1^{δ})) ) & , \\ P(s(x1^{δ})) & ; & w1^{γ}(s(x1^{δ})) \end{matrix}

(1.2.1)

(1.2.2)

Even more interesting is what happens below (1.2.2). We instantiate the meta-variables of Theorem 2.51 as follows:

\begin{aligned}Φ & := & Q(y0^{δ} , z0^{δ} ) \\ ℸ & := & w2^{γ}(y0^{δ} , z0^{δ} ) \\ Y & := & \{y0^{δ} , z0^{δ} \} \\ ϱ & := & \{y0^{δ} ↦x1^{δ} , z0^{δ} ↦s(x1^{δ})\} \\ M & := & \{¬Q(x1^{δ} , s(x1^{δ})), w2^{γ}(x1^{δ} , s(x1^{δ}))<w1^{γ}(s(x1^{δ}))\} \end{aligned}

This results in the tree below. Its left leaf is closed and its right leaf is (1.2.2.1).

(1.2.2)

¬Q(x1^{δ} , s(x1^{δ})), Q(x1^{δ} , s(x1^{δ})),

¬P(x1^{δ}), P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))

w2^{γ}(x1^{δ} , s(x1^{δ}))<w1^{γ}(s(x1^{δ})), Q(x1^{δ} , s(x1^{δ})),

¬P(x1^{δ}), P(s(x1^{δ})); w1^{γ}(s(x1^{δ}))

For (2) we get a sequent tree very similar to that of (1):

(2) Q(y0^{δ} , z0^{δ} ); w2^{γ}(y0^{δ} , z0^{δ} ) (nat1), γ, β, δ, Rewrite^{+}_{(2.1) _{Q(y0^{δ} , 0); w2^{γ}(y0^{δ} , 0)}}  _{(2.2) _{Q(y0^{δ} , s(z1^{δ} )); w2^{γ}(y0^{δ} , s(z1^{δ} ))}} (Q1)  (Q2), γ, β, β_{(2.2.1) \begin{matrix}Q(y0^{δ} , z1^{δ} ) & , & Q(y0^{δ} , s(z1^{δ} )) & ; \\ w2^{γ} & ( & y0^{δ} & , & s(z1^{δ} ) & ) \end{matrix}}  _{(2.2.2) \begin{matrix}P(y0^{δ} ), ¬Q(y0^{δ} , z1^{δ} ), \\ Q(y0^{δ} , s(z1^{δ} )) & ; & w2^{γ}(y0^{δ} , s(z1^{δ} )) \end{matrix}} ind.-hyp. appl. of (2)\{z0^{δ} ↦z1^{δ} \}  ind.-hyp. appl. of (1)\{x0^{δ} ↦y0^{δ} \}_{(2.2.1.1) \begin{matrix}w2^{γ}(y0^{δ} , z1^{δ} ) & < & w2^{γ}(y0^{δ} , s(z1^{δ} )) & , \\ Q(y0^{δ} , z1^{δ} ) & , & Q(y0^{δ} , s(z1^{δ} )) & ; \\ w2^{γ} & ( & y0^{δ} & , & s(z1^{δ} ) & ) \end{matrix}}  _{(2.2.2.1) \begin{matrix}w2^{γ}(y0^{δ} ) & < & w2^{γ}(y0^{δ} , s(z1^{δ} )) & , \\ P(y0^{δ} ), ¬Q(y0^{δ} , z1^{δ} ), \\ Q(y0^{δ} , s(z1^{δ} )) & ; & w2^{γ}(y0^{δ} , s(z1^{δ} )) \end{matrix}}

We have applied each of the two weighted sequents (1) and (2) in each of their two proof trees 1 and 2. Luckily we used induction hypothesis application instead of lemma application. The latter would have resulted in a lemma application relation of {1, 2} × {1, 2} which is not well-founded and our proof trees would have been useless because we would never be able to apply Theorem 2.45. As we have used induction hypothesis application instead of lemma application, we have produced the four additional leaves (1.2.1.1), (1.2.2.1), (2.2.1.1), and (2.2.2.1), which are still open. We choose our 2^{nd} order weight functions according to w1^{γ}(x) := (x) and w2^{γ}(x, y) := (x, y), using the lexicographic combination of § 3.2.1. Now the proof attempt can be successfully completed: E.g., the first literal of (1.2.1.1) turns into (x1^{δ})<(s(x1^{δ})), which simplifies to QuodLibet’s ordering axiom x1^{δ} <s(x1^{δ}).

Which steps in this proof were typical for inductive theorem proving in the sense that their soundness relies on notions of inductive validity instead of the stronger notion of validity in all models?

Besides the four induction hypothesis applications, the final branch closure rules for <-literals are typical for induction because they require that, in all models in K, the successor of each natural number is different from that natural number and each natural number is built-up from zero by a finite number of successor steps (i.e. there are neither cycles nor Z-chains in the models, cf. Enderton (1973)).

3.2.3 Sequents versus Tableaus in Descente Infinie

In this § we are going to compare the appropriateness of sequent versus tableau trees under the special aspect of descente infinie. To this end we first see what the sequent tree of (1) of § 3.2.2 would look like as a tableau tree. After the first Hypothesizing step, the initial tableau for (1) looks the following way.

\begin{matrix}w1^{γ} & ( & x0^{δ} & ) \\ ¬P(x0^{δ}) \end{matrix}

Note that this differs from (1) in duality. While this is not a hindrance for completely automatic ITP systems, it poses considerable practical problems in systems where user-guidance is possible: The primitive process of switching duality is a typical source of errors for human beings (or me at least).

For the closed complete proof tree for (1) on the following page, we have chosen a representation according to clausal tableau calculi because there is not enough space for non-atomic formulas here. Let us have a closer look at the boxed formula in this tableau. It results from induction hypothesis application of (2). Note that the only difference to an Extension step in Model Elimination tableaus (cf. Baumgartner &al. (1997)) lies with the additional child (the boxed node), which asks us to show that the instance of the hypothesis is smaller than the weight of our proof tree. Indeed: As the induction ordering is fixed here, hypothesis application differs from the standard lemma (or axiom) application only in producing an additional <-goal. This makes hypothesis application a little more expensive than lemma application.

w1^{γ}(x0^{δ}) ¬P(x0^{δ}) x0^{δ} = 0  _{x0^{δ} = s(x1^{δ})} ¬P(0)  ¬P(s(x1^{δ})) P(0)  P(x1^{δ}) P(s(x1^{δ}))  ¬P(x1^{δ})  ¬Q(x1^{δ} , s(x1^{δ})) P(x1^{δ})  \begin{matrix}w1^{γ} & ( & x1^{δ} & ) \\ ≮ & w1^{γ}(x0^{δ}) \end{matrix}  Q(x1^{δ} , s(x1^{δ}))  \begin{matrix}w2^{γ} & ( & x1^{δ} & , & s(x1^{δ}) & ) \\ ≮ & w1^{γ}(x0^{δ}) \end{matrix} \begin{matrix}w1^{γ} & ( & x1^{δ} & ) \\ ≮ & w1^{γ}(s(x1^{δ})) \end{matrix}  \begin{matrix}w2^{γ} & ( & x1^{δ} & , & s(x1^{δ}) & ) \\ ≮ & w1^{γ}(s(x1^{δ})) \end{matrix}_{x1^{δ} ≮s(x1^{δ})}  _{x1^{δ} ≮s(x1^{δ})}

The left-hand term w2^{γ}(x1^{δ} , s(x1^{δ})) is the weight term of (2) instantiated via {y0^{δ} ↦s(x1^{δ}), z0^{δ} ↦x1^{δ} } because this substitution enables the left sibling of the boxed node to close its branch with the instantiated formula of (2). The right-hand term w1^{γ}(x0^{δ}) comes down from the root of the tree. Contrary to the sequent tree where the weight of the root is carried along and updated on its way down, we have to rewrite the variable x0^{δ} in it with an ancestor equality literal to know what the root weight means in the local context.

Note that the sequent tree is not equal to the result of the standard transformation of the tableau tree. The standard transformation of a tableau tree into a sequent tree works for inductive trees just as for deductive trees:

1. Bottom-up replace the label of each node with the weighted sequent listing the conjugates of the formulas and the weight labeling the (partial) branch from this node to the root.

2. Remove the root part of the tree where the nodes are ancestors of a node of the initial Hypothesizing step (in our example: remove the root node).

This standard transformation multiplies the number of formulas labeling each proof tree with at most nearly the depth of that tree, but does not use the advantages of sequent trees, namely the ability to simplify formulas that label ancestor nodes in a tableau tree. For example, in the above tableau tree it is not possible to rewrite the literal ¬P(x0^{δ}) with the equality literals below it in place. In tableau trees, an equality literal can be used to rewrite formulas of its offspring in place, whereas it must copy ancestor formulas beforehand down to its offspring because the ancestor is also part of other branches that do not include the equality literal. Moreover, the weight term can be rewritten in the sequent tree, which again is not possible in the tableau version where the weight is at the root node. Since x0^{δ} is in solved form after the Rewrite steps, we know that validity cannot rely on the equality literals containing it. This means that we can safely remove both equality literals in the sequent tree so that they do not appear in (1.1) and (1.2). Removing redundant formulas is the most important simplification step besides contextual rewriting. This is impossible in tableau trees unless the redundancy of the formula is due to the ancestor nodes only, which is the case only for useless formulas that should not have been added at all.

Note that formulas like (nat1) from § 1.1.1 make equality omnipresent in inductive theorem proving and that these simplification steps are even more important in inductive than in deductive theorem proving: Not only do they play a rôle in the generation of appropriate induction hypotheses; in addition to the detection of invalid input theorems they are an essential part of the failure detection process that has to compensate for over-generalization of induction hypotheses: Indeed, many induction proofs can only be successful when we try to show propositions that are more general than the ones we initially intended to show. This is because—in an induction proof—a proposition is not only a task (as a goal) but also a tool (as an induction hypothesis). This generalization is unsafe in the sense that it may overgeneralize a valid hypothesis into an invalid one. Therefore, generalization should not be modeled in Expansion steps within a tree. Instead, the generalized sequent should start a new tree (Hypothesizing step) and be later applied to the original tree as a lemma or an induction hypothesis. Since even a valid input theorem may result in an invalid goal due to over-generalization, the ability of an inductive theorem proving system to detect invalid goals is of major importance in practice, cf. § 2.4.2.

In Wirth (1997) and in QuodLibet the Expansion from (1) into (1.1) and (1.2) is done in a single inference step called “substitution add” applying a “covering set of substitutions”. Note that the state of the sequent proof resulting from this step is much simpler than the corresponding state of the tableau proof. The former consists of the nodes (1.1) and (1.2) and has two formulas and one variable. The latter consists of a six node tree with five formulas and two variables. This is of practical importance because tactics for proof search are more easily confused with less concise proof state representations. The rest of the whole sequent proof is analogous to the tableau proof with the exception that all rewrite steps of the tableau tree are omitted since there are no equality literals to rewrite with and the terms are already in normal form.

Another possibility restricted to sequent trees is that each weighted sequent labeling a node in the trees could be applied as an induction hypothesis. We do not see a real advantage in this because splitting the tree in two above such an induction hypothesis results in a better structure of the proof forest and in more successful proofs because we can adjust the weighted sequent appropriately:

Suppose we had not started a new proof tree for the hypothesis for Q but instead kept the hypothesis for Q down in the tree (1) at position (1.2.2). Several unsafe generalization steps would have been necessary before

Q(x1^{δ} , s(x1^{δ})), ¬P(x1^{δ}), P(s(x1^{δ})); w0^{γ}(s(x1^{δ}))

would have become useful as an induction hypothesis, namely removing the second and third formula, generalizing s(x1^{δ}) to a new variable, and switching to a weight that measures also this new variable.

Moreover, in practice one should not apply the hypothesis for Q in the tree for P before it is obvious that the tree for Q mutually needs the hypothesis for P: Most of the time a proof for Q can be completed in a proof forest not containing the tree for P. In this case, not only the number of trees in the proof forest for Q gets smaller, but also the tree for P because (2) can then be applied as a lemma and not as an induction hypothesis, which would cut off the rightmost <-branch of the proof tree of P.

3.3 An Example for Eager Hypotheses Generation

Let us try to find a lower bound for the Ackermann function ack : nat → nat → nat w.r.t. the ordering on natural numbers less : nat → nat → bool, assuming the following axioms.

(ack1)  ∀y. ack(0, y)=s(y)
(ack2) ∀x, y. ack(s(x), 0)=ack(x, s(0))
(ack3) ∀x, y. ack(s(x), s(y))=ack(x, ack(s(x), y))
(less1)  ∀y. less(0, s(y))=true
(less2)  ∀x. less(x, 0)=false
(less3) ∀x, y. less(s(x), s(y))=less(x, y)

Standard lemmas for less proved automatically by QuodLibet are:

(less4)  ∀x. less(x, s(x))
(less5)  ∀x, y. ( less(x, y) ⇒ less(x, s(y)) )
(less6)  ∀x, y. ( less(s(x), y) ⇒ less(x, y) )
(less7) ∀x, y, z. ( \binom{less(x, y)}{∧ less(y, z)} ⇒ less(s(x), z) )

Note that for Boolean terms t we abbreviate the equation t=true with t. Moreover, note that (less7) is a strengthened version of transitivity. The simple transitivity is a simple consequence of it, using (less6).

Let us start with a Hypothesizing step in the sequent calculus of Definition 2.42, posing the query for a lower bound z0^{γ} : nat → nat → nat

(1) less(z0^{γ}(x0^{δ} , y0^{δ} ), ack(x0^{δ} , y0^{δ} )); w1^{γ}(x0^{δ} , y0^{δ} )

with variable-condition R := {z0^{γ}, w1^{γ}} × {x0^{δ} , y0^{δ} }.

Note that z0^{γ} must be higher order: If z0^{γ} were a first-order variable, it could not depend on x0^{δ} and y0^{δ} due to R, resulting in a constant lower bound, which would not be too interesting. If we did not include z0^{γ} into dom(R), however, we could not do induction on the variables x0^{δ} and y0^{δ} because they would not be elements of the set Y of Theorem 2.51.

Applying (nat1) (cf. § 1.1.1) as a lemma yields the two goals

(1.1) less(z0^{γ}(0, y0^{δ} ), ack(0, y0^{δ} )); w1^{γ}(0, y0^{δ} )

(1.2) less(z0^{γ}(s(x1^{δ}), y0^{δ} ), ack(s(x1^{δ}), y0^{δ} )); w1^{γ}(s(x1^{δ}), y0^{δ} ) just as it was explained in § 3.2.2, adding {z0^{γ}, w1^{γ}} × {x1^{δ} } to the variable-condition. The same procedure again yields

(1.2.1) less(z0^{γ}(s(x1^{δ}), 0), ack(s(x1^{δ}), 0)); w1^{γ}(s(x1^{δ}), 0)

(1.2.2) less(z0^{γ}(s(x1^{δ}), s(y1^{δ} )), ack(s(x1^{δ}), s(y1^{δ} ))); w1^{γ}(s(x1^{δ}), s(y1^{δ} ))

adding {z0^{γ}, w1^{γ}} × {y1^{δ} } to the variable-condition.

Rewriting (1.1), (1.2.1), and (1.2.2) with (ack1), (ack2), and (ack3), resp., yields

(1.1.1) less(z0^{γ}(0, y0^{δ} ), s(y0^{δ} )); w1^{γ}(0, y0^{δ} )

(1.2.1.1) less(z0^{γ}(s(x1^{δ}), 0), ack(x1^{δ} , s(0))); w1^{γ}(s(x1^{δ}), 0)

(1.2.2.1) less(z0^{γ}(s(x1^{δ}), s(y1^{δ} )), ack(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))); w1^{γ}(s(x1^{δ}), s(y1^{δ} ))

In our previous examples the generation of induction hypotheses was always lazy in the sense of Protzen (1994). In this case, however, to be able to use goal-directedness also w.r.t. the induction hypotheses, we should generate them eagerly in the way suggested by the recursion analysis of explicit induction, cf. § 1.1.3. Recursion analysis and eager hypotheses generation are very useful for finding simple proofs completely automatically. Note that eager hypotheses generation is not possible with the induction rules of Baaz &al. (1997). Although the inductive theorem proving system Nqthm (cf. Boyer & Moore (1988)) cannot accept (1) because it does not have any free γ-variables (not even existential quantification), if we instantiate (1) with the proper lower bound, Nqthm proves (1) completely automatically, even when the lemma (less7) is not provided and the function ‘less’ is redefined so that the built-in features for treating arithmetic cannot help. Moreover, during this proof the fascinating Nqthm guesses (less7) completely automatically using the goal-directedness w.r.t. the eagerly generated induction hypotheses. Indeed, if the eagerly generated induction hypotheses happen to be the right ones, they can help us to find missing lemmas or to find proper instantiations for free γ-variables.

Since it is folklore heuristic knowledge in inductive theorem proving that a strong lower bound is often found by first finding a weaker one and then improving it, we should not look for an optimal lower bound with a difficult proof but for a reasonable lower bound with a simple proof.

In our example, the induction hypotheses suggested for (1.2.1.1) and (1.2.2.1) result from matching the ack-subterm of (1) to the ack-subterms of (1.2.1.1) and (1.2.2.1). For (1.2.1.1) we get the substitution {x0^{δ} ↦x1^{δ} , y0^{δ} ↦s(0)} and for (1.2.2.1) the substitutions {x0^{δ} ↦x1^{δ} , y0^{δ} ↦ack(s(x1^{δ}), y1^{δ} )} and

{x0^{δ} ↦s(x1^{δ}), y0^{δ} ↦y1^{δ} } resulting in:

(1.2.1.1.1) ¬less(z0^{γ}(x1^{δ} , s(0)), ack(x1^{δ} , s(0))), less(z0^{γ}(s(x1^{δ}), 0), ack(x1^{δ} , s(0))); w1^{γ}(s(x1^{δ}), 0)

(1.2.1.1.2) w1^{γ}(x1^{δ} , s(0))<w1^{γ}(s(x1^{δ}), 0), less(z0^{γ}(s(x1^{δ}), 0), ack(x1^{δ} , s(0))); w1^{γ}(s(x1^{δ}), 0)

(1.2.2.1.1) ¬less(z0^{γ}(x1^{δ} , ack(s(x1^{δ}), y1^{δ} )), ack(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))),

less(z0^{γ}(s(x1^{δ}), s(y1^{δ} )), ack(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))); w1^{γ}(s(x1^{δ}), s(y1^{δ} ))

(1.2.2.1.2) w1^{γ}(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))<w1^{γ}(s(x1^{δ}), s(y1^{δ} )), …

(1.2.2.1.1.1) ¬less(z0^{γ}(s(x1^{δ}), y1^{δ} ), ack(s(x1^{δ}), y1^{δ} )),

¬less(z0^{γ}(x1^{δ} , ack(s(x1^{δ}), y1^{δ} )), ack(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))),

less(z0^{γ}(s(x1^{δ}), s(y1^{δ} )), ack(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))); w1^{γ}(s(x1^{δ}), s(y1^{δ} ))

(1.2.2.1.1.2) w1^{γ}(s(x1^{δ}), y1^{δ} )<w1^{γ}(s(x1^{δ}), s(y1^{δ} )), …

After setting w1^{γ}(x, y) := (x, y), the goals (1.2.1.1.2), (1.2.2.1.2), and (1.2.2.1.1.2) can be closed due to their first formulas. The whole proof up to now is the “eager induction hypotheses generation” suggested by recursion analysis of (1).

Now, (1.2.2.1.1.1) cries for a lemma application of (less7). Indeed, the lemma can close it, provided that we can identify the pairs (s(z0^{γ}(s(x1^{δ}), y1^{δ} )), z0^{γ}(s(x1^{δ}), s(y1^{δ} ))) and (ack(s(x1^{δ}), y1^{δ} ), z0^{γ}(x1^{δ} , ack(s(x1^{δ}), y1^{δ} ))), which is achieved by their most general λβ-unifier, the pro-

jection z0^{γ}(x, y) := y.

Now (1.1.1) reads

(1.1.1’) less(y0^{δ} , s(y0^{δ} )); (0, y0^{δ} )

which can be closed by an application of lemma (less4).

The only branch that is still open is

(1.2.1.1.1’) ¬less(s(0), ack(x1^{δ} , s(0))), less(0, ack(x1^{δ} , s(0))); (s(x1^{δ}), 0)

which can be closed by an application of lemma (less6).

This completes the proof of (1) with the answer that z0^{γ} can be the projection to its second argument, i.e. the lower bound is y0^{δ} .

Note that it is possible to find this proof with the first-order system QuodLibet because one can use a symbol for an undefined function instead of the 2^{nd} order variable z0^{γ}. There is no 2^{nd} order unification but the user can set this function to be the projection during the proof.

Since QuodLibet guarantees consistency of the specification (i.e. the existence of models where semantical equality of constructor ground terms implies syntactical equality) (provided arithmetic is consistent, cf. Gentzen (1938)) and admits partially defined and non-terminating functions, the actual proof in QuodLibet differs from the presented one by some additional subgoals that can be closed by a lemma stating that ack is a total function, which has a simple inductive proof. For the details cf. Kühler & Wirth (1996).

3.4 An Example for a Variable Induction Ordering

In this § we are going to prove a generalized version of a lemma of M. H. A. Newman (cf. Newman (1942)), namely that local commutation of two relations implies their commutation, provided that the reverse of their union is well-founded.

0  :  nat
s  :  nat → nat
true, false  :  bool
∗, Rev  :  (A → A → bool) → A → A → bool
Union  : (A → A → bool) → (A → A → bool) → A → A → bool
Comm, LComm:  (A → A → bool) → (A → A → bool) → bool
Wellf  :  (A → A → bool) → bool

Our simply-typed higher-order signature is used to denote the following: ∗(⟶) contains the reflexive & transitive closure of the binary relation ⟶ on A, Rev(⟶) is its reverse relation, and Union(⟶, ⟶′) is its union with ⟶′. For all our Boolean terms t we abbreviate the equation t=true with t. For ⟶ : A → A → bool, instead of ⟶(x, y) we write x⟶y, instead of ∗(⟶, x, y) we write x⟶^{∗}y, and instead of Union(⟶, ⟶′) we write ⟶ ∪ ⟶′.

(∗1)  ∀⟶, x, z. ( x⟶^{∗}z ⇔ ( \begin{matrix}& x=z \\ ∨ & ∃y. \binom{x⟶y}{∧ y⟶^{∗}z} \end{matrix} ) )

(Union1) ∀⟶, ⟶′, x, y. ( x(⟶ ∪ ⟶′)y ⇔ \binom{x⟶y}{∨ x⟶′y} )
(Rev1)  ∀⟶, x, y. ( Rev(⟶, x, y) ⇔ y⟶x )

(Comm1), (LComm1), and (Wellf1) are the properties of commutation, local commutation, and wellfoundedness, resp.:

(Comm1) ∀⟶_{0}, ⟶_{1}. ( \begin{matrix}& Comm(⟶_{0}, ⟶_{1}) \\ ⇔ & ∀x, y_{0}, y_{1}. ( \begin{matrix}( & \begin{aligned}& x⟶^{∗}_{0}y_{0} \\ ∧ & x⟶^{∗}_{1}y_{1} \end{aligned} & ) \\ ⇒ & ∃z. \binom{y_{0}⟶^{∗}_{1}z}{∧ y_{1}⟶^{∗}_{0}z} \end{matrix} ) \end{matrix} )

(LComm1) ∀⟶_{0}, ⟶_{1}. ( \begin{matrix}& LComm(⟶_{0}, ⟶_{1}) \\ ⇔ & ∀x, y_{0}, y_{1}. ( \begin{matrix}( & \begin{aligned}& x⟶_{0}y_{0} \\ ∧ & x⟶_{1}y_{1} \end{aligned} & ) \\ ⇒ & ∃z. \binom{y_{0}⟶^{∗}_{1}z}{∧ y_{1}⟶^{∗}_{0}z} \end{matrix} ) \end{matrix} )

(Wellf1)  ∀r : A → A → bool.
Wellf(r)

⇔ ∀p : A → bool. ( \begin{matrix}& ∃x. p(x) \\ ⇒ & ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ r(y, x)} \end{matrix} ) \end{matrix} )

Note that well-foundedness and termination are no first-order properties.^{22} The transitivity lemma

(1) u0^{δ} ⟶^{∗}^{δ} u2^{δ} , ¬u0^{δ} ⟶^{∗}^{δ} u1^{δ} , ¬u1^{δ} ⟶^{∗}^{δ} u2^{δ} , ¬Wellf(Rev(⟶^{δ} )); u0^{δ}

can be shown by induction on u0^{δ} in ⟶^{δ} . Note that we need the well-foundedness because otherwise ⟶^{∗}^{δ} may be a proper super-relation of the reflexive & transitive closure of ⟶^{δ} . I.e. the reflexive & transitive closure is the smallest solution of (∗1) and in case of well-foundedness there is only one single solution.

