Proof assistants are becoming widespread for formalization of theories both in computer science and mathematics. They provide rich logics with powerful type systems and machine-checked proofs which increase the confidence in the correctness in complicated and detailed proofs. However, they incur a significant overhead compared to pen-and-paper proofs.

This thesis describes work on bridging the gap between high-order proof assistants and firstorder automated theorem provers by extending the capabilities of the automated theorem provers to provide features usually found in proof assistants.

My first contribution is the development and implementation of a first-order superposition calculus with a polymorphic type system that supports type classes and the accompanying refutational completeness proof for that calculus. The inclusion of the type system into the superposition calculus and solvers completely removes the type encoding overhead when encoding problems from many proof assistants.

My second contribution is the development of SupInd, an extension of the typed superposition calculus that supports data types and structural induction over those data types. It includes heuristics that guide the induction and conjecture strengthening techniques, which can be applied independently of the underlying calculus.

I have implemented the contributions in a tool called Pirate. The evaluations of both contributions show promising results.

iii

Zusammenfassung

Beweisassistenten werden zunehmend in der Formalisierung von Theorien, sowohl in der Informatik als auch in der Mathematik, genutzt. Ihre vielseitigen Logiken mit ausdrucksstarken Typsystemen ermöglichen maschinenkontrollierte Beweise. Dies erhöht die Vertrauenswürdigkeit von komplizierten und detaillierten Beweisen. Im Gegensatz zu Papierbeweisen ist ihr Gebrauch jedoch aufwendiger.

Diese Dissertation beschreibt Fortschritte darin, den Abstand zwischen Beweisassistenten höherer Stufe und automatischen Beweissystemen erster Stufe zu schließen, indem automatische Beweissysteme so erweitert werden, dass sie die Möglichkeiten die Beweisassistenten bieten auch bereit stellen.

Der erste Beitrag ist die Erweiterung des Superpositionskalküls erster Stufe um ein polymorphes Typsystem, das Typklassen unterstützt. Die Erweiterung beinhaltet einen Beweis der Widerlegungsvollständigkeit. Das Typsystem als Teil des Superpositionskalkül ermöglicht die Übertragung von Problemen aus Beweisassistenten ohne den sonst üblichen Mehraufwand durch Typenenkodierung.

Der zweite Beitrag ist die Entwicklung von SupInd, einer Erweiterung von Superposition, die Datentypen und strukturelle Induktion über diese Datentypen ermöglicht. SupInd beinhaltet Heuristiken, die die Induktion lenken und Annahmenverstärkungstechniken, die auch unabhängig des Kalküls benutzt werden können.

Die Beiträge wurden im Tool Pirate umgesetzt, die Evaluationen zeigen vielversprechende Ergebnisse. v

Introduction

This thesis describes work on bridging the gap between high-order proof assistants and first-order automated theorem provers by extending the capabilities of automated theorem provers to provide features generally found in proof assistants.

Motivation

Proof assistants are becoming widespread for formalization of theories both in computer science and mathematics. They provide rich logics with powerful type systems and machine-checked proofs which increase the confidence in the correctness in complicated and detailed proofs. However, despite their rising popularity, proof assistants can have a significant overhead compared to theorem proving with pen-and-paper and require significant interaction of the user of such an proof assistant.

Automated theorem provers on the other hand provide push-button automation to theorem proving that requires no user interaction. Their main disadvantage is that the most successful of them can only prove theorems in (untyped) first-order logic without many of the conveniences and features that proof assistants provide. As part of the preparatory phase of the Graduate School of Computer Science, I extended SPASS to support a monomorphic type system [START_REF] Blanchette | More SPASS with Isabelle[END_REF]. SMT-solvers and superposition provers like Vampire also support monomorphic type systems [START_REF] De Moura | Z3: An efficient SMT solver[END_REF][START_REF] Erkök | Using Yices as an automated solver in Isabelle/HOL[END_REF][START_REF] Kovács | First-order theorem proving and vampire[END_REF][START_REF] Reynolds | Induction for SMT solvers[END_REF].

Proof assistants can harness the power of automated theorem provers by encoding their rich structure into the first-order logic that automated theorem provers can process [START_REF] Armand | A modular integration of SAT/SMT solvers to Coq through proof witnesses[END_REF][START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF]. This process has two main phases. First, higher-order features are encoded into first-order constructors. After the removal of higher-order features, the proof assistant's type system has to be encoded into a type system that the automated theorem prover supports.

This has several drawbacks. For one, it is generally acknowledged that encodings add extra structure into the problem which then complicates the tasks for the automated theorem provers [START_REF] De Moura | Lost in translation: how easy (automated reasoning) problems become hard due to bad encodings[END_REF]. This can drastically reduce their success rate. Even worse, not all encodings lead to proofs that can be reconstructed in a proof assistant [START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF]. For example, the simple definition of reverse over the data type of list over natural numbers can be defined as the following, where @ is the list append written in infix notation and [. . . ] denotes the singleton list:

data type N -list : nil | cons(N , N -list) rev(nil) = nil rev(cons(X N , XS N -list )) = rev(XS N -list )@[X N ]
When encoding this to untyped first-order logic (via the so called type guards encoding) two predicates (p N and p N -list ), must be introduced to encode if a term is of the natural numbers or 1 a list. Additionally, axioms must be added to specify which terms are of the type the predicate corresponds to. The two simple equations encoded into untyped first-order logic then become the following formulas:

p N -list (nil)

p N (X) ∧ p N -list (XS ) ⇒ p N -list (cons(X, XS )) rev(nil) = nil p N (X) ∧ p N -list (XS ) ⇒ rev(cons(X, XS )) = rev(XS )@[X]

p N (X) ∧ p N -list (XS ) ⇒ p N -list (rev(X, XS ))

This encoding also loses information. In a proof assistant, the two equations that define the list reverse (rev) are implicitly oriented from left to right, i.e. in the order of rev's computation. This information about orientation is lost by the translation into untyped fist-order logic. Even worse, the recursive equation turns into a clause with three literals, making simplification via simple equational rewriting impossible. Furthermore, the information that N -list is a data type is also lost. Even by adding further formulas, that information can only be partially encoded, because induction (an essential property of data types) cannot be finitely first-order axiomatized.

The challenge posed by the significant overhead that encodings involve is further strengthened by the fact that automated theorem provers are designed to find theorems, but have trouble showing that sets of axioms are satisfiable. Whereas proof assistants generally have a vast set of axioms where only a small (a priori unknown) subset is relevant to proving a theorem. Thus, any proof obligation passed to an automated theorem prover will contain hundreds of irrelevant axioms and a handful of necessary ones. Ideally, we want to pass as many axioms as possible to the automated theorem provers, because it is hard to determine which axioms are irrelevant. The fewer encodings an automated theorem prover has to handle, the more likely it is that it does explore the relevant axioms, thereby finding a proof.

As mentioned, a further difference between automated theorem provers and proof assistance is the support of data types and induction over them. For example, the property that the reverse of the reverse of a list is the equal to the original list rev(rev(XS )) = XS is not a first-order consequence of the defining equations of rev but it is an inductive consequence. Since induction cannot be finitely axiomatized, support of induction inside the automated theorem provers is useful for any integration into a proof assistant.

Contributions

This thesis describes work on two main contributions toward bridging the gap between proof assistants and automated theorem provers.

The first contribution of this thesis is the development and implementation of a first-order superposition calculus with a polymorphic type system that supports type classes and the accompanying refutational completeness proof for that calculus. The inclusion of the type system into the superposition calculus removes the type encoding overhead when encoding problems from proof assistants such as the high-order logic proof assistant family (HOL) to this version of superposition (the encoding overhead for higher-order features remain). The HOL family is comprised of, among others, Isabelle/HOL, HOL4, HOL Light and ProofProver-HOL [START_REF] Gordon | Introduction to HOL: A Theorem Proving Environment for Higher Order Logic[END_REF][START_REF] Harrison | HOL Light: An overview[END_REF][START_REF] Nipkow | Isabelle/HOL: A Proof Assistant for Higher-order Logic[END_REF]. Furthermore, I proved that superposition extended with the polymorphic type system that supports type classes is still refutationally complete. The evaluation of my implementation -Pirateshows that the polymorphic calculus is superior to the usage of type encodings. The evaluation also shows that the polymorphic calculus it is competitive with it the simpler monomorphic type system, even though it is more expressive than the monomorphic encoding.

My second contribution is the development of the SupInd calculus, an extension of typed superposition that allows for recursive data types and structural induction over those data types. SupInd features a novel heuristic that guides the application of induction to promising positions while employing a technique that mitigates the result of irrelevant induction steps. I have also developed two new conjecture strengthening heuristics (and adapted an existing one) that can be applied independently of the underlying SupInd calculus. I also present an optimized variant of SupInd that avoids (some) unnecessary inferences and is capable of detecting and removing invalid conjectures and propositions. I have implemented SupInd in a specialized version of Pirate with promising evaluation results on two standard benchmark sets.

Structure of This Thesis

The structure of this thesis is as follows:

• Chapter 2 introduces the necessary background on first-order logic as well as the superposition calculus, which underlies many successful automated theorem provers.

• Chapter 3 describes the polymorphic first-order logic, including syntax with unification, typing rules, semantics and the necessary transformations using clausification and Skolemization. It also contains the proof that superposition is refutationally complete for that polymorphic logic.

• Chapter 4 describes SupInd, an extension of superposition to handle structural induction and conjecture strengthening techniques. It also includes the discussion on the developed heuristics and strengthening techniques.

• Chapter 5 summarizes my results and outlines future research opportunities.

Even though induction extends on the type system chapter, chapters 3 and 4 can be read in any order. The evaluations and related work is presented at the end of each chapter.

Preliminaries

The rest of this thesis requires knowledge of first-order logic and superposition [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF], which will be introduced in this chapter. The first-order logic introduced in this chapter is the standard, untyped version of first-order logic. It is implemented by many automated theorem provers. The text of this introductory section is heavily based on Weidenbach's script of the automated reasoning lecture given at Saarland University [START_REF] Kosta | Automated reasoning[END_REF] with some adaptions from Bachmair and Ganzinger [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF].

First, I will present the untyped first-order logic language with build-in equations (Sect. 2.1) and then the superposition calculus, including the necessary machinery and the refutational completeness proof (Sect. 2.2). The refutational completeness proof for superposition will then be extended to the typed case in chapter 3 and further with (structural) induction in chapter 4.

Untyped First-Order Logic

In this section, I formally describe the syntax and semantics of untyped, equational first-order logic. I will not provide the rules for predicates in our logic as both their rules are similar to those of functions and it is generally known that predicates can be expressed as functions combined with a special truth value.

Syntax

The syntax determines the allowed expressions and how they are built. It consists of the signature that declares the used symbols and their properties and the rules how to form terms, clauses and formulas and the syntactic operations of substitution and unification. Definition 2.1.1.1 (Signature). A signature fixes a set of non-logical symbols used to construct the terms and formulas. A signature Σ for untyped, equational first-order is the set S F , where

• S F is a set of function symbols f with arity ≥ 0, written as arity( f ) = m;

• S P is a set of predicate symbols p with arity ≥ 0, written as arity(p) = m;

From the symbols in the definitions of the signature terms can be build. Definition 2.1.1.2 (Terms). Let Σ be a signature and X be a given at most countably infinite set of term variables. Then all untyped terms T Σ (X ) are recursively defined as follows:

1. Every term variable in X is a term.

2. For all function symbols f ∈ S F with arity( f ) = m if t 1 ,. . . ,t m are terms then f (t 1 ,. . . ,t m ) is also a term.

A term is ground if it contains no variables. A function (symbol) is a constant if it has no arguments, for terms only consisting of a constant I also use f instead of f (). I will use s, t for terms, f for function symbols and u, v for term variables.

A position p in a term t is a list of natural numbers [p 1 , . . . , p n ] and is defined as pos([p 1 , . . . , p n ], f (t 1 , . . . , t m )) = pos([p 2 , . . . , p n ], t p 1 ) and pos([], t) = t. I write t[s] p to denote that the term s is placed at position p in another term t. Definition 2.1. 1.3 (Formulas). Let Σ be a signature. Then all untyped formulas F Σ (X ) are recursively defined as follows:

1. ⊥ 2.

3. p(t 1 , . . . , t m ) if p ∈ S P , t 1 , . . . , t m ∈ T Σ (X ) and arity(p

) = m 4. s ≈ t if s, t ∈ T Σ (X ) 5. ¬φ if φ ∈ F Σ (X ) 6. φ ∧ ψ if φ, ψ ∈ F Σ (X ) 7. φ ∨ ψ if φ, ψ ∈ F Σ (X ) 8. φ → ψ if φ, ψ ∈ F Σ (X ) 9. φ ↔ ψ if φ, ψ ∈ F Σ (X ) 10. ∀u. φ if φ ∈ F Σ (X ) 11. ∃u. φ if φ ∈ F Σ (X )
Let Q be either ∀ or ∃. Then for a (sub)formula Qu. φ the variable u is bound within φ. A formula where all variables are bound, i.e. have a corresponding quantifier, is called closed. The formulas constructed by 1-4 are atomic formulas. Atomic formulas and their negations (¬) are literals.

Definition 2.1.1.4 (Clauses). A clause is a disjunction of one or more literals without any quantifiers. I consider all variables of a clause to be implicitly universally quantified.

The clause consisting only of ⊥ is called the empty clause. Formulas and clauses are ground if they contain no variables. I will use φ, ψ for formulas, C, D for clauses and N for clause sets.

Substitutions Here, I introduce substitutions for variables, terms and clauses. Definition 2.1.1.5 (Variable Substitutions). A substitution is a mapping from variables (X ) to terms (T Σ (X )).

I will use σ, θ for substitutions and write them as σ = {u 1 → t 1 , . . . }, where all u i are pairwise distinct, and define them to be:

σ(v) = t i if v = u i v otherwise
I also write vσ for σ(v). A substitution σ is updated to return t for u by

σ[u → t](v) = t if v = u σ(v) otherwise
Definition 2.1.1.6 (Term Substitutions). Substitutions are extended to non-variable terms by f (t 1 , . . . , t m )σ = f (t 1 σ, . . . , t m σ) Definition 2.1.1.7 (Clause Substitutions). Substitutions are similarly extended to clauses by 1. ⊥σ = ⊥ 2. σ = 3. p(t 1 , . . . , t m )σ = p(t 1 σ, . . . , t m σ) 4. (s ≈ t)σ = sσ ≈ tσ 5. (¬(s ≈ t))σ = ¬(sσ ≈ tσ ) 6. (φ ∨ ψ)σ = (φσ ∨ ψσ) I do not need substitutions for formulas so I only define them for clauses.

Unification Unification describes the obligation to find a substitution σ such that for two terms s and t it holds that sσ = tσ . A substitution σ 1 is a more general unifier than the substitution σ 2 if there exists a substitution σ 3 such that for all terms t: tσ 2 = tσ 1 σ 3 . A substitution is the most general unifier (mgu) if for all σ 2 there exists a substitution σ 3 such that for all terms t: tσ 2 = tσ 1 σ 3 . It is well known that if two (untyped first-order) terms are unifiable, then they have a unique most general unifier (up to renaming of the variables).

Semantics

The semantics gives meaning to the constructs that can be build with a given syntax. It consists of the structure and the interpretations. I will also define the notion of satisfiability here. Interpretations The meaning of a variable is given by a valuation. A variable valuation (V) is a mapping X → U and is always relative to a Σ-structure. I leave this relation implicit. A valuation V is updated to return e for u by

V[u → e](v) = e if v = u V(v) else
Definition 2.1.2.2 (Interpretations of Terms). Valuations are extended to interpretations of terms (T Σ (X ) → U) by the following

I V (u) = V(u) I V ( f (t 1 , . . . , t m )) = f I (I V (t 1 ), . . . , I V (t m ))
where f I ∈ I F is the function corresponding to the function symbol f ∈ S F and m its arity (and equivalently for p I ∈ I P ).

