The subject of automated inductive theorem proving (AITP) aims at automating the process of finding proofs by induction. The problem can be stated a bit more precisely as follows: Given a theory and a formula , is there a proof of from with “induction”. In the literature the interpretation of “induction” varies. Usually “induction” refers to first-order structural induction over the language of the theory , but “induction” also may refer to other induction schemes possibly over different languages, or even to some standard model. In this article we interpret “induction” as the first-order scheme of structural induction.
The subject of AITP is of paramount importance to the formal verification of software and hardware. Every non-trivial program contains loops or recursion, hence its verification requires some inductive reasoning. But also the development of proof assistants can benefit from automated inductive theorem proving by providing hammers that can discharge lemmas automatically.
It is folklore that finding suitable induction axioms is difficult because of the non-analyticity of induction formulas. The non-analyticity of induction formulas can be explained proof theoretically by the failure of cut-elimination in LK with an induction rule, see  for a precise statement. A wide variety of approaches have been proposed to address this problem. Among others there are approaches based on enhancements of saturation-based provers [5, 6, 8], cyclic proofs , rippling , theory exploration , etc. Most of these approaches are rather technical in nature and are thus difficult to analyze formally. Hence most of the analyses carried out for methods of automated inductive theorem proving are empirical and little is known about the theoretical properties of these methods. We believe that providing formal analyses of these methods will contribute to the theoretical foundations of the subject and thus help in developing better methods.
The work presented in this article originates in  where Kersani and Peltier’s n-clause calculus is analyzed by means of a translation of the cycles of the n-clause calculus into proofs of the sequent calculus introduced in . The analysis carried out in  deals with the n-clause calculus as defined in . As a consequence it depends heavily on the technical details of the n-clause calculus. In this article we will consider a family of approaches based on saturation-based provers relying on clause set cycles. The notion of clause set cycle abstracts the details of the cycles of the n-clause calculus. This absence of details allows us to carry out a much more systematic analysis and to formulate more general conjectures. For example the results about clause set cycles are not complicated by the difficulties to define the addition of natural numbers due to syntactical restrictions, or the forward incompleteness of the underlying inference system as would be the case for the n-clause calculus.
The article is structured as follows. In Section 2 we will define the notion of clause set cycle and the associated notion of refutability by a clause set cycle. We will then situate these notions with respect to induction, and hence show that the formalism is inherently weak. This result is a generalization of the main theorem (Theorem 6.27) of . In Section 3 we will provide a finite axiomatization for a theory of triangular numbers with open induction. This result will then serve as the main technical result in Section 4, where we will show that the notion of refutability by a clause set cycle is not weaker than open induction. In Section 5 we will show that the n-clause calculus is indeed a special case of the system of clause set cycles and transfer the main results of sections 2 and 4 to the n-clause calculus. We thus answer positively the conjecture of  that there exists a clause set that is refutable by the n-clause calculus that is not refutable with open induction. We thus situate the power of the n-clause calculus with respect to the theories of induction and open induction.
2 Clause Set Cycles and Induction
We work in a many-sorted first-order classical logic. Every language that we consider is supposed to contain at least the sort representing the natural numbers, with its function symbols representing the number and representing the successor function. In the following we fix one such language and denote it by . Formulas, structures, models, truth, validity, , , etc. are defined as usual. By we denote a special variable ranging over the sort that is not bound by quantifiers. In the literature this variable is sometimes called a parameter. All other variables can range over an arbitrary sort. Let , then by we denote the term . Let be a term of sort and a function symbol of sort , then denotes the term .
Definition 1 (Literal, Clause, Clause set).
An formula is called an literal if it is an atom or the negation of an atom. An formula is said to be an clause if it of the form where with is a literal. An formula is called an clause set if it is of the form where with is a clause.
When the language is clear from the context we simply say literal, clause, and clause set instead of literal, clause, and clause set. For the sake of simplicity we will not distinguish between the formula representation and the set representation of clauses and clause sets. We are now ready to define the notion of clause set cycles and the related notion of refutability by a clause set cycle.
An clause set is called an clause set cycle if it satisfies the following conditions
A clause set cycle has a natural interpretation as an argument by infinite descent that we will explain in terms of induction. Before that we introduce the notion of refutation by a clause set cycle. A refutation by a clause set cycle consists of a clause set cycle and a case distinction.