The following lemmas have very simple non-inductive proofs that expand the definition (Wellf1) twice. Note that the expansion of a logical equivalence is nothing but (γ-steps followed by) a kind of Rewrite-step because formulas can be seen as higher-order terms of type bool and the logical equivalence as the equality of type bool.

(2a) ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), Wellf(Rev(⟶0^{δ}))

(2b) ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), Wellf(Rev(⟶1^{δ}))

Note that commutativity of Union implies that (2a) and (2b) are equivalent, but to prove ⟶0^{δ} ∪⟶1^{δ} = ⟶1^{δ} ∪⟶0^{δ} we need extensionality, which we do not want to discuss here. Cf. Benzmüller &al. (2004) for a comprehensive discussion of extensionality. Now we are going to show the generalized Newman Lemma, namely that well-foundedness of the reverse of the union plus local commutation implies commutation.

¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ}), Comm(⟶0^{δ} , ⟶1^{δ})

Expanding the definition (Comm1), three liberalized δ-steps, and two α-steps yield

¬x^{δ^{+}}⟶^{∗}0^{δ} z0^{δ^{+}}, ¬x^{δ^{+}}⟶^{∗}1^{δ} z1^{δ^{+}}, ∃z. \binom{z0^{δ^{+}}⟶^{∗}1^{δ} z}{∧ z1^{δ^{+}}⟶^{∗}0^{δ} z},

¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ})

Now, since we want to do induction on x^{δ^{+}}, we start a new proof tree for

(3) ¬x^{δ} ⟶^{∗}0^{δ} z0^{δ} , ¬x^{δ} ⟶^{∗}1^{δ} z1^{δ} , ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z},

¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});
x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

Note that this differs from the previous sequent (which can immediately be closed by lemma application of (3)) not only in that all free δ^{+}-variables are replaced with free δ^{−}-variables now (which we also could have achieved by using non-liberalized δ-steps before instead of the liberalized ones) but also in that x^{δ} is included into the weight, which is necessary for our intended induction. Actually we have set the weight directly to x^{δ} for simplicity. Note that if the heuristic knowledge to recognize the above sequent as the likely induction hypothesis is not present, our calculi violate our design goal of a natural flow of information (cf. § 1.2.1) because we sometime later realize that we should have started a new proof tree. With implemented calculi, however, this violation is no problem because one just has to implement a destructive inference rule that automatically splits a proof tree at a given position, reorganizes the former subtree into a new individual proof tree, and closes the cut branch by lemma or induction hypothesis application of the sequent of the new tree.

Moreover, we have added a free γ-variable for the induction ordering

<^{γ} : A → A → A → (A → A → bool) → (A → A → bool) → A → A → bool

where the last two arguments will be supplied in infix notation below. Note that we have not supplied any induction quasi-ordering, but instead assume it to be the empty relation as in the discussion after Theorem 2.51, so that the sequents (5) and (6) can be omitted from the set M in Theorem 2.51. We set our variable-condition to R := {<^{γ}} × {x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ} } to have all free δ^{−}-variables of (3) in the set Y of Theorem 2.51. Expansion of the equivalence (∗1) in the first formula of (3), a β-, a liberalized δ- and an α-step yield:

(3.1) x^{δ} ≠z0^{δ} , ¬x^{δ} ⟶^{∗}1^{δ} z1^{δ} , ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, …; …

(3.2) ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} , ¬x^{δ} ⟶^{∗}1^{δ} z1^{δ} , ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z},

¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});
x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

Rewriting with the first formula of (3.1) yields:

(3.1.1) ¬x^{δ} ⟶^{∗}1^{δ} z1^{δ} , ∃z. \binom{x^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, …; …

which is easily proved by setting z to z1^{δ} in a γ-step. Expansion of the equivalence (∗1) in the third formula of (3.2), a β-, a liberalized δ- and an α-step yield:

(3.2.1) x^{δ} ≠z1^{δ} , ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} , ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, …; …

(3.2.2) ¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}1^{δ} z1^{δ} , ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} ,

∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});

x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

Rewriting with the first formula of (3.2.1) yields:

(3.2.1.1) ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} , ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ x^{δ} ⟶^{∗}0^{δ} z}, …; …

Now we have to regenerate the literal ¬x^{δ} ⟶^{∗}0^{δ} z0^{δ} (which a tableau proof would still have available from (3)) by application of (∗1) and then close this subtree by setting z to z0^{δ} . Expansion of (LComm1) in (3.2.2), γ-, β- and liberalized δ-steps yield two tautologies plus

(3.2.2.1) ¬y0^{δ^{+}}⟶^{∗}1^{δ} y2^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}0^{δ} y2^{δ^{+}},

¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}1^{δ} z1^{δ} , ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} ,

∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});

x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

Applying (3) as an induction hypothesis according to Theorem 2.51 with substitution {x^{δ} ↦y0^{δ^{+}}, z1^{δ} ↦y2^{δ^{+}}} yields four tautologies and

(3.2.2.1.1) ¬z0^{δ} ⟶^{∗}1^{δ} y3^{δ^{+}}, ¬y2^{δ^{+}}⟶^{∗}0^{δ} y3^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}1^{δ} y2^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}0^{δ} y2^{δ^{+}},

¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}1^{δ} z1^{δ} , ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} ,

∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});

x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

(3.2.2.1.2) y0^{δ^{+}} <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) x^{δ} , …, ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, …

(3.2.2.1.3) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ y <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) x} \end{matrix} ) ),

…, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), …

(3.2.2.1.4) ∀x, y : A. \binom{x <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) y}{⇔ x <^{γ}(y0^{δ^{+}}, z0^{δ} , y2^{δ^{+}}, ⟶0^{δ} , ⟶1^{δ}) y}, …

where (3.2.2.1.1) is presented after application of a liberalized δ- and an α-step. The situation of the first two lines of (3.2.2.1.1) (seen as an antecedent) can be depicted as follows:

x^{δ}  _{0}_{1}  y0^{δ^{+}}  _{0}^{∗}_{1} _{∗}  z0^{δ}_{1} _{∗} y1^{δ^{+}}  _{0}_{∗}_{1} _{∗}  y2^{δ^{+}}  _{0}_{∗} y3^{δ^{+}} z1^{δ}

Application of (1) as a lemma yields (besides a sequent that can be closed by lemma application of (2a))

(3.2.2.1.1.1) ¬y1^{δ^{+}}⟶^{∗}0^{δ} y3^{δ^{+}}, ¬z0^{δ} ⟶^{∗}1^{δ} y3^{δ^{+}}, ¬y2^{δ^{+}}⟶^{∗}0^{δ} y3^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}1^{δ} y2^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}0^{δ} y2^{δ^{+}},

¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, ¬y1^{δ^{+}}⟶^{∗}1^{δ} z1^{δ} , ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, ¬y0^{δ^{+}}⟶^{∗}0^{δ} z0^{δ} ,

∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), ¬LComm(⟶0^{δ} , ⟶1^{δ});

x^{δ} , <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ})

Applying (3) as an induction hypothesis with substitution {x^{δ} ↦y1^{δ^{+}}, z0^{δ} ↦y3^{δ^{+}}} yields four tautologies and

(3.2.2.1.1.1.1) ¬z0^{δ} ⟶^{∗}1^{δ} y4^{δ^{+}}, ¬z1^{δ} ⟶^{∗}0^{δ} y4^{δ^{+}}, ¬y3^{δ^{+}}⟶^{∗}1^{δ} y4^{δ^{+}},

¬y1^{δ^{+}}⟶^{∗}0^{δ} y3^{δ^{+}}, ¬z0^{δ} ⟶^{∗}1^{δ} y3^{δ^{+}}, …, ∃z. \binom{z0^{δ} ⟶^{∗}1^{δ} z}{∧ z1^{δ} ⟶^{∗}0^{δ} z}, …

(3.2.2.1.1.1.2) y1^{δ^{+}} <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) x^{δ} , …, ¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, …

(3.2.2.1.1.1.3) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ y <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) x} \end{matrix} ) ),

…, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), …

(3.2.2.1.1.1.4) ∀x, y : A. \binom{x <^{γ}(x^{δ} , z0^{δ} , z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) y}{⇔ x <^{γ}(y1^{δ^{+}}, y3^{δ^{+}}, z1^{δ} , ⟶0^{δ} , ⟶1^{δ}) y}, …

where (3.2.2.1.1.1.1) is presented after application of a liberalized δ- and an α-step, whose resulting sequent’s antecedent can be depicted as

x^{δ}  _{0}_{1}  y0^{δ^{+}}  _{0}^{∗} z0^{δ}_{1} _{∗} y1^{δ^{+}}  _{0}_{∗}_{1} _{∗}  y3^{δ^{+}}_{1} _{∗} z1^{δ}  _{0}_{∗}  y4^{δ^{+}}

and also after a lemma application of the transitivity lemma (1) (producing another goal closed by lemma application of (2b)).

Now (3.2.2.1.1.1.1) can be closed after setting z to y4^{δ^{+}} in a γ-step. When we finally apply the R-substitution {<^{γ} ↦ λv_{0}, …, v_{4}. (Rev(v_{3} ∪ v_{4}))} and λβ-reduce, we get the following open goals:

(3.2.2.1.2’) Rev(⟶0^{δ} ∪ ⟶1^{δ} , y0^{δ^{+}}, x^{δ} ), …, ¬x^{δ} ⟶0^{δ} y0^{δ^{+}}, …

(3.2.2.1[.1.1].3’) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ Rev(⟶0^{δ} ∪ ⟶1^{δ} , y, x)} \end{matrix} ) ),

…, ¬Wellf(Rev(⟶0^{δ} ∪ ⟶1^{δ})), …

(3.2.2.1[.1.1].4’) ∀x, y : A. ( \begin{matrix}Rev & (⟶0^{δ} ∪ ⟶1^{δ} , x, y) \\ ⇔ & Rev(⟶0^{δ} ∪ ⟶1^{δ} , x, y) \end{matrix} ), …

(3.2.2.1.1.1.2’) Rev(⟶0^{δ} ∪ ⟶1^{δ} , y1^{δ^{+}}, x^{δ} ), …, ¬x^{δ} ⟶1^{δ} y1^{δ^{+}}, …

which can be easily closed.

4 Conclusion

We have shown how to integrate descente infinie in the style of a working mathematician into state-of-the-art free-variable sequent and tableau calculi which are well-suited for an efficient interplay of human interaction and automation. The semantical requirements are satisfied for a variety of two-valued logics, such as clausal logic, classical first-order logic, and higher-order modal logic.

For the special case of first-order universally quantified clausal logic we have realized this style of inductive theorem proving in the tactic-based inductive theorem prover QuodLibet, cf. Wirth (1997), Kühler (2000), Avenhaus &al. (2003), Schmidt-Samoa (2006a), Schmidt-Samoa (2006b), Schmidt-Sa-moa (2006c). The extension of QuodLibet’s approach to full first-order logic, however, turned out to be more difficult than expected, because the standard state-of-the-art free-variable first-order sequent and tableau calculi destroy the well-foundedness of descente infinie. The foundational problems that ensued from the combination of descente infinie with these calculi are solved now for the first time by our technique of combining the liberalized δ-rules with

• raising (instead of Skolemization),

• preservation of solutions (i.e. closing substitutions), and

• an explicit representation of dependence between variables.

Lemma and induction-hypothesis application are included for the first time in all calculi treated in this paper: Wirth (1999) included only hypothesis application for the weak version (i.e. without free δ^{+}-vari-ables and liberalized δ-rules) of the calculi of Wirth (1998). To apply lemmas and induction hypotheses free and easily also in the strong version, we surprisingly had to change the notion of (C, R)-validity, cf. Note 12. With this exception and besides minor improvements, the calculi of this paper are the ones of the strong version of Wirth (1998) with the free δ^{−}-variables and the non-liberalized δ-rules of the weak version added.

Our comprehensive (or “fat”) integration of descente infinie differs from the “lean” calculus of Baaz &al. (1997) in the following aspects: We can have mutual induction and variable induction orderings. Our induction hypotheses can be arbitrary sequents instead of a single preset literal. Finally, we can also generate induction hypotheses eagerly in the style of explicit induction, which enables goal-directedness w.r.t. induction hypotheses. Indeed, in our framework all the heuristic knowledge and automatization of the field of explicit induction is still applicable and indispensable.^{23} We have just opened a door to a new formal basis that provides the flexibility and the support a mathematician needs when he searches for hard induction proofs.

Acknowledgments: After three years of solid—and solitary—work on this paper, when I was not able to see the wood for the trees, Jörg Siekmann showed me a path out of the wilderness. I owe more to Jörg than I can express here. I would also like to thank Ulrich Kühler for the development of the Quod-Libet system, and Paul Howard for a short but very helpful e-mail communication on the Principle of Dependent Choice.

A Optimizations

A.1 The Low Price and High Value of Choice-Conditions

Note that (as far as Theorem 2.49 and Theorem 2.51 are concerned) the choice-conditions do not have any influence on our proofs as long as we never instantiate free δ^{+}-variables and always choose a completely new free δ^{+}-variable x^{δ^{+}} in the liberalized δ-steps. Thus, in implementations of our calculus, the choice-conditions may be omitted. We could, however, use them for the following purposes:

1. We can use the choice-conditions to weaken our requirements for our set of axioms AX: Instead of V_{γ}×V_{δ} -validity of AX, (C, R)-validity of AX (which is logically weaker, cf. Lemma 2.28) is sufficient for Theorem 2.45.

2. We can simulate the behavior of an improved version of the δ^{+^{+}}-rule of Beckert &al. (1993) by equating different free δ^{+}-variables whose C-values are initially equal or have become logically equivalent during the proof. Note that this does not anymore require a functional and extensional behavior of choice-conditions as in Wirth (1998). There we had to require that, for (x^{δ^{+}}, A) ∈ C, the value for x^{δ^{+}} is not just an arbitrary one from the set of values that make A valid, but a unique element of this set given by some choice-function. In the present version (due to the changed notion of (C, R)-validity) it is possible to replace not only a free γ-variable globally, but also a free δ^{+}-variable x^{δ^{+}} with any term that (if possible) makes C(x^{δ^{+}}) true, cf. § B.3. Expressed with Hilbert’s ε-terms (as indicated in § 2.2.4), our treatment is similar to a structure sharing version of the merely intensional treatment of ε-terms in Giese & Ahrendt (1999). Note that our choice-conditions even do not imply a functional dependence of ϵ(π)(τ)(y^{δ^{+}}) from C(y^{δ^{+}}); instead the choice of a special value is a step in a proof similar to the instantiation of a free γ-vari-able, and we do not have to commit to this choice for other occurrences of the same ε-term. This means that our choice-conditions work like the word “some” in the in the English language. E.g., “Some human loves some human” is like Loves(x^{δ^{+}}, y^{δ^{+}}) with C(x^{δ^{+}}) = Human(x^{δ^{+}}) and C(y^{δ^{+}}) = Human(y^{δ^{+}}), or like

Loves(εx. Human(x), εx. Human(x))

and follows from Loves(Jack, Jill), Human(Jack), and Human(Jill). There is more on this subject in Wirth (2006b).

3. Moreover, the choice-conditions may be used to get more interesting solutions to query variables, as explained in the following example.

Example A.1 Starting with the empty proof forest and hypothesizing

∀x. Q(x, x), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{γ})

with the rules of § 1.2.4 we can produce a proof tree with the leaves

¬Q(x^{δ^{+}}, x^{δ^{+}}), Q(x^{δ^{+}}, x^{δ^{+}}), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{γ})

and ¬P(x^{δ^{+}}), Q(x^{δ^{+}}, x^{δ^{+}}), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{γ})

and the ∅-choice-condition {(x^{δ^{+}}, ¬Q(x^{δ^{+}}, x^{δ^{+}}))}.

The ∅-substitution {z^{γ}↦x^{δ^{+}}} closes the proof tree via an Instantiation step. The solution x^{δ^{+}} for our query variable z^{γ} is not very interesting unless the choice-condition tells us to choose x^{δ^{+}} in such a way that Q(x^{δ^{+}}, x^{δ^{+}}) becomes false.

Note that if we had applied the δ^{−}-rule instead of the liberalized δ^{+}-rule in the above proof, i.e. if we had introduced x^{δ} instead of x^{δ^{+}}, then we would not only be unable to provide any information on our query variable (because the choice-condition is empty), but we would even be unable to finish our proof because—due to the new variable-condition R = {(z^{γ}, x^{δ} )}—we cannot apply {z^{γ}↦x^{δ} } anymore, because it is not an R-substitution anymore. With the δ^{−}-rule, all we can show instead is

∀x. Q(x, x), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), ∃z. P(z)

Thus, it is obvious that the liberalized δ^{+}-rule typically is not only superior^{24} to the δ^{−}-rule w.r.t. reductive theorem proving but also w.r.t. computation of answers and solutions.

Nevertheless—unless we conjecture propositions that already contain free δ^{+}-variables from the very beginning—the choice-conditions do not produce any overhead in an implementation because they can simply be omitted; thereby leaving the free δ^{+}-variables unspecified just like the Skolem functions in Skolemizing deduction.

The only overhead compared to the standard framework of Skolemization seems to be that we have to compute transitive closures when checking whether a substitution σ is really an R-substitution on V_{γ} and when computing the σ-update of R. But we actually do not have to compute the transitive closure at all, because we only have to check for acyclicity, which can be done on a graph generating the transitive closures. This check is in the worst case linear in

|R| + ∑_{σ} ( |Δ_{σ}| + |Γ_{σ}| )

and is expected to perform at least as well as an optimally integrated version (i.e. one without conversion of term-representation) of the linear unification algorithm of Paterson & Wegman (1978) in the standard framework of Skolemization and unification. (Of course, the check for being an R-substitution can also be implemented with any other first-order unification algorithm.)

A.2 Smaller Variable-Condition versus Less Free δ^{+}-Variables

Not computing the transitive closure of variable-conditions enables another refinement that allows us to go even beyond the fascinating strong Skolemization of Nonnengart (1996), whose basic idea can be translated into our framework in the following simplified way.

Instead of proving ∀x. (A∨B) it may be advantageous to prove the stronger ∀x.A ∨ ∀x.B, because after applications of α- and liberalized δ-rules to ∀x.A ∨ ∀x.B, resulting in A{x↦xA^{δ^{+}}}, B{x↦xB^{δ^{+}}}, the variable-conditions introduced for xA^{δ^{+}} and xB^{δ^{+}} may be smaller than the variable-condition introduced for y^{δ^{+}} after applying these rules to ∀x. (A∨B), resulting in A{x↦y^{δ^{+}}}, B{x↦y^{δ^{+}}}, i.e. V_{free}(A) and V_{free}(B) may be proper subsets of V_{free}(A, B). Therefore, the proof of ∀x.A ∨ ∀x.B may be simpler than the proof of ∀x. (A∨B). The nice aspect of strong Skolemization roughly translated into our framework is that the intermediately sized V_{free}(A) × {xA^{δ^{+}}} ∪ V_{free}(A, B) × {xB^{δ^{+}}} is added to the variable-condition, but only a single Skolem function f is introduced with xA^{δ^{+}} represented as f(A′, X) and xB^{δ^{+}} represented as f(A′, B′\A′) where X are some new free γ-variables, A′ := V_{γ} ∩ R^{∗}⟨V_{free}(A)⟩, and B′ := V_{γ} ∩ R^{∗}⟨V_{free}(B)⟩. Thus, xB^{δ^{+}} still becomes dependent on the free variables of the whole disjunction, so that—due to this asymmetry^{25}—it may make a difference to prove ∀x. (A∨B) or ∀x. (B∨A).

Now, if we do not really compute the transitive closures as indicated in § A.1, we can try to prove A{x↦xA^{δ^{+}}}, B{x↦xB^{δ^{+}}} first, and—if this fails—may later switch directly to prove the weaker A{x↦y^{δ^{+}}}, B{x↦y^{δ^{+}}} instead, simply by merging the nodes for xA^{δ^{+}} and xB^{δ^{+}} and substituting xA^{δ^{+}} and xB^{δ^{+}} by y^{δ^{+}}. Of course, we have to check that R stays well-founded.

Finally note that the same conflict and solution apply to

∀x. (A∧B) versus ∀x.A ∧ ∀x.B,

although these formulas are logically equivalent: The latter in general generates smaller variable-con-ditions (unless V_{free}(A) = V_{free}(B)) but the former generates less free δ^{+}-variables (Skolem functions) and each of the two effects may enable additional proofs and reduce the size of minimal proofs.

A.3 Improving Multiple γ-Rule Applications and Matrix Calculi

Another optimization, inspired by the ideas of § 7 of Giese (1998) and Appendix B of Wirth (1997), improves the behavior of multiple γ-rule applications to the same formula. It requires a new kind of free γ-variables which are not used for direct instantiation but as generators for the usual kind of free γ-vari-ables. In the tableau community these variables are sometimes called “universal” (cf. e.g. Beckert & Hähnle (1998)), but they have nothing to do with our free δ-variables here. Thus, we call them generator variables and denote them with x^{γ^{+}} and V_{γ^{+}} . Instead of the γ-rule say

\begin{matrix}Γ ∃x.A Π \\ A\{x↦t\} Γ ∃x.A Π \end{matrix}

we take a rule like

\begin{matrix}Γ ∃x.A Π \\ A\{x↦x^{γ^{+}}\} Γ Π \end{matrix}

where ∃x.A is removed and x^{γ^{+}} is a new generator variable. Other γ-rules are changed analogously. The α-rules are not changed and the β-rules of § 1.2.4 are restricted in their applicability by the restriction of V_{γ^{+}}(A) ∩ V_{γ^{+}}(B) = ∅, which (together with the condition that generator variables do not occur in root sequents of Hypothesizing steps and substitutions of Instantiation steps) guarantees that for each generator variable there is always a single branch in a tree that contains all its occurrences. To enable blocked β-steps and for Instantiation, we need a generation rule like

\begin{matrix}Γ A Π \\ A\{x^{γ^{+}}↦t\} Γ A Π \end{matrix}

The δ-rules of § 1.2.4 either get restricted by V_{γ^{+}}(A) = ∅ or otherwise we can proceed in the following less simple but more powerful way: We treat generator variables like free γ-variables and the generation rule replaces each free δ^{+}-variable y^{δ^{+}} (free δ^{−}-variables analogously) from V_{δ^{+}}(A) ∩ ⟨{x^{γ^{+}}}⟩R^{+} in A with a new one, say y_{′}^{δ^{+}}, and add to the variable-condition R a copy of the graph of ⟨{x^{γ^{+}}}⟩R^{∗} with y_{′}^{δ^{+}} instead of y^{δ^{+}}, and add to the choice-condition C something like (y_{′}^{δ^{+}}, (C(y^{δ^{+}})){y^{δ^{+}}↦y_{′}^{δ^{+}}, …}). The nice treatment in § 7 of Giese (1998) makes the reason for this seemingly complicated procedure obvious by means of Hilbert’s ε-terms.

To include this into our framework, the crucial step is to change the notion of (δ, e, A)-validity such that a generator variable x^{γ^{+}} is treated like a free γ-variable with the exception that its value may also be chosen from the values of its instances in the generation rule; i.e. a value of x^{γ^{+}} establishing the validity must exist among ϵ(e)(δ)(x^{γ^{+}}) and the values of eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t) for the terms t introduced for x^{γ^{+}} in the generation rule. Without this flexibility, the generation rule would not preserve solutions.

Now, if the formula A in the γ-rule above is a literal or a blocked β-formula, then the new γ-rule plus n generation steps have the effect of n applications of the old γ-rule and no improvement takes place. Otherwise, however, several inference rules may be applied after the new γ-rule, and when we suddenly discover that we need say P(x^{γ^{+}}) twice, then we can apply two generation steps instead of repeating the whole subtree up to the γ-rule application.

All in all, we have to admit that the possibilities to improve multiple γ-rule applications are poor in sequent and tableau calculi. In a matrix representation like in Wallen (1990), however, it is possible to dynamically increase the multiplicity and to let all γ-variables be generating, no matter whether all occurrences of a variable are on the same branch or not; cf. Autexier (2005b) for the first step towards a realization. Thus, an implementation should use matrix calculi instead of the presentationally simpler sequent and tableau calculi used in this paper, because there the β- and δ-formulas do not suffer from the severe restrictions explained above.

Moreover, as explained in Wirth &al. (2003) for the (lim+)-example of Wirth (2006a), matrix representation helps to find the right ordering of β-steps (especially of the ones that are critical due to consecutive δ-steps) and to answer the question of downfolding to the left or right in β-steps, simply by delaying the decisions a sequent or tableau representation forces us to do prematurely.

Thus, to follow our design goal of a natural flow of information of § 1.2.1, instead of a sequent or tableau representation, we should use a matrix representation for an implementation of our calculi, similar to the one the CoRe system of Autexier (2003), Autexier (2005a).

B Tools for the Proofs

B.1 Technical Lemmas

The following technical lemma says—roughly speaking—that the Substitution-Lemma can be lifted to (A, R)-valuations as expected.