An interpretation I V is term-generated, if for every e ∈ U there exists a ground term t ∈ T Σ ( / 0) such that e = I V (t). Definition 2.1.2.3 (Interpretations of Formulas). Based on the interpretations of terms, the interpretation of formulas is given by the following

I V (⊥) = 0 I V ( ) = 1 I V (p(t 1 , . . . , t m )) = p I (I V (t 1 ), . . . , I V (t m )) I V (s ≈ t) = 1 ⇔ I V (s) = I V (t) I V (¬φ) = 1 -I V (φ) I V (φ ∧ ψ) = min(I V (φ), I V (ψ)) I V (φ ∨ ψ) = max(I V (φ), I V (ψ)) I V (φ → ψ) = max(1 -I V (φ), I V (ψ)) I V (φ ↔ ψ) = 1 ⇔ I V (φ) = I V (ψ) I V (∀x.φ) = min e∈U (I V[x →e] (φ)) I V (∃x.φ) = max e∈U (I V[x →e] (φ))
A formula φ is valid in the interpretation I V (I V is a model of φ) if I V φ ⇔ I V (φ) = 1. A formula φ entails a formula ψ (φ ψ) if for all interpretations I V it holds that I V φ implies I V ψ. A formula φ is satisfiable if and only if there exists an interpretation I V such that I V φ. If there exists no such interpretation the formula is unsatisfiable. I call an interpretation a model of a clause (formula) set N if and only if all clauses (formulas) of that set are true under that interpretation.

Clausification and Skolemization

Superposition is defined on implicitly universally quantified clauses. Thus, in order to apply superposition to arbitrary formulas existential quantification must be removed and the formulas must be transformed to clauses.

A formula is in prenex normal form if all quantifiers are at the top of a quantifier-free formula, i.e. the formula has the form Q 1 u 1 . . . . Q n u n . φ where each Q i is either ∃ or ∀ and φ is quantifierfree. Any formula can be translated (=⇒ P ) to an equivalent formula in prenex normal form. Skolemization replaces the existential quantifiers by a choice function (often called Skolem function), which computes the existential quantifier. The choice of what the existential quantifier chooses depends only on the quantifiers above it or alternatively on the all free variables below it.

Those variables turn into the arguments of the Skolem function. I apply Skolemization first to the top most existential quantifier of a formula in prenex normal form. This existential quantifier only depends on the universal quantifiers above it. The Skolem transformation (=⇒ S ) then is ∀u 1 . . . ∀u m . ∃u.φ =⇒ S ∀u 1 . . . ∀u m . φ{u → f (u 1 , . . . , u m )}

where n ≥ 0 and f is a fresh (Skolem) function symbol of arity m that is not present in the signature (S F ). The transformation also adds the function symbol f to the signature. The resulting formula of the Skolem transformation is not equivalent to the original formula, because the signature has changed. It is guaranteed that the original formula is satisfiable in the original signature if and only if the formula produced by the Skolem transformation is satisfiable in the extended signature. Clause normal form transformation (⇒ CNF ) translates a prenex normal formula without existential quantifiers into an equivalent set of clauses. The set of clauses is then interpreted as an n-ary conjunction. I will not focus on clausification but note that any set of formulas can be transformed in an equisatisfiable set of clauses by transforming each formula via performing prenex normal form transformation followed by exhaustive application of Skolemization and then applying clause normal form transformation.

Superposition

Superposition [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF] is one of the most successful calculi for untyped equational first-order logic. It is refutationally complete for first-order logic and a decision procedure for various first-order logic fragments. Superposition is usually untyped, but there are variants which support (monadic) sorts, e.g. the version underlying SPASS [START_REF] Weidenbach | Combining superposition, sorts and splitting[END_REF]. Because of it success in automatically solving first-order problems, superposition-based theorem provers are important backend tools to attempts to automate higher-order proof assistants, e.g. for tools such as Sledgehammer [START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF]. The one guiding theme of this research is to make superposition more suitable for such a integration.

Literal and Clause Orderings

The superposition calculus is parameterized by orderings on terms, literals and clauses [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF]. They are used to decrease the necessary search space by restricting the inferences to the largest literals and terms. Definition 2.2.1.1 (Admissible Literal Ordering). Following Bachmair and Ganzinger's definition [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF], an ordering on literals is admissible if 1. it is total on ground literals, 2. its restriction to terms is a reduction ordering and 3. closed under substitutions: for all literals L and L and all substitutions σ it holds that L L implies Lσ L σ 4. for all literals L and L it holds that L L if a) max(L) max(L ) where max is the maximal term of a literal or b) max(L) = max(L ) where L is negative and L is positive I call a literal L in a clause C ∨ L maximal if there is a substitution σ such that Lσ L for all literals L in C . I call a literal L in a clause C ∨ L strictly maximal if there is a substitution σ such that Lσ L for all literals L in C .

Definition 2.2.1.2 (Admissible Clause Ordering). Again, following Bachmair and Ganzinger definition [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF], an ordering on clauses is admissible if 1. it is well-founded, 2. irreflexive and 3. closed under substitutions: for all clauses C and C and all substitutions σ it holds that C C implies Cσ C σ 4. for all clauses C and C it holds that C C if a) max(C) max(C ) where max is the maximal literal of a clause.

Term Orderings

Term orderings are used to restrict the direction of superposition inferences to replacing terms only with other terms that are not larger. The term orderings that are used are usually lifted to an ordering on literals by assigning the literal s ≈ t the multiset {s, t} and the literal s ≈ t (also written as ¬s ≈ t) the multiset {s, s, t, t}. Then the multiset extension of the term ordering is used for the literal ordering. Similarly, clauses are ordered by considering them as multisets of literals and using the multiset extension of the literal ordering. Clause and literal ordering lifted in this way from reduction orderings are admissible [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF].

Reduction Orderings

A reduction ordering (as defined by Baader and Nipkow [3, p. 102]) is a well-founded rewrite ordering. A total reduction ordering is also a simplification ordering, i.e. subterms are smaller than superterms. A (total) reduction ordering thus is a (total) well-founded strict ordering and is 1. (total: for all s 1 , s 2 ,

s 1 s 2 ∨ s 2 s 1 ∨ s 1 = s 2 )
2. irreflexive: for all s 1 , ¬(s 1 s 1 )

3. transitive: for all s 1 , s 2 , s 3 , s 1 s 2 ∧ s 2 s 3 =⇒ s 1 s 3 [START_REF] Bachmair | On restrictions of ordered paramodulation with simplification[END_REF]. compatible with Σ-operations: for all t 1 , . . . , t m , s 1 , s 2 ∈ T Σ (X ) and all m ≥ 0 and all function symbols f of arity m, s 1 s 2 implies f (t 1 , . . . , s 1 , . . . , t m ) f (t 1 , . . . , s 2 , . . . , t m )

5. closed under substitutions: for all s 1 , s 2 ∈ T Σ (X ) and all substitutions σ, s 1 s 2 implies s 1 σ s 2 σ

Simplification Orderings

A simplification ordering is a reduction ordering that has the subterm property, i.e. all subterms are smaller than their superterms.

Knuth-Bendix Ordering The Knuth-Bendix Ordering (KBO) [START_REF] Knuth | Simple word problems in universal algebras[END_REF] is a widely used simplification ordering, especially in superposition-based automated theorem provers. I present the KBO adapted from Baader and Nipkow [3, p. 124].

Let |t| u denotes how often the variable u occurs in the term t. Let > f be a strict ordering on the function symbols and let w be a weight function with the following properties:

1. There exists w 0 ∈ R + \{0} such that for all variables u, w(u) = w 0 for all constant symbols f , w( f ) ≥ w 0 2. If f is a unary function symbol with weight w( f ) = 0, then f is the greatest element with respect to > f

The weight function w is extended to terms by w( f (t 1 , . . . , t n )) = w( f ) + w(t 1 ) + • • • + w(t n ). I define s KBO t to hold if and only if:

1. For all term variables u: |s| u ≥ |t| u and w(s) > w(t), or 2. For all term variables u: |s| u ≥ |t| u and w(s) = w(t), and one of the following: a) There exists a unary function symbol f , a variable u and a positive integer n such that s = f n (u) and t = u b) There exist functions symbols f , g such that f > f g and s = f (s 1 , . . . , s n f ) and t = g(t 1 , . . . , t n g ) c) There exists a function symbol f and an index i, 1 ≤ i ≤ n, such that s = f (s 1 , . . . , s n ), t = f (t 1 , . . . , t n ) and s 1 = t 1 , . . . , s i-1 = t i-1 and s i KBO t i

For untyped first-order superposition reduction orderings that are total on ground terms are sufficient. The Knuth-Bendix Ordering is widely used for automated theorem proving, because it is well-behaved, i.e. no matter the chosen parameters, syntactically smaller terms tend to be smaller than (significantly) larger terms.

The Superposition Calculus

The superposition calculus is designed to establish whether a set of first-order clauses is unsatisfiable. It is refutationally complete, that is, it terminates if the clause set is unsatisfiable, but the calculus may or may not terminate if it is satisfiable. The superposition calculus I present here consist of four inference rules. The calculus operates on a set of clauses and exhaustively applies the inferences until either no inferences are applicable or the empty clause has been derived. Superposition requires clause-, literal-and term orderings and a selection functions. The selection function, selects a (possibly empty) subset of literals of each clause. Selection overrides the maximality restrictions of the side conditions of the superposition calculus' inferences.

In order to use superposition to prove that a conjecture formula is a consequence of a set of axiom formulas, the conjecture formula must be negated and the negated formula must be added to the axiom set. As described above, the extended set is then transformed to an equisatisfiable set of clauses. If the clause set unsatisfiable, then the conjecture formula follows from the axiom formulas, because its negation is unsatisfiable together with the axioms. If no further inference can be applied and the empty clause has not been derived, the clause set is satisfiable. Each inference has one or two clauses as premise and produce a new clause, which is smaller according to the clause ordering. The calculus allows redundancy elimination, the removal of clauses that are implied by smaller clauses. I present the inference rules and side condition of the superposition calculus adapted from Bachmair and Ganzinger [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF].

Positive Superposition only if conditions 2-8 hold

D ∨ t ≈ t C ∨ s[s 2 ] p ≈ s (D ∨ C ∨ s[t ] p ≈ s )σ (PSup)
Equality Factoring only if conditions 1-3 and 10 hold

C ∨ s ≈ s ∨ t ≈ t (C ∨ t ≈ s ∨ t ≈ s )σ (EF)
Negative Superposition only if conditions 2-6 and 9 hold

D ∨ t ≈ t C ∨ s[s 2 ] p ≈ s (D ∨ C ∨ s[t ] p ≈ s )σ (NSup)
Equality Resolution only if conditions 9 and 11 hold

C ∨ s ≈ s C σ (ER)
Let ≺ be a fixed reduction order that is total on ground terms. I refer to s[s 2 ] p also as s.

1. σ is the mgu of s and t 2. sσ s σ 3. tσ t σ 4. s 2 is not a term variable 5. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ, nothing selected 6. σ is the mgu of t and s 2 7. (s ≈ s )σ is strictly maximal in (C ∨ s ≈ s )σ, nothing selected 8. tσ ≈ t σ sσ ≈ s σ 9. ((s ≈ s )σ is maximal in (C ∨ s ≈ s )σ, nothing selected) ∨ s ≈ s selected 10. (t ≈ t )σ is maximal in (C ∨ s ≈ s ∨ t ≈ t )σ, nothing selected 11. σ is the mgu of s and s

Redundancy Redundancy elimination is a critical feature of the superposition calculus. A clause C is redundant with respect to a clause set N if it is implied by clauses in N that are smaller than C (according to the clause ordering). Redundancy elimination enables many simplifications such as rewriting, subsumption and others without sacrificing refutational completeness. I will denote the (possibly infinite) set of clauses that is redundant with respect to a clause set N by Red(N). Note that Red(N) may contain clauses not contained in N, i.e. Red(N) is not necessarily a subset of N. A clause set N is saturated with respect to redundancy if any clause that can be derived from N with one of the four inference rules is an element of N ∪ Red(N).

Refutational Completeness

In this section I will show the proof that if a clause set is unsatisfiable, then the empty clause will be derived, i.e. the proof that the calculus is refutationally complete. The completeness proofs for first-order logic are based on the refutational completeness of the ground case, then extending it to the non-ground case by lifting and model construction. Again, I heavily base the description on the script of the automated reasoning lecture given at Saarland University [START_REF] Kosta | Automated reasoning[END_REF]. The proofs given here are based on a simplification of Waldmann's refutational completeness proof [START_REF] Waldmann | Cancellative abelian monoids and related structures in refutational theorem proving (part i)[END_REF][START_REF] Waldmann | Cancellative abelian monoids and related structures in refutational theorem proving (part ii)[END_REF] itself an extension of Nieuwenhuis refutational completeness proof for constrained superposition [START_REF] Nieuwenhuis | Theorem proving with ordering and equality constrained clauses[END_REF] and Bachmair and Ganzinger's refutational completeness proof [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF]. I will not introduce the constraints of constrained superposition, but use the same proof layout as Waldmann, i.e. a single induction proof for model construction.

For the remaining section, I need to talk about ground instances of clauses and clause sets so I define the following notation for them. Let C be a clause. Then G Σ (C) is the set of all ground instances of that clause. Let N be a set of clauses. Then G Σ (N) is the set of all ground instances of all clauses in N.

Construction of Ground Candidate Interpretations

The construction of candidate interpretations of saturated sets and the corresponding lemmas follow the description of Bachmair and Ganzinger [START_REF] Bachmair | Rewrite-based equational theorem proving with selection and simplification[END_REF] and Weidenbach [START_REF] Kosta | Automated reasoning[END_REF]:

Let N be a set of clauses not containing the empty clause. Using induction on the clause ordering c , the sets of rewrite rules E C and R C for all C ∈ G Σ (N) are defined as follows:

Assume that E D has already been defined for all D ∈ G Σ (N) with D ≺ c C. Then R C = D≺ c C E D .

The set E C contains the rewrite rule s → t, if Proof. Obviously, s t for all rules s → t in R C and R ∞ . Furthermore, it is easy to check that there are no critical pairs between any two rules: Assume that there are rules u → v in E D and s → t in E C such that u is a subterm of s. As is a reduction ordering that is total on ground terms, I get u ≺ s and therefore D ≺ c C and E D ⊆ R C . But then s would be reducible by R C , contradicting condition [START_REF] Bachmair | Equational reasoning in saturation-based theorem proving[END_REF].

1. C = C ∨ s ≈ t, 2. s ≈ t is strictly maximal in C, 3. s t, 4. C is false in R C , 5. C is false in R C ∪ {s → t}, 6.

Lifting to Variables

with the main differences that I extracted Lemma 2.2.4.5 from Lemma 2.2.4.8, which it was previously part of. This makes the proofs in the typed cases simpler, because Lemma 2.2.4.8 can remain unmodified. The lemma can remain unmodified, because all its assumptions are extracted into individual lemmas. Then only the lemmas for the assumptions, need to be shown again for the typed case.

For the refutational completeness proof to succeed, two main assumptions must hold for variables. First, variable instances must be closed under rewriting with R Cθ , i.e. it must be possible to instantiate a variable to all terms that its instances can be rewritten to. Second, inferences from ground-substituted clauses must be instances of inferences of the non-ground clauses. These properties are expressed in the following three lemmas. With the help of these three lemmas, the remaining proof of the Model Construction Lemma is independent of how variables are actually defined, i.e. if they are untyped or restricted by types. Lemma 2.2.4.5 (Variable instances are closed under rewriting with R Cθ ). Let C ∈ N and θ be a substitution such that Cθ ∈ G Σ (C) and u be a variable occurring in C. If uθ → R Cθ t then there exists a θ such that uθ = t and Cθ ∈ G Σ (C). Lemma 2.2.4.6 (Lifting Lemma for the equality resolution and equality factoring inferences [START_REF] Kosta | Automated reasoning[END_REF]).

Let C be a clause and let θ be a substitution such that Cθ is ground. Then every equality resolution (or equality factoring) inference of Cθ is an instance of an equality resolution (or equality factoring) inference from C. Lemma 2.2.4.7 (Lifting Lemma for the superposition inferences [START_REF] Kosta | Automated reasoning[END_REF]). Let C = C ∨ s ≈ s and D = D ∨ t ≈ t be two clauses without common variables and let θ be a substitution such that Cθ and Dθ are ground. If there is a superposition inference between Cθ and Dθ where sθ and some subterm of tθ are overlapped and sθ does not occur in tθ at or below a variable position of t, then the inference is an instance of a superposition inference from C and D.