We say that an clause set is refuted by an clause set cycle if there exists a natural number such that
If the language is clear we simply speak of clause sets cycles and of clause sets refuted by a clause set cycle. Let us consider an example in order to clarify the notions of clause set cycle and refutation by a clause set cycle.
Let and be unary predicate symbols over the sort and let be the clause set consisting of the clauses
Let be the clause set consisting of the clauses , , and . Then it is easy to verify that is a clause set cycle and that moreover is refuted by .
The notions of clause set cycle and of refutability by a clause set cycle may appear restrictive at the first sight in the sense that the clause set cycles do neither allow for an arbitrary step width nor for an offset. The following proposition shows that relaxing these conditions does not increase the strength of the system.
Let , be clause sets, and such that
Then is refuted by a clause set cycle.
It is straightforward to see that the offset is inessential, by letting . Now in order to show that an arbitrary step is inessential we let
We will show that is a clause set cycle. To show the base case it suffices to observe that by the assumption we have for thus . In order to show that satisfies (2) we need to consider two cases. First let , then we have thus . Now let , then we have by the assumption and thus . Therefore is a clause set cycle and is refuted by . ∎
Clause set cycles thus abstract parameters such as offset and step width and therefore simplify a formal analysis.
Let be a formula where is a variable of sort , then the structural induction axiom is defined by
By an formula we understand a formula of the form , where is quantifier-free. The notion of formulas is defined dually to formulas. We will now introduce the two theories of induction that are of interest for the study of the formalism of clause set cycles.
The theories and are given by
Whenever the language is clear from the context or irrelevant, we will write , instead of , . Let be a formula with of sort , then we say that is inductive if and .
Let us now consider how the notions of clause set cycles and refutability by a clause set cycle relates to provability in theories of induction. Let be a clause set cycle, then by (1) and (2) we obtain and . In other words the formula is inductive. Since is a clause set, is logically equivalent to an formula, hence is logically equivalent to an formula. Hence we obtain:
Let be a clause set cycle, then we have .
Intuitively a refutation by a clause set cycle consists of a clause set cycle and a case distinction. The case distinction with cases can be formalized as follows:
Since is clearly inductive and logically equivalent to an formula, the formula is provable with induction. So we have:
Let , then .
If a clause set is refuted by a clause set cycle, then
Refutability by a clause set cycle is thus contained in the theory of induction. Note that this restriction is entirely due to the clause normal form. Similar limitations may thus apply to other formalisms that enhance saturation-based provers by purely clausal induction.
3 Open Induction and Triangular numbers
In this section we will provide a finite, universal axiomatization of a theory of triangular numbers with open induction. This finite axiomatization of the theory of triangular numbers will be used in Section 4, to show that there exists a clause set that is refutable by a clause set cycle but that is not refutable by open induction. The result presented in this section is a generalization of the finite axiomatization for multiplication-free arithmetic with open induction provided by Shoenfield in .
Let , then by we denote the -th triangular number . By we denote the one-sorted first-order language consisting of the function symbols , , , . By we denote the language obtained by extending by a binary predicate symbol . The predicate symbol will be written in infix notation.
By we denote the theory axiomatized by
The standard model for this theory is denoted by . The model interprets the symbols in the natural way. The predicate symbol is interpreted as the graph of the triangle function i.e. the function associating with each natural number the triangular number .
The theory proves the following formulas
By we denote the theory .
Another simple but important observation is that for every formula of the language we have
We will now show that every formula is in equivalent to some formula that is “simple” in the following sense.
A term is simple if it is of the form , where . An atom (or ) is simple if both and are simple. A formula is simple if all of its atoms are simple.
A simple formula does in particular not contain the symbol . We start by examining how the symbol can be eliminated from a formula. Then obtaining a simple formula is just a matter of rewriting the formula with associativity, commutativity and the definition of .
Let be a term containing the symbol . Then by using associativity, commutativity and the definition of , it is possible in to permute the symbol inwards until it is directly above an occurrence of the symbol .
Having this in mind, let us now consider an atom containing at least one occurrence of the symbol . If is of the form , then by () the atom is equivalent to . We now permute an occurrence of inwards as described above until it is right above an outermost occurrence of . Now we apply (7) to obtain a formula each of whose atoms contain strictly less occurrences of the symbol . We iterate this procedure until we obtain a formula whose atoms do not contain the symbol .