Lemma B.1

Let A be a Σ-structure, and let R be a variable-condition and σ an R-substitution.

1. If R′ is a variable-condition with R ⊆ R′, then each (A, R′)-valuation is also an (A, R)-valuation.

2. Let R′ be the σ-update of R.

For each (A, R′)-valuation e′ there is some (A, R)-valuation e such that

S_{e} = S_{e′} ∘ (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}

and for all δ : V_{δ} → A:

ϵ(e)(δ) = (_{V_{γ}\dom(σ)}↿id ∪_{V_{γ}}↿σ) ∘ eval(A ⊎ ϵ(e′)(δ) ⊎ δ).

3. Let (C′, R′) be the extended σ-update of (C, R). For each (A, R′)-valuation e′ and each π′ that is (e′, A)-compatible with (C′, R′), there is some (A, R)-valuation e such that

R ∪ S_{e} ∪ _{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}} is well-founded,
S_{e} = (S_{π′} ∪_{V_{δ}} ↿id) ∘ (S_{e′} ∘ (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}),

and for all δ : V_{δ} → A and τ := _{V_{δ}} ↿δ:

ϵ(e)(δ) = (_{V_{γ}\dom(σ)}↿id ∪_{V_{γ}}↿σ) ∘ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ).

B.2 Generalized Notions

As Hilbert’s ε-terms can be used to constrain variables in a very general sense with a vast number of applications, the possibility to include a representation of ε-terms into our inference system provides considerable evidence for the quality of our combination of descente infinie and deduction. This inclusion, however, now only requires a minor generalization of our choice-conditions. For a motivational introduction to choice-conditions as an indefinite semantics for Hilbert’s ε-terms, cf. Wirth (2008). Since we do not want to publish the long proofs twice, all proofs are omitted in Wirth (2006b) and Wirth (2008). As a consequence, the proofs in this paper have to include the following generalization of the notion of choice-condition and show with little additional effort that our combination of descente infinie and deduction admits the inclusion of Hilbert’s ε-terms.

The generalizations in the following definitions—as compared to the ones of § 2.2.4—additionally model the so-called “subordinate” ε-terms by extending the possible value of a choice-condition from a simple formula B to a formula-valued λ-term λv_{0}…. λv_{l−1}. B with a formula B in which the variables v_{0}, …, v_{n−1} may occur free. Notice that, for l = 0, all generalized definitions specialize to the original definitions.

Definition B.2 (Choice-Condition, generalized) (Cf. Definition 2.20) More generally than stated in Definition 2.20, the values of an R-choice-condition C can be formulavalued λ-terms (instead of formulas) where, for y^{δ^{+}} ∈ dom(C) and C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B,

B is a formula whose free occurring variables from V_{bound} are among {v_{0}, …, v_{l−1}} ⊆ V_{bound}

and where, for v_{0} : α_{0}, …, v_{l−1} : α_{l−1}, we have

y^{δ^{+}} : α_{0} → … → α_{l−1} → α_{l} for some type α_{l},

and any occurrence of y^{δ^{+}} in B must be of the form y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}).

Definition B.3 (Compatibility, generalized) (Cf. Definition 2.23) Item 2 of Definition 2.23 is generalized to the following:

2. For all y^{δ^{+}} ∈ dom(C) with C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B for a formula B, for all τ : V_{δ} → A, for all η : {y^{δ^{+}}} → A, and for all χ : {v_{0}, …, v_{l−1}} → A, setting δ := ϵ(π)(τ) ⊎ τ ⊎ χ, δ′ := η ⊎_{V\{y^{δ^{+}}}}↿δ (i.e. δ′ is the η-variant of δ):

If B is (δ′, e, A)-valid, then B is also (δ, e, A)-valid.

B.3 Instantiation of Free δ^{+}-Variables

Due to the existential treatment of free δ^{+}-variables in Definition 2.27 (“some π”), an Instantiation step may replace not only the free γ-variables but also the free δ^{+}-variables globally. For doing so, we need means of expressing the requirement on an R-substitution on V_{γ} ∪ V_{δ^{+}} to replace the free δ^{+}-variables in accordance with the compatibility requirement of Definition B.3(2):

Definition B.4 (Q_{C}) For an R-choice-condition C, we let Q_{C} be a total function from dom(C) into the set of single-formula sequents such that for each y^{δ^{+}} ∈ dom(C) with C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B for a formula B, we have Q_{C}(y^{δ^{+}}) =

∀v_{0}…. ∀v_{l−1}. ( ∃y. B{y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}) ↦ y} ⇒ B )

for an arbitrary fresh bound variable y ∈ V_{bound}\V(C(y^{δ^{+}})).

Note that Q_{C}(y^{δ^{+}}) is (C, R)-valid and can serve as an axiom in AX as indicated in item 1 of § A.1. Indeed, directly by Definition B.3, Q_{C}(y^{δ^{+}}) is even (π, e, A)-valid for each (A, R)-valuation e and each π that is (e, A)-compatible with (C, R).

For dealing with R-substitutions on V_{γ} ∪ V_{δ^{+}} semantically, we need the following technical lemma used in the proofs of Lemma B.6 and Lemma B.7, which again are essential for Lemma 2.31(5) and Lemma 2.37(5), respectively.

Note that, considering those variables that are constrained by the choice-condition C and replaced by the substitution σ, on the one hand, the set O contains the variables whose replacements are supported by the lemmas (⟨O⟩Q_{C})σ. On the other hand, the set N contains the variables that are not supported by such lemmas, plus all the variables that are constrained by C and suffer from this missing support in the sense that they depend on these variables via the variable-condition R.

Lemma B.5 Let C be an R-choice-condition, let A be a Σ-structure, and let σ be an R-substitution on V_{γ} ∪ V_{δ^{+}}. Let (C′, R′) be the extended σ-update of (C, R). Assume that we have O and N with O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N, N ⊆ dom(C) \ O, and dom(C) ∩ ⟨N⟩R^{+} ⊆ N. Now, for any (A, R′)-valuation e′ and any π′ that is (e′, A)-compatible with (C′, R′) such that (⟨O⟩Q_{C})σ is (π′, e′, A)-valid, there are an (A, R)-valuation e and a π that is (e, A)-compatible with (C, R) for which the following holds:

1. For any term or formula B (possibly with some unbound occurrences of variables from a set W ⊆ V_{bound}) with N ∩ V(B) = ∅, and for any τ : V_{δ} → A and χ : W → A, when we set δ′ := ϵ(π′)(τ) ⊎ τ and δ := ϵ(π)(τ) ⊎ τ :

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B).

2. For any set of sequents G with N ∩ V(G) = ∅ :

Gσ is (π′, e′, A)-valid iff G is (π, e, A)-valid.

The following two lemmas generalize Lemma 2.31(6) and Lemma 2.37(6), respectively:

Lemma B.6 (Reduction & Instantiation) For an R-substitution σ on V_{γ} ∪ V_{δ^{+}}, and the extended σ-update (C′, R′) of (C, R), and for O, N with O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N,

N ⊆ dom(C) \ O, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, and N ∩ V(G_{0}, G_{1}) = ∅:

1. If G_{0}σ ∪ (⟨O⟩Q_{C})σ is (C′, R′)-valid in A, then G_{0} is (C, R)-valid in A.

2. If G_{0} (C, R)-reduces to G_{1} in A, then G_{0}σ (C′, R′)-reduces to G_{1}σ ∪ (⟨O⟩Q_{C})σ in A.

Lemma B.7 (Groundedness and Instantiation) For an R-substitution σ on V_{γ} ∪ V_{δ^{+}}, and the extended σ-update (C′, R′) of (C, R), and for O, N with O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N,

N ⊆ dom(C) \ O, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, and N ∩ V(G_{0}, G_{1}, L_{1}) = ∅,

and L_{2} a set of weighted sequents with Seq(L_{2}) = (⟨O⟩Q_{C})σ :

If G_{0} →_{C,R} (G_{1}, L_{1}), then G_{0}σ →_{C′,R′} (G_{1}σ, L_{1}σ ∪ L_{2}).

The following definition extends the Instantiation rule of Definition 2.42 to the application of R-substitutions even on V_{γ} ∪ V_{δ^{+}} instead of V_{γ} only. Note that it specializes to the original definition for R-substitutions on V_{γ}.

Every replacement of a free δ^{+}-variable y^{δ^{+}} must be justified by a lemma Q_{C}(y^{δ^{+}})σ given by the proposition of a proof tree number j_{y^{δ^{+}}}, which must be added in a preceding Hypothesizing step unless it is already present. Note that this lemma is special in the sense that it is not applied locally in some proof tree but globally. Especially problematic is the possibility that y^{δ^{+}} occurs in the proof of the lemma itself. If we are not very careful, the lemma becomes a lemma of itself, resulting in a cyclic lemma application relation. Therefore, since we do not want to reintroduce the lemma as an open lemma and prove it again, we take a very close look on which of our (possibly open) propositions really depend on the justifying lemma Q_{C}(y^{δ^{+}})σ after global application of σ. Our solution is that the lemma is relevant for any proof tree number i whose proof state (i.e. the goals, the proposition itself, and the lemmas) contains free δ^{+}-variables that may depend on y^{δ^{+}}; i.e. for any i with y^{δ^{+}} ∈ D_{i}, for the D_{i} given below.

(Cf. Definition 2.42, Definition 2.47)

Definition B.8 (Generalized Instantiation Rule and Soundness of Steps) Let σ be an R-substitution on V_{γ} ∪ V_{δ^{+}} . Let (C′, R′) be the extended σ-update of (C, R).

Set and H′ := H and F′ := { ( i, ((Γ σ, ℵσ), tσ) ) ( i, ((Γ, ℵ), t) ) ∈ F }.

Assume that for each y^{δ^{+}} ∈ dom(C) ∩ dom(σ) there is some j_{y^{δ^{+}}} ∈ dom(F) with

Seq(Propos(⟨{j_{y^{δ^{+}}}}⟩F′)) = {Q_{C}(y^{δ^{+}})σ}.

For each i ∈ dom(F) set I := H^{∗}⟨{i}⟩ and

D_{i} := dom(C) ∩ dom(σ) ∩ R^{∗}⟨V_{δ^{+}}(Goals( Trees(⟨I⟩F) ), Propos( ⟨{i} ∪ L⟨I⟩⟩F ))⟩.

Set L′ := L ∪ { (j_{y^{δ^{+}}}, i) y^{δ^{+}} ∈ D_{i} ∧ i ∈ dom(F) }.

Such a generalized Instantiation step is safe if, for all y^{δ^{+}} ∈ dom(C) ∩ dom(σ), Q_{C}(y^{δ^{+}})σ is (C′, R′)-valid by satisfying the requirements of Theorem 2.45, i.e. all trees in Trees( ⟨(L′∪H′)^{∗}⟨{j_{y^{δ^{+}}}}⟩⟩F′ ) are closed and L′∘H′^{∗} is well-founded.

C The Proofs

Proof of Lemma 2.1 The backward implication is trivial because R^{+}-minimality in a class A implies R-minimality in A due to R ⊆ R^{+}. For the forward implication, since R^{+} is clearly transitive, it suffices to show that it is well-founded, because then it is irreflexive. Thus, suppose that there is some class A with ∀a ∈ A. ∃a′ ∈ A. a′R^{+}a. We have to show that A must be empty. Set B := { b | ∃a ∈ A. aR^{∗}b }. \underline{Claim 1:} For any b ∈ B, there is some b′ ∈ B with b′Rb. \underline{Proof of Claim 1:} By definition of B and the property of A, there is some a ∈ A with aR^{+}b. Thus, there is some b′ with aR^{∗}b′Rb. \underline{Q.e.d. (Claim 1)}

By Claim 1 and the assumption that R is well-founded, we get B = ∅. Then, we also have A = ∅ due to A ⊆ B. Q.e.d. (Lemma 2.1)

Proof of Lemma 2.5 \underline{\underline{2.2 ⇒ 2.4:}} Let < be an ordering with ∀a ∈ A. ∃a′ ∈ A. a > a′. Set R := > ∩ (A×A). Now

dom(R) = A ⊇ ran(R). Assume A ≠ ∅. By the Principle of Dependent Choice, R is not

terminating. This contradicts (i) and (ii) of the Principle of Descente Infinie. \underline{\underline{2.4 ⇒ 2.2:}} Let R be a binary relation with ran(R)⊆dom(R) ≠ ∅. We are going to show that R is not

terminating.

Set A := \{ a ∃n ∈ N. \binom{a : \{0, …, n\} → dom(R)}{∧ ∀i ≺ n. a_{i}Ra_{i+1}} \}.

Define ≲ on A by a ≳ a′ if \binom{dom(a) ⊆ dom(a′)}{∧ ∀i ∈ dom(a). a_{i} = a′_{i}}. Let < be the ordering of ≲.

\underline{Claim 1:} ∀a ∈ A. ∃a′ ∈ A. a > a′. \underline{Proof of Claim 1:} For a : \{0, …, n\} → dom(R) we have to show the existence of some a′ : {0, …, n, n+1} → dom(R) with a > a′. When we set a′_{i} := a_{i} for i ⪯ n then (due to a_{n} ∈ dom(R)) there exists an a′_{n+1} with a_{n} R a′_{n+1}, and then a′_{n+1} ∈ ran(R)⊆dom(R).

Q.e.d. (Claim 1)

Since dom(R) ≠ ∅ we have A ≠ ∅. Thus, by Claim 1 and the Principle of Descente Infinie (i) there is some non-terminating sequence (a_{i})_{i∈N} in > and we set C := ran(a) or (ii) there is some C ⊆ A totally ordered by < that has no <-minimal element. But then ⋃ C is a non-terminating sequence in R. \underline{\underline{2.4(i) ⇒ 2.3:}} If < is not well-founded, then there is some non-empty class A with ∀a ∈ A. ∃a′ ∈ A.

a>a′. Thus, by the Principle of Descente Infinie 2.4(i), > ∩ (A×A) is not terminating,

which implies that > is not terminating. \underline{\underline{2.3 ⇒ 2.4(i):}} Let < be an ordering. Then < ∩ (A×A) is an ordering, too. Thus, if > ∩ (A×A) is

terminating, by the Principle of Well-foundedness, <∩(A×A) is a well-founded ordering.

In case of ∀a ∈ A. ∃a′ ∈ A. a>a′, this means that A must be empty. Q.e.d. (Lemma 2.5)

Proof of Lemma 2.22 Here we denote concatenation (product) of relations ‘∘’ simply by juxtaposition and assume it to have higher priority than any other binary operator. R′^{+} is a well-founded ordering simply because R′ is the σ-update of R and σ is an R-substitution. Now it suffices to show the following two claims for an arbitrary y^{δ^{+}} ∈ dom(C′): \underline{Claim 1:} For all z^{δ} ∈ V_{δ}(C′(y^{δ^{+}}))\\{y^{δ^{+}}\}: z^{δ}R′^{+}y^{δ^{+}}. \underline{Claim 2:} For all u^{γ} ∈ V_{γ}(C′(y^{δ^{+}})): u^{γ}R′^{+}y^{δ^{+}}. \underline{Proof of Claim 1:}Let z^{δ} ∈ V_{δ}(C′(y^{δ^{+}}))\\{y^{δ^{+}}\}. By the definition of C′ this means z^{δ} ∈ V_{δ}(C(y^{δ^{+}}))\\{y^{δ^{+}}\} or there is some u ∈ V(C(y^{δ^{+}})) with z^{δ} Δ_{σ} u. Since C is an R-choice-condition, we have z^{δ} R^{+} y^{δ^{+}} or z^{δ} Δ_{σ} u R^{∗} y^{δ^{+}}. As R′ is the σ-update of R, we have R ∪ Δ_{σ} ⊆ R′.^{26} Thus z^{δ}R′^{+}y^{δ^{+}}.

Q.e.d. (Claim 1)

\underline{Proof of Claim 2:} Let u^{γ} ∈ V_{γ}(C′(y^{δ^{+}})). By the definition of C′ there is some v ∈ V(C(y^{δ^{+}})) with u^{γ} (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}) v. Since C is an R-choice-condition, we have v R^{∗} y^{δ^{+}}, i.e. u^{γ} (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ})R^{∗} y^{δ^{+}}. As R′ is the σ-update of R, we have (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ})R^{∗} ⊆

(R ∪ Γ_{σ})^{∗} ⊆ R′^{∗}.^{27} Thus u^{γ}R′^{+}y^{δ^{+}}.  \underline{Q.e.d. (Claim 2)}  Q.e.d. (Lemma 2.22)

Proof of Lemma 2.24 Set ⊲ := (R ∪ S_{e})^{+} and S_{π} := ⊲ ∩ (V_{δ} ×V_{δ^{+}}). As e is an (A, R)-valuation, ⊲ is a well-founded ordering. With the help of a choice function and by recursion on y^{δ^{+}} ∈ V_{δ^{+}} in ⊲ we can define π(y^{δ^{+}}) : (S_{π}⟨{y^{δ^{+}}}⟩ → A) → A in the following way: Let τ : S_{π}⟨{y^{δ^{+}}}⟩ → A. In case of y^{δ^{+}} ∈ V_{δ^{+}}\dom(C) we choose an arbitrary value for π(y^{δ^{+}})(τ) from the universe of A (of the appropriate type). Note that universes are assumed to be non-empty, cf. § 2.1.4. In case of y^{δ^{+}} ∈ dom(C), we have the following situation: C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B, B is a formula whose unbound variables from V_{bound} are among {v_{0}, …, v_{l−1}} ⊆ V_{bound} and where, for v_{0} : α_{0}, …, v_{l−1} : α_{l−1}, we have y^{δ^{+}} : α_{0} → … → α_{l−1} → α_{l} for some type α_{l}, and any occurrence of y^{δ^{+}} in B is of the form y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}). In this case, we let π(y^{δ^{+}})(τ) be the function f that for χ : {v_{0}, …, v_{l−1}} → A chooses a value from the universe of A for f(χ(v_{0})) ⋯ (χ(v_{l−1})) such that, if possible, B is (ϵ(π)(τ ⊎ τ′)⊎τ ⊎ τ′ ⊎ χ, e, A)-valid for an arbitrary τ′ : (V_{δ} \dom(τ)) → A. Note that this definition of f(χ(v_{0})) ⋯ (χ(v_{l−1})) does not depend on the values of f(χ′(v_{0})) ⋯ (χ′(v_{l−1})) for a different χ′ : {v_{0}, …, v_{l−1}} → A because any occurrence of y^{δ^{+}} in B is of the form y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}). \underline{Claim 1:} For z^{δ} ∈ V_{δ} with z^{δ} ⊲ y^{δ^{+}}, (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{δ}) depends only τ, π(z^{δ}), and z^{δ}. \underline{Claim 2:} For x^{γ} ∈ V_{γ} with z^{γ} ⊲ y^{δ^{+}}, ϵ(e)(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(x^{γ}) depends only τ, _{⊲⟨\{y^{δ^{+}}\}⟩} ↿π and e(x^{γ}). \underline{Claim 3:} The definition of π(y^{δ^{+}})(τ) depends only on such π(v^{δ^{+}}) with v^{δ^{+}} ⊲ y^{δ^{+}}. \underline{Claim 4:} The definition of π(y^{δ^{+}})(τ) does not depend on τ′. \underline{Proof of Claim 1:} For z^{δ} ∈ V_{δ} we have (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{δ}) = τ(z^{δ}) due to z^{δ} ∈ S_{π}⟨\{y^{δ^{+}}\}⟩. Moreover, for z^{δ} ∈ V_{δ^{+}}, we have S_{π}⟨{z^{δ}}⟩ ⊆ S_{π}⟨{y^{δ^{+}}}⟩, and therefore (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{δ}) = π(z^{δ})(_{S_{π}⟨\{z^{δ}\}⟩}↿(τ ⊎ τ′)) = π(z^{δ})(_{S_{π}⟨\{z^{δ}\}⟩}↿τ). \underline{Q.e.d. (Claim 1)} \underline{Proof of Claim 2:} As S_{e}⟨\{x^{γ}\}⟩ ⊆ ⊲⟨\{y^{δ^{+}}\}⟩, and ϵ(e)(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(x^{γ}) = e(x^{γ})(_{S_{e}⟨\{x^{γ}\}⟩}↿(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)) this follows from Claim 1. \underline{Q.e.d. (Claim 2)} \underline{Proof of Claim 3 and 4:} Since C is an R-choice-condition, we have z ⊲ y^{δ^{+}} for all z ∈ V_{free}(C(y^{δ^{+}}))\\{y^{δ^{+}}\}. Thus, this follows from Claim 1 and Claim 2. \underline{Q.e.d. (Claim 3, 4)} Now π is well-defined by Claim 3 and Claim 4 and obviously semantical. Thus, Item 1 of Definition 2.23 is satisfied because (R ∪ S_{e} ∪ S_{π})^{+} = ⊲ is a well-founded ordering. For showing Item 2 of Definition B.3, let τ : V_{δ} → A, y^{δ^{+}} ∈ dom(C), and C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B, and assume to the contrary that, for some η : {y^{δ^{+}}} → A and χ : {v_{0}, …, v_{l−1}} → A, B is (δ′, e, A)-valid, but not (δ, e, A)-valid for δ := ϵ(π)(τ) ⊎ τ ⊎ χ and δ′ := η ⊎ _{V\{y^{δ^{+}}}}↿δ. This contradicts the definition of π(y^{δ^{+}})(_{S_{π}⟨{y^{δ^{+}}}⟩}↿τ) from above due to Claim 4. Q.e.d. (Lemma 2.24)

Proof of Lemma 2.26 Due to R⊆R′, by Lemma B.1(1), e is an (A, R)-valuation, too. As π is (e, A)-compatible with (C′, R′), C⊆C′, and the choice-condition occurs only in Item 2 of Definition 2.23 and Definition B.3, π is (e, A)-compatible with (C, R′). As R⊆R′, and the variable-condition occurs only in Item 1 of Definition 2.23, π is (e, A)-compatible with (C, R). Q.e.d. (Lemma 2.26)

Proof of Lemma 2.28 As G is (V_{γ}×V_{δ})-valid in A, there is some (A, V_{γ}×V_{δ})-valuation e s.t. G is (e, A)-valid. \underline{Claim 1:} e is an (A, R)-valuation. \underline{Proof of Claim 1:} As C is an R-choice-condition, R is well-founded. As e is an (A, V_{γ}×V_{δ})-valuation, S_{e} ∘ (V_{γ}×V_{δ}) is irreflexive. This means S_{e} = ∅, i.e. R ∪ S_{e} = R. This means that R ∪ S_{e} is well-founded, as was to be shown. \underline{Q.e.d. (Claim 1)} By Claim 1, G is immediately R-valid. Moreover, by Claim 1 and Lemma 2.24, there is some π that is (e, A)-compatible with (C, R). As G is (e, A)-valid, G is also (ϵ(π)(τ) ⊎ τ, e, A)-valid for all τ : V_{δ} → A. Then, as π is (e, A)-compatible with (C, R), and by Claim 1, G is (C, R)-valid in A.

Q.e.d. (Lemma 2.28)

Proof of Lemma 2.29 As G is (C, R)-valid in A, there are some (A, R)-valuation e and some π s.t. π is (e, A)-compatible with (C, R) and G is (π, e, A)-valid. Set S_{e′} := (_{V_{δ}} ↿id ∪ S_{π}) ∘ S_{e}↾_{V_{γ}\ran(ς)} ∪ S_{π} ∘ ς. We define e′ via: \underline{For x^{γ} ∈ V_{γ}\ran(ς):} For τ : S_{e′}⟨\{x^{γ}\}⟩ → A:

e′(x^{γ})(τ) := e(x^{γ})(_{S_{e}⟨{x^{γ}}⟩}↿(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′))

where τ′ : (V_{δ} \dom(τ)) → A. Note that this right-hand side is okay because dom(τ) ⊆ V_{δ} ; indeed, due to x^{γ} ∉ ran(ς), we have S_{e′}⟨{x^{γ}}⟩ = (V_{δ} ∩ S_{e}⟨{x^{γ}}⟩) ∪ (S_{π} ∘ S_{e})⟨{x^{γ}}⟩ ⊆ V_{δ} . Furthermore, note that this right-hand side does not depend on τ′ because V_{δ} ∩ S_{e}⟨{x^{γ}}⟩ ⊆ S_{e′}⟨{x^{γ}}⟩ = dom(τ), and for y^{δ^{+}} ∈ S_{e}⟨{x^{γ}}⟩, we have S_{π}⟨{y^{δ^{+}}}⟩ ⊆ (S_{π} ∘ S_{e})⟨{x^{γ}}⟩ ⊆ S_{e′}⟨{x^{γ}}⟩ and therefore ϵ(π)(τ ⊎ τ′)(y^{δ^{+}}) = π(y^{δ^{+}})(_{S_{π}⟨{y^{δ^{+}}}⟩}↿(τ ⊎ τ′)) = π(y^{δ^{+}})(_{S_{π}⟨{y^{δ^{+}}}⟩}↿τ). \underline{For x^{γ} ∈ ran(ς):} For τ : S_{e′}⟨\{x^{γ}\}⟩ → A: e′(x^{γ})(τ) := π(ς^{−1}(x^{γ}))(τ). Note that this right-hand side is okay because, due to x^{γ} ∈ ran(ς), we have S_{e′}⟨{x^{γ}}⟩ = S_{π}⟨{ς^{−1}(x^{γ})}⟩ ⊆ V_{δ} . \underline{Claim 1:} e′ is an (A, R′)-valuation.