Model Construction

The model construction shows that any saturated (with respect to redundancy) set of clauses that does not contain the empty clause has a term-generated model. Theorem 2.2.4.8 (Model Construction [START_REF] Kosta | Automated reasoning[END_REF]). Let N be a set of clauses that is saturated up to redundancy and does not contain the empty clause. Then for every ground clause Cθ ∈ G Σ (N) it holds that:

1. E Cθ = / 0 if and only if Cθ is true in R Cθ .

2. If Cθ is redundant with respect to G Σ (N), then it is true in R Cθ .

3. Cθ is true in R ∞ and in R D for every D ∈ G Σ (N) with D C Cθ Proof. The following proof of the theorem does not consider selection. It uses case distinction and induction on the clause ordering C and assume that 1-3 are already satisfied for all clauses in G Σ (N) that are smaller than Cθ. Note that the "if" part of condition 1 is obvious from the construction and that condition 3 follows immediately from condition

E Dθ ⊆ R Cθ . Let Dθ = D θ ∨ tθ ≈ t θ with E Dθ = {tθ → t θ}. Since Dθ is productive, D θ is false in R Cθ .
Besides, by condition 2 of the induction hypothesis, Dθ is not redundant with respect to G Σ (N), so D is not redundant with respect to N. Note that tθ cannot occur in sθ at or below a variable position of s since otherwise Cθ would be subject to Case 2 above. Thus, the left superposition inference

D θ ∨ tθ ≈ t θ C θ ∨ sθ[tθ] ≈ s θ D θ ∨ C θ ∨ sθ[t θ] ≈
inference C θ ∨ tθ ≈ t θ ∨ sθ ≈ s θ C θ ∨ t θ ≈ s θ ∨ tθ ≈ t θ
From the Lifting Lemma (Lemma 2.2.4.6) it follows that this inference is a ground instance of an inference from C. The conclusion is smaller since the negative literal contains the smaller term and the positive literal stays unchanged. Thus, by the induction hypothesis we known that the conclusion is true in R Cθ . C θ must be false (or Cθ would be true) and t θ = s θ implies that t θ ≈ s θ and thus C θ ∨ t θ ≈ s θ must be also false. For the conclusion to be true, tθ ≈ t θ must be true in R Cθ and thus sθ ≈ s θ (and therefore Cθ) must be true.

b) sθ ≈ s θ is strictly maximal in Cθ and sθ is reducible. Suppose that sθ ≈ s θ is strictly maximal in Cθ and sθ is reducible by some rule in E Dθ ⊆ R Cθ . Let Dθ = D θ ∨ tθ ≈ t θ and E Dθ = {tθ → t θ}. Since Dθ is productive, Dθ is not redundant and D θ is false in R Cθ . We can now proceed in essentially the same way as in Case 3b: We know that tθ does not occurred in sθ at or below a variable position of s, because then Cθ would be subject to Case 2 above. Thus, the right superposition inference iii. C θ can be true in R Cθ ∪ {sθ → s θ}.

D θ ∨ tθ ≈ t θ C θ ∨ sθ[tθ] ≈ s θ D θ ∨ C θ ∨ sθ[t θ] ≈
In the first two cases there is nothing to show. Let us therefore assume that Cθ is false in R Cθ and C θ is true in R Cθ ∪ {sθ → s θ}. Then C θ = C θ ∨ tθ ≈ t θ, where the literal tθ ≈ t θ is true in R Cθ ∪ {sθ → s θ} and false in R Cθ . In other words, tθ ↓ R Cθ ∪sθ→s θ t θ, but not tθ ↓ R Cθ t θ. Consequently, there is a rewrite proof of tθ → * u ← * t θ by R Cθ ∪ {sθ → s θ} in which the rule sθ → s θ is used at least once. Without loss of generality, assume that tθ t θ. Since sθ ≈ s θ L tθ ≈ t θ and sθ s θ I can conclude that sθ tθ t θ. Then there is only one possibility how the rule sθ → s θ can be used in the rewrite proof: sθ = tθ must hold and the rewrite proof must have the form tθ → s θ → * u ← * t θ, where the first step uses sθ → s θ and all other steps use rules from R Cθ . Consequently, s θ ≈ t θ is true in R Cθ . Then there is an equality factoring inference

C θ ∨ tθ ≈ t θ ∨ sθ ≈ s θ C θ ∨ t θ ≈ s θ ∨ tθ ≈ t θ
From the Lifting Lemma (Lemma 2.2.4.6) we know that it is a ground instance of an equality factoring inference of C. The conclusion is smaller because sθ tθ t θ and sθ s θ. The conclusion of the ground inference is true in R Cθ since the clause set it saturated up to redundancy and because of the induction hypothesis. Since the literal t θ ≈ s θ must be false in R Cθ , the rest of the clause must be true in R Cθ , and therefore Cθ must be true in R Cθ .

Refutational Completeness

Now, the actual refutational completeness theorems for superposition remain. Refutational completeness exists in two flavors. The first flavor is static refutational completeness, which means that a saturated clause set has a model if and only if it does not contain the empty clause. The second flavor is dynamic refutational completeness, which means that for any unsatisfiable clause set, under some fairness restrictions, any sequence of inference steps eventually derives the empty clause. Again, I follow the presentation from Weidenbach [START_REF] Kosta | Automated reasoning[END_REF].

The Static View

For the static view on completeness, the model constructed by the model construction has to be lifted from the ground clauses to the non-ground clauses. Then static refutational completeness is a consequence of the Model Construction Lemma. Lemma 2.2.4.9 (Model Lifting [START_REF] Kosta | Automated reasoning[END_REF]). Let N be a set of (universally quantified) Σ-clauses and let I be a term-generated Σ-interpretation.

Then I is a model of G Σ (N) then it is a model of N.
Theorem 2.2.4.10 (Herbrand [START_REF] Kosta | Automated reasoning[END_REF]). A countable set N of first-order clauses is satisfiable if and only if it has a term-generated model.

Proof. ⇐ If it has a term-generated model it is satisfiable ⇒ Let N be satisfiable and thus N ⊥.

N ⊥ ⇒ ⊥ ∈ Sup * (N) Superposition is sound ⇒ ⊥ ∈ G Σ (Sup * (N)) ⇒ G Σ (Sup * (N)) I G Σ (Sup * (N)) (Lemma
⇒ G Σ (Sup * (N)) I Sup * (N) (Lemma 2.2.4.9) ⇒ G Σ (Sup * (N)) I N (N ⊆ Sup * (N))
Theorem 2.2.4.11 (Static Refutational Completeness [START_REF] Kosta | Automated reasoning[END_REF]).

Let N be a set of clauses that is saturated up to redundancy. Then N has a model if and only if N does not contain the empty clause.

Proof. If ⊥ ∈ N, then obviously N does not have a model. If ⊥ ∈ N, then the interpretation R ∞ is a model of all ground instances in of N according to Part 3. of the Model Construction Lemma. As R ∞ is term-generated, it is a model of G Σ (N). Thus, by Herbrand's Theorem it is also a model of N (Theorem 2.2.4.10).

The Dynamic View

For the dynamic view on completeness, fairness needs to be defined in such a way that the limit of any fair run is saturated (up to redundancy). Then dynamic refutational completeness can be shown using fairness and static refutational completeness. An inference is enabled with respect to a clause set N if all its premises are contained in N and its result is not contained in N or Red(N). A run of the superposition calculus is a sequence of clause sets N 0 N 1 N 2 • • • , such that N i N i+1 and all clauses in N i \N i+1 are redundant with respect to N i+1 . Each step takes the previous clause set adds any number of clauses that follow from that clause set and removes any number of clauses that follow from smaller clauses of the new clause set. A run is fair if for all i and inferences sup that are enabled at N i there exists a j with j > i such that the inference sup is not enabled in N j . Lemma 2.2.4.12 (Limit is saturated [START_REF] Kosta | Automated reasoning[END_REF]). If a run is fair, then its limit is saturated up to redundancy.

Proof. If the limit is not saturated up to redundancy, there must be an inference that can still be applied. Thus both its premises must be in N * but the result is not in N * and is not redundant with respect to N * . Such an inference must be enabled in N * and thus must be enabled in all j that are j ≥ i for some i. By definition such a run cannot be fair. Lemma 2.2.4.13 (Redundant Clauses [START_REF] Kosta | Automated reasoning[END_REF]). Let C be a clause that is redundant with respect to a clause set N and let I be an interpretation such that I N then I C. Theorem 2.2.4.14 (Dynamic Refutational Completeness [START_REF] Kosta | Automated reasoning[END_REF]). Let N 0 N 1 N 2 . . . be a fair run and N * its limit. Then N 0 has a model if and only if ⊥ ∈ N * .

Proof. ⇒ Obvious. ⇐ The run is fair and therefore N * is saturated up to redundancy (Lemma 2.2.4.12). If ⊥ ∈ N * and since we know that N * is saturated up to redundancy, it has to have a model (Theorem 2.2.4.11). Every clause in N 0 is an element of N * or is redundant with respect to N * and thus the model of N * is also a model of N 0 (Lemma 2.2.4.13).

Typed Superposition

In this chapter I present how to extend the superposition calculus with a polymorphic type system that supports type classes. The type system is designed to be a first-order version of the type system used by the interactive and higher-order logic proof assistant Isabelle/HOL [START_REF] Nipkow | Isabelle/HOL: A Proof Assistant for Higher-order Logic[END_REF]. In particular, this typed version of superposition enables translations of proof obligations from Isabelle without any type-encoding related overhead. Encoding of other features, such as higherorder features like higher-order quantification (the superposition calculus is still first-order), partial applications and lambdas is still required.

To achieve this, I first define a first-order logic extended with such a type system (Sect. 3.1). Afterwards, I show how to adapt the superposition calculus and its machinery to this typed setting. The main changes to superposition that are required to include a type system are contained within unification (Sect. 3.1.3), Skolemization (Sect. 3.1.5) and the orderings (Sect. 3.2). The inference rules of the superposition calculus itself remains largely unchanged (Sect. 3.3).

To restrict the search space, I have made the decision to not consider combinations of type classes that do not contain any ground types, i.e. to consider those combinations of type classes to be invalid. This has the benefit of limiting the reasoning to the relevant parts of the type classes (and their combinations). A side effect is that type-Skolemization for those combinations of type classes (without ground types) is either impossible or not satisfiability preserving (Sect. 3.1.5).

An evaluation of an implementation of the presented typed superposition calculus against type-encodings used by Isabelle and a monomorphic type system provides evidence to the type systems usefulness (Sect. 3.4). The benchmark problems used for the evaluation are generated by Sledgehammer [START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF] from Isabelle formalizations. The formalizations that I used are either included in Isabelle or from the Archive of Formal Proofs (AFP, www.isa-afp.org).

Furthermore, I show refutational completeness of the superposition calculus extended with the type system by lifting untyped ground superposition via intermediate type-symbol and monomorphic first-order languages to the polymorphic type system presented below (Sect. 3.5).

Finally, I discuss related work (Sect. 3.6).

Polymorphic First-Order Logic with Type Classes

In this section, I define the first-order language that includes the polymorphic type system extended with type classes. The language features terms consisting of variables and functions with complex types. These complex types allow type terms consisting of type constructors and type variables. The type variables are further restricted by (sets of) type classes to only range over a certain subset of all available types. As before, in the untyped first-order logic (presented in section 2.1.1), I first define the syntax (Sect. 3.1.1). In contrast to the untyped first-order setting, I also have to define typing rules that determine if terms are well-typed. The description of the typing rules is therefore presented directly after the syntax (Sect. 3.1.2). Following this, I present unification for the typed terms (Sect. 3.1.3). In that section, I also introduce an alternative representation of the typed terms that makes unifications easier and faster to compute. Then, I define the semantics of the typed language and finally show the typed clausification (Sect. 3.1.4) and discuss clausification and Skolemization (Sect. 3.1.5).

Syntax

I now present the syntax of the polymorphic language with type classes. First, I present the signature followed by the types, terms and formulas. In contrast to the untyped case more information must be encoded in the signature to express the type of each symbol. Terms also must be able to express the types. There is also additional structures to represent type terms, type classes and type-class constraints, which restrict type variables. Definition 3.1.1.1 (Signature). A signature for a polymorphic first-order language with type classes is a tuple Σ = (S F , S P , S T , S K , T C, T , F, P) where S F is the set of function symbols, S P is the set of predicate symbols, S T is the set of type constructor symbols, S K is the set of type class symbols, T C is the set of subclass declarations, T is the set of type declarations, F is the set of function declarations and P is the set of predicate declarations.

Every symbol has a fixed arity. There must be exactly one declaration per function and predicate symbol.

Before I formally define T , F and P I need the definitions of (possibly not well-formed) type-class constraints, type terms, terms and formulas. Section 3.1.2 then introduces rules that determine if they are well-formed. In particular, those rules prevent formulas with non-prenex type quantifiers and ill-typed terms.

Notation I use f for function symbols, p for predicate symbols, t, s for terms, φ, ψ for formulas, u, v for term variables, α for type variables, σ, θ for substitutions, τ for type terms, κ for type constructors, k for type classes, K for sets of type classes (i.e. type-class constraints), n for type arity and m for term arity. As before, I write t[s] p to denote that the term s is placed at position p in another term t. If not explicitly mentioned otherwise, variables means both type and term variables.

Subclass Declarations

The subclass declarations are defined as follows:

T C is a finite set of elements k 1 ⊆ k 2 ∈ T C, which are subclass declarations, i.e. k 1 is a subclass of k 2 . The structure of T C must form a directed acyclic graph (DAG).

Definition 3.1.1.2 (Type-class constraint). A type-class constraint K ⊆ S K is a set of type-class symbols.

Each type class represents a set of types and the type-class constraint represents the intersection of all the type sets of its type classes. For a type constraints K, I also write K = k 1 & . . . & k n instead of the set representation K = {k 1 , . . . , k n }. I assume in the remaining chapter, that the type-class constraints are minimal, i.e. that they contain no type class that has a subclass in the type-class constraint. A type class is automatically fulfilled if one of its subclasses is and can therefore be removed if a subclass is present. Definition 3.1.1.3 (Type terms). Let X τ be a given countably infinite set of type variables. All possibly not well-formed type terms are recursively defined as:

• Every type variable in X τ is a type term • For all κ ∈ S T , if τ 1 , . . . , τ n are type terms, then κ(τ 1 , . . . , τ n ) is a type term.

Type terms that do not contain a type variable are monomorphic. Definition 3.1.1.4 (Terms). Let X t be a given countably infinite set of term variables. All possibly not well-formed terms are recursively defined as:

• Every term variable in X t is a term • For all f ∈ S F if τ 1 , . . . , τ n are type terms and t 1 , . . . , t m are terms, then f [τ 1 , . . . , τ n ](t 1 , . . . , t m )
is also a term.

Terms that do not contain a term variable are ground and those that do not contain a type variable are monomorphic. Terms that have the form f [τ 1 , . . . , τ n ](t 1 , . . . , t m ) are function terms. Definition 3.1.1.5 (Formulas). All possibly not well-formed formulas are recursively defined as:

1. ⊥ is a formula 2.
is a formula

∧ φ 2 , φ 1 ∨ φ 2 , φ 1 ⇒ φ 2 , φ 1 ⇔ φ 2
and ¬φ 1 are also formulas.

6. If φ is a formula, u a term variable and τ a type term, then ∀u:τ. φ and ∃u:τ. φ are also formulas. Within φ the term variable u is bound and of type τ (unless it is bound again in subformulas of φ. Then it is not bound in those subformulas, but the u of the subformula is bound).

7. If φ is a formula, α a type variable and K a type-class constraint, then ∀ τ α:K. φ and ∃ τ α:K. φ are also formulas. Within φ the type variable α is bound and of type-class constraint K (unless it is bound again in subformulas of φ, then it is not bound in those subformulas, but the α of the subformula is bound).

Note that the quantifiers in 6 range over term variables and the quantifiers in 7 ranges over type variables. In formulas, type quantifiers never occur below other formula symbols (except other type quantifiers). The formulas 1-4 are considered atomic formulas. Atomic formulas and their negations (¬) are literals. A closed formula is a formula in which every variable is bound by a quantifier. I only consider closed formulas. Without loss of generality, I assume that every variable has a unique name. In closed formulas with unique variable names, there is always a unique binding quantifier for each variable and thus it is always known which type a term variable has and which type-class constraint a type variable has. Definition 3.1.1.6 (Clause). A clause is a disjunction of literals. All variables of a clause are implicitly universally quantified and thus implicitly given their type and type-class constraint.

The clause consisting of no literals is called ⊥ or the empty clause. A clause can be written as a formula (then with explicit quantification). Thus, if I have definitions or proofs for formulas, I do not duplicate them for clauses. Formulas and clauses are (term) ground if they contain no (term) variables. Now that I have defined possibly not well-formed (type) terms and formulas, I can properly define the remaining elements of the signature. They are:

T is a finite set of elements ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T , which are type declarations. The ": k" part is optional. If omitted, the type constructor κ does not belong to any type class and there must be exactly one declaration for κ. For every type constructor κ in S T there must be at least one declaration.