Otherwise if is of the form , the situation is only slightly more complicated. We need to eliminate the occurrences of in in two steps. First if contains the symbol , then by () and () the formula is equivalent to . Using the same technique as above we eliminate an occurrence of on the left hand side of . The triangle atoms of the resulting formula all have at least one occurrence of less in the left hand side argument. We can thus iteratively eliminate all the occurrences of in the left hand argument of triangle atoms. In the second stage we repeat the above step but this time eliminating occurrences in the right argument of triangle atoms. Since there are no occurrences of in the left argument of triangle atoms, iterating this step will eventually result in a formula without occurrences of in triangle atoms. Finally we eliminate in the newly introduced equational atoms. We thus have obtained:
Let be a formula, then there exists a simple formula such that .
We have now everything at hand to start with the model theoretic considerations of the theory . In the following we fix an arbitrary model of the theory . Our aim is to show that is also a model of open induction over the language . By , , , , and we denote the respective interpretations of the symbols , , , , and in the model . We start with a few simple observations about the structure of the model .
Let , then we define if there exists such that . Accordingly we define if or . We say that and are comparable, if or .
It is not hard to see that comparability of elements is an equivalence relation. The equivalence classes together with form chains. Elements that are comparable with are called the natural numbers/standard elements of . The chain of standard elements is isomorphic to the chain of natural numbers. Elements that are not standard elements are called non-standard elements. A chain of non-standard elements is isomorphic to .
Let us summarize some basic properties of . Let be a non-standard element of , then . Thus by () the element is also a non-standard element. Hence by () we have for all . Consider now an element of the form . If and are both standard elements then it is clear that is a standard element. Now suppose that is a standard element and suppose without loss of generality that is not a standard element. Then there exists such that . By () we obtain which contradicts (). Hence must also be a natural number. To summarize we thus have:
Let be elements of
If is a non-standard element, then is a non-standard element.
If is a non-standard element and , then .
The element is a standard element if and only if and are standard elements.
We are now interested in the elements of which a formula is true in , we will also call such elements solutions of . Let be formula with , then by we denote the interpretation of in . In the following we will show that simple atomic formulas are either valid in or are true for only a finite number of comparable elements.
Let be a simple atomic formula, a vector of elements of
a vector of elements ofand , then either is valid in or has only finitely many solutions comparable with .
Depending on the form of we need to distinguish between two cases. If is of the form , then clearly is equivalent in to for some . The claim then follows from Lemma 1 in . If is of the form , then is equivalent in to for some and . We can consider two cases. If , then let with be two comparable solutions of . We have and . Therefore by we have . By and we obtain . By we then have . Hence we clearly have . Thus , hence is true. Hence is valid in .
Hence and since we obtain i.e. there are at most two comparable solutions. ∎
We are now ready to show that is a model of open induction over the language . The proof is analogous to the proof given in . For the sake of completeness we outline the main steps of the proof.
Let be a model of , then is a model of .
Let be a quantifier-free formula of , where is taken to be the induction variable and are all the other free variables occurring in . By Proposition 3 we can assume without loss of generality that is a simple formula. Let be a vector of elements of and let . Assume that is true and is valid in . Let be an arbitrary element of . If is a standard element, then we clearly have . Otherwise, since the atoms of are either valid or have at most finitely many solutions comparable with , we have by taking large enough (and thus by falsifying all non-valid atoms) . But we already now that is true, thus is true. Since , we apply the induction step times to obtain . ∎
Let be a formula, then if and only if .
4 Clause Set Cycles and Open Induction
In Section 2 we have shown that refutability by a clause set cycle is contained in the theory of induction. The next obvious question to ask is whether refutability by a clause set cycle is also contained in the theory of open induction. In this section we will provide a negative answer to that question by making use of the finite axiomatizability of the theory of triangular numbers with open induction shown in Section 3. In order to provide such a negative answer it suffices to provide a clause set which is refutable by a clause set cycle, but that is not refutable by open induction. A candidate clause set is readily found.
Let us denote by the language of the clause set . The clause set expresses that the triangle function is not total. We start by showing that is refutable by a clause set cycle. We have and . Hence i.e. satisfies condition (2). Now assume and let be arbitrary. Then we have . By the contrapositive of () we have . Therefore , i.e. satisfies (1). Since clause set cycles are trivially refuted by a clause set cycle, we thus have:
The clause set is refutable by a clause set cycle.