\underline{Proof of Claim 1:} Here we denote concatenation (product) of relations ‘∘’ again by juxtaposition and assume it to have higher priority than any other binary operator. It suffices to show that R′ ∪ S_{e′} is well-founded. As π is (e, A)-compatible with (C, R), we know that R ∪ S_{e} ∪ S_{π} is well-founded. Thus, the subset (_{V_{δ} ∪V_{γ}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{δ} ∪V_{γ}\ran(ς)} ∪ (_{V_{δ}} ↿id ∪ S_{π})S_{e}↾_{V_{γ}\ran(ς)} of its transitive closure is well-founded, too. Since the domain of this relation and dom(S_{π}) are disjoint from ran(ς), we know that (_{V_{δ} ∪V_{γ}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{δ} ∪V_{γ}\ran(ς)} ∪ (_{V_{δ}} ↿id ∪ S_{π})S_{e}↾_{V_{γ}\ran(ς)} ∪ S_{π}ς is well-founded, too. Since the domain of this relation and V_{γ} are disjoint from V_{δ^{+}}, (_{V_{δ} ∪V_{γ}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{δ} ∪V_{γ}\ran(ς)} ∪ V_{γ}×V_{δ^{+}} ∪ (_{V_{δ}} ↿id ∪ S_{π})S_{e}↾_{V_{γ}\ran(ς)} ∪ S_{π}ς is well-founded, too. Since a step with this relation that can precede a step with ς^{−1} can only be a step with S_{π}ς (due to dom(ς^{−1}) = ran(ς) ⊆ V_{γ}), (_{V_{δ} ∪V_{γ}\ran(ς)}↿id ∪ ς^{−1})R^{+}↾_{V_{δ} ∪V_{γ}\ran(ς)} ∪ V_{γ}×V_{δ^{+}} ∪ (_{V_{δ}} ↿id ∪ S_{π})S_{e}↾_{V_{γ}\ran(ς)} ∪ S_{π}ς is well-founded, too; just like its subset R′ ∪ S_{e′}. \underline{Q.e.d. (Claim 1)} As the universes are assumed to be non-empty (cf. § 2.1.4), there is some δ : V_{δ^{+}} → A by the Axiom of Choice. Define π′ by π′(y^{δ^{+}})(∅) := δ(y^{δ^{+}}). \underline{Claim 2:} π′ is (e′, A)-compatible with (∅, R′). \underline{Proof of Claim 2:} We have S_{π′} = ∅. Thus, R′ ∪ S_{e′} ∪ S_{π′} is equal to R′ ∪ S_{e′}, which is well-founded by Claim 1. \underline{Q.e.d. (Claim 2)} \underline{Claim 3:} For τ : V_{δ} → A and x^{γ} ∈ V_{γ}(G):

ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(x^{γ}) = ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{γ}).

\underline{Proof of Claim 3:} We have x^{γ} ∈ V_{γ}(G) ⊆ V_{γ}\ran(ς). Thus, by the discussion of the first case of the definition of e′, we have ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(x^{γ}) = e′(x^{γ})(_{S_{e′} ⟨{x^{γ}}⟩}↿τ) = e(x^{γ})(_{S_{e}⟨\{x^{γ}\}⟩}↿(ϵ(π)(τ) ⊎ τ)) = ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{γ}). \underline{Q.e.d. (Claim 3)} \underline{Claim 4:} For τ : V_{δ} → A and y^{δ^{+}} ∈ V_{δ^{+}}(G): ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(ς(y^{δ^{+}})) = ϵ(π)(τ)(y^{δ^{+}}). \underline{Proof of Claim 4:} Since ς(y^{δ^{+}}) ∈ ran(ς), by the discussion of the second case of the definition of e′, we have ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(ς(y^{δ^{+}})) = e′(ς(y^{δ^{+}}))(_{S_{e′} ⟨{ς(y^{δ^{+}})}⟩}↿τ) = π(ς^{−1}(ς(y^{δ^{+}})))(_{S_{π}⟨{ς^{−1}(ς(y^{δ^{+}}))}⟩}↿τ) = π(y^{δ^{+}})(_{S_{π}⟨\{y^{δ^{+}}\}⟩}↿τ) = ϵ(π)(τ)(y^{δ^{+}}). \underline{Q.e.d. (Claim 4)} \underline{Claim 5:} Gς is (π′, e′, A)-valid. \underline{Proof of Claim 5:} Let τ : V_{δ} → A be arbitrary. First by the Substitution-Lemma, second by Claim 3, V_{δ^{+}}(G) ⊆ dom(ς), Claim 4, and third as G is (π, e, A)-valid, we get: eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(Gς) =

eval( \begin{matrix}& A \\ ⊎ & ϵ(e′)(ϵ(π′)(τ) ⊎ τ) \\ ⊎ & _{V_{δ^{+}}\dom(ς)}↿(ϵ(π′)(τ)) ⊎ ς ∘ (ϵ(e′)(ϵ(π′)(τ) ⊎ τ)) \\ ⊎ & τ \end{matrix} )(G) =

eval( A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ )(G) = TRUE \underline{Q.e.d. (Claim 5)} \underline{Claim 6:} Gς is R′-valid in A. \underline{Proof of Claim 6:} First note that by Claim 1, e′ is an (A, R′)-valuation. Let τ′ : V_{δ} → A be arbitrary. When we set δ := _{V_{δ^{+}}}↿τ′ and τ := _{V_{δ}} ↿τ′, we get eval(A ⊎ ϵ(e′)(τ′) ⊎ τ′)(Gς) = eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(Gς) = TRUE, where the last step is due to Claim 5. \underline{Q.e.d. (Claim 6)} Now we conclude that Gς is (∅, R′)-valid in A (by Claim 1, Claim 2, and Claim 5) and R′-valid in A (by Claim 6). Q.e.d. (Lemma 2.29)

Proof of Lemma 2.31 (1), (2), (3), and (4) are trivial. \underline{\underline{(5a):}} As G_{0} is (C′, R′)-valid in A, there is an (A, R′)-valuation e and some π s.t. π is (e, A)-compatible

with (C′, R′) and G_{0} is (π, e, A)-valid. By Lemma 2.26, e is also an (A, R)-valuation and π is also (e, A)-compatible with (C, R). Thus, G_{0} is (C, R)-valid in A. \underline{\underline{(5b):}} Suppose that e is an (A, R′)-valuation and π is (e, A)-compatible with (C′, R′), and that G_{1} is

(π, e, A)-valid. By Lemma 2.26, e is also an (A, R)-valuation and π is also (e, A)-compatible with (C, R). Thus, since G_{0} (C, R)-reduces to G_{1}, also G_{0} is (π, e, A)-valid as was to be shown. \underline{\underline{(6):}} By Lemma B.6, setting O := ∅ and N := ∅. Q.e.d. (Lemma 2.31)

Proof of Lemma 2.37 (1), (2), (3), and (4) are trivial. \underline{\underline{(5):}} Let A ∈ K, S ∈ G_{0}, let e be an (A, R′)-valuation, and π be (e, A)-compatible with (C′, R′).

Suppose that (S_{0}, τ_{0}) is an (π, e, A)-counterexample. By Lemma 2.26, e is also an (A, R)-valua-tion and π is also (e, A)-compatible with (C, R). By assumption, G_{0} →_{C,R} (G_{1}, L_{1}). Thus, there is some (π, e, A)-counterexample (S_{1}, τ_{1}) with S_{1} ∈ L_{1} or S_{1} ∈ G_{1} and in the latter case (S_{1}, τ_{1}) is (π, e, A)-smaller than (S_{0}, τ_{0}). \underline{\underline{(6):}} By Lemma B.7, setting O := ∅ and N := ∅.

\underline{\underline{(7):}} To show H_{1} →_{C,R} (G_{1}, L_{1}), let A ∈ K, e be some (A, R)-valuation, and π be (e, A)-compatible

with (C, R). W.l.o.g. we may assume that L_{1} does not have an (π, e, A)-counterexample. Let D be the class of (π, e, A)-counterexamples (S_{0}, τ_{0}) with S_{0} ∈ H_{1} for which there is no (π, e, A)-counter-example (S_{1}, τ_{1}) s.t. S_{1} ∈ G_{1} and (S_{1}, τ_{1}) is (π, e, A)-smaller than (S_{0}, τ_{0}). It suffices to show that D is empty. We show this by the Method of Descente Infinie on the meta-level. Suppose there is some meta-counterexample ((Γ_{0}, (w_{0}, <_{0}, ≲_{0})), τ_{0}) ∈ D. Due to the assumed H_{1} → ↓ _{C,R} (H_{1}, G_{1}, L_{1}), there must be an (π, e, A)-counterexample ((Γ_{1}, (w_{1}, <_{1}, ≲_{1})), τ_{1}) s.t. (Γ_{1}, (w_{1}, <_{1}, ≲_{1})) ∈ H_{1} and ((Γ_{1}, (w_{1}, <_{1}, ≲_{1})), τ_{1}) is strictly (π, e, A)-smaller than ((Γ_{0}, (w_{0}, <_{0}, ≲_{0})), τ_{0}). The latter means that there are ⊲ and ⊲ ∼ s.t., for i ∈ {0, 1}, δ_{i} := ϵ(π)(τ_{i}) ⊎ τ_{i}, B_{i} := A ⊎ ϵ(e)(δ_{i}) ⊎ δ_{i}, w̄_{i} := eval(B_{i})(w_{i}), we have ⊲ = eval(B_{i})(<_{i}), ⊲ ∼ = eval(B_{i})(≲_{i}), w̄_{1}⊲^{+}w̄_{0}, and ⊲ is wellfounded. By Lemma 2.1, ⊲^{+} is a well-founded ordering. \underline{((Γ_{1}, (w_{1}, <_{1}, ≲_{1})), τ_{1}) ∈ D :} In this case we have found the meta-counterexample we are looking for. It is important that we indeed have a single meta-induction ordering here, which is defined as follows: ((Γ′_{0}, (w′_{0}, <′_{0}, ≲′_{0})), τ′_{0}) is strictly smaller than ((Γ′_{1}, (w′_{1}, <′_{1}, ≲′_{1})), τ′_{1}) if for i ∈ {0, 1}, δ′_{i} := ϵ(π)(τ′_{i}) ⊎ τ′_{i}, B′_{i} := A ⊎ ϵ(e)(δ′_{i}) ⊎ δ′_{i}, w̄′_{i} := eval(B′_{i})(w′_{i}), we have some well-founded ⊲′ with ⊲′ = eval(B′_{i})(<′_{i}) and w̄_{1}⊲′^{+}w̄_{0}. \underline{((Γ_{1}, (w_{1}, <_{1}, ≲_{1})), τ_{1}) ∉ D :} In this case, there must be some (π, e, A)-counter-example ((Γ_{2}, (w_{2}, <_{2}, ≲_{2})), τ_{2}) s.t. (Γ_{2}, (w_{2}, <_{2}, ≲_{2})) ∈ G_{1} and ((Γ_{2}, (w_{2}, <_{2}, ≲_{2})), τ_{2}) is (π, e, A)-smaller than ((Γ_{1}, (w_{1}, <_{1}, ≲_{1})), τ_{1}). The latter means, for δ_{2} := ϵ(π)(τ_{2}) ⊎ τ_{2}, B_{2} := A ⊎ ϵ(e)(δ_{2}) ⊎ δ_{2}, w̄_{2} := eval(B_{2})(w_{2}), we have ⊲ = eval(B_{2})(<_{2}), ⊲ ∼ = eval(B_{2})(≲_{2}), and w̄_{2} (⊲ ∼ ∪ ⊲)^{∗} w̄_{1}. But then we also have w̄_{2} (⊲ ∼ ∪ ⊲)^{∗} w̄_{0}. This, however, contradicts

((Γ_{0}, (w_{0}, <_{0}, ≲_{0})), τ_{0}) ∈ D.  Q.e.d. (Lemma 2.37)

Proof of Theorem 2.44 As ∅ is an ∅-choice-condition, (∅, ∅, ∅, ∅, ∅) vacuously satisfies the invariant for soundness. For the iteration steps, let (i′′, ((Γ′′, ℵ′′), t′′)) ∈ F′ be arbitrary. Assuming the invariant for soundness of (F, C, R, L, H) and using the abbreviations

I := H^{∗}⟨{i′′}⟩
A := Goals(Trees(⟨I′⟩F))

I′ := H′^{∗}⟨{i′′}⟩
A′ := Goals(Trees(⟨I′⟩F′))
B′ := Propos(⟨L′⟨I′⟩⟩F′).

we have to show that C′ is an R′-choice-condition and that {(Γ′′, ℵ′′)} →_{C′,R′} (A′, B′). \underline{\underline{Hypothesizing:}} Note that F′ is a partial function on N_{+} just like F because of i ∈ N_{+} \dom(F). Note

that R is a variable-condition and that R^{+} is a well-founded ordering because C is an

R-choice-condition (because (F, C, R, L, H) is assumed to be a proof forest). \underline{i′′ ∈ dom(F):} By assumption,

{(Γ′′, ℵ′′)} →_{C,R} (Goals(Trees(⟨I⟩F)), Propos(⟨L⟨I⟩⟩F)).

As (C′, R′) is an extension of (C, R) and by Lemma 2.37(5), this means

{(Γ′′, ℵ′′)} →_{C′,R′} (Goals(Trees(⟨I⟩F)), Propos(⟨L⟨I⟩⟩F)).

Due to H = H′ we have I = I′, and then due to L = L′ and F ⊆F′, we have

Goals(Trees(⟨I⟩F)) ⊆ A′ and Propos(⟨L⟨I⟩⟩F) ⊆ B′.

Thus, by Lemma 2.37(2), we have

Goals(Trees(⟨I⟩F)) →_{C′,R′} (A′, ∅) and Propos(⟨L⟨I⟩⟩F) →_{C′,R′} (∅, B′).

Thus, by Lemma 2.37(3a,b), we have {(Γ′′, ℵ′′)} →_{C′,R′} (A′, B′). \underline{i′′ = i:} Then \{(Γ′′, ℵ′′)\} = \{(Γ, ℵ)\} = Goals(\{t\}) = Goals(\{t′′\}) ⊆ A′ ⊆ A′ ∪ B′. Thus, by Lemma 2.37(2), {(Γ′′, ℵ′′)} →_{C′,R′} (A′, B′). \underline{\underline{Expansion:}} Note that Propos(⟨J⟩F) = Propos(⟨J⟩F′) for all J ⊆ N_{+}.

\underline{Claim 1:} Propos(⟨I′⟩F) →_{C′,R′} (A, B′).

\underline{Claim 2:} A → ↓ _{C′,R′} (Propos(⟨I′⟩F), A′, B′). By Claim 1, Claim 2, and Lemma 2.37(3a), we get

Propos(⟨I′⟩F) → ↓ _{C′,R′} (Propos(⟨I′⟩F), A′, B′).

By Lemma 2.37(7), we get Propos(⟨I′⟩F) →_{C′,R′} (A′, B′). Since {(Γ′′, ℵ′′)} ⊆ Propos(⟨I′⟩F), we have {(Γ′′, ℵ′′)} →_{C′,R′} (Propos(⟨I′⟩F), ∅) by Lemma 2.37(2). Thus, by Lemma 2.37(3a), we get {(Γ′′, ℵ′′)} →_{C′,R′} (A′, B′). \underline{Proof of Claim 1:} By Lemma 2.37(4) it suffices to show Propos(⟨{i′′′}⟩F) →_{C′,R′} (A, B′) for any i′′′ ∈ I′. We have

Propos(⟨{i′′′}⟩F) →_{C,R} (Goals(Trees(⟨I′′′⟩F)), Propos(⟨L⟨I′′′⟩⟩F))

for I′′′ := H^{∗}⟨{i′′′}⟩ by assumption. As (C′, R′) is an extension of (C, R) and by Lemma 2.37(5),

Propos(⟨{i′′′}⟩F) →_{C′,R′} (Goals(Trees(⟨I′′′⟩F)), Propos(⟨L⟨I′′′⟩⟩F)).

Due to H⊆H′, we have I′′′ ⊆ H′^{∗}⟨{i′′′}⟩ ⊆ H′^{∗}⟨I′⟩ = I′. Thus, Goals(Trees(⟨I′′′⟩F)) ⊆ A and (due to L⊆L′) Propos(⟨L⟨I′′′⟩⟩F) ⊆ Propos(⟨L′⟨I′⟩⟩F) = B′. Thus, by Lemma 2.37(2), we get Goals(Trees(⟨I′′′⟩F)) →_{C′,R′} (A, ∅) and Propos(⟨L⟨I′′′⟩⟩F) →_{C′,R′} (∅, B′). By Lemma 2.37(3a,b): Propos(⟨\{i′′′\}⟩F) →_{C′,R′} (A, B′). \underline{Q.e.d. (Claim 1)} \underline{Proof of Claim 2:} If i ∉ I′, then we have A = A′ and Claim 2 follows from Lemma 2.37(2). Thus, we may assume i ∈ I′. By construction of t′ we have A\{(Δ, ℶ)} ⊆ A′. Thus, by Lemma 2.37(2),

A\{(Δ, ℶ)} → ↓ _{C′,R′} (Propos(⟨I′⟩F), A′, B′).

By assumption we have

{(Δ, ℶ)} → ↓ _{C′,R′} (Propos(⟨N_{H}⟩F), G, Propos(⟨N_{L}⟩F)).

By Lemma 2.37(4), we get Claim 2 due to Propos(⟨N_{H}⟩F) ⊆ Propos(⟨I′⟩F), G ⊆ Goals({t′}) = Goals(Trees(⟨{i}⟩F′)) ⊆ A′, and Propos(⟨N_{L}⟩F) ⊆ Propos(⟨L′⟨I′⟩⟩F) = B′, which hold due to N_{H} ⊆ H′⟨{i}⟩ ⊆ H′⟨I′⟩ = I′, the construction of t′, and N_{L} ⊆ L′⟨{i}⟩ ⊆ L′⟨I′⟩, respectively.

Q.e.d. (Claim 2)

\underline{\underline{Instantiation:}} Not that here we take into account the generalization of the Instantiation rule of Defini-

tion 2.42 given by Definition B.8.

By Lemma 2.22, C′ is an R′-choice-condition. Set O := D_{i′′} and N := dom(C) ∩ ⟨(dom(C) ∩ dom(σ)) \ O⟩R^{∗}. \underline{Claim 3:} O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, N ⊆ dom(C) \ O, and N ∩ V(Goals(Trees(⟨I⟩F)), Propos(⟨{i′′}∪L⟨I⟩⟩F)) = ∅. \underline{Proof of Claim 3:} By definition of D_{i} and N, the first, second, and third statement are trivial with the exception of N∩O = ∅, which we will show together with the last statement: Set M := R^{∗}⟨V_{δ^{+}}(Goals(Trees(⟨I⟩F)), Propos(⟨{i′′}∪L⟨I⟩⟩F))⟩. It now suffices to show N∩M = ∅. If z1^{δ^{+}} ∈ N, there is some z0^{δ^{+}} ∈ (dom(C) ∩ dom(σ))\O with z0^{δ^{+}} R^{∗} z1^{δ^{+}}, but then, if z1^{δ^{+}} ∈ M, we get z0^{δ^{+}} ∈ M and the contradictory z0^{δ^{+}} ∈ O by definition of O. \underline{Q.e.d. (Claim 3)} By assumption Propos(⟨{i′′}⟩F) →_{C,R} (Goals(Trees(⟨I⟩F)), Propos(⟨L⟨I⟩⟩F)). Set B′′ := ⋃_{y^{δ^{+}} ∈ O} Propos(⟨{j_{y^{δ^{+}}}}⟩F′). Then we have Seq(B′′) = (⟨O⟩Q_{C})σ according to the requirements of the Instantiation rule. By Claim 3 we can apply Lemma B.7 to get:

{(Γ′′, ℵ′′)} = Propos(⟨{i′′}⟩F)σ→_{C′,R′}(Goals(Trees(⟨I⟩F))σ, Propos(⟨L⟨I⟩⟩F)σ ∪ B′′)
= (Goals(Trees(⟨I⟩F′)), Propos(⟨L⟨I⟩⟩F′) ∪ B′′)
= (A′, Propos(⟨L⟨I′⟩⟩F′) ∪ B′′),

the latter step being due to I = I′. By definition of L′ we have { j_{y^{δ^{+}}} | y^{δ^{+}} ∈ O } ⊆ L′⟨{i′′}⟩ ⊆ L′⟨I′⟩. Thus, we have B′′⊆B′. Moreover, due to L⊆L′ , we have Propos(⟨L⟨I′⟩⟩F′) ⊆ B′. Together this implies Propos(⟨L⟨I′⟩⟩F′) ∪ B′′ →_{C′,R′} (∅, B′), by Lemma 2.37(2). By Lemma 2.37(3b) we get {(Γ′′, ℵ′′)} →_{C′,R′} (A′, B′).

Q.e.d. (Theorem 2.44)

Proof of Theorem 2.45 Let A ∈ K be arbitrary. Since AX is V_{γ}×V_{δ}-valid in A (cf. Definition 2.38) and C is an R-choice-condition, AX is (C, R)-valid in A by Lemma 2.28. By definition, this means that there is some (A, R)- valuation e and some π that is (e, A)-compatible with (C, R) s.t. AX is (π, e, A)-valid. \underline{Claim 1:} For i′ with i′ (L∪H)^{∗} i and for (i′, ((Γ′, ℵ′), t′)) ∈ F : Γ′ is (π, e, A)-valid. \underline{Proof of Claim 1:} By induction on i′ in L∘H^{∗}: Set I := H^{∗}⟨\{i′\}⟩. Due to I ⊆ (L∪H)^{∗}⟨\{i\}⟩ and by the closedness assumption of the theorem we have Seq(Goals(Trees(⟨I⟩F))) ⊆ Seq(Goals(Trees(⟨(L∪H)^{∗}⟨{i}⟩⟩F))) ⊆ AX. Thus, Seq(Goals(Trees(⟨I⟩F))) is (π, e, A)-valid. By induction hypothesis, Seq(Propos(⟨L⟨I⟩⟩F)) is (π, e, A)-valid. Together this means that Seq(Goals(Trees(⟨I⟩F)) ∪ Propos(⟨L⟨I⟩⟩F)) is (π, e, A)-valid, too. (Note that the last step would not be possible for (C, R)-validity instead of (π, e, A)-validity.)

Since (i′, ((Γ′, ℵ′), t′)) ∈ F and (F, C, R, L, H) satisfies the invariant for soundness, {(Γ′, ℵ′)} →_{C,R} (Goals(Trees(⟨I⟩F)), Propos(⟨L⟨I⟩⟩F)). All in all, by Lemma 2.37(1b), Γ′ is (π, e, A)-valid. \underline{Q.e.d. (Claim 1)} For i′ = i, Claim 1 says that Γ is (C, R)-valid in A. Q.e.d. (Theorem 2.45)

Proof of Theorem 2.48 The empty proof forest trivially satisfies the invariant for safeness. \underline{\underline{Hypothesizing:}} When we assume the old trees from F to satisfy the invariant for safeness for

(C, R), then they also satisfy it for (C′, R′) by Lemma 2.31(5b) because (C′, R′)

is an extension of (C, R). The new tree (i, ((Γ, ℵ), t)) satisfies the invariant for safeness because Seq(Goals({t})) = {Γ } and {Γ } (C′, R′)-reduces to {Γ } by Lemma 2.31(2). \underline{\underline{Expansion:}} When we assume the non-expanded trees to satisfy the invariant for safeness for (C, R),

then they also satisfy it for the extension (C′, R′) of (C, R) by Lemma 2.31(5b). For the

new tree (i, (Γ, t′)) we have to show that Seq(Goals({t′})) (C′, R′)-reduces to {Γ }. \underline{Claim 1:} Seq(G) (C′, R′)-reduces to \{Δ\}. \underline{Proof of Claim 1:} In case of a sequent calculus this is given by the additional requirement of safeness of the Expansion step. In case of a tableau calculus we have Seq(G) = { ΠΔ | Π ∈ M }, and the claim follows because because (π, e, A)-validity of Δ implies (π, e, A)-validity of ΠΔ. \underline{Q.e.d. (Claim 1)} \underline{Claim 2:} Seq(Goals(\{t′\})) (C′, R′)-reduces to Seq(Goals(\{t\})). \underline{Proof of Claim 2:} As Goals(\{t′\}) \ G ⊆ Goals(\{t\}), we have Seq(Goals(\{t′\})) \ Seq(G) ⊆ Seq(Goals({t′}) \ G) ⊆ Seq(Goals({t})), so that Seq(Goals({t′})) \ Seq(G) (C′, R′)-reduces to Seq(Goals({t})) by Lemma 2.31(2). Thus, by Claim 1, the claim follows by Lemma 2.31(4) due to Δ ∈ Seq(Goals(\{t\})). \underline{Q.e.d. (Claim 2)} When we assume the old tree (i, ((Γ, ℵ), t)) to satisfy the invariant for safeness for (C, R), then Seq(Goals({t})) (C′, R′)-reduces to {Γ } by Lemma 2.31(5b). By Lemma 2.31(3), together with Claim 2 this implies that Seq(Goals({t′})) (C′, R′)-reduces to {Γ }, as was to be shown. \underline{\underline{Instantiation:}} Not that here we take into account the generalization of the Instantiation rule of Defini-

tion 2.42 given by Definition B.8.