F is a finite set of elements f : ∀ τ α A type class constraint K is more general than a type class constraint [START_REF] Haftmann | Constructive type classes in Isabelle[END_REF][START_REF] Schmidt-Schauß | Computational aspects of an order-sorted logic with term declarations[END_REF]). The set of type declarations T is coregular' if for all ∀ τ α 1 :K

K (K ≤ T C K) if and only if for all k ∈ K there is a k ∈ K such that k ⊆ * T C k. Definition 3.1.1.7 (Standard Coregularity, adapted from
1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T and ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T such that k ⊆ * T C k, it holds that K i ≤ T C K i for all i.
Coregularity ensures that there are most general unifiers for order-sorted algebras [START_REF] Nipkow | Type checking type classes[END_REF][START_REF] Schmidt-Schauß | Computational aspects of an order-sorted logic with term declarations[END_REF]. Since T does not require a type declaration for all combinations of type constructors and type classes, coregularity has to take that into account by also considering the type declarations that the type classes 'inherit' (via the subclass relation) from their subclasses. Definition 3.1.1.8 (Coregularity, further adapted from [START_REF] Haftmann | Constructive type classes in Isabelle[END_REF][START_REF] Schmidt-Schauß | Computational aspects of an order-sorted logic with term declarations[END_REF]). The set of type declarations T is coregular if for all ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T and ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T such that k ⊆ * T C k, it holds that K i ≤ T C K i for all i. Furthermore, for all type classes k and type constructors κ, there exists a type class k

⊆ * T C k with ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T such that for all k ⊆ * T C k with ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T such that K i ≤ T C K i for all i.
Note, if a type class k has a type declaration for a type constructor κ, the new constraint is fulfilled if the original coregularity was fulfilled, because then k is the k we look for. The new constraint adds the check for the subclass from which the type class 'inherits' its type declaration.

I require that T is coregular. Isabelle's constructive type classes are also coregular [START_REF] Haftmann | Constructive type classes in Isabelle[END_REF][START_REF] Nipkow | Type checking type classes[END_REF].

Typing Rules

So far, I have only defined formulas, terms and type terms with no restriction as to whether they are well-typed. The main objective of the typing rules is to ensure that declared and used types of terms match with the declarations and quantors, to prevent that a type quantifier occurs below a term quantifier and to define which type classes a type-term belongs to. I now define the typing rules for formulas, terms and type terms. Let γ T C represent a typing context, where T is a mapping from term variables to types and C is a mapping from type variables to a set of type classes (type-class constraint). All well-typedness assertions are implicitly relative to a given signature. Without loss of generality, I assume that all variables are named uniquely. I further assume that o B , o are boolean pseudo types which do not match any type in the signature. I use these two boolean types to fix the quantifier for types (∀ τ , ∃ τ ) to appear only on the very top position in formulas, so that formulas of the type o B can only be extended by further type quantifiers.

I will give the typing rules in form of inference rules, which follow the following structure: The elements below the bar of the rules are what we want to show (the conclusion). The elements above the bar are the assumptions and have to be proven.

A closed formula φ is well-typed if and only if one can, starting from γ / 0 / 0 φ : o, apply the inference rules until all assumptions are empty or follow directly from the signature (i.e. the assumptions are checks if a declaration is an element of the corresponding set in the signature).

Formulas The typing rules for formulas have two main objectives. First, to ensure that the type quantifiers (∀ τ , ∃ τ ) are always at the top of the formulas to prevent a type quantifier to be below a term quantifier. Secondly, that the arguments of predicates match the predicate's definition and are well-typed, and that the type of both terms of an equality is the same. Definition 3.1.2.1 (Formula Typing Rules). The typing rules for formulas are as follows:

γ T C s : τ γ T C t : τ γ T C s ≈ t : o B (≈) γ T C φ 1 : o B γ T C φ 2 : o B γ T C φ 1 # φ 2 : o B (#∈{∧,∨,⇒,⇔}) γ T C φ : o B γ T C ¬φ : o B (¬) p : ∀α 1 :K 1 , . . . , α n :K n . τ 1 , . . . , τ m ∈ P γ T C t 1 : τ 1 σ . . . γ T C t n : τ n σ γ T C p[α 1 σ, . . . , α n σ](t 1 , . . . , t n ) : o B (pred)
and for all i : 1..m. C α i σ :

K i γ T [u →τ] C φ : o B γ T C #u : τ. φ : o B (#∈{∀,∃}) γ T C φ : o B γ T C φ : o (top) γ T C[α →K] φ : o γ T C #α : K. φ : o (#∈{∀ τ ,∃ τ })
Terms The typing rules for the terms ensure that the declared and used types of variables match their binding quantors and that functions arguments' type match the declaration and are well-typed.

For given term variable mapping T and type variable mapping C, the following rules determine if a term t is of type τ. Note that all terms of a closed formula share the same mappings T and C. Furthermore, a (well-typed) function term's type is uniquely determined by its function declaration and its type arguments. Definition 3.1.2.2 (Term Typing Rules). The typing rules for terms are as follows:

γ T C u : T (u) (term var) f : ∀α 1 :K 1 , . . . , α n :K n . τ 1 , . . . , τ m → τ ∈ F γ T C t 1 : τ 1 σ . . . γ T C t m : τ m σ γ T C f [α 1 σ, . . . , α n σ](t 1 , . . . , t m ) : τσ (fun)
and for all i from 1 to n it holds that C α i σ : K i Type Terms The typing rules for type terms infer if a type is a member of a type-class constraint.

For a given type variable mapping C, the following rules determine if a type term τ is a member of a set of type classes K. Note that all type terms of a closed formula share the same mapping C. The T mentioned in the κ rule, is not a mapping but the type declaration set of the signature. Definition 3.1.2.3 (Type-Term Typing Rules). The typing rules for type terms are as follows:

C τ : / 0 (empty) k ∈ C(α) C α : {k} (type var)
where τ is not a variable

∀α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T C α 1 σ : K 1 . . . C α n σ : K n C κ(α i σ, . . . , α m σ) : {k} (κ) k 1 ⊆ k 2 ∈ T C C τ : {k 1 } C τ : {k 2 } (subclass) C τ : {k 1 } • • • C τ : {k N } C τ : {k 1 , . . . , k N } (combine)
where N > 1 and τ is not a variable Non-Overlapping Typing Rules I am now presenting a slight variation on the rules that show that they can be implemented in such a way that always only one typing rule applies. To achieve this, the top typing rule is delayed and the subclass typing rule is integrated in the other type-term typing rules. First, I show that this is sufficient to have non-overlapping typing rules. Obviously, the typing rules of formulas (terms, type terms) can only be applied to formulas (terms, type terms). Thus, it is sufficient to separately show the typing rules for formulas, terms and type terms to be non-overlapping.

Lemma 3.1.2.4. After removing the top rule, all remaining typing rules for formulas (Def. 3.1.2.1) are non-overlapping.

Proof. The conclusion of the formula typing rules can be of one of the following forms:

1. s ≈ t : o B , 2. φ 1 # φ 2 : o B with # ∈ {∧, ∨, ⇒, ⇔} 3. ¬φ : o B 4. p[τ 1 , . . . , τ n ](t 1 , . . . , t m ) : o B . 5. #u : τ, φ : o B with # ∈ {∀, ∃} 6. #u : τ, φ : o with # ∈ {∀ τ , ∃ τ }
Clearly, the structure of these forms is different and they are thus non-overlapping. They also map one-to-one with the typing rules (Def. Proof. The conclusion of the term typing rules can be of one of the following forms:

1. u : τ or 2. f [τ 1 , . . . , τ n ](t 1 , . . . , t m ) : τ.
Again, these forms are non-overlapping and exhaustive and map one-to-one with the typing rules.

Lemma 3.1.2.6. After removing the subclass typing rule, all remaining typing rules for type terms (Def. 3.1.2.3) are non-overlapping.

Proof. The conclusion of the type-term typing rules can be of one of the following forms:

1. τ : / 0, 2. α : {k}, 3. κ(α i σ, . . . , α m σ) : {k} or 4. τ : {k 1 , . . . , k N } with N > 1.
The forms for the type terms are also non-overlapping and exhaustive and map one-to-one with the typing rules, when not considering the subclass rule. Note, in case 4, N is larger than 1, because N = 1 is handled by case 2 for type variables and case 3 for type constructors.

We have shown that, except the top and subclass rules, all typing rules are non-overlapping. Therefore, I now focus on the top and subclass rules.

Top Rule

The top rule for formulas only overlaps with the rule for typed quantifiers. It can be delayed until the typed quantifiers have been processed. Lemma 3.1.2.7. Without loss of generality, the top rule should only be applied if no other rule is applicable.

Proof Sketch. The top rule is only applicable on conclusions of the form φ : o. The only other applicable rule is the one for type quantifiers, which is applicable only if φ has a type quantifier at the top. Applying the top rule on a φ that has a type quantifier at the top is senseless, because none of the other typing rules is applicable to type quantifiers. Thus, only after exhaustively applying the rule handling type quantifiers, should the top rule be applied.

Subclass Rule

To get rid of the overlap between the type var and subclass typing rule and the overlap between the κ and the subclass typing rule they can be combined. The result of the combination of the type var and κ typing rules with the subclass typing rule resulting in the following typing rules (and the unchanged empty and combine typing rules)

k ⊆ * T C k k ∈ C(α) C α : {k} (type var ) k ⊆ * T C k ∀α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T C α 1 σ : K 1 . . . C α n σ : K n C κ(α i σ, . . . , α m σ) : {k} (κ )
Termination The typing rules terminate, because the recursive premises are always smaller than the conclusion.

Lemma 3.1.2.8. All typing rules assumptions are either non-recursive or assumption on strict subformulas, subterms, subtype-terms or subsets of the type-class constraints of the conclusion.

Determining the type of a term is straight-forward. Either a term is a variable (with annotated type) or a function term, then we can look up its definition and instantiate the definition with the type arguments of the function symbol. We can then check if the term is well-typed by using the above typing rules.

Well-typedness has to be checked only initially, because all operations that are necessary for superposition are well-typedness preserving. From now on, I will only consider well-typed formulas (and clauses) and their terms and type terms.

Notation

After the well-typedness check I annotate all terms with the mappings T and C (but never explicitly write them anywhere). After the CNF transformation (Section 3.1.5), only universal quantifier at the top of the formulas remain. Therefore, I can omit all quantifiers and annotate term variables (u) with their type (τ, given by T ) and type variables with their type-class constraint (α K , given by C). I use the same notation (t τ ) to make the type τ of a term t explicit and τ K to make the type-class constraint (K) of type terms explicit (τ). If the type(-class constraint) is not relevant, I sometimes leave this implicit.

Unification

I now present unification of the polymorphic first-order language with type classes. First I introduce a preprocessing step making unification easier to compute; then I present substitution followed by unification.

Alternative Term Representation The syntax presented above is the input syntax we want to expose to other tools, e.g. Isabelle/HOL. But in that syntax the type of a term f [α 1 σ, . . . , α n σ](t 1 , . . . , t m ) is not immediately obvious. In the input syntax, the type of a term must be computed form the type arguments and its declaration f : ∀α 1 :K 1 , . . . , α n :K n . τ 1 , . . . , τ m → τ ∈ F (to be τσ). This is unfortunate, because unification is ubiquitous in superposition and for unification we regularly need the type of a term. To simplify unification, I introduce an alternative term representation, that includes the term's type. Additionally, I remove those type arguments that are implicit from the other arguments and thus are not necessary. The alternative representation removes the need to recompute the type of a term each time it is used in unification.

I will first define the alternative representation, then substitutions and then show how to convert the initial term representation to the alternative term representation. Definition 3.1.3.1 (Alternative Term Representation). Let X t be a given countably infinite set of term variables. The alternative representation of a term is defined as:

• Every term variable in X t is a term • For all f ∈ S F if t 1 , . . . , t m are terms and τ r , τ 1 , . . . , τ n are type terms then f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m ) is also a term.

From here on I will mainly use the alternative term representation. Therefore, term will stand only for the alternative term representation, except if explicitly mentioned otherwise.

Substitutions

Here I introduce substitutions for variables, type variables, type terms and terms. Definition 3.1.3.2 (Variable Substitutions). A substitution is a mapping from (type) variables to (type) terms.

As before, I use σ, θ for substitutions and write them as σ = {u τ 1 1 → t 1 , . . . , α K 1 1 → τ 1 , . . . }, where all u i s and all α i s are pairwise distinct; τ i must be the same type as the type of t i and τ i must be of the type-class constraint K i . I define variable substitutions to be:

σ(u τ ) = t i if u τ = u τ i i u otherwise
A substitution σ is updated to return t for u by

σ[u → t](v) = t if v = u σ(v) otherwise
(correspondingly for α 1 → τ 1 instead of u 1 → t 1 ). I also write ασ for σ(α). Definition 3.1.3.3 (Type Term Substitutions). Substitutions are extended to type terms as follows:

κ(τ 1 , . . . , τ n )σ ::= κ(τ 1 σ, . . . , τ n σ) Definition 3.1.3.4 (Term Substitutions). Substitutions are extended to terms as follows:

u τ σ ::= σ(u τσ ) f τ 1 , . . . , τ n (t 1 , . . . , t m )σ ::= f τ 1 σ, . . . , τ n σ (t 1 σ, . . . , t m σ)
The definitions ensure that the application consists of two steps if σ's domain consists of both type and term variables. Let σ τ be the part of σ whose domain consists of type variables and σ t be the remaining part whose domain consists of term variables, then tσ = (tσ τ )σ t .

A substitution is well-typed if for all its term variable mappings u τ i i → t i that τ i is equal to the type of t i (i.e. checking with the typing rules that t i : τ i ) and for all its type variables mappings α K i i → τ i that τ i is a member of K i , i.e. checking with the typing rules that τ i : K. I call a substitution σ grounding for a given term t if tσ contains no variables; a unifier of the terms t 1 and t 2 if t 1 σ ≈ t 2 σ; more general than σ 2 if for all terms t there exists σ 1 such that tσσ 1 ≈ tσ 2 ; most general if for all terms t and forall σ 2 there exists σ 1 such that tσσ 1 ≈ tσ 2 .

Converting to the Alternative Term Representation

To avoid recomputing the type of a term for each unification, I have introduced the alternative term representation. Here I define how to convert the original term representation into the alternative term representation, based only on the information available in the declaration.

Furthermore, for function and predicate terms, some of the type arguments can contain redundant information that can be discarded to obtain a more compact representation. In particular, those type arguments that already occur in a type of an argument of the function can be omitted without any loss of information. Only those type arguments that do not occur in any argument's type must be handled separately. In the original representation of terms, unification requires a lookup of the full type in the declarations in F (and P) and an instantiation of the declared type, when performing (sub)unification tasks. The alternative representation includes only the information on the necessary type arguments and does not require the lookup of any type in the declarations. Functions and predicates are represented only by their return type, the necessary 'true' type argument terms and their argument terms. This negates the need to look up any of the declarations. I only show the transformation for terms but use the same transformation also for predicates. For predicates the return type (τ r ) can be omitted, because it is always the boolean return type for predicates. In detail:

f [τ 1 , . . . , τ n ](t 1 , . . . , t m ) is represented by f τ r , τ i 1 , . . . , τ i p (t 1 , . . . , t m )
and let ∀ τ α 1 :K 1 , . . . , α n :K n . τ 1 , . . . , τ m → τ ∈ F be f 's declaration. Furthermore, let the substitution σ be such that for all j from 1 to n it holds that α j σ = τ j and for all j from 1 to m it holds that the type of t j is τ j . Then τ r is defined to be τ σ. Let α i 1 , . . . , α i p be a subsequence of α 1 , . . . , α n of those α i that do not occur in τ 1 , . . . , τ m or τ . The τ i 1 , . . . , τ i p is α i 1 σ, . . . , α i p σ the instantiation of those type argument variables. Clearly, both representations, together with F and P, provide the same information and thus can be transformed back and forth. The advantage of the second form is that it requires no lookup and no substitution of declarations in F (and P) to perform unification between variables and functions. Except for keeping the actual return type around, it is also more compact, because only instantiation of type variables that are not already present in the arguments' type terms or in the return type term are recorded.