It now remains to show that cannot be refuted by open induction. In order to be able to make use of Theorem 3, we will now reformulate the clause set in terms of a theory of triangular numbers. In the following we denote by the theory axiomatized by the formulas () – ().
if and only if .
In order to complete the negative answer it clearly suffices to show that .
We proceed indirectly and assume that . By Theorem 3 we then also have . Since is a universal theory we can apply Herbrand’s theorem to obtain terms such that
Clearly is a model of and the triangle function is in . Since the terms , with describe linear functions in , there exists such that
The clause set is refutable by a clause set cycle and .
To summarize we thus have shown the following theorem.
There exists a language , and an clause set refutable by clause set cycles such that .
Since refutability by a clause set cycle is not contained in open induction, the next obvious question to ask is whether every clause set that is refutable with open induction is also refutable by a clause set cycle. We believe that this is not the case. Intuitively, this is can be explained by the following two points: first clause set cycles do not allow for any free variables and secondly the quantifiers introduced by clause set cycles are of the wrong polarity. These two shortcomings of clause set cycles can be demonstrated on the following example. We consider the usual right recursive definition of the addition and we want to prove the sentence . To prove with open induction, we first prove by open induction on the variable the inductive formula . The “lemma” can now be used to prove by instantiating the universally quantified variable by . In this example both ideas mentioned above came into play, that is, the “lemma” contains a free variable and it contains a universal quantifier that is actually used to prove .
There exists a language , and an clause set such that but is not refutable by a clause set cycle.
5 The n-Clause Calculus: A Case Study
In this section we will use the notion of clause set cycle in order to derive results about a concrete approach for AITP – the n-clause calculus. The n-clause calculus is a formalism for AITP that was introduced by Kersani and Peltier in . This calculus enhances a superposition calculus by a cycle detection mechanism. This mechanism detects a certain type of cyclic dependencies between the clauses that are derived during the saturation process. Such a cyclic dependency represents an argument by infinite descent and thus represents an unsatisfiable subset of the derived clauses. Once such a cycle is detected the refutation is terminated. The n-clause calculus operates on a syntactically restricted fragment of the logical formalism presented in Section 2. The languages in this section are assumed to contain at least one other sort, say , besides the sort of natural numbers. Furthermore, the languages should not contain any other function symbols of range besides and . By an n-clause we understand a clause of the form , where is a disjunction of atoms of the form and is a disjunction of literals of the form with and being terms of sort other than . The formula is called the constraint part of the n-clause. An -clause set is a conjunction of -clauses. For the sake of readability we will sometimes identify an n-clause set with the set of its conjuncts. The notion of “cycles” of the n-clause calculus is based on the following descent operator with .
Let , and an -clause with . Then we define with . For an -clause set we define .
Intuitively, the operation allows us to express that is replaced by the -th predecessor. The following lemma states a crucial property of the construction.
Let be clause set and , then we have .
The converse of the above entailment does not hold. However it holds in a theory that provides at least the injectivity of the successor function.
Let be a clause set and , then
We can now introduce the notions of cycle and of refutability by a cycle for the n-clause calculus. For the sake of brevity we consider a simplified variant of the n-clause calculus defined in . There is only one simplification that we impose that actually restricts the power of the formalism. The cycles presented in  rely on an a decidable entailment relation between clauses such that implies , where is an entailment relation for standard semantics. Instead we require the stronger condition that whenever the formalism in  requires . According to  the relation is intended to abstract relations such as syntactic equality or subsumption that also satisfy our stronger requirement. Therefore our restriction is practically irrelevant.
Let be an n-clause set. A triple with , and is a cycle for if for and . We say that is refuted by a cycle if there exists a cycle for and , for .
A cycle for a clause set is similar to an argument by induction with an offset and a step with . Accordingly, the conditions for correspond to the base cases, whereas the condition corresponds to the step case.
Cycles of the n-clause calculus are thus structurally similar to clause set cycles. As announced in Section 1 we will show that clause set cycles are an abstraction of the cycles of the n-clause calculus In order to show that every n-clause set refutable by a cycle is also refutable by a clause set cycle it essentially remains to show that the argument by induction with offset and step can be turned into an argument by structural induction.
Let be an -clause set refuted by a cycle, then is refuted by a clause set cycle.
Let be a cycle refuting . Consider the formula
It is not difficult to see that is logically equivalent to a clause. Since is a cycle, we have for . Therefore by instantiating by we obtain for . Hence we have .