Assume any old tree (i, ((Γ, ℵ), t)) ∈ F to satisfy the invariant for safeness for (C, R), i.e. Seq(Goals({t})) (C, R)-reduces to {Γ }. Set O := D_{i} and N := dom(C) ∩ ⟨(dom(C) ∩ dom(σ)) \ O⟩R^{∗}. \underline{Claim 3:} O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, N ⊆ dom(C) \ O, and N ∩ V(Goals(Trees(⟨I⟩F)), Propos(⟨{i}∪L⟨I⟩⟩F)) = ∅. \underline{Proof of Claim 3:} Just like the proof of Claim 3 in the proof of Theorem 2.44. \underline{Q.e.d. (Claim 3)} By Lemma B.6 and Claim 3, Seq(Goals({tσ})) (C′, R′)-reduces to {Γ σ} ∪ (⟨O⟩Q_{C})σ. As the Instantiation step is safe by assumption, by Theorem 2.44 and Theorem 2.45, (⟨O⟩Q_{C})σ is (C′, R′)-valid. Thus, Seq(Goals({tσ})) (C′, R′)-reduces to {Γ σ}, as was to be shown. Q.e.d. (Theorem 2.48)

Proof of Theorem 2.49 To illustrate our techniques, we just prove the first rule of each kind to be a safe sub-rule of the Expansion rule, all other case are similar. Due to ran(G) = {ℶ}, for the α-, β-, γ-, Rewrite-, and Cut-rules, it suffices to show that, for each Σstructure A, each (A, R)-valuation e, each π that is (e, A)-compatible with (C, R), each τ : V_{δ} → A, and for δ := ϵ(π)(τ) ⊎ τ, the (δ, e, A)-validity of {Δ} is logically equivalent to (δ, e, A)-validity of Seq(G).

\underline{\underline{α-rule:}} (δ, e, A)-validity of \{Γ (A∨B) Π\} is indeed logically equivalent to (δ, e, A)-validity of

{A B Γ Π}. \underline{\underline{β-rule:}} (δ, e, A)-validity of \{Γ (A∧B) Π\} is indeed logically equivalent to (δ, e, A)-validity of

\{A Γ Π, B [ \overline{A} ] Γ Π\}. \underline{\underline{γ-rule:}} (δ, e, A)-validity of \{Γ ∃x. A Π\} is indeed logically equivalent to (δ, e, A)-validity of

{A{x↦t} Γ ∃x. A Π}. The implication from left to right is simple because the former sequent is a sub-sequent of the latter. For the other direction, assume that A{x↦t} is (δ, e, A)-valid. Let y^{δ} ∈ V_{δ}\V(A). Then, since A{x↦y^{δ}}{y^{δ}↦t} is equal to A{x↦t}, we know that A{x↦y^{δ}}{y^{δ}↦t} is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Then, by the Substitution-Lemma, A{x↦y^{δ}} is valid in A ⊎ ϵ(e)(δ) ⊎ δ′ for δ′ : V_{δ} → A given by V_{δ}\{y^{δ}}↿δ′ := _{V_{δ}\{y^{δ}}}↿δ and δ′(y^{δ}) := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t). By the standard semantical definition of ∃ (cf. e.g. Enderton (1973), p. 82) and since binding of x cannot occur in A (as ∃x. A is a formula in our restricted sense, cf. § 2.1.3), this means that ∃x. (A{x↦y^{δ}}{y^{δ}↦x}) is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Since y^{δ} does not occur in A, this formula is equal to ∃x. A, which means that the former sequent is (δ, e, A)-valid. \underline{\underline{Rewrite-rule:}} We have to show that (δ, e, A)-validity of \{Γ A[s] Π B Λ\} is logically equivalent to

(δ, e, A)-validity of {A[t] Γ Π B Λ}.

If eval(A ⊎ ϵ(e)(δ) ⊎ δ)(s) ≠ eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t), then both are (δ, e, A)-valid because B is. Note that B is of the form (s≠t) or (t≠s). Otherwise, we set a := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(s), choose some z^{δ} ∈ V_{δ}\V(A[s]), and define δ′ : V_{δ} → A by _{V_{δ}\{z^{δ}}}↿δ′ := _{V_{δ}\{z^{δ}}}↿δ and δ′(z^{δ}) := a. Then a = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t). Moreover, by the Substitution-Lemma:

eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[s])  =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[z^{δ}]{z^{δ}↦s}) =
eval(A ⊎ ϵ(e)(δ) ⊎ δ′)(A[z^{δ}])  =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[z^{δ}]{z^{δ}↦t}) =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[t]).

Note that the usual problems with variables getting captured by binders cannot occur in our context, because the unbound occurrence of variables from V_{bound} in formulas (like (s≠t)) is not permitted, cf. § 2.1.3. \underline{\underline{Cut:}} Trivial. \underline{\underline{δ-rule:}} Note that in this proof, we only use the weaker conditions on the occurrence of x^{δ} given in

Note 4. \underline{Claim 1:} (C′, R′) is an extension of (C, R). \underline{Proof of Claim 1:} Since (F, C, R, L, H) is a proof forest, C is an R-choice-condition. Moreover, C⊆C′ and R⊆R′ are trivial, because the rule says that C′′ := ∅, R′′ := V_{γδ^{+}}(A, Γ Π, ℶ) × {x^{δ} }, C′ := C ∪ C′, R′ := R ∪ R′′. Thus, we only have to show that C′ is an R′-choice-condition. As C′ = C, we only have to show that R′ is well-founded. As ran(R′′) = {x^{δ} } and as {x^{δ} } ∩ dom(R) = ∅ is required in Note 4, we have R′′∘R = ∅. As ran(R′′) ∩ dom(R′′) ⊆ V_{δ} ∩ (V_{γ} ∪ V_{δ^{+}}) = ∅, we have R′′∘R′′ = ∅. Therefore, as R is well-founded, R′ is well-founded, too. \underline{Q.e.d. (Claim 1)} Now, we have to show that

{(Γ ∀x. A Π, ℶ)} →_{C′,R′} ({(A{x↦x^{δ} } Γ Π, ℶ)}, ∅)

Let e and π be arbitrary s.t. e is an (A, R′)-valuation and π is (e, A)-compatible with (C′, R′). Assume that ((Γ ∀x. A Π, ℶ), τ) is an (π, e, A)-counterexample. Then, Γ Π is invalid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ.

\underline{Claim 2:} Γ Π is invalid in A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′ and

eval(A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′)(ℶ)

= eval(A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ)(ℶ)

for all τ′ : V_{δ} → A with _{V_{δ} \{x^{δ} }}↿τ′ = _{V_{δ} \{x^{δ} }}↿τ. \underline{Proof of Claim 2:} Otherwise, there must be some u ∈ V_{γδ^{+}}(Γ Π, ℶ) with x^{δ} S_{π} ∘ S_{e} u (the first occurrence of τ′ makes a difference) or x^{δ} S_{e} u (the second occurrence of τ′ makes a difference) or x^{δ} S_{π} u when the third occurrence of τ′ makes a difference. Note that the fourth occurrence of τ′ cannot make a difference simply because x^{δ} does not occur in V(Γ Π, ℶ) according to Note 4. Since u R′′ x^{δ} , we know that R′ ∪S_{e} ∪S_{π} is not well-founded, which contradicts π being (e, A)-compatible with (C′, R′).

Q.e.d. (Claim 2)

Now, if there is any τ′ : V_{δ} → A with _{V_{δ} \{x^{δ} }}↿τ′ = _{V_{δ} \{x^{δ} }}↿τ s.t. A{x↦x^{δ} } is invalid in A⊎ϵ(e)(ϵ(π)(τ′) ⊎ τ′)⊎ϵ(π)(τ′)⊎τ′, then due to Claim 2 ((A{x↦x^{δ} } Γ Π, ℶ), τ′) is the (π, e, A)- counterexample we are searching for. Thus, we only have to derive a contradiction from the assumption that A{x↦x^{δ} } is valid in A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′ for all τ′ : V_{δ} → A with V_{δ} \{x^{δ} }↿τ′ = _{V_{δ} \{x^{δ} }}↿τ. \underline{Claim 4:} A\{x↦x^{δ} \} is valid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ′ for all τ′ : V_{δ} → A with V_{δ} \{x^{δ} }↿τ′ = _{V_{δ} \{x^{δ} }}↿τ. \underline{Proof of Claim 4:} Otherwise there must be some u ∈ V_{γδ^{+}}(A\{x↦x^{δ} \}) with x^{δ} S_{π} ∘ S_{e} u (the first occurrence of τ makes a difference) or x^{δ} S_{e} u (the second occurrence of τ makes a difference) or x^{δ} S_{π} u when the third occurrence of τ makes a difference. Since u R′′ x^{δ} , we know that R′∪S_{e}∪S_{π} is not well-founded, which contradicts π being (e, A)-compatible with (C′, R′). \underline{Q.e.d. (Claim 4)} By the standard semantical definition of ∀ (cf. e.g. Enderton (1973), p. 82) and since binding of x cannot occur in A (as ∀x. A is a formula in our restricted sense, cf. § 2.1.3), Claim 4 means that ∀x. (A{x↦x^{δ} }{x^{δ} ↦x}) is valid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ, i.e. (ϵ(π)(τ) ⊎ τ, e, A)-valid. Since x^{δ} does not occur in A according to Note 4, this formula is equal to ∀x. A, which contradicts ((Γ ∀x. A Π, ℶ), τ) being an (π, e, A)-counterexample. Finally, for the safeness proof, assume that Γ ∀x. A Π is (π, e, A)-valid. For arbitrary τ : V_{δ} → A we have to show that A{x↦x^{δ} } Γ Π is (δ, e, A)-valid for δ := ϵ(π)(τ)⊎τ. If some formula in Γ Π is (δ, e, A)-valid, then the latter sequent is (δ, e, A)-valid, too. Otherwise, ∀x. A is (δ, e, A)-valid. Then, by the standard semantical definition of ∀, A{x↦x^{δ} } is (δ, e, A)-valid, too, as was to be shown. \underline{\underline{Liberalized δ-rule:}} Note that in this proof, we only use the weaker conditions on the occurrence of x^{δ^{+}}

given in Note 5.

\underline{Claim 5:} (C′, R′) is an extension of (C, R). \underline{Proof of Claim 5:} Since (F, C, R, L, H) is a proof forest, C is an R-choice-condition. Moreover, C⊆C′ and R⊆R′ are trivial, because the rule says that C′′ := \{(x^{δ^{+}}, \overline{A\{x↦x^{δ^{+}}\}})\}, R′′ := V_{free}(A) × {x^{δ^{+}}}, C′ := C ∪ C′, R′ := R ∪ R′′. Thus, we only have to show that C′ is an R′-choice-condition. As x^{δ^{+}} ∈ V_{δ^{+}}\dom(C) by Note 5, C′ is a partial function on V_{δ^{+}}, too. As ran(R′′) = {x^{δ^{+}}} and as {x^{δ^{+}}} ∩ dom(R) = ∅ by Note 5, we have R′′∘R = ∅. As ran(R′′) ∩ dom(R′′) = {x^{δ^{+}}} ∩ V_{free}(A) = {x^{δ^{+}}} ∩ V(A) = ∅ by Note 5, we have R′′∘R′′ = ∅. Therefore, as R is wellfounded, R′ is a well-founded, too. Moreover, for y^{δ^{+}} ∈ dom(C′), we either have y^{δ^{+}} ∈ dom(C) and then V_{free}(C′(y^{δ^{+}})) × {y^{δ^{+}}} = V_{free}(C(y^{δ^{+}})) × {y^{δ^{+}}} ⊆ R^{∗} ⊆ R′^{∗}, or y^{δ^{+}} = x^{δ^{+}} and then V_{free}(C′(y^{δ^{+}})) × {y^{δ^{+}}} = V_{free}(A{x↦x^{δ^{+}}}) × {x^{δ^{+}}} ⊆ (V_{free}(A) ∪ {x^{δ^{+}}}) × {x^{δ^{+}}} ⊆ R′′^{∗} ⊆ R′^{∗}.

Q.e.d. (Claim 5)

Now, due to ran(G) = {ℶ}, it suffices to show that, for each Σ-structure A, each (A, R′)-valuation e, each π that is (e, A)-compatible with (C′, R′), each τ : V_{δ} → A, and for δ := ϵ(π)(τ)⊎τ, the (δ, e, A)- validity of

Γ ∀x. A Π is logically equivalent to (δ, e, A)-validity of A{x↦x^{δ^{+}}} Γ Π.

For the soundness direction, we have to show that the former sequent is (δ, e, A)-valid under the assumption that the latter is. If some formula in Γ Π is (δ, e, A)-valid, then the former sequent is (δ, e, A)- valid, too. Otherwise, this means that A{x↦x^{δ^{+}}} is (δ, e, A)-valid. Since π is (e, A)-compatible with (C′, R′), by Item 2 Definition 2.23, we know that A{x↦x^{δ^{+}}} is (δ′, e, A)-valid for all δ′ : V_{δ} → A with _{V_{δ}\{x^{δ^{+}}}}↿δ′ = _{V_{δ}\{x^{δ^{+}}}}↿δ. This means that A{x↦x^{δ^{+}}} is valid in A ⊎ ϵ(e)(δ′) ⊎ δ′ for all δ′ : V_{δ} → A with _{V_{δ}\{x^{δ^{+}}}}↿δ′ = _{V_{δ}\{x^{δ^{+}}}}↿δ. \underline{Claim 6:} A\{x↦x^{δ^{+}}\} is valid in A ⊎ ϵ(e)(δ) ⊎ δ′ for all δ′ : V_{δ} → A with_{V_{δ}\\{x^{δ^{+}}\}}↿δ′ =_{V_{δ}\\{x^{δ^{+}}\}}↿δ. \underline{Proof of Claim 6:} Otherwise we have x^{δ^{+}}S_{e}u^{γ} for some u^{γ} ∈ V_{γ}(A\{x↦x^{δ^{+}}\}). But then u^{γ} ∈ V_{free}(A) and then u^{γ}R′′x^{δ^{+}}. This means that R′ ∪ S_{e} is not well-founded, which contradicts e being an (A, R′)- valuation. \underline{Q.e.d. (Claim 6)} By the standard semantical definition of ∀ (cf. e.g. Enderton (1973), p. 82) and since binding of x cannot occur in A (as ∀x. A is a formula in our restricted sense, cf. § 2.1.3), Claim 6 means that ∀x. (A{x↦x^{δ^{+}}}{x^{δ^{+}}↦x}) is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Since x^{δ^{+}} does not occur in A by Note 5, this formula is equal to ∀x. A, which means that the former sequent is (δ, e, A)-valid as was to be shown. For the safeness direction, we have to show that the latter sequent is (δ, e, A)-valid under the assumption that the former is. If some formula in Γ Π is (δ, e, A)-valid, then the latter sequent is (δ, e, A)-valid, too. Otherwise, ∀x. A is (δ, e, A)-valid. Then, by the standard semantical definition of ∀, A{x↦x^{δ^{+}}} is (δ, e, A)-valid, too, as was to be shown. Q.e.d. (Theorem 2.49)

Proof of Theorem 2.51 Let G := { (ΠΔ, ℶ) | Π ∈ M } as in the Expansion rule in tableau trees. According to Definition 2.42 we have to show

{(Δ, ℶ)} → ↓ _{C′,R′} ({(Φ, ℸ)}, G, ∅)

in case of “induction hypothesis application” and

{(Δ, ℶ)} → ↓ _{C′,R′} (∅, G, {(Φ, ℸ)})

in case of “lemma application”. According to Definition 2.36 and Definition 2.35 and due to ran(G) = {ℶ}, it is sufficient to show that, for A ∈ K, e an (A, R′)-valuation, and π (e, A)-compatible with (C′, R′), for any (π, e, A)-counterexample ((Δ, ℶ), τ), under the assumption that Seq(G) is (δ, e, A)-valid for δ := ϵ(π)(τ) ⊎ τ, there is an (π, e, A)-counterexample ((Φ, ℸ), τ′) such that, for ⊲ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<), ⊲ ∼ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲), w̄ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w), δ′ := ϵ(π)(τ′) ⊎ τ′, we have (in case of hypothesis application only):

⊲ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′),

⊲ ∼ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′),
eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(w′) ⊲ w̄,

and ⊲ ∘ ⊲ ∼ ⊆ ⊲^{+} and ⊲ is well-founded.

Since, for all Π ∈ M, ΠΔ ∈ Seq(G) is assumed to be (δ, e, A)-valid whereas Δ is assumed to be not, we know that M is (δ, e, A)-valid. By the definition of M, this means that Φϱ is not (δ, e, A)-valid (due to (1)) and (in case of hypothesis application only):

⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ) (due to (4)), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ) (due to (5)), eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w′ϱ) ⊲ w̄ (due to (2)),

and ⊲ ∘ ⊲ ∼ ⊆ ⊲^{+} (due to (6)), and ⊲ is well-founded (due to (3)). To complete the proof, we have to get rid of the ϱ here by stepping from δ to δ′ given by some appropriate τ′ as indicated above.

Define τ′(y^{δ} ) := \{ \begin{matrix}eval(A ⊎ ϵ(e)(δ) ⊎ δ)(ϱ(y^{δ} )) & for y^{δ} ∈ Y \\ τ(y^{δ} ) & for y^{δ} ∈ V_{δ} \Y \end{matrix} \}.

\underline{Claim 1:} For v^{δ^{+}} ∈ V_{δ^{+}}(Φ, ℸ) we have ϵ(π)(τ)(v^{δ^{+}}) = ϵ(π)(τ′)(v^{δ^{+}}). \underline{Proof of Claim 1:} Otherwise there must be some y^{δ} ∈ Y with y^{δ} S_{π} v^{δ^{+}}. Since v^{δ^{+}} ∈ V_{δ^{+}}(Φ, ℸ) we have v^{δ^{+}} R′ y^{δ} by definition of Y. But then R′ ∪ S_{e} ∪ S_{π} is not well-founded, which contradicts π being (e, A)-compatible with (C′, R′). \underline{Q.e.d. (Claim 1)} \underline{Claim 3:} For x^{γ} ∈ V_{γ}(Φ, ℸ) we have ϵ(e)(δ)(x^{γ}) = ϵ(e)(δ′)(x^{γ}). \underline{Proof of Claim 3:} Otherwise we have ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{γ}) ≠ ϵ(e)(ϵ(π)(τ′) ⊎ τ′)(x^{γ}). Then there must be some y^{δ} ∈ Y with y^{δ} S_{π} ∘ S_{e} x^{γ} (i.e. the first occurrence of τ′ makes a difference) or y^{δ} S_{e} x^{γ} when the second occurrence of τ′ makes a difference. Since x^{γ} ∈ V_{γ}(Φ, ℸ) we have x^{γ} R′ y^{δ} by definition of Y. But then R′ ∪ S_{e} ∪ S_{π} is not well-founded, which contradicts π being (e, A)- compatible with (C′, R′). \underline{Q.e.d. (Claim 3)} The respective values of Φ, w′, <′, and ≲′ under eval(A ⊎ ϵ(e)(δ′) ⊎ δ′) are the same as the values of Φ, w′, <′, and ≲′ under eval(A ⊎ ϵ(e)(δ) ⊎ ϵ(π)(τ) ⊎ τ′) by definition of δ′, Claim 1, Claim 3, and the Explicitness-Lemma, which again are the same as the values of Φϱ, w′ϱ, <′ϱ, and ≲′ϱ under eval(A ⊎ ϵ(e)(δ) ⊎ δ) by the Substitution-Lemma and the definition of δ. Thus, due to Φϱ not being (δ, e, A)-valid, ((Φ, ℸ), τ′) is an (π, e, A)-counterexample with (in case of hypothesis application only):

⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ) = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′),

⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ) = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′),
eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(w′) = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w′ϱ) ⊲ w̄.

Q.e.d. (Theorem 2.51)

Proof of Lemma B.1 Here we denote concatenation (product) of relations ‘∘’ simply by juxtaposition and assume it to have higher priority than any other binary operator. \underline{\underline{(1):}} When e is an (A, R′)-valuation, R′ ∪ S_{e} is well-founded. In case of R⊆R′, we have R ∪ S_{e} ⊆

R′ ∪ S_{e} and R ∪ S_{e} is well-founded, too. \underline{\underline{(2):}} Set σ′ := _{V_{γ}\dom(σ)}↿id ∪ _{V_{γ}}↿σ. Let e′ be an (A, R′)-valuation. Define S_{e} :=

S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}} and the (A, R)-valuation e by (x ∈ V_{γ}, τ′ : S_{e}⟨{x}⟩ → A): e(x)(τ′) := eval(A ⊎ ϵ(e′)(τ) ⊎ τ)(σ′(x)) where τ : V_{δ} → A is an arbitrary extension of τ′. For this definition to be okay, we have to prove the following claims: \underline{Claim 1:} For x ∈ V_{γ}, y ∈ V_{δ}(σ′(x)), the choice of τ ⊇ τ′ does not influence the value of τ(y). \underline{Claim 2:} For x ∈ V_{γ}, x′ ∈ V_{γ}(σ′(x)), the choice of τ ⊇ τ′ does not influence the value of ϵ(e′)(τ)(x′). \underline{Claim 3:} R ∪ S_{e} is well-founded.

\underline{Proof of Claim 1:} y ∈ V_{δ}(σ′(x)) means (y, x) ∈ Δ_{σ}↾_{V_{γ}}. By definition of S_{e} we have (y, x) ∈ S_{e}, i.e. y ∈ S_{e}⟨\{x\}⟩ = dom(τ′). \underline{Q.e.d. (Claim 1)} \underline{Proof of Claim 2:} x′ ∈ V_{γ}(σ′(x)) means (x′, x) ∈ _{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}} . Thus by definition of S_{e} we have S_{e′}{(x′, x)} ⊆ S_{e}, i.e. S_{e′}⟨{x′}⟩ ⊆ S_{e}⟨{x}⟩ = dom(τ′). Therefore ϵ(e′)(τ)(x′) = e′(x′)(_{S_{e′} ⟨\{x′\}⟩}↿τ) = e′(x′)(_{S_{e′} ⟨\{x′\}⟩}↿τ′). \underline{Q.e.d. (Claim 2)} \underline{Proof of Claim 3:} R′ ∪ S_{e′} is well-founded because e′ is an (A, R′)-valuation. Moreover, as R′ is the σ-update of R, we have^{28} R′ = R ∪ Γ_{σ} ∪ Δ_{σ}. Thus, (R ∪ Γ_{σ} ∪ Δ_{σ} ∪ S_{e′})^{+} is a well-founded ordering, just like its subset (R ∪ S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}})^{+}, which is equal to (R ∪ S_{e})^{+}.

Q.e.d. (Claim 3)

Now, for τ : V_{δ} → A and x ∈ V_{γ} we have

ϵ(e)(τ)(x) = e(x)(_{S_{e}⟨{x}⟩}↿τ) = eval(A ⊎ ϵ(e′)(τ) ⊎ τ)(σ′(x)),

i.e. ϵ(e)(τ) = σ′ ∘ eval(A ⊎ ϵ(e′)(τ) ⊎ τ). \underline{\underline{(3):}} Set σ′ := _{V_{γ}\dom(σ)}↿id ∪_{V_{γ}}↿σ.

Define S_{e} := (S_{π′} ∪_{V_{δ}} ↿id)(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}) and the (A, R)-valuation e by (x ∈ V_{γ}, τ′ : S_{e}⟨{x}⟩ → A):

e(x)(τ′) := eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(σ′(x))

where τ : V_{δ} → A is an arbitrary extension of τ′. For this definition to be okay, we have to prove the following claims: \underline{Claim 4:} For x ∈ V_{γ} and y ∈ V(σ′(x)), the choice of τ ⊇ τ′ does not influence:

(a) In case of y ∈ V_{δ} , the value of τ(y).

(b) In case of y ∈ V_{δ^{+}}, the value of ϵ(π′)(τ)(y).

(c) In case of y ∈ V_{γ}, the value of ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(y).