Unification Let t 1 , t 2 be two terms or type terms. Then unification of these two terms is the task to derive a substitution σ such that t 1 σ = t 2 σ. The unification rules work on a tuple (E; S ), where E are the equations that are still to be unified and S are the equations that are already processed. I use . =

for not yet unified equations and = for equations that are already processed. The initial state for unifying t 1 and t 2 is ({t 1 . = t 2 }; / 0). If E is empty, the unification is complete and then S contains the unifier, since it only contains variable to (type) term mappings. The unification has failed if any equation in E cannot be removed by applying one of the unification rules. In that case no unification is possible. I define the rules in such a way that there is no overlap between them, this simplifies the proofs below.

The first rules are the rules removing term or type identities: A substitution σ is the most general substitution (mgs τ,K ) of a type term τ and type-class constraint K if for all σ 2 exists a σ 3 such that if τσ 2 is a member of K (according to T C and T ) then τσ 2 = τσσ 3 . This has no effect on ground type terms and only restricts the type variables' type classes constraint, since restricting a type variable is more general than instantiating it. I.e. a mgs is a mapping from type variables to type variables (with potentially stricter type class constraints).

8 τ-Orient (τ . = α K , E; S ) ⇒ (α K . = τ,E; S) τ is not a variable 9 α-Eliminate (α K . = τ, E; S ) ⇒ (Eθ; α K = τσ, τ = τσ, S θ) τ ∈ vars(τ), σ is mgs τ,K and θ = σ[α K → τσ, τ → τσ] 10 τ-Eliminate (α K . = τ, E; S ) ⇒ (Eθ; α K = τσ, S θ) α ∈ vars(τ), τ ∈ vars(τ), σ is mgs τ,K and θ = σ[α K → τσ]
As with untyped first-order unification, an efficient implementation can be archived by using unification contexts instead of substituting E and S . Furthermore, in an actual implementation, rules to detect failures can be easily added to speed up the detection of impossible unifications.

Computing the mgs τ,K A mgs τ,K is a substition θ from type variables to type variables (with potentially stricter type class constraints) such that τθ fulfills all type classes of K. Let the union mgs τ,K ∪ mgs τ ,K of two such substitutions mgs τ,K = {α

K 1 1 → α K 1 1 , . . . } and mgs τ ,K = {α K 1 1 → α K 1 1 , . . . } be {α K 1 1 → α K 1 ∪K 1 1
, . . . }. The mgs τ,K (if it exists) can be recursively computed by the following case distinction on τ:

τ = α K α then mgs τ,K maps α K α → α K∪K α if K ∪ K α is populated (i.
e. contains a ground type). τ = κ(τ 1 , . . . , τ n ) For each k ∈ K, there is either a type declaration for κ and k with the most general type constraints (compared to all subclasses) or there is a subclass κ and k that has the most general type constraints (compared to all subclasses). This is ensured by coregularity (Def. 3.1.1.8). Let ∀ . . . α j : K j . . . κ(. . . , α j at argument position i, . . . ) : k ∈ T be the corresponding type declaration, then mgs τ,{k} is recursively defined by mgs τ 1 ,K 1 ∪ . . . ∪ mgs τ n ,K n , where τ i are the arguments of κ and K i are the K i corresponding to the type variable at the ith position in the type declaration. Then mgs τ,K is k∈K mgs τ,{k} .

Correctness and Uniqueness of Unification I now show that the presented unification computes unifiers (Theorem 3. 1.3.11) and that the most general unifier is unique (Theorem 3.1.3.12). First we have to show that S , the second part of the unification tuple, always contains a substitution (Lemma 3. 1.3.6). This requires us to show that S 's variables do not occur in E (Lemma 3.1.3.5). Then we show that the mgs τ,K is most general and unique (Lemma 3.1.3.7). Further properties that we require are that unification terminates (Lemma 3.1.3.8), that at each point in the unification process exactly one unification rule is applicable to an given equation (Lemma 3.1.3.9) and crucially that each unification step preserves the unifiers (Lemma 3.1.3.10). From those lemmas, I can finally conclude that the polymorphic first-order language with type classes has a most general unifier which is unique up to renaming of the (type) variables.

I start by showing that the variables occurring in S do not occur in E, the first part of the unification tuple.

Lemma 3.1.3.5 (S 's variables not in E). Let (E; S ) ⇒ (E ; S ) be one unification step. If E does not contain any variable that occurs in the left-hand side of an equation of S , then E does not contain any variable that occurs in the left-hand side of S .

Proof. By induction over the unification rules.

The (τ-)Identity, κ-, fun-and pred-Decompose and (α-)Orient rules do not change S at all, i.e. S = S . The (τ-)Identity rules removes an equation from E to derive E and thus cannot add additional variables to E that were not present in E. The κ-, fun-and pred-Decompose remove an equation, with the same top level symbol on both sides, from E and add equations between the arguments to E . Since the variables of the arguments are also contained in the removed equation, no new variables are introduced into E . The (α-)Orient rules remove an equation from E and add it with the two sides of the equations swapped to E , clearly no new variables can be introduced this way.

The Eliminate rule introduces a new left-hand side variable u in S but instantiates all of u's occurrences in E . It also instantiates u in the remainder of S , but by induction hypothesis u does not occur on the left hand side of the substitution represented by S .

The α-Eliminate rule introduces two new left-hand side type variables α and τ in S but instantiates all of their occurrences in E to a type fresh variable. Note, that the substitution σ possibly instantiates variables occurring in τ to make the type-class constraint K of α and the type-class constraint of τ match. The α-Eliminate rule also instantiates the α, τ and the type variables from the substitution σ in the remainder of S but by induction hypothesis they do not occur on the left hand side of the substitution represented by S .

The τ-Eliminate is analog to the α-Eliminate, except that τ does not become a left-hand side in S .

To be a unifier, the computed mapping S must be a substitution, because a unifier is a substitution that makes two terms syntactically equal. Lemma 3.1.3.6 (S contains a substitution). Let t 1 , t 2 be two terms and (t 1 . = t 2 ; / 0) ⇒ * (E; S ) be a series of unification steps then S only contains variable to (type) term mappings.

Proof. By induction over the unification rules.

The (τ-)Identity, κ-, fun-and pred-Decompose and (α-)Orient rule do not change S at all. The Eliminate and αand τ-Eliminate rules introduce a new equations in S . The left hand side of those equations are variables. Those variables can never be instantiated because after the application of the rule they do not occur in E anymore (Lemma 3.1.3.5).

For the unification algorithm to work, the unification of the type-class (constraints) has to be most general and unique, up to renaming of the variables. Lemma 3.1.3.7. mgs τ,K is most general and unique (up to renaming).

Proof. Proof by induction over τ.

• Let τ be α K α then mgs τ,K is of the most general type-class constraint K u unifying K α and K, i.e. K u = K α ∪ K. Either K u is not populated, meaning that there is no type constructor κ which has declarations (in T and T C) for all k ∈ K u or the mgs τ,K is α : K u , which is unique and most general (up to renaming).

• Let τ be κ(τ 1 , . . . , τ n ). For each type class k ∈ K coregularity requires that there exists a type declaration ∀ . . . α j : K j . . . κ(. . . , α j at argument position i, . . . ) : k ∈ T that is more general than the type declaration of all subclasses (k is k if there is a type declaration for κ and k). The recursive requirements mgs τ i ,K j are either empty or unique and most general by the induction hypothesis and so is the union of the requirements.

The unification algorithm must terminate and at each step only one rule may be applicable. • Let t = κ l (τ 1 , . . . , τ n ) have a type symbol at the top and s = α be a type variable. In this case, only the τ-Orient rule is applicable.

• Let t = α be a variable and s = κ r (τ 1 , . . . , τ n ) have a type symbol at the top. Then they are unifiable only if s does not contain t. In this case, only the τ-Eliminate rule is applicable.

• Let t = α t and α = u s both be type variables. In this case only the α-Eliminate rule can be applicable.

To show that the unification algorithm computes the most general unifier, I show that if for each step of the unification algorithm no unifier is lost, then the most general unifier must be an instance (renaming) of the resulting substitution.

Lemma 3.1.3.10 (Unification Preserves Unifiers). Let (E; S ) ⇒ (E ; S ) be one step of the unification algorithm. Then if θ is a unifier for (E; S ) then there is also a unifier θ 2 of (E ; S ) such that for the substitution σ contained in S it holds that θ = σθ 2 .

Proof. Let t . = s be an arbitrary unification obligation in E. Let E r be E without t . = s. Then the proof is by induction over the rules of the unification algorithm • (τ-)Identity, then t = s and E = E r and S = S . Clearly, if θ is a unifier for (E; S ) then it is also a unifier for (E ; S ).

• κ-Decompose, then t = κ(τ 1 , . . . , τ n ) and s = κ(τ s 1 , . . . , τ s n ) and E is τ 1 . = τ s 1 , . . . , τ m . = τ s m , E r and S = S . Clearly, if θ is a unifier for (E; S ) then tθ = sθ and thus it is also a unifier for the subtypes τ i θ = τ s i θ. Therefore, θ is also a unifier for (E ; S ).

• fun-Decompose, then t = f τ 1 , . . . , τ m (t 1 , . . . , t m ) and s = f τ s 1 , . . . , τ s m (s 1 , . . . , s m ) and

E is τ 1 . = τ s 1 , . . . , τ m . = τ s m , t 1 . = s 1 , . . . , t m .
= s m , E r and S = S . Clearly, if θ is a unifier for (E; S ) then tθ = sθ and thus it is also a unifier for the types τ i θ = τ s i θ and for the subterms t i θ = s i θ. Therefore, θ is also a unifier for (E ; S ).

• pred-Decompose, then t = p τ 1 , . . . , τ m (t 1 , . . . , t m ) and s = p τ s 1 , . . . , τ s m (s 1 , . . . , s m ) and E is τ 1 . = τ s 1 , . . . , τ m . = τ s m , t 1 . = s 1 , . . . , t m . = s m , E r and S = S . Clearly, if θ is a unifier for (E; S ) then tθ = sθ and thus it is also a unifier for the types τ i θ = τ s i θ and for the subterms t i θ = s i θ. It is therefore also a unifier for (E ; S ).

• Orient rule, then t = f τ 1 , . . . , τ m (t 1 , . . . , t m ), s = u, E is s . = t, E r and S = S . Clearly, if θ is a unifier of (t . = s, E r ; S ) it is also a unifier of (t . = s, E r ; S )

• Eliminate rule, then t is a variable (u) and of type τ t , u is not a subterm of s, s is of type τ s , E is τ t . = τ s , E r {u → s} and S is S {u → s}. Clearly, if θ is a unifier of (E; S ) then uθ = sθ and thus their types are equal (τ t θ = τ s θ). Furthermore, θ can be split into θ = θ 1 θ 2 such that uθ 1 = s, i.e. θ 1 = {u → s}, which is the substitution used to derive E and S . Then θ 2 is a unifier of (E ; S ).

• τ-Orient rule, then t = κ(τ 1 , . . . , τ m ), s = α, E is s . = t, E r and S = S . Clearly, if θ is a unifier of (t . = s, E r ; S ) it is also a unifier of (t . = s, E r ; S )

• α-Eliminate rule, then t = α t , s = α s , σ is the mgs of s and t, E is E r σ and S is S σ. If θ is a unifier for (E; S ) then tθ = sθ and t and s are (at least) instantiated according to their mgs (possibly further), therefore, θ can be split into θ = θ 1 θ 2 such that θ 1 is the mgs of s and t, which is the substitution used to derive E and S . Clearly, θ 2 is a unifier of (E ; S ).

• τ-Eliminate rule, then t = α, s = κ(τ 1 , . . . , τ m ), σ is the mgs of s and t, E is E r σ and S is S σ. If θ is a unifier for (E; S ), then tθ = sθ and t and s are (at least) instantiated according to their mgs (possibly further), therefore, θ can be split into θ = θ 1 θ 2 such that θ 1 is the mgs of s and t, which is the substitution used to derive E and S . Clearly, θ 2 is a unifier of (E ; S ). Now I can combine the previous lemmas to show that a most general unifier is computed and that it is unique up to renaming of the variables. If there is a unifier θ of t and s then ({t . = s}; / 0) ⇒ * ( / 0, S ) and θ is an instance of the unifier contained in S .

Proof. Suppose there is a unifier and unification does not result in a ( / 0, S ) that contains that unifier. Since the unification algorithm always terminates (Lemma 3.1.3.8) there are the following possibilities: = s}; / 0) ⇒ * ( / 0, S ) and S does not contain the most general unifier.

In the first case, Lemma 3.1.3.9 guarantees that there is a unification rule that is applicable if E is unifiable. E must be unifiable if there is a most general unifier, but then (E, S ) cannot be the end result of the unification algorithm. In the second case, no unifier (in particular the most general unifier) is lost by a step of the unification algorithm (Lemma 3.1.3.10). Lemma 3.1.3.6 guarantees that S always contains a substitution. Therefore, the unifier is an instance of the unifier contained in S .

Theorem 3.1.3.12 (The Most General Unifier is Unique). The most general unifier of two terms t and s is unique up to renaming of variables.

Proof. Follows from Lemma 3.1.3.11, because all most general unifiers are instances of the unifier θ contained in S .

Semantics

So far, I have presented the syntax, the typing rules and the unification algorithm for the polymorphic first-order language. Here I give the semantics. In contrast to the semantic for untyped first-order language, the universe now has to be partitioned into domains. Domains are disjoint subsets of the universe. Those domains then represent the interpretation of the types. Terms are interpreted as elements of the universe. The interpretation of a term must be an element of the domain that corresponds to the type of the term. Type classes and type-class constraints are interpreted as a subset of the set of domains for which their type-class declarations are fulfilled.

The domains which are fulfilled by a type class are defined by a fixpoint over the type-class declarations in T and T C. U is a non-empty countable set of elements, the universe. D a non-empty set of non-empty disjoint subsets of U. It represents the set of the types (domains). I T is the set of type constructors (κ I ) which map domains to a domain (D n → D). I F is the set of functions ( f I ) which maps a cartesian product of domains and elements to an element (D n × U m → U). I P is the set of predicates (p I ) which map a cartesian product of domains and elements to true or false (D n × U m → {0, 1}).

Note that the set D is countable, because there are only countable many non-empty disjoint subsets of a countable set (there are only countable many disjoint subsets of size one) and the universe U T is countable.

Interpretation A variable valuation is a mapping from variables to elements of the universe relative to a given Σ-structure. In general, I will not explicitly mention the Σ-structure but leave this relation implicit. I use θ to map type variables to domains (X τ → D) and ξ to map term variables to elements (X t → U).

Interpretations (I θ,ξ ) of type terms and terms are in general parameterized by both the type variable (θ) and the term variable (ξ) mapping. If I omit one or both mappings, they are assumed to be the empty mapping. For example, the interpretation of type terms only requires the mapping for type variables (θ) and therefore omit the term variable mapping. Definition 3.1.4.2 (Interpretation of Type Terms). The interpretation of a type term is as follows:

I θ (α) = θ(α) I θ (κ(τ 1 , . . . , τ n )) = κ I (I θ (τ 1 ), . . . , I θ (τ n ))
where κ I ∈ I T is the type constructor corresponding to the type symbol κ ∈ S T . Additionally, each ground term must evaluate to a different d ∈ D.

I also use the symbol I for valuations of terms. Term valuations are parameterized by two valuations, one for type variables (θ) and one for term variable (ξ). Definition 3.1.4.3 (Interpretation of Terms). The interpretation of a term is as follows:

I θ,ξ (u) = ξ(u) I θ,ξ ( f τ i , . . . , τ n (t 1 , . . . , t m )) = f I I θ (τ 1 ), . . . , I θ (τ n ) (I θ,ξ (t 1 ), . . . , I θ,ξ (t m )))
where f I ∈ I F is the function corresponding to the function symbol f ∈ S F . Additionally, f I I θ (τ 1 ), . . . , I θ (τ n ) (I θ,ξ (t 1 ), . . . , I θ,ξ (t m )) must evaluate to an element of I θ (τ r ), where τ r is the type assigned to f τ i , . . . , τ n (t 1 , . . . , t m ) by the typing rules (Def. 3.1.2.2).