Let , then we clearly have . Now let . Since is a cycle, we have . Thus by Lemma 6 we obtain . Therefore . We thus have shown that is a clause set cycle. Since we have and therefore . Now let , then since we have . ∎
By the above proposition refutability of an n-clause set by a cycle is also not stronger than induction. In the following we will show that an analogue of Theorem 4 also holds for the n-clause calculus. Let consist of the following -clauses.
Now assume that . Ignoring the sorts of the function symbols yields , where the language is obtained from the language by forgetting the sorts of the symbols. By replacing the constant by we then obtain
This implies thus contradicting Corollary 1.
There exists an -clause set refutable by cycles such that .
We have introduced the concept of clause set cycles and the notion of refutability by a clause set cycle. Clause set cycles abstract the analogous concepts of cycle and refutability by a cycle of the n-clause calculus. The main advantage of clause set cycles is their semantic nature, which makes them independent of any inference system. This independence of an inference system allows for a more general analysis of the properties of this type of cycle.
We have explained clause set cycles in terms of theories of induction. We first have shown that refutability by clause set cycles is contained in the theory of induction. On the other hand clause set cycles are not contained in the theory of open induction and we even conjecture that open induction is incomparable with the refutability by a clause set cycle. Finally we have transferred these results to the n-clause calculus. The results allow us to formally situate the strength of the n-clause calculus with respect to induction, where we formerly only had empirical evidence. The formal results described in this article improve our understanding of the strength of the approaches for AITP based on clause set cycles and help to direct further research.
As mentioned in the introduction the analysis of clause set cycles is part of a research program which aims at studying methods for automated inductive theorem proving in order to improve the theoretical foundations of this subject. One of the next questions to consider is how clause set cycles can be extended to handle multiple parameters, how this extension would impact the power of the formalism, and how the addition of parameters can be explained from the perspective of induction. Another question to consider is how the enhancement of superposition by structural induction presented by Cruanes in  is related to clause set cycles. We are also interested in fragments of the cyclic sequent calculi introduced by Brotherston and Simpson in . The inductive theorem prover “Cyclist”  is based on the cut-free cyclic sequent calculus, but it is yet unclear how the restriction to the cut-free fragment affects the power of the system.
-  James Brotherston, Nikos Gorogiannis, and Rasmus L. Petersen. A generic cyclic theorem prover. In Ranjit Jhala and Atsushi Igarashi, editors, Programming Languages and Systems, volume 7705 of Lecture Notes in Computer Science, pages 350–367. Springer Berlin Heidelberg, 2012.
-  James Brotherston and Alex Simpson. Sequent calculi for induction and infinite descent. Journal of Logic and Computation, 21(6):1177–1216, 10 2010.
Alan Bundy, Andrew Stevens, Frank van Harmelen, Andrew Ireland, and Alan
Rippling: A heuristic for guiding inductive proofs.Artificial Intelligence, 62(2):185 – 253, 1993.
-  Koen Claessen, Moa Johansson, Dan Rosén, and Nicholas Smallbone. Automating inductive proofs using theory exploration. In Maria Paola Bonacina, editor, Automated Deduction – CADE-24, volume 7898 of Lecture Notes in Computer Science, pages 392–406. Springer Berlin Heidelberg, 2013.
-  Simon Cruanes. Superposition with structural induction. In Clare Dixon and Marcelo Finger, editors, Frontiers of Combining Systems, volume 10483 of Lecture Notes in Computer Science, pages 172–188. Springer International Publishing, 2017.
M. Echenim and N. Peltier.
Combining induction and saturation-based theorem proving.
Journal of Automated Reasoning, pages 1–42, Mar 2019.
-  Stefan Hetzl and Tin Lok Wong. Some observations on the logical foundations of inductive theorem proving. Logical Methods in Computer Science, Volume 13, Issue 4, April 2018.
-  Abdelkader Kersani and Nicolas Peltier. Combining superposition and induction: A practical realization. In Pascal Fontaine, Christophe Ringeissen, and Renate A. Schmidt, editors, Frontiers of Combining Systems, volume 8152 of Lecture Notes in Computer Science, pages 7–22. Springer Berlin Heidelberg, 2013.
-  J. R. Shoenfield. Open sentences and the induction axiom. Journal of Symbolic Logic, 23(1):7–12, 1958.
-  Jannik Vierling. Cyclic superposition and induction. Master’s thesis, Technische Universität Wien, Austria, 2018.