\underline{Claim 5:} R ∪ S_{e} ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}} is well-founded. \underline{Proof of Claim 4a:} y ∈ V_{δ} (σ′(x)) means (y, x) ∈ _{V_{δ}} ↿Δ_{σ}↾_{V_{γ}}. By definition of S_{e} we have (y, x) ∈ S_{e}, i.e. y ∈ S_{e}⟨\{x\}⟩ = dom(τ′). \underline{Q.e.d. (Claim 4a)} \underline{Proof of Claim 4b:} y ∈ V_{δ^{+}}(σ′(x)) means (y, x) ∈ Δ_{σ}↾_{V_{γ}}. Thus by definition of S_{e} we have S_{π′}{(y, x)} ⊆ S_{e}, i.e. S_{π′}⟨{y}⟩ ⊆ S_{e}⟨{x}⟩ = dom(τ′). Therefore ϵ(π′)(τ)(y) = π′(y)(_{S_{π′} ⟨{y}⟩}↿τ) = π′(y)(_{S_{π′} ⟨\{y\}⟩}↿τ′). \underline{Q.e.d. (Claim 4b)} \underline{Proof of Claim 4c:} y ∈ V_{γ}(σ′(x)) means (y, x) ∈ _{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}. If the value of ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(y) = e′(y)(_{S_{e′} ⟨{y}⟩}↿(ϵ(π′)(τ) ⊎ τ)) depended on the choice of τ ⊇ τ′, then there would be some z ∈ S_{e′}⟨{y}⟩ with (S_{π′} ∪_{V_{δ}} ↿id)⟨{z}⟩ ⊈ dom(τ′), which is contradictory to (S_{π′} ∪_{V_{δ}} ↿id)⟨{z}⟩ ⊆ ((S_{π′} ∪_{V_{δ}} ↿id)S_{e′})⟨{y}⟩ ⊆ ((S_{π′} ∪_{V_{δ}} ↿id)S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}))⟨{x}⟩ ⊆ S_{e}⟨\{x\}⟩ = dom(τ′). \underline{Q.e.d. (Claim 4c)} \underline{Proof of Claim 5:} R′ ∪ S_{e′} ∪ S_{π′} is well-founded because π′ is (e′, A)-compatible with (C′, R′). Moreover, as R′ is the σ-update of R, we have^{29} R′ = R ∪ Γ_{σ} ∪ Δ_{σ}. Thus, R ∪ Γ_{σ} ∪ Δ_{σ} ∪ R′ ∪ S_{e′} ∪ S_{π′} is well-founded, just like the subset

R ∪ (S_{π′} ∪_{V_{δ}} ↿id)(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}) ∪ _{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}} of its transitive closure, which is again equal to R ∪ S_{e} ∪_{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}}. \underline{Q.e.d. (Claim 5)}

Q.e.d. (Lemma B.1)

Proof of Lemma B.5 Assuming σ, C, R, C′, R′, O, N, A, e′, π′ as described in the lemma, we set A := (V_{δ^{+}} ∩ dom(σ)) \ (N⊎O). As σ is a substitution on V_{γ} ∪ V_{δ^{+}}, we have V_{δ} ∩ dom(σ) ⊆ N⊎O⊎A ⊆ V_{δ^{+}}. This leaves us in the following situation:

⟵V_{δ^{+}}⟶ ⟵V_{γ}⟶
⟵dom(C)⟶  ⋮
⟵dom(σ)⟶
⟵N⟶ ⟵O⟶ ⟵A⟶

Note that C′ is an R′-choice-condition due to Lemma 2.22. As π′ is (e′, A)-compatible with (C′, R′),

⊲ := (R′ ∪ S_{e′} ∪ S_{π′})^{+}

is a well-founded ordering. Let e be the (A, R)-valuation given by Lemma B.1(3) for e′. Then

S_{e} = (S_{π′} ∪_{V_{δ}} ↿id) ∘ (S_{e′} ∘ (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}) (B.5.1)

and for all δ : V_{δ} → A and τ := _{V_{δ}} ↿δ: ϵ(e)(δ) = (_{V_{γ}\dom(σ)}↿id ∪_{V_{γ}}↿σ) ∘ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ) (B.5.2) and

R ∪ S_{e} ∪ _{V_{δ}}↿⊲↾_{V_{δ}} is well-founded. (B.5.3)

\underline{Claim 1:} For any term or formula B (possibly with some unbound occurrences of variables from a set W ⊆ V_{bound}) and any τ : V_{δ} → A, χ : W → A, and δ, δ′, δ̄′ : V_{δ} → A with _{V_{δ}} ↿δ = τ, V_{δ}(⟨V_{γ}(B)⟩σ)↿δ̄′ = _{V_{δ}(⟨V_{γ}(B)⟩σ)}↿δ′, δ′ = ϵ(π′)(τ) ⊎ τ:

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ)(Bσ)

= eval(A ⊎ ϵ(e)(δ) ⊎_{V_{δ}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎_{V\dom(σ)}↿δ̄′ ⊎ χ)(B).

\underline{Proof of Claim 1:} eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ)(Bσ) = (by the Substitution-Lemma) eval(A ⊎ (_{V\dom(σ)}↿id ⊎ σ) ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ))(B) =

(by the Explicitness-Lemma: as the variables of W do not occur free in ran(σ) and by_{V_{δ}(⟨V_{γ}(B)⟩σ)}↿δ̄′ = _{V_{δ}(⟨V_{γ}(B)⟩σ)}↿δ′)

eval( \begin{matrix}& A \\ ⊎ & (_{V_{γ}\dom(σ)}↿id ⊎_{V_{γ}}↿σ) ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) \\ ⊎ & _{V_{δ}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) \\ ⊎ & _{V\dom(σ)}↿δ̄′ ⊎ χ \end{matrix} )( B ) =

(by (B.5.2),_{V_{δ}} ↿δ = τ, and δ′ = ϵ(π′)(τ) ⊎ τ)

eval(A ⊎ ϵ(e)(δ) ⊎_{V_{δ}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎_{V\dom(σ)}↿δ̄′ ⊎ χ)(B). \underline{Q.e.d. (Claim 1)} \underline{Claim 2:} _{V_{δ}}↿(R^{+}) ⊆ ⊲, Δ_{σ}∘R^{+} ⊆ ⊲, and S_{e}∘R^{+} ⊆ ⊲. \underline{Proof of Claim 2:} As R′ is the σ-update of R, we have^{30} R′ = R ∪ Γ_{σ} ∪ Δ_{σ}. Thus, the first two statements of Claim 2 are trivial by definition of ⊲ and the third follows from (B.5.1). \underline{Q.e.d. (Claim 2)} Set S_{π} := ⊲ ∩ (V_{δ} ×V_{δ^{+}}). \underline{Claim 3:} R ∪ S_{e} ∪ S_{π} is well-founded. \underline{Proof of Claim 3:} This follows from (B.5.3). \underline{Q.e.d. (Claim 3)} The idea for the definition of the π we have to find is—roughly speaking—as follows: For y^{δ^{+}} ∉ N⊎O⊎A we take π(y^{δ^{+}}) to be π′(y^{δ^{+}}). For y^{δ^{+}} ∈ O we evaluate σ(y^{δ^{+}}) in (π′, e′, A) because we know that (⟨O⟩Q_{C})σ is valid there by assumption of the lemma. For y^{δ^{+}} ∈ A we take the same because this case is unproblematic. For y^{δ^{+}} ∈ N, however, we have to take care of (e, A)-compatibility with (C, R) explicitly in an ⊲-recursive definition. Let π be defined by (y^{δ^{+}} ∈ V_{δ^{+}}, τ : V_{δ} → A)

π(y^{δ^{+}})(_{S_{π}⟨\{y^{δ^{+}}\}⟩}↿τ) := \{ \begin{matrix}f & if y^{δ^{+}} ∈ N \\ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(σ(y^{δ^{+}})) & if y^{δ^{+}} ∈ O⊎A \\ π′(y^{δ^{+}})(_{S_{π′} ⟨\{y^{δ^{+}}\}⟩}↿τ) & otherwise \end{matrix}

where (for details cf. the proof of Lemma 2.24) f is chosen s.t., for C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B for a formula B, and for any χ : {v_{0}, …, v_{l−1}} → A

B becomes—if possible— (_{V_{δ^{+}}\{y^{δ^{+}}}}↿(ϵ(π)(τ)) ⊎ {y^{δ^{+}}↦f} ⊎ τ ⊎ χ, e, A)-valid.

Note that this definition is okay because the only part of τ that is relevant on the right-hand side is S_{π}⟨{y^{δ^{+}}}⟩↿τ (we have (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}} ⊆ R′ due to R′ being the σ-update of R) and because it is recursive in ⊲; indeed, for x^{γ} ∈ V_{γ}(C(y^{δ^{+}})) we have x^{γ} R^{+} y^{δ^{+}} (as C is an R-choice-condition) and then for v^{δ} S_{e} x^{γ} we have v^{δ} ⊲ y^{δ^{+}} by Claim 2, and for z^{δ} ∈ V_{δ}(C(y^{δ^{+}}))\{y^{δ^{+}}} we have z^{δ} R^{+} y^{δ^{+}} and then z^{δ} ⊲ y^{δ^{+}} by Claim 2. \underline{Claim 4:} For all y^{δ^{+}} ∈ O⊎A and τ : V_{δ} → A, when we set δ′ := ϵ(π′)(τ) ⊎ τ:

ϵ(π)(τ)(y^{δ^{+}}) = eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′)(σ(y^{δ^{+}})).

\underline{Proof of Claim 4:} Immediately by the definition of π. \underline{Q.e.d. (Claim 4)} \underline{Claim 5:} For all y^{δ^{+}} ∈ V_{δ^{+}}\(N⊎O⊎A) and τ : V_{δ} → A: ϵ(π)(τ)(y^{δ^{+}}) = ϵ(π′)(τ)(y^{δ^{+}}). \underline{Proof of Claim 5:} Immediately by the definition of π. \underline{Q.e.d. (Claim 5)} \underline{Claim 6:} For any term or formula B (possibly with some unbound occurrences of variables from a set W ⊆ V_{bound}) with N∩V(B) = ∅, and for any τ : V_{δ} → A and χ : W → A, when we set δ := ϵ(π)(τ) ⊎ τ and δ′ := ϵ(π′)(τ) ⊎ τ, we have

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B).

\underline{Proof of Claim 6:} eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = (by Claim 1) eval(A ⊎ ϵ(e)(δ) ⊎_{V_{δ}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) ⊎_{V\dom(σ)}↿δ′ ⊎ χ)(B) =

(by O⊎A ⊆ V_{δ} ∩ dom(σ) ⊆ N⊎O⊎A and N∩V(B) = ∅)

eval(A ⊎ ϵ(e)(δ) ⊎_{O⊎A}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) ⊎_{V\(N⊎O⊎A)}↿δ′ ⊎ χ)(B) =

(by Claim 4 and Claim 5)

eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B). \underline{Q.e.d. (Claim 6)} \underline{Claim 7:} For any set of sequents G′ (possibly with some unbound occurrences of variables from a set W ⊆ V_{bound}) with N∩V(G′) = ∅, and for any τ : (V_{δ} ∪ W) → A: (ϵ(π)(τ) ⊎ τ, e, A)-validity of G′ is logically equivalent to (ϵ(π′)(τ) ⊎ τ, e′, A)-validity of G′σ. \underline{Proof of Claim 7:} This is a trivial consequence of Claim 6. \underline{Q.e.d. (Claim 7)} \underline{Claim 8:} For y^{δ^{+}} ∈ dom(C) \ N we have N ∩ V(C(y^{δ^{+}})) = ∅. \underline{Proof of Claim 8:} Otherwise there is some z^{δ^{+}} ∈ N∩V(C(y^{δ^{+}})), but then z^{δ^{+}} R^{∗} y^{δ^{+}} as C is an Rchoice-condition, and then, as dom(C) ∩ ⟨N⟩R^{+} ⊆ N, we have the contradicting y^{δ^{+}} ∈ N.

Q.e.d. (Claim 8)

\underline{\underline{Claim 9:}} Let y^{δ^{+}} ∈ dom(C) and C(y^{δ^{+}}) = λv_{0}…. λv_{l−1}. B. Let τ : V_{δ} → A and

χ : {v_{0}, …, v_{l−1}} → A and suppose that, for some η : {y^{δ^{+}}} → A , B is (δ̄, e, A)-valid for δ̄:= _{V_{δ^{+}}\{y^{δ^{+}}}}↿(ϵ(π)(τ)) ⊎ η ⊎ τ ⊎ χ. Now: B is (δ, e, A)-valid for δ := ϵ(π)(τ) ⊎ τ ⊎ χ.

\underline{\underline{Proof of Claim 9:}} Set δ̄′ := _{V_{δ^{+}}\\{y^{δ^{+}}\}}↿(ϵ(π′)(τ)) ⊎ η ⊎ τ ⊎ χ and δ′ := ϵ(π′)(τ) ⊎ τ ⊎ χ. \underline{y^{δ^{+}} ∉ O⊎N:} In this case, we have y^{δ^{+}} ∉ dom(σ) because of dom(C) ∩ dom(σ) ⊆ O⊎N. Thus, as

(C′, R′) is the extended σ-update of (C, R), we have C′(y^{δ^{+}}) = (C(y^{δ^{+}}))σ. By Claim 8

we have N∩V(B) = ∅. For later application of Claim 1, note that _{V_{δ}(⟨V_{γ}(B)⟩σ)}↿δ̄′ = _{V_{δ}(⟨V_{γ}(B)⟩σ)}↿δ′; otherwise there would be some x^{γ} ∈ V_{γ}(B) = V_{γ}(C(y^{δ^{+}})) with y^{δ^{+}} Δ_{σ} x^{γ}, and then, as C is an R-choice-condition, y^{δ^{+}} Δ_{σ} x^{γ} R^{+} y^{δ^{+}}, and then, by Claim 2, y^{δ^{+}} ⊲ y^{δ^{+}}, which contradicts the wellfoundedness of ⊲. Note that _{V_{δ^{+}}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) = _{V_{δ^{+}}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′); otherwise there would be some z^{δ^{+}} ∈ V_{δ^{+}}(C(y^{δ^{+}})) with y^{δ^{+}} ∈ V(σ(z^{δ^{+}})), which implies y^{δ^{+}} R′ z^{δ^{+}} R^{∗} y^{δ^{+}} (as R′ is the σ-update of R and C is an R-choice-condition), and then, by Claim 2, y^{δ^{+}}⊲z^{δ^{+}}⊴y^{δ^{+}}, which contradicts the well-foundedness of ⊲. Moreover: V(B)↿δ̄ = (due to y^{δ^{+}} ∉ dom(σ), N ∪ (dom(σ) ∩ V_{δ}) = N⊎O⊎A, N∩V(B) = ∅, Claim 5) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{δ^{+}}(B)}↿(ϵ(π)(τ)) = (by Claim 4) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{δ^{+}}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) = (cf. above) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{δ^{+}}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′). Now: TRUE = (by assumption of Claim 9) eval(A ⊎ ϵ(e)(δ̄) ⊎ δ̄)(B) = (by the above and dom(σ) ∩ V_{δ}(B) = (O⊎A) ∩ V_{δ^{+}}(B)) eval(A ⊎ ϵ(e)(δ̄) ⊎ _{V_{δ}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎ _{V\dom(σ)}↿δ̄′)(B) =

(by Claim 1 instantiated with the substitution {δ↦δ̄})

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′)(Bσ) = (as otherwise for some x^{γ} ∈ V_{γ}(Bσ) = V_{γ}(C′(y^{δ^{+}}))

we have y^{δ^{+}} S_{e′} x^{γ} R′^{+} y^{δ^{+}}, i.e. y^{δ^{+}}⊲y^{δ^{+}})

eval(A ⊎ ϵ(e′)(δ̄′) ⊎ δ̄′)(Bσ). As π′ is (e′, A)-compatible with (C′, R′), we know that Bσ is (δ′, e′, A)-valid. Thus, by Claim 7, B is (δ, e, A)-valid. \underline{y^{δ^{+}} ∈ O:} N∩V(B) = ∅ by Claim 8. Let y ∈ V_{bound}\V(C(y^{δ^{+}})) and D be the formula

∃y. (B{y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}) ↦ y})

s.t. Q_{C}(y^{δ^{+}}) is equal to ∀v_{0}…. ∀v_{l−1}. (D ⇒ B). We have N∩V(D) = ∅. As B is valid in A⊎ϵ(e)(δ̄)⊎δ̄, for w^{δ} ∈ V_{δ}\V(B) and w̄ := eval(A ⊎ ϵ(e)(δ̄) ⊎ δ̄)(y^{δ^{+}}(v_{0}) ⋯ (v_{l−1})) we have

TRUE = eval(A ⊎ ϵ(e)(δ̄) ⊎ δ̄)(B{y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}) ↦ w^{δ}}{w^{δ} ↦ y^{δ^{+}}(v_{0}) ⋯ (v_{l−1})})
= eval(A ⊎ ϵ(e)(δ̄) ⊎ _{V\{w^{δ}}}↿δ̄ ⊎ {w^{δ}↦w̄})(B{y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}) ↦ w^{δ}})

by the Substitution-Lemma. Thus, by the standard semantical definition of ∃ (cf. e.g. Enderton (1973), p. 82), D is valid in A ⊎ ϵ(e)(δ̄) ⊎ δ̄, too; and then (as y^{δ^{+}} does not occur in D anymore (as all occurrences of y^{δ^{+}} in B are of the form y^{δ^{+}}(v_{0}) ⋯ (v_{l−1}) according to Definition B.2)) also valid in A ⊎ ϵ(e)(δ̄) ⊎ δ. Moreover, D is even valid in A ⊎ ϵ(e)(δ) ⊎ δ; otherwise there would be some v^{γ} ∈ V_{γ}(D) with y^{δ^{+}} S_{e} v^{γ}, but then v^{γ} ∈ V(C(y^{δ^{+}}))\{y^{δ^{+}}} and (as C is an R-choice-condition) v^{γ} R^{+} y^{δ^{+}}, which contradicts the well-foundedness of R ∪ S_{e}, which contradicts e being an (A, R)- valuation. By Claim 7, Dσ is (δ′, e′, A)-valid. But by assumption of the lemma on (⟨O⟩Q_{C})σ and by the standard definition of ∀, we know that (D ⇒ B)σ is (δ′, e′, A)-valid. Thus, Bσ is (δ′, e′, A)-valid. By Claim 7, B is (δ, e, A)-valid. \underline{y^{δ^{+}} ∈ N:} By definition of π. \underline{\underline{Q.e.d. (Claim 9)}}

By Claim 3 and Claim 9, π is (e, A)-compatible with (C, R), and then items 1 and 2 of the lemma are trivial consequences of Claim 6, Claim 7, resp.. Q.e.d. (Lemma B.5)

Proof of Lemma B.6 \underline{(1):} As G_{0}σ ∪ (⟨O⟩Q_{C})σ is (C′, R′)-valid in A, there is an (A, R′)-valuation e′ and some π′ s.t. π′ is

(e′, A)-compatible with (C′, R′) and G_{0}σ ∪ (⟨O⟩Q_{C})σ is (π′, e′, A)-valid. Let e and π be given as in Lemma B.5. Then G_{0} is (π, e, A)-valid. Moreover, as π is (e, A)-compatible with (R, C) and as e is an (A, R)-valuation, G_{0} is (C, R)-valid in A. \underline{(2):} Let e′ be an (A, R′)-valuation, π′ be (e′, A)-compatible with (C′, R′), and suppose that G_{1}σ ∪

(⟨O⟩Q_{C})σ is (π′, e′, A)-valid. Let π and the (A, R)-valuation e be given as in Lemma B.5. Then π is (e, A)-compatible with (C, R), and G_{1} is (π, e, A)-valid. By assumption, G_{0} (C, R)-reduces to G_{1}. Thus, G_{0} is (π, e, A)-valid, too. By Lemma B.5(2), this means that G_{0}σ is (π′, e′, A)-valid as was to be shown. Q.e.d. (Lemma B.6)

Proof of Lemma B.7 Let A ∈ K, let e′ be an (A, R′)-valuation, and π′ be (e′, A)-compatible with (C′, R′). Let (Γ, (w, <, ≲)) ∈ G_{0} and assume that ((Γ σ, (wσ, <σ, ≲σ)), τ) is an (π′, e′, A)-counterexample. Assuming that there is no (π′, e′, A)-counterexample of L_{1}σ ∪ L_{2}, we have to find some (π′, e′, A)-counterexample ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) with (Γ′, (w′, <′, ≲′)) ∈ G_{1}, s.t. ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) is (π′, e′, A)-smaller than ((Γ σ, (wσ, <σ, ≲σ)), τ). By our assumption on no (π′, e′, A)-counterexamples of L_{2}, we can apply Lemma B.5 to get a an (A, R)-valua-tion e and a π that is (e, A)-compatible with (C, R). Moreover, by this lemma, ((Γ, (w, <, ≲)), τ) is an (π, e, A)-counterexample. By assumption, G_{0} →_{C,R} (G_{1}, L_{1}). Thus, there is some (π, e, A)- counterexample ((Γ′, (w′, <′, ≲′)), τ′) with (Γ′, (w′, <′, ≲′)) ∈ L_{1} or both (Γ′, (w′, <′, ≲′)) ∈ G_{1} and ((Γ′, (w′, <′, ≲′)), τ′) is (π, e, A)-smaller than ((Γ, (w, <, ≲)), τ). By Lemma B.5(2), ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) is an (π′, e′, A)-counterexample, and by our assumption on L_{1}σ, we then have (Γ′, (w′, <′, ≲′)) ∈ G_{1} and ((Γ′, (w′, <′, ≲′)), τ′) is (π, e, A)-smaller than ((Γ, (w, <, ≲)), τ). We only have left to show that ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) is (π′, e′, A)-smaller than ((Γ σ, (wσ, <σ, ≲σ)), τ). This is nearly implied by Lemma B.5(1); the only problem is that <, ≲, <′, ≲′ are possibly no terms (so that the B of Lemma B.5(1) cannot be instantiated with them). Thus, for arbitrary τ : V_{δ} → A and δ and δ′ given as in Lemma B.5(1), we still have to prove say eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′)(<σ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<). After expanding the shorthand on both sides for some distinct x, y ∈ V_{bound}\V(<, dom(σ), ran(σ)), this follows from eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ {x↦a, y↦b})(x (<σ) y) = (as x, y ∉ dom(σ)) eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ {x↦a, y↦b})((x < y)σ) = (due to Lemma B.5.1) eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ {x↦a, y↦b})(x < y). Q.e.d. (Lemma B.7)

D Notes

Note 1: This step is actually superfluous because we can simply take the class of all counterexamples for a contradiction. But at this early stage, we want to be independent of the two alternative notions of well-foundedness as discussed in § 2.1.2.

Note 2: For inductive theorem proving, however, Sergey Yu. Maslov’s inversion technique (cf. Maslov (1971)) (note that this is more general than Maslov’s inverse method, cf. Lifschitz (1989)) and non-refutational resolution (cf. Lee (1967); Leitsch (1997), Theorem of Lee, p. 203) could be organized in a goal-directed manner by starting with the axioms plus the induction hypotheses, and a formula that subsumes the induction conclusion is to be inferred. However, this form of goal-directedness is still insufficient: As a myriad of lemmas are applicable, it is practically impossible to find the appropriate ones unless the conclusion has been considerably expanded. Furthermore, since inductive proofs typically follow the form of the recursive definitions, non-refutational resolution requires to paramodulate with the defining rules from right to left, resulting in a high branching rate. All in all, we conclude that non-refutational resolution as well as Maslov’s inversion technique are not adequate for our purpose.

Note 3: In Expander, cf. Padawitz (1996), Padawitz (1998), the induction hypotheses are super-clauses (i.e. disjunctions of super-literals, which are conjunctions of literals) with additional existentially quantified variables. They generate inference rules operating on clauses, similar to the super-clauses in Sergey Yu. Maslov’s inverse method, cf. Lifschitz (1989). Moreover, goaldirectedness w.r.t. the induction conclusion is achieved in Expander by starting from the negated induction conclusion in the form of a set of “goals”, i.e. clauses in dual notation for readability. Contrary to this, the inverse method starts from the set of tautologies, which has the advantage of deductive completeness but lacks goal-directedness w.r.t. the induction conclusion. Nevertheless, from my experiences with Expander, it does not seem to satisfy our main design goals (I) and (II) of § 1.2.1 particularly well.

Note 4: Note that for soundness and safeness of the δ-rule it is sufficient that

x^{δ} ∉ V(A, Γ Π, ℶ) ∪ dom(R),

cf. the proof of Theorem 2.49. Nevertheless, we require the stronger condition

x^{δ} ∉ V(F) for F = (F, C, R, L, H),

because we do not want to lose possible proofs.

Note 5: Note that for soundness and safeness of the liberalized δ-rule it is sufficient that

x^{δ+} ∉ V(A) ∪ dom(C∪R),

cf. the proof of Theorem 2.49. Nevertheless, we require the stronger condition

x^{δ+} ∉ V(F) for F = (F, C, R, L, H),

because we do not want to lose possible proofs.