The interpretation for type-class constraints (K) need no parameters and also results in a set of domains that type-class constraint represents. Definition 3.1.4.4 (Interpretation of Type-Class Constraints). The interpretation of a typeclass constraint is as follows:

1. I(K) = D if K = / 0 2. I(K) = k∈K I(k) if K = / 0
Note that I(K) may be empty. This is the case when there is no ground type that is an element of all type-classes in K. The interpretation of a type class is a fixpoint defined by the interpretations of the types and the type class declarations. The fixpoint results in a set of domains that the type class represents. Definition 3.1.4.5 (Interpretation of Type Classes). The set of domains that form the interpretation of a type class k is defined by the least fixpoint of the type-class constraint interpretation and the following two rules, i.e. I(k) is defined as the least fixpoint of:

1. For all declarations ∀ τ α 1 :K 1 , . . . , α n :K n . τ:k ∈ T and all grounding substitution σ of τ it holds that 1≤i≤n

I(α i σ) ∈ I(K i ) ⇒ I(τσ) ∈ I(k)
2. For all declarations k 1 ⊆ k ∈ T C and all ground type terms τ, I require that if a type is an element of a type class, then it is also element of its superclass:

I(τ) ∈ I(k 1 ) ⇒ I(τ) ∈ I(k)
Finally, interpretations of formulas, like interpretations of terms, need two parameters, one for type variables (θ) and one for term variable (ξ). They are adapted by the quantifications occurring in the formulas. Let false be represented by 0 and true be represented by 1 and let max, min the corresponding functions for maximum and minimum. The interpretation of formulas is defined by Definition 3.1.4.6 (Interpretation of Formulas). The interpretation of a formula is as follows:

I θ,ξ (p τ α i , . . . , α n (t 1 , . . . , t m )) = p I [I θ (τ α 1 ), . . . , I θ (τ α n )](I θ,ξ (t 1 ), . . . , I θ,ξ (t m )) I θ,ξ (⊥) = 0 I θ,ξ ( ) = 1 I θ,ξ (s ≈ t) = 1 ⇔ I θ,ξ (s) = I θ,ξ (t) I θ,ξ (¬φ) = 1 -I θ,ξ (φ) I θ,ξ (φ ∧ ψ) = min(I θ,ξ (φ), I θ,ξ (ψ)) I θ,ξ (φ ∨ ψ) = max(I θ,ξ (φ), I θ,ξ (ψ)) I θ,ξ (φ → ψ) = max(1 -I θ,ξ (φ), I θ,ξ (ψ)) I θ,ξ (φ ↔ ψ) = 1 ⇔ I θ,ξ (φ) = I θ,ξ (ψ) I θ,ξ (∀u : τ. φ) = min e∈I θ (τ) (I θ,ξ[u→e] (φ)) I θ,ξ (∃u : τ. φ) = max e∈I θ (τ) (I θ,ξ[u→e] (φ)) I θ,ξ (∀ τ α : K. φ) = min d∈I(K) (I θ[α→d],ξ (φ)) I θ,ξ (∃ τ α : K. φ) = max d∈I(K) (I θ[α→d],ξ (φ))
where p I ∈ I P is the function corresponding to the function symbol p ∈ S P .

Properties of the Semantics

To show that the rules of definition 3.1.4.5 have a least fixpoint, I use Tarski's fixpoint theorem. Therefore, I first present his definition of complete lattice, increasing function and then Tarski's fixpoint theorem [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF]: Definition 3.1.4.7 (Complete Lattice [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF]). A complete lattice is a system A, ≤ such that A is a non-empty set and ≤ a partial order on elements of A such that for each B ⊆ A there is a least upper bound of B and a least lower bound of B. Theorem 3.1.4.9 (Tarski's Lattice-Theoretical Fixpoint Theorem [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF]). Let A, ≤ be a complete lattice, f be an increasing function A → A and P be the set of all fixpoints of f . Then the set P is not empty and the system P, ≤ is a complete lattice, in particular f has a least fixpoint and a greatest fixpoint.

I now use Tarski's fixpoint theorem to show the existence of a least fixpoint defining I(k).

Lemma 3.1.4.10 (The Least Fixpoint Exists). The defining rules of I(k) have a least fixpoint.

Proof. Let the set A be the set of all subsets of D. Let ≤ be a partial order, such that for a, b ∈ A it holds that a ≤ b if there are more domains in b than in a. The upper bound of a subset B of A is the union of the sets in B and the lower bound is the intersection of the sets in B. Then clearly A, ≤ is a complete lattice. The function f , A → A, is (implicitly) given by the fixpoint rules, by mapping the current interpretation (I(k)) to a new extended set of domains as long as one of the rules is applicable. Thus, we have to show both rules (Def. 3.1.4.5) increasing:

1. Rule one adds the type definitions to their corresponding type classes, thereby increasing the number of elements.

2. Rule two adds the subclass definitions to the corresponding superclasses, thereby increasing the number of elements.

Since the interpretation of the type classes also includes the interpretation rules of the type-class constraints (Def. 3.1.4.4), we have to show both of those rules increasing:

1. Rule one does not change at all, thus it fulfills the requirements of increasing the number of elements.

2. Rule either stays the same or adds new elements if a I(k) grows such that the whole intersection contains a new domain, thus it is also increasing.

Thus, by Theorem 3.1.4.9 the least fixpoint exists. Now I show that the judgment of the typing rules matches the semantic I have just defined.

Lemma 3.1.4.11 (Typing Matches Type Constraint Semantics).

For each type term τ and type-class constraint K, if the judgment τ : K holds, according to the typing rules, then I(τ) ∈ I(K).

Proof. Proof by induction over the typing rules for ground type terms.

1. empty, i.e. τ : / 0. All type terms are of the empty type-class constraint, and its interpretation is D. 3. κ, i.e. τ : {k} and there is a declaration (∀α 1 :K 1 , . . . , α n :K n . κ(α i , . . . , α m ) : k ∈ T ) and from the induction hypothesis we know that for the premises the lemma holds (i.e. I(α i σ :

K i ) ∈ I(K i )).
Then by rule one of the type class interpretation, the interpretation of τ is part of the interpretation of k, i.e. I(τ) ∈ I(K).

4. subclass, i.e. τ : {k} and k 1 ⊆ k and by the second rule of the type class interpretation, the interpretation of τ is contained in the interpretation of k.

5. combine, i.e. τ : K and K has at least two elements. From the induction hypothesis we know that for each k i ∈ K that τ : {k i }. Then for each k i ∈ K that I(τ) ∈ I(k i ) and thus I(τ) ∈ k i ∈K I(k i ) and thus I(τ) ∈ I(K).

Furthermore, I show that for each interpretation of a type class k if there is a domain d in that type class k then there is a type term τ such that the interpretation of τ is d. Lemma 3.1.4.12 (Type Class Are Type Term Generated). Let k be a type class, if d ∈ I(k) then there is a ground type term τ such that τ : {k} holds, according to the typing rules and I(τ) = d.

Proof. If d ∈ I(k) then it was introduced by one of the (least) fixpoint rules of the type class semantics. Therefore, the proof is by induction on the fixpoint rules of the type class semantics.

1. If d was introduced by the first rule then there is a ground type term τσ such that I(τσ) = d.

2. If d was introduced by the second rule then there is a ground type term τ such that I(τ) = d.

From this it then follows that the semantic of type-class constraints matches the judgment of the typing rules. Lemma 3.1.4.13 (Type-Class Constraint Semantics Matches Typing). Let K = / 0 be a type-class constraint, if d ∈ I(K) then there is a ground term τ such that τ : K holds, according to the typing rules and I(τ) = d.

Proof. By definition of the semantics of type-class constraints I(K) = k∈K I(k). For each k ∈ K and d ∈ I(k) there exists a ground type term τ : {k} (Lemma 3.1.4.12). Since, by the definition of type term interpretations, different ground type terms evaluate to a different (disjoint) domains, we have one ground type term τ for each domain d ∈ I(K) such that for all k ∈ K that τ : {k}. Thus from the combine typing rule it follows that τ : K.

Finally, I can prove that the interpretation of a type-class constraint is the union of the interpretations of the type-class constraint's ground type terms. We require this property later, in the refutational completeness proof, in particular in the lifting step from the monomorphic to the polymorphic first-order logic with type classes.

Clausification and Skolemization

The semantics of the boolean connectives for typed formulas is not different from the semantics in the untyped case. Thus, the prenex normal form and clause normal form translations are performed as before (Section 2.1.3), with the only difference that there are two separate sets of quantifiers -the type and term quantifier. Skolemization, however, must be adapted to the typed setting.

Type Skolemization

In principle, before clausification, all type quantifications with empty type-class constraint would need to be removed (⇒ E τ ). This is because I restricted the search space to only consider combinations of type classes that do contain a ground type.

∀ τ α:K. φ ⇒ E τ
if there is no ground type that fulfills K

∃ τ α:K. φ ⇒ E τ ⊥
if there is no ground type that fulfills K However, in our target use case, the translation of proof obligations from a higher-order proof assistant to a first-order automated theorem prover, it is impractical to translate all facts and axioms known to the proof assistant. Consider, for example, the case where we want to show a property holds for all members of a type-class constraint (e.g. the negated conjecture ∃ τ α:K.¬φ) and the perfect matching axiom (e.g. ∀ τ α:K.φ). But, because no ground type was included both the conjecture and the axiom would be removed. In fact, including a ground type would only need to be done to populate the type classes, but could not possibly be helpful in the actual reasoning process. Adding all necessary ground types would require the proof assistant to analyze each proof obligation and accompanying facts, without any reasonable gain. To avoid this, I assume that all type-class constraints in the initial axioms and conjecture are supposed to be populated, i.e. I keep the formulas even though Skolemization may then produce Skolem type constructors for previously unpopulated type classes. This removes the need for the proof assistant to spend effort to specify ground types. While this makes Skolemization not satisfiability preserving (by potentially introducing new ground types in type classes with no ground types), I feel this is a reasonable compromise. Especially, since it is anyways not reasonable for the proof assistant to pass the complete type hierarchy and all axioms to the automated theorem prover.

Definition 3.1.5.1 (Type Skolemization). The Skolem transformation for types (⇒ S τ ) is:

∀ τ α 1 :K 1 , . . . , ∀ τ α n :K n . ∃ τ α:K α . φ ⇒ S τ ∀ τ α 1 :K 1 , . . . , ∀ τ α n :K n . φ{α → κ(α 1 , . . . , α n )}
where n ≥ 0 and κ is a type-constructor symbol of arity n that is not present in the signature (S T ). The transformation also adds the type-constructor symbol κ to the signature (S T ) and adds for each

k in α's type-class constraint K α a ∀ τ α 1 :K 1 , . . . , α n :K n . κ(α 1 , . . . , α n ) : k type-class declaration (to T ).

Term Skolemization

The Skolemization for polymorphic terms is similar to the untyped one, except that the appropriate declarations need to be added. Definition 3.1.5.2 (Term Skolemization). The Skolem transformation for terms (⇒ S ) adapted to our polymorphic setting is:

∀ τ α 1 :K 1 , . . . , ∀ τ α n :K n . ∀u 1 :τ 1 , . . . , ∀u m :τ m . ∃u : τ.φ ⇒ S ∀ τ α 1 :K 1 , . . . , ∀ τ α n :K n . ∀u 1 :τ 1 , . . . , ∀u m :τ m . φ{u → f α 1 , . . . , α n (u 1 , . . . , u m )}
where m ≥ 0, n ≥ 0 and f is a function symbol of type arity n and term arity m that is not present in the signature (S F ). The transformation also adds the function symbol f to the signature (S F ) and adds the adequate (∀ τ α 1 :K 1 , . . . , α n :K n .τ 1 , . . . , τ m → τ) function declaration (to F).

While I chose the type Skolemization to be not satisfiability preserving, the term Skolemization is satisfiability preserving. Lemma 3.1.5.3. A formula φ is satisfiable with respect to a signature Σ if and only if the formula produced by the Skolem transformation φ ⇒ S φ is satisfiable in the extended signature.

Proof. Suppose the lemma does not hold. Then there must be set of values for α 1 , . . . , α n and u 1 , . . . , u m , where the existential quantifier is satisfiable, but there is no interpretation in the extended signature such that φ is satisfiable. This means that there is an interpretation

I such that θ = {α 1 → d 1 , . . . , α n → d n } and ξ = {u 1 → e 1 , .
. . , u m → e m } for some domains d 1 , . . . , d n and some elements e 1 , . . . , e m and I θ,ξ (∃u : τ. φ) is true and thus max

e∈I θ (τ) (I θ,ξ[u → e] (φ)
) is true for some e ∈ I θ (τ), but there is no interpretation I such that I θ,ξ (φ{u → f α 1 , . . . , α n (u 1 , . . . , u m )}) is satisfiable in the extended signature. Clearly, there is one interpretation I where f I d 1 , . . . , d n (e 1 , . . . , e m ) = e and thus there must be a I θ,ξ (φ{u → f α 1 , . . . , α n (u 1 , . . . , u m )}) that is true.

Orderings

In this section I introduce a typed version of the Knuth-Bendix Ordering, an ordering which is often used by superposition-based automated theorem provers. Orderings are useful, because superposition only requires inferences that fulfill certain ordering constraints. Thus superposition requires an ordering as a parameter. The untyped superposition calculus requires that the ordering is a reduction ordering, which is total on ground terms. The typed superposition calculus, on the other hand, requires a simplification ordering which is total on ground terms.

The commonly used orderings are simplification ordering, therefore requiring a simplification ordering instead of a reduction ordering is not a major restriction. Nonetheless, I will first discuss why the change is required (Sect. 3.2.1). Afterwards, I introduce the Typed Knuth-Bendix Ordering (Sect. 3.2.2).

Simplification Ordering Required

While it is generally known that a total reduction ordering is a simplification ordering in the untyped case, in the type case a total reduction ordering is not necessarily a simplification order. The untyped refutational completeness proof of superposition assumes the fact that a total reduction ordering is a simplification ordering. The fact is used to show that the rewrite systems that are constructed in the candidate interpretation construction are convergent.

First, I sketch why an untyped total reduction ordering is a simplifications ordering, then I show why replacing the reduction ordering by a simplification ordering solves the problem. Lemma 3.2.1.1 (An untyped total reduction ordering is a simplification order). If the signature is untyped, a reduction ordering that is total is a simplification ordering, i.e. subterms are smaller than superterms.

Proof Sketch. Suppose there is a subterm that is larger than a superterm. Then we can indefinitely add the context of the subterm to the superterm gaining further smaller terms (because of totality and compatibility with Σ-operations). This cannot be well-founded and thus a total reduction ordering must have the subterm property.

Unfortunately, a total typed reduction ordering is not necessarily a simplification ordering, because the type of the superterm and subterm can be different and thus they might not share any common context at all. To guarantee completeness in a typed setting my superposition calculus requires a reduction ordering that is a simplification ordering on ground terms instead of a reduction ordering that is total on ground terms. With this change, the rewriting systems (R C and R ∞ ) generated by Candidate Interpretation Construction (Sect. 2.2.4) are still confluent and Lemma 2.2.4.2 can be restated as:

Lemma 3.2.1.2.
The rewrite systems R C and R ∞ are convergent.

Proof. Obviously, s t for all rules s → t in R C and R ∞ . Furthermore, it is easy to check that there are no critical pairs between any two rules: Assume that there are rules u → v in E D and s → t in E C , such that u is a subterm of s. As is, on ground terms, a total simplification order, we get u ≺ s and therefore D ≺ C C and E D ⊆ R C . But then s would be reducible by R C , contradicting condition (6) of the Candidate Interpretation Construction.

To derive a (ground) typed simplification ordering, it does not seem possible to relax any of the properties of simplification orderings (with the exception that only well-typed substitutions are relevant). In particular, it is not possible to restrict the subterm property to terms of the same type, because then terms could become reducible after they were considered in the model construction. This would make the presented proof of the model construction fail.

A Polymorphically Typed Knuth-Bendix Ordering

The most commonly used orderings by superposition provers are the Knuth-Bendix Ordering (KBO) [3, Page 124] and the Lexicographic Path Ordering (LPO [START_REF] Baader | Term Rewriting and All That[END_REF]Page 118]). Since our goal is a complete superposition prover, including all machinery, we present an extension of KBO which is designed for our polymorphic language. We extend the standard KBO for terms by introducing a nested KBO for types and show that the adapted version is a simplification order which is total on ground terms. Type classes do not have to be considered separately, since distinct variables must be incomparable and the same variable can only have one type-class constraint.

The main goal of the Typed Knuth-Bendix Ordering, besides having a typed ordering, is to behave as much as possible like the untyped versions, i.e. for the types to have as little impact on the orderings as possible. The motivation for this goal is to keep the configurable simplification heuristics that we developed [START_REF] Blanchette | More SPASS with Isabelle[END_REF] (in work not included in this dissertation) easily adaptable to the typed setting.

Let w f be a function that maps function symbols to positive numbers, let w κ be a function that maps type-constructor symbols to positive numbers and w their extension to (type) terms (where the weight of terms may or may not include the weight of their types), let > κ be a strict ordering on type constructor symbols, > f be a strict ordering on function symbols and > c be the transitive closure of the subclass declarations (T C). With the following restrictions, we will call any weight function that fulfills these restriction admissible:

1. There exists w 0 ∈ R + \{0} such that for all term variables u, w(u) = w 0 for all term constants f , w( f ) ≥ w 0 2. There exists w 1 ∈ R + \{0} such that for all type variables α, w(α) = w 1 for all type constants κ, w(κ) ≥ w 1 3. If κ is a unary type constructor symbol with weight w(κ) = 0, then κ is the greatest element with respect to > κ 4. If f is a unary function symbol with weight w( f ) = 0, then f is the greatest element with respect to > f

The type ordering is a KBO defined on type terms. We define τ s τ τ t to hold if and only if: For all type variable α : C. |τ s | α:C ≥ |τ t | α:C and 1. w(τ s ) > w(τ t ), or 2. w(τ s ) = w(τ t ), and one of the following: a) There exists a unary type constructor symbol κ, a variable α and a positive integer n such that τ s = κ n (α) and τ t = α b) There exist type constructor symbols κ f , κ g such that κ f > κ κ g and τ s = κ f (τ s 1 , . . . , τ s n ) and τ t = κ g (τ t 1 , . . . , τ t n ) c) There exists a type constructor symbol κ f and an index i,

1 ≤ i ≤ n, such that τ s = κ f (s 1 , . . . , s n ), τ t = κ f (τ t 1 , . . . , τ t n ) and τ s 1 = τ t 1 , . . . , τ s i-1 = τ t i-1 and τ s i τ τ t i
Let = Term to be equality but only considering non-type (sub)terms. Then s KBO t holds if and only if: For all term variables u: |s| u ≥ |t| u and 1. w(s) > w(t), or 2. w(s) = w(t), and one of the following: a) There exists a unary function symbol f , a variable u and a positive integer n such that s = ( f τ 1 , . . . , τ m ) n (u) and t = u b) There exist functions symbols f , g such that f > f g and s = f τ s 1 , . . . , τ s m (s 1 , . . . , s n ) and t = g τ t 1 , . . . , τ t m (t 1 , . . . , t n ) c) There exists a function symbol f and an index i,

1 ≤ i ≤ n, such that s = f τ s 1 , . . . , τ s m (s 1 , . . . , s n ), t = f τ t 1 , . . . ,
= f τ s 1 , . . . , τ s m (s 1 , . . . , s n ) and t = f τ t 1 , . . . , τ t m (t 1 , . . . , t n )) and a) an index i, 1 ≤ i ≤ m such that τ s 1 = τ t 1 , . . . , τ s i-1 τ τ t i-1 and τ s 1 τ τ t i , or b) for all index i, 1 ≤ i ≤ m τ s i = τ t i
and an there exists an index j, 1 ≤ j ≤ n, such that s 1 = t 1 , . . . , s j-1 = t j-1 and s j TKBO t j

It is obvious that τ and KBO are simplification orderings, because they are essentially restating KBO once for type terms and once of typed terms where the types are ignored. I now show that their combination into the Typed Knuth Bendix Ordering TKBO results in a simplification order. The Typed Knuth Bendix Ordering tries to emulate KBO as much as possible, only resorting to using the types to break ties.

Here I show that the Typed Knuth Bendix Ordering is a simplification ordering by first showing that it is a reduction ordering and then showing the simplification ordering. Lemma 3.2.2.1 (Typed Knuth-Bendix Ordering is a Reduction Ordering). Let w f be an admissible weight function for > f then the Typed Knuth-Bendix Ordering ( TKBO ) induced by > κ and τ is a reduction ordering which is total on ground terms.

Proof. The usual proof (see [START_REF] Baader | Term Rewriting and All That[END_REF]Page 112]) by using simplification orderings is not sufficient. It fails because the requirement is on a combination of subterms, but we cannot use all these subterms, because we cannot guarantee well-typedness. To show that TKBO is a reduction ordering, we have to show all properties of a reduction ordering (Section 2.2.2):

1. It has to be total on ground terms s 1 , s 2 :

s 1 TKBO s 2 ∨ s 2 TKBO s 1 ∨ s 1 = s 2
If s 1 = s 2 then we have two cases. Either s 1 = Term s 2 , then we use TKBO case 1 and use the ordering KBO , which is total on ground terms, to order s 1 and s 2 . The other case is s 1 = T erm s 2 but s 1 = s 2 , then there is a position at which a type of s 1 and the corresponding type of s 2 are different and thus TKBO case 2b applies until such a position is reached. Then TKBO case 2a uses τ , which is total on ground type terms.

It has to be irreflexive for all terms s: ¬(s T KBO s)

We argue by induction over s. The case where s is a variable is trivial, since there is no rule in TKBO , KBO or τ to make any variable larger than a variable, thus they cannot be reflexive. In the case where s is function term (s = f τ s 1 , . . . , τ s m (t 1 , . . . , t n )). For TKBO case 1 we know that KBO is irreflexive and are done. In TKBO case 2a we know that τ is irreflexive and are done. Finally for TKBO case 2b we can apply the induction hypothesis and are done.

It has to be transitive for all s

1 , s 2 , s 3 : (s 1 TKBO s 2 ∧ s 2 TKBO s 3 ) =⇒ (s 1 TKBO s 3 )
From s 1 TKBO s 2 and s 2 TKBO s 3 we know that |s 1 | u ≥ |s 2 | u ≥ |s 3 | u and thus the variable conditions for KBO are fulfilled. We also know that w(s 1 ) ≥ w(s 2 ) ≥ w(s 3 ). If any of the inequalities is strict, then w(s 1 ) > w(s 3 ) and thus s 1 T KBO s 3 must hold ( TKBO case 1). Thus the case w(s 1 ) = w(s 3 ) remains. Now either s 1 = Term s 3 or s 1 = Term s 3 . If s 1 = Term s 3 then s 1 = Term s 2 and s 2 = Term s 3 , s 1 = Term s 2 and s 2 = Term s 3 or s 1 = Term s 2 and s 2 = Term s 3 . In all three of these cases, transitivity of KBO suffices to show transitivity of TKBO .

Let τ(t) ::= τ 1 , . . . , τ last be the sequence of types of a term t by listing them from left to right and let τ(t) i be the ith element of that sequence. If s 1 = Term s 3 and s 2 = Term s 3 then there are positions i 1 and i 2 such that τ(s 1 ) i 1 τ τ(s 2 ) i 1 and τ(s 2 ) i 2 τ τ(s 3 ) i 2 and for all j 1 < i 1 and j 2 < i 2 it holds that τ(s 1 )

j 1 = τ(s 2 ) j 1 and τ(s 2 ) j 2 = τ(s 3 ) j 2 . Then either i 1 < i 2 and τ(s 1 ) i 1 τ τ(s 2 ) i 1 = τ(s 3 ) i 1 and thus s 1 TKBO s 3 . Or i 1 = i 2 and τ(s 1 ) i 1 τ τ(s 2 ) i 1 τ τ(s 3 ) i 1 and thus s 1 TKBO s 3 . Or i 1 > i 2 and τ(s 1 ) i 2 = τ(s 2 ) i 2 τ τ(s 3 ) i 2 and thus s 1 TKBO s 3 .
4. It has to be compatible with Σ-operations for all s 1 , s 2 ∈ T(Σ,V) and all m ≥ 0 and all function symbols f of arity m, s

1 TKBO s 2 implies f τ 1 , . . . , τ m (t 1 , . . . , s 1 , . . . , t m ) TKBO f τ 1 , . . . , τ m (t 1 , . . . , s 2 , . . . , t m ) Either s 1 = Term s 2 or s 1 = s 2 . If s 1 = Term s 2 then f (t 1 , . . . , s 1 , . . . , t m ) = Term f (t 1 , . . . , s 2 , . . . , t m )
and thus the compatibility follows from the compatibility of KBO . If

s 1 = Term s 2 then f (t 1 , . . . , s 1 , . . . , t m ) = Term f (t 1 , . . . , s 2 , . . . , t m ). Also τ( f τ 1 , . . . , τ m (t 1 , . . . , s 1 , . . . , t m )) and τ( f τ 1 , . . . , τ m (t 1 , . . . , s 2 , . . . , t m
)) are identical except (possibly) for the subsequences τ(s 1 ) respectively τ(s 2 ) and therefore

s 1 TKBO s 2 implies f τ 1 , . . . , τ m (t 1 , . . . , s 1 , . . . , t m ) TKBO f τ 1 , . . . , τ m (t 1 , . . . , s 2 , . . . , t m ).
5. It has to be closed under substitutions for all s 1 , s 2 ∈ T(Σ,V) and all substitutions σ s 1 TKBO s 2 implies s 1 σ TKBO s 2 σ

Either s 1 = Term s 2 or s 1 = Term s 2 . If s 1 = Term s 2 then closed under substitutions follows from the fact that KBO is closed under substitutions and that s 1 σ KBO s 2 σ implies that s 1 σ = Term s 2 σ. If s 1 = Term s 2 then there is a position i such that τ(s 1 ) i τ τ(s 2 ) i and for all j < i it holds that τ(s 1 ) j = τ(s 2 ) j . Then closed under substitutions for τ means that τ(s 1 ) i σ τ τ(s 2 ) i σ and for all j < i it holds that τ(s 1 ) j σ = τ(s 2 ) j σ. Therefore, and because = Term is also closed under substitutions it holds that τ(s 1 σ) i τ τ(s 2 σ) i and for all j < i it holds that τ(s 1 σ) j = τ(s 2 σ) j . Thus s 1 σ KBO s 2 σ holds. Now, the only property that remains to be shown is the subterm property, then the Typed Knuth-Bendix Ordering is also a simplification ordering. Lemma 3.2.2.2 (Typed Knuth-Bendix Ordering is a Simplification Ordering). Let w f be an admissible weight function for > f then the Typed Knuth-Bendix Ordering ( T KBO ) induced by > κ and τ is a simplification ordering which is total on ground terms.

Proof. A simplification ordering is a reduction ordering with the subterm property.

1. The ordering is a reduction ordering (Lemma 3.2.2.1)

If s[t] and s = t then s T KBO t.

If t is a proper subterm of s then s = Term t. Since the subterm property holds for KBO it holds for TKBO .

The Superposition Calculus

I now present the superposition calculus for the polymorphic first-order language with type classes.

Positive Superposition

only if conditions 2-8 hold D ∨ t ≈ t C ∨ s[s 2 ] p ≈ s (D ∨ C ∨ s[t ] p ≈ s )σ (PSup)
Equality Factoring only if conditions 1-3 and 10 hold

C ∨ s ≈ s ∨ t ≈ t (C ∨ t ≈ s ∨ t ≈ s )σ (EF)
Negative Superposition only if conditions 2-6 and 9 hold

D ∨ t ≈ t C ∨ s[s 2 ] p ≈ s (D ∨ C ∨ s[t ] p ≈ s )σ (NSup)
Equality Resolution only if conditions 9 and 11 hold

C ∨ s ≈ s C σ (ER)
Let ≺ be a fixed simplification order that is total on ground terms. I refer to s[s 2 ] p also as s.

1. σ is the mgu of s and t 2. sσ s σ 3. tσ t σ 4. s 2 is not a term variable 5.

(t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ, nothing selected 6. σ is the mgu of t and s 2 7. (s ≈ s )σ is strictly maximal in (C ∨ s ≈ s )σ, nothing selected 8. tσ ≈ t σ sσ ≈ s σ 9. ((s ≈ s )σ is maximal in (C ∨ s ≈ s )σ, nothing selected) ∨ s ≈ s selected 10. (t ≈ t )σ is maximal in (C ∨ s ≈ s ∨ t ≈ t )σ, nothing selected 11.
σ is the mgu of s and s

As we can see, the side conditions and the inference rules themselves are identical to the untyped case (Sect. 2.2.3). In fact, the polymorphic language was designed such that only the machinery of superposition has to be adapted, not the inference rules themselves. What has changed is the definition of clauses, terms and their notation [] p to access a subterm and the (most general) unification. The restriction on the orderings is changed from reduction ordering to simplification ordering.

In the completeness proof below, we show that superposition calculus is still refutationally complete (Section 3.5). We will use the same inference rules and introduce intermediate languages to lift completeness from ground superposition, via the intermediate languages, to the polymorphic language.

Implementation and Evaluation

In this section, I provide evidence that the native implementation of type systems into the superposition calculus is superior to (efficient) type-encodings into untyped first-order logic. I further show that native support for the polymorphism extended with type classes is competitive with monomorphisation [START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF], an incomplete but very efficient native encoding. For problems with thousands of axioms, the polymorphic type system (with type classes) outperforms monomorphisation.

The Pirate Implementation

I have implemented the polymorphic calculus with type classes in a tool called Pirate. Pirate is written in (about 25,000 lines of) Scala. The CNF transformation implemented by Pirate is rather naive. The only improvement implemented is polarity-based replacement of equivalences. Furthermore, Pirate does not support splitting, but it supports many common redundancy elimination rules [START_REF] Weidenbach | Combining superposition, sorts and splitting[END_REF], such as Subsumption, Rewriting, Merging Replacement Resolution, Assignment Equation Deletion, Condensation and Tautology removal. Its main indexing is based on Path Indexing [START_REF] Stickel | The path-indexing method for indexing term[END_REF], while Subsumption uses a variant of Feature Vector Indexing [START_REF] Schulz | Simple and efficient clause subsumption with feature vector indexing[END_REF]. Pirate uses a global hash-based term sharing that guarantees that every term has at most one object representing it (during the complete runtime). It uses a worked-off/usable main-loop with given-clause selection heuristics and ordering computation similar to our extension of SPASS [START_REF] Blanchette | More SPASS with Isabelle[END_REF]. It has full proof search documentation, i.e. for all clauses Pirate records which inference or reduction introduced or removed them. Pirate has an independent proof checking subsystem, that translates a proof consisting of inferences or reduction rules to a simpler proof that uses only typed-check instantiations and the inferences of the superposition calculus without computing unifiers (i.e. only on syntactically equal terms). The unifiers are separated from inferences to check that all (type) substitutions of a proof are well-typed and withhin the type class constraints.

Setup

I have evaluated my prototype on problems generated by Sledgehammer [START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF] from Isabelle/HOL theories. Each problem corresponds to one user action within a proof. The theories are of areas as diverse as the fundamental theorem of algebra, the completeness of Hoare logic and the type soundness of a subset of Java. I used the 1249 problems generated from seven of those Isabelle theory files 1 and tested them on seven different type encodings, each with nine different number of facts per problem2 . A fact is either an Isabelle definition or theorem, they are selected and their importance is ranked by Sledgehammer. I used a time limit of 1 hour on one HyperThread of a cluster of 2xIntel Xeon E5620 using a JVM heap size of 6 GB. For the comparison, I used the following type encodings:

Type Classes

Using native polymorphism with type classes.

Poly Native

Using native polymorphism with a predicate-based type class encoding.

Monomorph

An incomplete encoding of polymorphism with type classes by picking relevant monomorphic instances [START_REF] Bobot | Expressing polymorphic types in a many-sorted language[END_REF]. Native monomorphism is currently the most efficient type encoding used in Isabelle [9, pp. 11-12].

Poly Tags

Encodes polymorphism with type classes into untyped first-order logic with the help of special typing function symbols.

Light Poly Tags

Encodes polymorphism with type classes into untyped first-order logic with a reduced number of special typing function symbols due to monotonicity analysis of the occurring types.

Poly Guards

Encodes polymorphism into untyped first-order logic with the help of special typing predicate symbols.

Light Poly Guards Encodes polymorphism with type classes into untyped first-order logic with a reduced number of special typing predicate symbols due to monotonicity analysis of the occurring types.

The encodings are performed by Sledgehammer and more details on them can be found in [START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF]. For the Type Classes encoding, 6 to 9 problems (0.5%-0.7%) have a subclass structure and corresponding type declarations that are not coregular. It is my impression that this is because some intermediate type classes are missing. This means that for the not coregular part of these problems Pirate is not refutational complete. Pirate still processes the problems by computing unification as if the problem is coregular (thereby losing most general unification for those type classes). This approach is sound, because the unifiers are still unifiers just not most general.