Note 6: An anonymous referee of a previous version of this text wrote:

“A minor item: After stating the relevant induction principle the author writes: ‘Now by the Principle of Dependent Choice (cf. Rubin & Rubin (1985)) ….’ I find this reference quite inappropriate: Of course, one needs some form of the Axiom of Choice to prove the existence of minimal elements in general, however in the context of inductive reasoning the used ordering is always concretely given and consequently the fact that ‘a class without minimal elements contains a chain without a least element’ is always obvious in any particular scenario of theorem proving”.

The problem, however, is that there may be several counterexamples and the induction ordering only partial. So we have to pick again and again smaller counterexamples from unstructured non-empty classes. Nevertheless, because of this remark we finally changed the definition of well-foundedness from non-termination of the reverse relation to the existence of minimal elements, which resulted in an immediate soundness of the Method of Descente Infinie without the Principle of Descente Infinie.

Note 7: The typical problems of higher-order logic—incompleteness, undecidability of unifiability, and Skolemization—do not burden this paper: We neither Skolemize nor show completeness. Moreover, unification is not treated in this paper, we just assume the right instance.

Note 8: It may be objected that in the modal logics of, say, Fitting (1999), Cerrito & Cialdea (2001), Fitting (2002), the Substitution-Lemma is not valid because it only holds for the substitution of rigid and rigidified (grounded, annotated, nonrelativized) terms. This is, however, a wrong view: Those substitutions for which the Substitution-Lemma does not hold are no proper substitutions. They cannot occur in proof steps because such proof steps would be unsound. And therefore we do not need them at all, and simply do not call them substitutions, which renders the Substitution-Lemma valid again. Indeed, the substitutions for which the Substitution-Lemma does not hold when applied to a certain term or formula B, are not “free” for B in some sense. The problem is that an implicit variable is captured by some quantifier. We explain this for the higher-order modal logic of Fitting (2002) because there the relativization operator ↓ makes this obvious. For a term t of intensional type ↑α, the term ↓t has the extensional type α. Instead of ↓t one could also write tw where w is a variable valuated to the current world, so that tw is the extension of t at world w. The quantifiers □, ♢ and the binder λ implicitly bind this implicit variable w. Let us now have a look on the standard example for the violation of the Substitution-Lemma. Let x, y be variables of the extensional type 0. Let h, p be constants of the intensional type ↑0 standing for the intentional notions of Hesperus (morning star) and Phosphorus (evening star), and assume that □ means “all former highly developed civilizations knew” or simply “the ancients knew”. Then

x = y ⇒ □(x = y)

is valid because the ancients knew that two identical things are identical. On the other hand its instance

↓h = ↓p ⇒ □(↓h = ↓p)

via the “substitution” {x ↦ ↓h, y ↦ ↓p} is not valid in our world because here the extensions of Hesperus and Phosphorus are identical but the ancients did not know that. But with the variable w made explicit, the first formula reads

x = y ⇒ □w. (x = y)

for which the “substitution” {x ↦ hw, y ↦ pw} is obviously not “free” because the w is captured by the quantifier □w.

Note 9: Consider the valid Henkin quantified IF logic formula

∀x_{0}. ∀x_{1}. ∃y_{0}/x_{1}. ∃y_{1}/x_{0}. ( x_{0}=y_{0} ∧ x_{1}=y_{1} )

or its logically equivalent raised form

∃y_{0}. ∃y_{1}. ∀x_{0}. ∀x_{1}. ( x_{0}=y_{0}(x_{0}) ∧ x_{1}=y_{1}(x_{1}) )

Its representation in our framework as the formula x0^{δ}=y0^{γ} ∧ x1^{δ}=y1^{γ} with variable-condition R = {(y0^{γ}, x1^{δ}), (y1^{γ}, x0^{δ})} fails to be R-valid. Indeed, while {y0^{γ}↦x0^{δ}} and {y1^{γ}↦x1^{δ}} are R-substitutions on V_{γ}, their combination σ = {y0^{γ}↦x0^{δ}, y1^{γ}↦x1^{δ}} is no R-substitution:

y0^{γ}  _{R}  x0^{δ}^{Δ_{σ}} y1^{γ}  _{R} x1^{δ}_{Δ_{σ}}

Now, if you want to turn this wrong representation into a proper one, you have to use the notions from the weak version of Wirth (1998) instead. Reformulated according to the slightly different notion of a substitution used in this paper, they read:

Definition Note 9.1 (Weak Variable-Condition) (Cf. Definition 2.7) A variable-condition is a subset of V_{γ} × V_{δ}.

Definition Note 9.2 (Weak R-Substitution) (Cf. Definition 2.11) Let R be a variable-condition. σ is an R-substitution if σ is a substitution and Δ_{σ} ∘ R is irreflexive.

Definition Note 9.3 (Weak σ-Update) (Cf. Definition 2.12) Let R be a variable-condition and σ be a substitution. The σ-update of R is (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}) ∘ R.

Note that for this weak version we have to pay the price that we cannot use a liberalized version of the δ-rule, which makes our proofs dependent on the order in which we eliminated quantifiers, thereby violating our design goal of a natural flow of information, cf. § 1.2.1.

Note 10: If you nevertheless want to have re-use and permutations of free γ-variables you have to use the following alternative notions instead.

Definition Note 10.1 (Alternative Variable-Condition) (Cf. Definition 2.7) A variable-condition is a subset of V_{free} × V_{δ}.

Definition Note 10.2 (Alternative R-Substitution) (Cf. Definition 2.11) Let R be a variable-condition. σ is an R-substitution if σ is a substitution and (_{V_{δ}∪(V_{γ}\dom(σ))}↿id ∪ Γ_{σ} ∪ Δ_{σ}) ∘ R ∪ (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}} is well-founded.

Definition Note 10.3 (Alternative σ-Update) (Cf. Definition 2.12) Let R be a variable-condition and σ be a substitution. The σ-update of R is (_{V_{δ}∪(V_{γ}\dom(σ))}↿id ∪ Γ_{σ} ∪ Δ_{σ}) ∘ R ∪ (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}}.

In an implementation, substituted free γ-variables should get new nodes while their old nodes lose their labels. E.g., (where we have boxed the old occurrences of the re-used free γ-variables x^{γ} and u^{γ}) for

R := {( x^{γ} , y^{δ}), ( x^{γ} , z0^{δ}), ( x^{γ} , z1^{δ}), ( x^{γ} , z2^{δ}), ( u^{γ} , v^{δ}), (w^{γ}, v^{δ})}.

and the R-substitution on V_{γ} (in the alternative sense!)

σ := { x^{γ} ↦ (u^{γ} + v^{δ}), u^{γ} ↦ x^{γ}, y^{γ} ↦ v^{δ}}

we should update

u^{γ}  _{R}  v^{δ}  w^{γ}^{R} y^{δ}  x^{γ}_{R}_{R}  _{R}  _{R} z0^{δ}  z1^{δ}  z2^{δ}

first to

y^{γ} x^{γ}  _{Γ_{σ}}  u^{γ}  _{R}  v^{δ}_{Δ_{σ}} _{Δ_{σ}}  w^{γ}_{R} y^{δ}  x^{γ}_{R}_{R}  _{R}  _{R}  u^{γ}_{Γ_{σ}} z0^{δ}  z1^{δ}  z2^{δ}

and then to  x^{γ}  •  v^{δ}  w^{γ} y^{δ}  •  u^{γ} z0^{δ}  z1^{δ}  z2^{δ}

representing the σ-update of R in the alternative sense. Note that the edge from v^{δ} to y^{γ} has been completely removed in the last step because y^{γ} has no out-going R-edge. This may be an efficiency advantage over the non-alternative version, cf. also Note 19 in § 3.1.

Note 11: A first alternative approach one may try is to admit a slight modification of e to e′ such that e′(x^{γ})(δ) = a. However, such a modification does not conform to our requirement on preservation of solutions. Moreover, this approach fails because it is not possible to preserve reduction under instantiation steps:

E.g., an instantiation step with the R-substitution {x^{γ}↦y^{δ+}} transforms the reduction of Example 2.19 into the reduction of

∀y. ¬P(y), P(y^{δ+})

to ¬P(y^{δ+}), P(y^{δ+})

Taking δ, e, and A as in Example 2.19, the new lower sequent is still (e, A)-valid. There is, however, no modification e′ of e such that the new upper sequent is (δ, e′, A)-valid.

Another alternative approach is to admit a slight modification of δ instead. E.g., for the reduction step of Example 2.19, one would require the existence of some π : {y^{δ+}} → A such that the upper sequent is (π ⊎ _{V_{δ}\{y^{δ+}}}↿δ, e, A)-valid instead

of (δ, e, A)-valid. Choosing π := {y^{δ+}↦a} would solve the problem of Example 2.19 then: Indeed, the upper sequent is (π ⊎_{V_{δ}\{y^{δ+}}}↿δ, e, A)-valid because for the e of Example 2.19 we have e(x^{γ})(π ⊎_{V_{δ}\{y^{δ+}}}↿δ) = (π ⊎_{V_{δ}\{y^{δ+}}}↿δ)(y^{δ+}) = a. Moreover, with this approach, reduction is preserved under instantiation steps. However, the difficulty with this approach is that neither the choice of a single π for all δ or nor the admission of a different π for each δ solves the problem:

Example Note 11.1 Consider the following liberalized δ-step where the additional free δ-variable z^{δ} occurs in the principal formula, namely the reduction of ∀y. z^{δ}≠y, z^{δ}=x^{γ} to z^{δ}≠y^{δ+}, z^{δ}=x^{γ} For the e of Example 2.19 (which gives x^{γ} the value of y^{δ+}) the lower sequent is (e, A)-valid.

Different π: The admission of a different π for each δ seems to be necessary due to the following argumentation: In case of R = ∅, the upper sequent must be (π ⊎_{V_{δ}\{y^{δ+}}}↿δ, e, A)-valid for all δ. This holds only when π : {y^{δ+}} → A changes when the δ-value of z^{δ} changes:

E.g., for δ := {y^{δ+}↦a, z^{δ}↦b} we need π(y^{δ+}) := b, while for δ := {y^{δ+}↦b, z^{δ}↦a} we need π(y^{δ+}) := a.

Indeed, in the reduction above, y^{δ+} is functionally dependent on z^{δ}. This dependence is the main reason for our requirement of the liberalized δ-rule to insert (z^{δ}, y^{δ+}) into the variable-condition, cf. § 1.2.4. (The other reason is that we do not have to insert R⟨{z^{δ}}⟩ × {y^{δ+}} into the variable-condition R anymore (as was the case in Wirth (1998)) because the transitive closure now takes care of this.)

Single π: The restriction to a single π for all δ seems to be necessary due to the following argumentation: In case of R = {(x^{γ}, z^{δ})}, the upper sequent of Example Note 11.1 is not R-valid in general. Thus, to preserve the connection between reduction and validity (cf. Lemma 2.31(1)), the step of Example Note 11.1 must not be a reduction, i.e. the upper sequent must not be (π ⊎ _{V_{δ}\{y^{δ+}}}↿δ, e, A)-valid for all δ. Therefore, π must not depend on the δ-value of z^{δ}, contrary to the item above. Note that such a dependence would effectively allow x^{γ} to read the value of z^{δ}, which is explicitly forbidden by the variable-condition R.

Thus, the only solution can be that π (just like e) depends on some values of δ but not on others. Since we are interested in extracting information on the solution of free γ-variables of the original theorem from a completed proof, we want to have the additional possibility to look up what rôle the free δ^{+}-variables introduced by liberalized δ-steps really play. And this is what the choice-conditions are all about.

Note 12: It should be pointed out that the “some π” in this definition is something we can play around with. Indeed, in Wirth (1998), Definition 5.7 (resp. Definition 4.4 in short version), we can read “each π” instead, which is just the other extreme. The reason why we prefer “some π” to “each π” here and in Wirth (2008) is that “some π” results in more valid formulas (e.g. (E2) in Wirth (2008)) and makes theorem proving easier. Contrary to “each π” and to all semantics for Hilbert’s ε in the literature, “some π” frees us from considering all possible choices: We just have to pick a single one and fix it in a proof step. As the major notion here and in Wirth (2008) is not validity but reduction (cf. Definition 2.30), where the quantification of π must be universal no matter how we quantify in the notion of (C, R)-validity, changing the quantification of π in Definition 2.27 would only have very local consequences. Roughly speaking, only Lemma 2.31(5a) and Lemma B.6(1) become false for a different choice on the quantification of π in Definition 2.27.

Note 13: For example, a drawback of the implicit-induction calculus of Bachmair (1988) (implemented as the Unicom system, cf. Gramlich & Lindner (1991)) is that every simplification has to reduce the induction conclusion in the induction ordering <. Thus, the more reduction steps, the smaller the goals, and the less likely a successful completion of the proof, because this means to find an induction hypothesis being smaller than the goals in ≲. This can be avoided in our framework by requiring the simplified induction conclusion to be smaller only in ≲ instead of in <.

Note 14: Exceptions are: Expander (Padawitz (1998)) admits any relation, but soundness holds only if it is well-founded. Unicom (Gramlich & Lindner (1991)) and Spike (Bouhoula & Rusinowitch (1995)) admit the adjustment of some parameters for the induction ordering in advance. Note that Nqthm and other explicit-induction systems can be seen to have a fixed induction ordering when we augment the weight terms with the information on how the induction ordering is constructed from a fixed set of combinations, such as it is done in QuodLibet (Avenhaus &al. (2003)). E.g., instead of comparing a tuple like (x, y, z) in “length–lex(≺)” we can take it to be the ordinal number ω^{2}(x+1) + ω(y+1) + (z+1).

Note 15: Groundedness was first defined in Wirth & Becker (1995) under the name “foundedness”, which, however, is too easily confused with “well-foundedness”.

Note 16: Note that an Instantiation step can be unsafe if free δ^{+}-variables are instantiated, cf. Definition B.8.

Note 17: Although it might be possible to instantiate more variables than the ones from Y, this does not seem to be necessary due to the following arguments:

1. To include any y^{δ} ∈ V_{δ} (Φ, ℸ) into Y we can extend R′ with

V_{γδ+}(Φ, ℸ) × {y^{δ} } provided that R′ is still well-founded after the extension. If this extension of R′ makes a query variable useless (i.e. blocks a solution for a free γ-variable), we have to take a higher-order query variable instead, cf. § 3.3.

2. I do not known a more general approach in the literature. For example, in Baaz &al. (1997), an application of a δ-rule triggers an induction on the variable y of the quantifier removed by the δ-rule. In our approach, the δ-rule application replaces y with a new free δ^{−}-variable y^{δ} and extends the variable-condition with V_{γδ+}(Φ, ℸ) × {y^{δ} } so that y^{δ} ∈ Y holds indeed.

Note 18: Firstly, note that “p(a)” may abbreviate “p(a)=true”.

Secondly, for the soundness of descente infinie we have to make sure that well-foundedness in the models in K really means well-foundedness on the meta-level. To express the well-foundedness of < properly, “α → bool” should have the standard interpretation of a predicate over “α”. As a sufficient condition for the admission of general (or Henkin) models, however, (cf. e.g. Andrews (2002)) Chad E. Brown recommended to require that the definition of general models includes an operator W : (α → α → bool) → α → bool satisfying

eval( A ⊎ ϵ(e)(δ) ⊎ δ )( ∃a:α. W (<)(a) ∧ ∀a:α. ( W (<)(a) ⇒ ∃a′:α. (W (<)(a′) ∧ a′<a) ) ) = TRUE

whenever eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<) is not well-founded (on the meta-level). Note that eval(A ⊎ ϵ(e)(δ) ⊎ δ)(W (<)) serves as a witness in case of a non-well-founded induction ordering. As long as we do not have fixed a concrete calculus, I do not see an alternative. Notice, however, that we do not have to add the well-foundedness formula to the set M at all, when we have some alternative means to guarantee the well-foundedness of ⊲, as indicated in the text on page 2.5.2.

Note 19: Indeed, for the alternative notions in Note 10, we get R′ := ∅ here because (y2^{γ}, y1^{γ}) and (y2^{γ}, y3^{γ}) from Γ_{σ} are removed, just as the edge from v^{δ+} to y^{γ} in the example of Note 10, because there are no out-going R′-edges from y1^{γ} and y3^{γ}.

Note 20: Note that we cannot take arbitrary length because the lexicographic combination of arbitrary length of well-founded orderings is not well-founded: (1) > (0, 1) > (0, 0, 1) > · · · . This length is not limiting the QuodLibet system, however, because it is not implemented: If a proof attempt is successful it has used only a finite number of finite terms and we can assume that the limit is the maximum length of lexicographic combination occurring in them.

Note 21: x^{δ} ∈ V_{δ} is in solved form in the weighted sequent Γ (x^{δ} ≠t) Π; ℶ if x^{δ} ∉ V(t, Γ Π, ℶ) and V_{γδ+}(t, Γ Π, ℶ) ⊆ R^{+}⟨{x^{δ} }⟩.

Note 22: If well-foundedness or termination were a first-order property, the first-order theory of the Peano algebra of natural numbers would be first-order axiomatizable and enumerable, but it is not even arithmetically definable, cf. e.g. Enderton (1973), p. 228.

Note 23: Actually, the possibility to be lazy simplifies things a little bit when different induction schemes are in conflict with each other. To get an idea on this, compare Walther (1992) with Kühler (2000), § 8.3.

Note 24: In reductive theorem proving, there is one disadvantage, however, of the liberalized δ-rule compared to the nonliberalized δ-rule. Sometimes the liberalized δ-rule results in a larger variable-condition because it introduces dependences from the free δ^{−}-variables of the principal formula. This is necessary for the soundness of lemma and induction-hypothesis application. One consequence of this is that simplification becomes more difficult: For example, in the second tree in § 3.2.2, we safely removed the literal x0^{δ} ≠s(x1^{δ} ) from

x0^{δ} ≠s(x1^{δ} ), P(s(x1^{δ} )); w1^{γ}(s(x1^{δ} ))

because x0^{δ} was in solved form in this sequent, cf. Note 21. If we had applied the liberalized δ-rule instead, we would have got

x0^{δ} ≠s(x1^{δ+}), P(s(x1^{δ+})); w1^{γ}(s(x1^{δ+}))

where x0^{δ} is not in solved form because this sequent contains the free δ^{+}-variable x1^{δ+} which is not in R^{+}⟨{x0^{δ} }⟩. Moreover, we cannot extend the variable-condition R such that R^{+}⟨{x0^{δ} }⟩ contains x1^{δ+} because the liberalized δ-rule has introduced the dependence (x0^{δ} , x1^{δ+}) into R, so that R would become cyclic. Note that x1^{δ+} stands for εy. (x0^{δ} =s(y)), which means that x0^{δ} still occurs hidden the latter sequent. Indeed, under the variable-condition R := {(x0^{δ} , x1^{δ+})}, the choice-condition C := {(x1^{δ+}, (x0^{δ} =s(x1^{δ+})))}, and (nat1) from § 1.1.1, the removal of x0^{δ} ≠s(x1^{δ+}) from x0^{δ} ≠s(x1^{δ+}), x1^{δ+}≠0; … is not safe in the sense of Definition 2.47; to wit, let A have the universe {+, −} × N with s^{A}(+, n) := (+, n+1), s^{A}(−, n+1) := (−, n), s^{A}(−, 0) := (+, 1), and 0^{A} := (+, 0), and set

π(x1^{δ+})(τ) := \{ \begin{matrix}(+, 0) & if τ(x0^{δ} )=(+, 0) \\ (−, 0) & if τ(x0^{δ} )=(+, 1) \\ (+, n+1) & if τ(x0^{δ} )=(+, n+2) \\ (−, n+1) & if τ(x0^{δ} )=(−, n) \end{matrix} \},

which is compatible with (C, R). Moreover, considering τ(x0^{δ} ) = 0^{A}, it can be easily seen that

x0^{δ} ≠s(x1^{δ+}), x1^{δ+}≠0

is (π, e, A)-valid, but x1^{δ+}≠0 is not, thereby violating safeness.

There is, however, a general way to overcome this shortcoming for constructive domains. For our special case of natural numbers it looks as follows: When we add the axiom (nat3) from § 1.1.2, then the removal of x0^{δ} ≠s(x1^{δ+}) from x0^{δ} ≠s(x1^{δ+}), Γ; … is always safe because the image of the predecessor function on the universe without 0^{A} is the whole universe and if Γ is false for τ(x0^{δ} ) = 0^{A} then x0^{δ} ≠s(x1^{δ+}), Γ is false for the τ′ which differs from τ in τ′(x0^{δ} ) = s^{A}(π(x1^{δ+})(τ)) because then π(x1^{δ+})(τ′) = π(x1^{δ+})(τ).

Note 25: This asymmetry results from the following line of argumentation: For some new variable z ∈ V_{bound} and t denoting the term εz. ((¬A ⇒ x=z) ∧ ¬A{x↦z}), using the logical equivalence of ∀x. (A∨B) with ∀x. A ∨ ∀x. (B{x↦t}) and then the logical equivalence of ∀x. A with ∃x. (A{x↦t}), we see that ∀x. (A∨B) is logically equivalent with ∃x. (A{x↦t}) ∨ ∀x. (B{x↦t}).

Note 26: For the alternative notions in Note 10, we have to replace this sentence with the following: As R′ is the σ-update of R, we have

Δ_{σ}R^{∗}↾_{V_{δ}} ⊆ Δ_{σ}RR^{∗} ∪ Δ_{σ}↾_{V_{δ}} = Δ_{σ}R(_{V_{δ}}↿R)^{∗} ∪ Δ_{σ}↾_{V_{δ}} ⊆ R′^{+},

the second step being due to ran(R) ⊆ V_{δ} for any alternative variable-condition R. Similarly, _{V_{δ}}↿(R^{+}) = (_{V_{δ}}↿R)^{+} ⊆ R′^{+}. Q.e.d. (Claim 1)

Note 27: For the alternative notions in Note 10, we have to replace this sentence with the following: As R′ is the σ-update of R, we have

(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ})R^{∗}↾_{V_{δ}} ⊆ (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ})RR^{∗} ∪ _{V_{free}}↿id ∪ Γ_{σ}↾_{V_{δ}} =
(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ})R(_{V_{δ}}↿R)^{∗} ∪ _{V_{free}}↿id ∪ Γ_{σ}↾_{V_{δ}} ⊆ R′^{∗},

the second step being due to ran(R) ⊆ V_{δ} for any alternative variable-condition R. \underline{Q.e.d. (Claim 2)}

Note 28: For the alternative notions in Note 10, we have to deviate here in the following way: Moreover, as R′ is the σ-update of R, we have

R′ = (_{V_{δ}∪(V_{γ}\dom(σ))}↿id ∪ Γ_{σ} ∪ Δ_{σ})R ∪ (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}}.

As (R′ ∪ S_{e′})^{+} is a well-founded ordering, so is its subset

(_{V_{δ}∪(V_{γ}\dom(σ))}↿R ∪ S_{e′}↾_{V_{γ}\dom(σ)} ∪ S_{e′}Γ_{σ}↾_{V_{γ}}R ∪ Δ_{σ}↾_{V_{γ}}R)^{+}.

The alternative version of a variable-condition guarantees ran(R) ⊆ V_{δ}. Thus, additional steps with_{V_{γ}∩dom(σ)}↿R must cause immediate termination; i.e.

(R ∪ S_{e′}↾_{V_{γ}\dom(σ)} ∪ S_{e′}Γ_{σ}↾_{V_{γ}}R ∪ Δ_{σ}↾_{V_{γ}}R)^{+}

is a well-founded ordering, too. As ran(Γ_{σ}↾_{V_{γ}} ∪ Δ_{σ}↾_{V_{γ}}) ⊆ V_{γ} and dom(S_{e′} ∪ Δ_{σ}) ⊆ V_{δ}

(R ∪ S_{e′}↾_{V_{γ}\dom(σ)} ∪ S_{e′}Γ_{σ}↾_{V_{γ}} ∪ Δ_{σ}↾_{V_{γ}})^{+}

is a well-founded ordering, which is equal to (R ∪ S_{e})^{+} by definition of S_{e}. \underline{Q.e.d. (Claim 3)} Note 29: For the alternative notions in Note 10, we have to deviate here in the following way: Moreover, as R′ is the σ-update of R, we have

R′ = (_{V_{δ}∪(V_{γ}\dom(σ))}↿id ∪ Γ_{σ} ∪ Δ_{σ})R ∪ (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}}.

As R′ ∪ S_{e′} ∪ S_{π′} is well-founded, the subset

V_{δ}∪(V_{γ}\dom(σ))↿R ∪ (S_{π′} ∪_{V_{δ}} ↿id)(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}})R ∪_{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}}

of its transitive closure is well-founded, too. The alternative version of a variable-condition guarantees ran(R) ⊆ V_{δ}. Thus, additional steps with_{V_{γ}∩dom(σ)}↿R must cause immediate termination; i.e.

R ∪ (S_{π′} ∪_{V_{δ}} ↿id)(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}})R ∪_{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}}

is well-founded, too. As ran(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}) ⊆ V_{γ} and dom(S_{π′} ∪_{V_{δ}} ↿id) ⊆ V_{δ}

R ∪ (S_{π′} ∪_{V_{δ}} ↿id)(S_{e′}(_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ}↾_{V_{γ}}) ∪ Δ_{σ}↾_{V_{γ}}) ∪_{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}}

is well-founded, which is equal to R ∪ S_{e} ∪_{V_{δ}}↿(R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{δ}} by definition of S_{e}. \underline{Q.e.d. (Claim 5)}

Note 30: For the alternative notions in Note 10, we have to deviate here in the following way: As R′ is the σ-update of R, we have

R′ = (_{V_{δ}∪(V_{γ}\dom(σ))}↿id ∪ Γ_{σ} ∪ Δ_{σ})∘R ∪ (Γ_{σ} ∪ Δ_{σ})↾_{V_{δ}}.

As the alternative version of a variable-condition guarantees ran(R) ⊆ V_{δ} and ⊲ is transitive, we have _{V_{δ}}↿(R^{+}) ⊆ ⊲ and (_{V_{γ}\dom(σ)}↿id ∪ Γ_{σ} ∪ Δ_{σ})∘R^{+} ⊆ ⊲. The latter implies S_{e}∘R^{+} ⊆ ⊲ by (B.5.1). \underline{Q.e.d. (Claim 2)}

REFERENCES 93

E References

Fabio Acerbi (2000). Plato: Parmenides 149a7–c3. A Proof by Complete Induction?. Archive for History of Exact Sciences 55,

pp. 57–76, Springer. Wilhelm Ackermann (1940). Zur Widerspruchsfreiheit der Zahlentheorie. Mathematische Annalen 117, pp. 163–194. Re-

    ceived Aug. 15, 1939. http://dz-srv1.sub.uni-goettingen.de/sub/digbib/loader?did=D37625
    (July23,2007).

Peter B. Andrews (1972). General Models, Descriptions, and Choice in Type Theory. J. Symbolic Logic 37, pp. 385–394. Peter B. Andrews (1981). Theorem Proving via General Matings. J. ACM 28, pp. 193–214, ACM Press. Peter B. Andrews (2002). An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof. 2^{nd} ed. (1^{st} ed. 1986),

Academic Press (Elsevier). Serge Autexier (2003). Hierarchical Contextual Reasoning. PhD thesis, FR Informatik, Saarland Univ.. Serge Autexier (2005a). The CoRe Calculus. 20^{th}CADE 2005, LNAI3632, pp. 84–98, Springer. Serge Autexier (2005b). On the Dynamic Increase of Multiplicities in Matrix Proof Methods for Classical Higher-Order Logic.

14^{th}TABLEAUX 2005, LNAI3702, pp. 48–62, Springer. Serge Autexier, Dieter Hutter, Heiko Mantel, Axel Schairer (1999). Inka 5.0 — A Logical Voyager. 16^{th}CADE 1999, LNAI1632,

pp. 207–211, Springer. Jürgen Avenhaus, Ulrich Kühler, Tobias Schmidt-Samoa, Claus-Peter Wirth (2003). How to Prove Inductive Theorems? Quod-

Libet!. 19^{th}CADE 2003, LNAI2741, pp. 328–333, Springer. http://www.ags.uni-sb.de/~cp/p/quodlibet

    (July23,2003).

Matthias Baaz, Christian G. Fermüller (1995). Non-elementary Speedups between Different Versions of Tableaus. 4^{th}TAB-

LEAUX 1995, LNAI918, pp. 217–230, Springer. Matthias Baaz, Uwe Egly, Christian G. Fermüller (1997). Lean Induction Principles for Tableaus. 6^{th}TABLEAUX 1997,

LNAI1227, pp. 62–75, Springer. Leo Bachmair (1988). Proof By Consistency in Equational Theories. 3^{rd} IEEE Symposium on Logic In Computer Sci., pp. 228–

233, IEEE Press. Klaus Barner (2001). Das Leben Fermats. DMV-Mitteilungen 3/2001, pp. 12–26. Peter Baumgartner, Ulrich Furbach, Frieder Stolzenburg (1997). Computing Answers with Model Elimination. Artificial Intelli-

gence 90, pp. 135–176. Bernhard Beckert, Reiner Hähnle (1998). Analytic Tableaus. In: Bibel & Schmitt (1998), Vol. 1, pp. 11–41. Bernhard Beckert, Reiner Hähnle, Peter H. Schmitt (1993). The Even More Liberalized δ-Rule in Free-Variable Semantic

Tableaus. Kurt Gödel Colloquium, LNCS713, pp. 108–119, Springer. Christoph Benzmüller, Chad E. Brown, Michael Kohlhase (2004). Higher Order Semantics and Extensionality. J. Symbolic

Logic 69, pp. 1027–1088. Karel Berka, Lothar Kreiser (eds.) (1973). Logik-Texte – Kommentierte Auswahl zur Geschichte der modernen Logik. Akademie-

Verlag, Berlin, 2^{nd}rev. ed. (1^{st}ed. 1971; 4^{th}rev. rev. ed. 1986). Wolfgang Bibel (1987). Automated Theorem Proving. 2^{nd} rev. ed. (1^{st} ed. 1982), Vieweg, Braunschweig. Wolfgang Bibel, Peter H. Schmitt (eds.) (1998). Automated Deduction — A Basis for Applications. Kluwer (Springer). Susanne Biundo, Birgit Hummel, Dieter Hutter, Christoph Walther (1986). The Karlsruhe Induction Theorem Proving System.

8^{th}CADE 1986, LNCS230, pp. 672–674, Springer. Adel Bouhoula, Michaël Rusinowitch (1995). Implicit Induction in Conditional Theories. J. Automated Reasoning 14, pp. 189–

235, Kluwer (Springer). Robert S. Boyer, J S. Moore (1979). A Computational Logic. Academic Press (Elsevier). Robert S. Boyer, J S. Moore (1988). A Computational Logic Handbook. Academic Press (Elsevier). Alan Bundy (1988). The use of Explicit Plans to Guide Inductive Proofs. DAI Research Paper No. 349, Dept. Artificial Intelli-

gence, Univ. Edinburgh. Short version in: 9^{th}CADE 1988, LNAI310, pp. 111–120, Springer. Alan Bundy (1999). The Automation of Proof by Mathematical Induction. Informatics Research Report No. 2, Division of In-

formatics, Univ. Edinburgh. Also in: Robinson & Voronkov (2001), Vol. 1, pp. 845–911. Alan Bundy, Frank van Harmelen, C. Horn, Alan Smaill (1990). The Oyster-Clam System. 10^{th}CADE 1990, LNAI449, pp. 647–

648, Springer. W. H. Bussey (1917). The Origin of Mathematical Induction. American Mathematical Monthly XXIV, pp. 199–207. Paolo Bussotti (2006). From Fermat to Gauß: indefinite descent and methods of reduction in number theory. Algorismus 55, Dr.

Erwin Rauner Verlag, Augsburg.

Ricardo Caferra, Gernot Salzer (eds.) (2000). Automated Deduction in Classical and Non-Classical Logics. LNAI1761, Springer. Domenico Cantone, Marianna Nicolosi-Asmundo (2000). A Further and Effective Liberalization of the δ-Rule in Free-Variable

Semantic Tableaus. In: Caferra & Salzer (2000), pp. 109–125. Serenella Cerrito, Marta Cialdea (2001). Free-Variable Tableaus for Constant-Domain Quantified Modal Logics with Rigid and

Non-Rigid Designation. 1^{st}IJCAR 2001, LNAI2083, pp. 137–151, Springer. Herbert B. Enderton (1973). A Mathematical Introduction to Logic. 2^{nd} printing, Academic Press (Elsevier). Euclid of Alexandria (ca. 300 b.c.). Elements. English translation: Thomas L. Heath (ed.). The Thirteen Books of Euclid’s

Elements. Cambridge Univ. Press, 1908. Web version: http://www.perseus.tufts.edu/cgi-bin/ptext? doc=Perseus:text:1999.01.0086 (Aug.15,2006). Alternative English web version: D. E. Joyce (ed.). Euclid’s Elements. Dept. Math. & Comp. Sci., Clark Univ., Worcester, MA. http://aleph0.clarku.edu/~djoyce/

    java/elements/Euclid.html (March24,2003).

Pierre Fermat (1891ff.). Œuvres de Fermat. Paul Tannery, Charles Henry (eds.), Gauthier-Villars, Paris. http://fr.

    wikisource.org/wiki/%C5%92uvres_de_Fermat (Aug.15,2006).

Melvin Fitting (1996). First-Order Logic and Automated Theorem Proving. 2^{nd} extd. ed. (1^{st} ed. 1990), Springer. Melvin Fitting (1999). On Quantified Modal Logic. Fundamenta Informaticae 39, pp. 105–121. Melvin Fitting (2002). Types, Tableaus, and Gödel’s God. Kluwer (Springer). Kurt von Fritz (1945). The Discovery of Incommensurability by Hippasus of Metapontum. Annals of Mathematics 46, pp. 242–

264. German translation Die Entdeckung der Inkommensurabilität durch Hippasos von Metapont in: Oscar Becker (ed.). Zur Geschichte der griechischen Mathematik, pp. 271–308, Wissenschaftliche Buchgesellschaft, Darmstadt, 1965.

Dov Gabbay, Christopher John Hogger, J. Alan Robinson (eds.) (1994). Handbook of Logic in Artificial Intelligence and Logic

Programming. Vol. 2: Deduction Methodologies. Clarendon Press. Gerhard Gentzen (1935). Untersuchungen über das logische Schließen. Mathematische Zeitschrift 39, pp. 176–210,

405–431. Also in Berka &al. Kreiser (1973), pp. 192–253. English translation in Gentzen (1969). http:

    //dz-srv1.sub.uni-goettingen.de/sub/digbib/loader?did=D17178,http://dz-srv1.sub.
    uni-goettingen.de/sub/digbib/loader?did=D17188 (July23,2007).

Gerhard Gentzen (1938). Die gegenwärtige Lage in der mathematischen Grundlagenforschung – Neue Fassung des Widerspruchsfreiheitsbeweises für die reine Zahlentheorie. Forschungen zur Logik und zur Grundlegung der exakten Wissenschaften, Neue Folge 4, pp. 3–44, Leipzig. Reprinted as facsimile by Wissenschaftliche Buchgesellschaft, Darmstadt, Verlag von S. Hirzel, Stuttgart. English translation in Gentzen (1969).

Gerhard Gentzen (1969). The Collected Papers of Gerhard Gentzen. Ed. by Manfred E. Szabo. North-Holland (Elsevier). Alfons Geser (1995). A Principle of Non-Wellfounded Induction. In: Tiziana Margaria (ed.). Kolloquium Programmiersprachen

und Grundlagen der Programmierung, MIP–9519, pp. 117–124, Univ. Passau. Martin Giese (1998). Integriertes automatisches und interaktives Beweisen: die Kalkülebene. Master’s thesis, Univ. Karlsruhe.

    http://i11www.ira.uka.de/~giese/da.ps.gz (May09,2000).

Martin Giese, Wolfgang Ahrendt (1999). Hilbert’s ε-Terms in Automated Theorem Proving. 8^{th}TABLEAUX 1999, LNAI1617,

pp. 171–185, Springer. Leonard Gillman (1987). Writing Mathematics Well. The Mathematical Association of America. Kurt Gödel (1931). Über formal unentscheidbare Sätze der Principia Mathematica und verwandter Systeme I. Monatshefte für

Mathematik und Physik 38, pp. 173–198. Kurt Gödel (1986ff.). Collected Works. Solomon Feferman (ed.), Oxford Univ. Press. Bernhard Gramlich, Wolfgang Lindner (1991). A Guide to Unicom, an Inductive Theorem Prover Based on Rewriting

and Completion Techniques. SEKI-Report SR–91–17 (SFB), FB Informatik, Univ. Kaiserslautern. http://agent.

    informatik.uni-kl.de/seki/1991/Lindner.SR-91-17.ps.gz (May09,2000).

Bernhard Gramlich, Claus-Peter Wirth (1996). Confluence of Terminating Conditional Term Rewriting Systems Revisited.

    7^{th}RTA 1996, LNCS1103, pp. 245–259, Springer. http://www.ags.uni-sb.de/~cp/p/rta96 (Aug.05,
    2001).

Reiner Hähnle, Peter H. Schmitt (1994). The Liberalized δ-Rule in Free-Variable Semantic Tableaus. J. Automated Reasoning 13,

pp. 211–221, Kluwer (Springer). David Hilbert, Paul Bernays (1968/70). Grundlagen der Mathematik. 2^{nd} rev. ed. (1^{st} ed. 1934/39), Springer. Jaakko Hintikka (1996). The Principles of Mathematics Revisited. Cambridge Univ. Press. Paul Howard, Jean E. Rubin (1998). Consequences of the Axiom of Choice. Math. Surv. and Monographs, Vol. 58, American

    Math. Society. http://www.math.purdue.edu/~jer/Papers/conseq.html (Oct.15,2002).

Dieter Hutter, Alan Bundy (1999). The Design of the CADE-16 Inductive Theorem Prover Contest. 16^{th}CADE 1999, LNAI1632, pp. 374–377, Springer.

Dieter Hutter, Werner Stephan (eds.) (2005). Mechanizing Mathematical Reasoning: Essays in Honor of Jörg Siekmann on the

Occasion of His 60^{th} Birthday. LNAI2605, Springer. Stig Kanger (1963). A Simplified Proof Method for Elementary Logic. In: Siekmann & Wrightson (1983), Vol. 1, pp. 364–371. Deepak Kapur, Hantao Zhang (1989). An Overview of Rewrite Rule Laboratory (Rrl). 3^{rd}RTA 1989, LNCS355, pp. 559–563,

Springer. Victor J. Katz (1998). A History of Mathematics: An Introduction. 2^{nd} ed., Addison-Wesley. Matt Kaufmann, Panagiotis Manolios, J S. Moore (2000). Computer-Aided Reasoning: An Approach. Kluwer (Springer). Donald E. Knuth (1997f.). The Art of Computer Programming. 3^{rd} ed., Addison-Wesley. Michael Kohlhase (1995). Higher-Order Tableaus. 4^{th}TABLEAUX 1995, LNAI918, pp. 294–309, Springer. Revised version is:

Kohlhase (1998). Michael Kohlhase (1998). Higher-Order Automated Theorem Proving. In: Bibel & Schmitt (1998), Vol. 1, pp. 431–462. Georg Kreisel (1965). Mathematical Logic. In: T. L. Saaty (ed.). Lectures on Modern Mathematics, Vol. III, pp. 95–195, John

Wiley & Sons, New York. Ulrich Kühler (2000). A Tactic-Based Inductive Theorem Prover for Data Types with Partial Operations. PhD thesis, In-

fix, Akademische Verlagsgesellschaft Aka GmbH, Sankt Augustin, Berlin. http://www.ags.uni-sb.de/~cp/

    p/kuehlerdiss (July23,2005).

Ulrich Kühler, Claus-Peter Wirth (1996). Conditional Equational Specifications of Data Types with Partial Operations for Inductive Theorem Proving. SEKI-Report SR–96–11, FB Informatik, Univ. Kaiserslautern. Short version in: 8^{th}RTA 1997,

    LNCS1232, pp. 38–52, Springer. http://www.ags.uni-sb.de/~cp/p/rta97 (Aug.05,2001).

Richard C.-T. Lee (1967). A Completeness Theorem and a Computer Program for Finding Theorems Derivable from Given

Axioms. PhD thesis, Univ. of California, Berkeley. Alexander Leitsch (1997). The Resolution Calculus. Springer. Vladimir A. Lifschitz (1971). Specialization of the Form of Deduction in the Predicate Calculus with Equality and Function

Symbols. In: Orevkov (1971), pp. 1–24. Vladimir A. Lifschitz (1989). What Is the Inverse Method?. J. Automated Reasoning 5, pp. 1–23, Kluwer (Springer). Michael Sean Mahoney (1994). The Mathematical Career of Pierre de Fermat 1601–1665. 2^{nd} rev. ed. (1^{st} ed. 1973), Princeton

Univ. Press. Elena Anne Marchisotto, James T. Smith (2007). The Legacy of Mario Pieri in Geometry and Arithmetic. Birkhäuser (Springer). Sergey Yu. Maslov (1971). The Inverse Method for Establishing Deducibility for Logic Calculi. In: Orevkov (1971), pp. 25–96. Dale A. Miller (1992). Unification under a Mixed Prefix. J. Symbolic Computation 14, pp. 321–358, Academic Press (Elsevier). M. H. A. Newman (1942). On Theories with a Combinatorial Definition of Equivalence. Annals of Mathematics 43(2), pp. 223–

242. Andreas Nonnengart (1996). Strong Skolemization. MPI–I–96–2–010, Max Planck Inst. für Informatik, Saarbrücken. Vladimir P. Orevkov (1971). The Calculi of Symbolic Logic.I. American Mathematical Society, Providence, Rhode Island. Peter Padawitz (1996). Inductive Theorem Proving for Design Specifications. J. Symbolic Computation 21, pp. 41–99, Academic

Press (Elsevier). Peter Padawitz (1998). Expander. A System for Testing and Verifying Functional Logic Programs. http://fldit-www.

    cs.uni-dortmund.de/~peter/ExpaTex.ps.gz (March24,2006).

Blaise Pascal (1954). Œuvres Complètes. Jacques Chevalier (ed.), Gallimard, Paris. Michael S. Paterson, Mark N. Wegman (1978). Linear Unification. J. Computer and System Sci. 16, pp. 158–167, Academic Press

(Elsevier). Mario Pieri (1907/8). Sopra gli assiomi aritmetici. Il Bollettino delle seduta della Accademia Gioenia di Scienze Naturali in

Catania Series 2, 1–2, pp. 26–30. English translation On the Axioms of Arithmetic in Marchisotto & Smith (2007), § 4.2, pp. 308–313.

Dag Prawitz (1960). An Improved Proof Procedure. In: Siekmann & Wrightson (1983), Vol. 1, pp. 159–199. Martin Protzen (1994). Lazy Generation of Induction Hypotheses. 12^{th}CADE 1994, LNAI814, pp. 42–56, Springer. Long version

in: Protzen (1995). Martin Protzen (1995). Lazy Generation of Induction Hypotheses and Patching Faulty Conjectures. PhD thesis, Infix, Akademi-

sche Verlagsgesellschaft Aka GmbH, Sankt Augustin, Berlin. J. Alan Robinson (1965). A Machine-Oriented Logic based on the Resolution Principle. In: Siekmann & Wrightson (1983), Vol. 1,

pp. 397–415. J. Alan Robinson, Andrei Voronkov (eds.) (2001). Handbook of Automated Reasoning. Elsevier. Herman Rubin, Jean E. Rubin (1985). Equivalents of the Axiom of Choice. Elsevier.

Tobias Schmidt-Samoa (2006a). An Even Closer Integration of Linear Arithmetic into Inductive Theorem Proving. Electronic Notes in Theoretical Computer Sci. 151, pp. 3–20, Elsevier. http://www.elsevier.com/locate/entcs

(Aug.20,2006).

Tobias Schmidt-Samoa (2006b). Flexible Heuristics for Simplification with Conditional Lemmas by Marking Formulas as Forbidden, Mandatory, Obligatory, and Generous. J. Applied Non-Classical Logics 16(1–2), pp. 209–239. http://www.

ags.uni-sb.de/~cp/p/jancl (March08,2006).

Tobias Schmidt-Samoa (2006c). Flexible Heuristic Control for Combining Automation and User-Interaction in Inductive Theorem Proving. PhD thesis, Univ. Kaiserslautern. http://www.ags.uni-sb.de/~cp/p/samoadiss

(July30,2006).

Jörg Siekmann, Graham Wrightson (eds.) (1983). Automation of Reasoning. Springer. Raymond M. Smullyan (1968). First-Order Logic. Springer. Wayne Snyder, Jean Gallier (1989). Higher-Order Unification Revisited: Complete Sets of Transformations. J. Symbolic Compu-

tation 8, pp. 101–140, Academic Press (Elsevier). Lincoln A. Wallen (1990). Automated Proof Search in Non-Classical Logics. MIT Press. Cf. Wirth (2006a) for some obsolete

aspects of this fascinating book. Christoph Walther (1992). Computing Induction Axioms. 3^{rd}LPAR 1992, LNAI624, pp. 381–392, Springer. Christoph Walther (1994). Mathematical Induction. In: Gabbay &al. (1994), pp. 127–228. Christoph Walther, Stephan Schweizer (2003). About ✓ eriFun. 19^{th}CADE 2003, LNAI2741, pp. 322–327, Springer. John Woods, Dov Gabbay (2004ff.). Handbook of the History of Logic. Elsevier. Claus-Peter Wirth (1997). Positive/Negative-Conditional Equations: A Constructor-Based Framework for Specification and In-

ductive Theorem Proving. PhD thesis, Verlag Dr. Kovač, Hamburg. http://www.ags.uni-sb.de/~cp/p/diss

(Aug.05,2001).

Claus-Peter Wirth (1998). Full First-Order Sequent and Tableau Calculi With Preservation of Solutions and the Liberalized δ-Rule but Without Skolemization. Report 698/1998, FB Informatik, Univ. Dortmund. Short version in: Gernot Salzer, Ricardo Caferra (eds.). Proc. 2^{nd} Int. Workshop on First-Order Theorem Proving (FTP’98), pp. 244–255, Tech. Univ. Vienna, 1998. Short version also in: Caferra & Salzer (2000), pp. 283–298. http://www.ags.uni-sb.de/~cp/p/ftp98

(Aug.05,2001).

Claus-Peter Wirth (1999). Full First-Order Free-Variable Sequents and Tableaus in Implicit Induction. 8^{th}TABLEAUX 1999,

LNAI1617, pp. 293–307, Springer. http://www.ags.uni-sb.de/~cp/p/d/tab99 (Aug.05,2001).

Claus-Peter Wirth (2005). History and Future of Implicit and Inductionless Induction: Beware the old jade and the zombie!. In:

Hutter & Stephan (2005), pp. 192–203. http://www.ags.uni-sb.de/~cp/p/zombie (Dec.02,2002).

Claus-Peter Wirth (2006a). lim +, δ^{+}, and Non-Permutability of β-Steps. SEKI-Report SR–2005–01, ISSN 1437-4447, rev. ed.

of July 30, 2006. http://www.ags.uni-sb.de/~cp/p/nonpermut (July30,2006).

Claus-Peter Wirth (2006b). Hilbert’s epsilon as an Operator of Indefinite Committed Choice. SEKI-Report SR–2006–02, ISSN 1437-4447. Journal version, shortened in the linguistic part, is Wirth (2008). http://www.ags.uni-sb.de/

~cp/p/epsi (Jan.27,2007).

Claus-Peter Wirth (2008). Hilbert’s epsilon as an Operator of Indefinite Committed Choice. J. Applied Logic, Elsevier, http://

dx.doi.org/10.1016/j.jal.2007.07.009. Longer version is Wirth (2006b). http://www.ags.uni-sb.
de/~cp/p/epsi (Oct.15,2007).

Claus-Peter Wirth, Klaus Becker (1995). Abstract Notions and Inference Systems for Proofs by Mathematical Induction.

4^{th}CTRS 1994, LNCS968, pp. 353–373, Springer. http://www.ags.uni-sb.de/~cp/p/ctrs94 (Aug.05,
2001).

Claus-Peter Wirth, Bernhard Gramlich (1994a). A Constructor-Based Approach for Positive/Negative-Conditional Equational Specifications. J. Symbolic Computation 17, pp. 51–90, Academic Press (Elsevier). http://www.ags.uni-sb.de/

~cp/p/jsc94 (Aug.05,2001).

Claus-Peter Wirth, Bernhard Gramlich (1994b). On Notions of Inductive Validity for First-Order Equational Clauses.

12^{th}CADE 1994, LNAI814, pp. 162–176, Springer. http://www.ags.uni-sb.de/~cp/p/cade94 (Aug.05,
2001).

Claus-Peter Wirth, Christoph Benzmüller, Armin Fiedler, Andreas Meier, Serge Autexier, Martin Pollet, Carsten Schürmann (2003). Human-Oriented Theorem Proving — Foundations and Applications. Lecture course at Universität des Saarlandes,

winter semester 2003/4. http://www.ags.uni-sb.de/~cp/teaching/hotp (Sept.12,2003).

Claus-Peter Wirth, Jörg Siekmann, Christoph Benzmüller, Serge Autexier (2008). Jacques Herbrand: Logic, Life, and Automated Deduction. In: Woods & Gabbay (2004ff.), Vol. 5: Logic from Russell to Church. http://www.ags.uni-sb.de/

~cp/p/herbrand (Dec.16,2007).

Received 12 September 2003. Revised version of 11 January 2008