Evaluation

In the evaluation we first look at the success rate, which shows that the type class encoding is highly successful. For larger fact sizes the type class encoding beats all other encodings, including the monomorphic encoding. Most likely, the reason for this is the duplication of facts that the monomorphic encoding requires. In general, it also requires fewer inferences than the : Success rate and scalability of each type encoding monomorphic encoding, even when its success rate is higher. The native encoding (type classes and monomorphic) are the encodings with the highest success rate. They also have the highest success rate without performing any inferences, i.e. by using just the simplification rules. We will also see that, while Pirate is less tuned than SPASS (e.g. it has no build in decision procedures), its success rate is between 74% to 118% of SPASS's success rate. In the following we will look closer at these and similar results of the evaluation. The native monomorphic and the native type class encodings are clearly superior to the encodings into untyped first-order logic. From 16 until 512 facts, the monomorphic encoding has the highest success rate and the type class encoding the second highest success rate. From 1024 to 4096 facts, the type class encoding has the highest success rate and the monomorphic encoding the second highest success rate -except for 4096 facts, where the poly native encoding is the second best and the monomorphic encoding only third. The encoding into untyped first-order logic with the highest success rate for 16, 128 and 256 facts is the light poly tags encoding; for the other fact sizes it is the light poly guards encoding.

Success Rate and Scalability of the Type Encodings

The number of facts determines the success rate. With few facts, many problems do not have all (for the proof) necessary facts available, but those that have all necessary facts are then easier to solve. With hundreds and thousands of facts, the encodings have so many facts available that the success rate starts to decline. This is most likely because the search space becomes too large because of the large number of potentially irrelevant (for a successful proof) facts. The most successful fact set size for poly native, light poly tags and poly guards is 256 facts; for monomorphic, poly tags and light poly guards it is 512 facts, while the type class encoding performs best for both 256 and 512 facts.

The cause for the different success rates of the various type encoding is difficult to determine for each individual problem. Already slight differences in the clause set (caused by the differences of the encodings) result in different exploration of the search space. It is generally known that any difference has the possibility of dramatic changes in runtime. Nonetheless, the higher success rate of the monomorphic encoding can be traced (at least in part) to a simpler problem structure. The monomorphic encoding only uses some (heuristically picked) ground instances of the types the type class and poly native encoding have to consider. One quantifiable indication of this is the number of saturations that can be found for 16 facts. The monomorphic encoding can saturate 26% of the problems, significantly more than the type class encoding (17% saturated) and the poly native encoding (14% saturated).

The downside of the simpler structure of monomorphic problems is that it duplicates facts (for each ground type instance the fact is either duplicated or excluded). So a formula in the type class or poly native encoding can become several formulas in the monomorphic encoding, one for each picked type instance. Figure 3.2 shows the number of initial formulas for both the monomorphic and type class encoding. For 4096 facts, an initial monomorphic problem has an average of 900 formulas more than the corresponding type class problem, while for 16 facts the average difference is just 2 formulas. The addition of a handful of duplicates has in practice a low impact, because the solver can still process them efficiently. Adding several hundred of duplicates on the other hand can significantly slow down the solver. In fact, 90% (= 293 proofs) of type class proofs for 4096 facts are found with picking (less than) 900 clauses for performing inferences -and each formula can result in multiple clauses. In comparison, 90% (= 276 proofs) of the monomorphic proofs for 4096 facts are found with picking (less than) 1400 clauses and 293 proofs are found with picking (less than) 2500 clauses for performing inferences.

Note that Sledgehammer cannot generate more than 4096 facts reliably. This can already be seen at 4096 facts, where the average number of formulas for the type class encoding is already below target (with generating only 4083 formulas). Even though there should be more than 4096 formulas due to the helper formulas of encoding higher-order features (as seen in all other fact sizes, where there are more formulas than facts). The average number of clauses picked for performing inferences with (for each encoding and fact size) is given in figure 3.3. It shows that the monomorphic encoding requires more inferences than the type class encoding. This is even the case when it proves fewer problems (i.e. see the results from 1024 to 4096 facts). The type class encoding generally also requires fewer inferences than the encodings into untyped first-order logic. The exceptions are only at fact sizes where the encodings into untyped first-order logic have lower success rate. The lower success rate is from 3 percentage points (poly tags at 256 to 1024 facts and light poly guards at 2048 facts) up to 23 percentage points (poly guards at 4096 facts).

Variance Inbetween Fact Sizes Figure 3.4 shows, for each type encoding, the percentage of problems that can be proven by at least N different fact sizes. Experiments with SPASS shows similar results (SPASS does not support the poly native and type classes encodings though). The type class encoding has the most problems that can be solved by all fact sizes. All encodings have a number of problems that can be proven only by few of the fact sizes. Around twice as many problems can be proven by one or more fact sizes compared to the number of problems proven by all fact sizes. The reasons include that the smaller fact sizes tend to not include all necessary facts, in particular for

Proofs Using Only Simplifications

.5 shows, for each type encoding, the percentage of problems that can be proven only with simplifications (i.e. without performing any inferences). Interestingly, there is a clear partition in three parts. The least successful encoding is the poly guards encoding with a success rate below 5%. The monomorphic and the type classes encoding have the highest success rate. Their success rate is between 11% (16 facts) and 14% (from 1024 facts on). Inbetween are all other encodings with a success rate between 8% (poly tags at 16 facts) and 11% (poly native at 4096 facts). A possible reason for the difference between the native encodings and the encodings into untyped logic is that all non-native encodings have to encode the type classes. The type class encoding provides native support while the monomorphic encoding removes them by just considering some type instances.

Time Until Successful Proof

Here, I compare the type class encodings average time until it find proofs with the light poly guards encoding and then with the monomorphic encoding.

There are multiple possible ways to reasonably measure the average time. My goal is to avoid penalizing the encoding that is more successful, because (in general) harder proofs require more We can expect that encodings with higher success rate also prove more of the harder problems and thus take longer. I chose two ways to compare the average time, which are both suitable for comparison and additionally invariant to the length of the timeout: First, the average time until a proof was found for those problems where both encodings find a proof (marked as Both Proved). The second is the average time to find the N fastest proofs, where N is the number of proofs the worse of the two encodings finds (marked as Max Proofs). It is possible that the N fastest proofs of the two encodings are from different problems. Note that a comparison using those averages should only be done within one fact size and figure, because the averages of different fact sizes are based on a different number of potentially different problems. Figure 3.6 presents the number of problems used at each fact size for both averages. Figure 3.7 shows the two average times for the type class and light poly guards encoding. Except for the Both Proved It also consistently solves more problems. Figure 3.8 shows the two average times for the type class and monomorphic encoding. For smaller fact sizes (up to 128 facts), the monomorphic encoding is faster and solves more problems. For larger fact sizes, the type class encoding is faster and solves more problems (from 1024 facts). For reference, I have compared the performance of our prototype with the performance of the SPASS version 3.8ds which we specifically optimized for Isabelle/HOL [START_REF] Blanchette | More SPASS with Isabelle[END_REF] (marked Isabelle) and the same SPASS version with default settings (marked defaults). The SPASS binary was created using profile guided whole program optimizations on similar Isabelle problems. I used the monomorphic and the poly guards type encoding for the comparison of SPASS and Pirate. The monomorphic encoding is the only native encoding SPASS supports while the poly guards encoding is Pirate's lowest performing (i.e. most difficult) type encoding. Additionally, SPASS has special support for the poly guards' predicates in form of its support for sorts. The main difficulty of the poly guards encoding is rewriting, because the guards added to previously unconditional equations make unconditional rewriting impossible.

The success rates of Pirate and SPASS on the two encodings are shown in Figure 3.9. Pirate and SPASS's Isabelle setting show similar scalability, but Pirate has a lower success rate. Pirate's monomorphic success rate is between 83% (1024 facts) and 90% (4096 facts) of SPASS's Isabelle setting, while Pirate's poly guards success rate is between 74% (512 facts) and 86% (16 facts) of SPASS's Isabelle setting. Pirate's monomorphic success rate is between 86% (16 and 128 facts) and 112% (2048 facts) of SPASS's default setting, while Pirate's poly guards success rate is between 87% (16 facts) and 118% (512 and 4096 facts) of SPASS's default setting.

I believe that the main causes of the difference between SPASS and Pirate is, that Pirate's CNF transformation is naive, SPASS's reductions are more powerful and its algorithms better tuned. Furthermore, SPASS is circa one order of magnitude faster, which is might be caused by a combination of the above and the fact that SPASS is written in hand-tuned C, while Pirate is written in Scala and runs on the Java Virtual Machine.

The evaluation results are available under http://people.mpi-inf.mpg.de/ ~dwand/thesis/

Refutational Completeness

The refutational completeness proof for polymorphic superposition with type classes is a composition of four liftings, four encodings and five (variants of) first-order languages. Each lifting step starts from a first-order language for which we know that superposition is refutationally complete and uses that to prove completeness for the first-order language with an extended type system. The lifting steps require the more expressive language to be encoded into the language we lift from. The encoding step must preserve satisfiability. The initial language is the standard first-order language with no types, in particular its ground version for which superposition is known to be refutationally complete (Sect. 2). It is represented by the bottom-most box in Figure 3.10. The first step then lifts completeness from superposition for ground untyped first-order to ground first-order with type symbols, represented by the second box from the bottom (Sect. 3.5.1). The second lifting then further extends completeness to the middle box of the figure -non-ground first-order with type symbols (Sect. 3.5.2). Thirdly, completeness of non-ground first-order with type-symbols is lifted to monomorphic first-order represented by the forth box from the bottom -a non-ground first-order language with type terms but no type variables (Sect. 3.5.3). Finally, the completeness for monomorphic first-order is lifted to polymorphic first-order with type classes, represented by the top box (Sect. 3.5.4).

The proof obligations for each step are as follows. First, an encoding from the more expressive to the previous logic has to be presented. That encoding has to be satisfiability preserving. To complete each step, we also have to lift the inferences to the more expressive logic. To proof the Model Construction Lemma (Lemma 2.2.4.8) using the Candidate Interpretation Construction (Section 2.2.4) it suffices to show the Lifting Lemmas for each inference of the superposition calculus (Lemma 2.2.4.6 and Lemma 2.2.4.7) as well as showing variables closed under rewriting in the Candidate Interpretation Construction (Lemma 2.2.4.5). Once these three lemmas are proven, the Model Construction Lemma follows and therefore static refutational completeness (Lemma 2.2.4.11) does too. For the intermediate lifting, we will not show dynamic refutational completeness, which is only required to run or meaningfully implement superposition. We will show dynamic refutational completeness for the last lifting to the polymorphic language with type classes.

The superposition calculus works on clauses. I have already shown that clausification and Skolemization are possible and can be used to transform formulas of the presented polymorphic language into clauses. Therefore, I define the intermediate languages only for clauses and not for formulas. Furthermore, to obtain a more compact presentation, I omit predicates. The rules for predicates are also very similar to those of functions. In fact, in a typed setting, predicates could be encoded as functions of a boolean type. In Section 3.5.1 I will first present the syntax and semantics of the type-symbol first-order language and then its completeness proof for ground terms. This is followed by the completeness proof for non-ground terms (Sect. 3.5.2). Then, I present the syntax and semantics of the monomorphic firstorder language and its proof (Sect. 3.5.3). Finally, I present the refutational completeness proof for the already presented polymorphic language with type classes (Sect. 3.5.4).

Lifting to Type Symbols without Term Variables

Here, I present the first typed first-order intermediate language. The language has terms with variables and a type system of type symbols which is in some respects similar to type constants in the polymorphic language. The type symbols are essentially sorts of a many-sorted system, but more general type declarations for function symbols are allowed. In particular, overloaded return types are possible in the typesymbol language. The language is not quite an instance of the polymorphic language presented above, because the type declaration of functions are more general than an instance derived by restricting the complex polymorphic type terms to be just type constants. I chose this route, because I believe it leads to a simpler presentation and most of the proofs than trying to achieve the same with an instance would have. When showing refutational completeness, I will first show the ground case and untyped ground case to be equivalent and then lift the type-symbol ground case to variables with type-symbols. Complex ground type terms present in the polymorphic calculus can be represented by a fresh type-symbol. We will use this in our lifting from type-symbols to monomorphic first-order logic.

Syntax

The syntax of our type-symbol language is the first step away from untyped first-order logic. For the ground case, the type-symbol language and the untyped language are essentially the same and we will show this below. In contrast to the polymorphic language, we define well-typedness and the terms and clauses simultaneously, since the type-symbol case is simpler. We therefore only define well-typed type-symbol terms and clauses. Definition 3.5.1.1 (Type-Symbol Signature). The signature Σ T for type-symbol first-order logic is the tuple (S T F , S T T , F T ) where

• S T F is a countable set of function symbols f with arity ≥ 0, written as arity( f ) = m;

• S T T is a countable set of type symbols. We will use κ for type symbols in this section;

• F T is a set of tuples ( f, κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n ) where f is a function symbol contained in S T F with arity m ≥ 0, symbol-arity n ≥ 0 and where κ is the type symbol that represent the range and κ 1 , . . . , κ m are the type symbols for the respective arguments domain. For each pair of function symbol f and type symbol κ at most one tuple may exist. Each instance of an overloaded function symbol represents its own function.

Conceptually, κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n is a single label τ with two associated functions. One function that maps each τ to a κ that gives its domain and one function that maps each τ to the list of κ 1 , . . . , κ m the argument domains. I leave these functions implicit but sometimes write τ instead of κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n .

If a function symbol f has an arity of 0 then we call f a constant symbol. Definition 3.5.1.2 (Type-Symbol Terms). Let Σ T be a signature and X be a given countably infinite set of term variables. We split X for each type symbol κ in S T T in disjoint subsets and write X κ for each countably infinite subset. Then all type-symbol terms T T Σ (X ) and their type symbol τ(. . . ) are recursively defined as follows:

1. For all sets of variables X κ each variable u ∈ X κ is a term. We define u's type to be τ(u) = κ. A term is ground if it contains no variables. We write u κ to denote that the variable u is from the set X κ and thus of a variable of the type symbol κ. Furthermore, we have no explicit quantifiers and all variables are implicitly universally quantified. Without loss of generality we also assume that all variables are named uniquely. Definition 3.5.1.3 (Type-Symbol Literals). Let Σ T be a signature. Then literals are defined as

For all tuples

( f, κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n ) ∈ F T ,
1. ⊥ 2. 3. s ≈ t if s, t ∈ T T Σ (X ) and τ(s) = τ(t) 4. s ≈ t if s, t ∈ T T Σ (X ) and τ(s) = τ(t)
The equality predicate is a built-in overloaded (for each τ) predicate. We require both its left-hand and right-hand side terms to be of the same type, i.e. τ(s) = τ(t). We call literals constructed by rules 1-3 atoms. Definition 3.5.1.4 (Type-Symbol Clauses). We define clauses to be multisets of literals.

We use A for atoms, L for literals and C, D, φ for clauses. A clause is ground if it contains no variables.

Substitutions Here I introduce substitutions for type-symbol variables, terms and literals. Definition 3.5.1.5 ((Variable Substitutions). A substitution is a mapping from variables (X ) to terms (T T Σ (X )). We write them as σ = {u 1 → t 1 , . . . , u n → t n }, where all u i are pairwise distinct and the type of the variable and terms are the same: τ(u i ) = τ(t i ). We define them to be:

σ(v) = t i if v = u i v otherwise
We also write uσ for σ(u). A substitution σ is updated to return t for u (where

τ(t) = τ(u)) by σ[u → t](v) = t if v = u σ(v) otherwise
f κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n (t 1 , . . . , t m )σ ⇒ f κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n (t 1 σ, . . . , t m σ)
Definition 3.5.1.7 ((Literal Substitutions). Substitutions are similarly extended to literals by

1. ⊥σ ⇒ ⊥ 2. σ ⇒ 3. (s ≈ t)σ ⇒ sσ ≈ tσ 4. (s ≈ t)σ ⇒ sσ ≈ tσ
For clauses the substitution is applied to each literal of the clause and for clause sets to each clause of the set.

Unification Superposition requires unification and in particular the existence of a unique most general unifier (up to renaming). Therefore, I define unification of type-symbol terms and show that it computes a unique most general unifier.

Let t 1 , t 2 be two terms, then unification is the task to derive a substitution σ such that t 1 σ = t 2 σ. The unification rules work on a tuple (E; S ), where E are the equations that are still to be unified and S are the equations that are already solved. We use . =

for not yet unified equations and = for equations that are already solved. We start the unification of two terms t 1 , t 2 with the tuple ({t 1 . = t 2 }; / 0) and apply the following unification rules. If E is empty, the unification is complete and then S contains the unifier, since it only contains variable to term mappings. The unification has failed if any equation in E cannot be removed by applying one of the unification rules. In that case, no unification is possible. I define the rules in such a way that there is no overlap between them, this simplifies the proofs below. In particular, the side condition of the Decompose rule is only needed to prevent an overlap with the Identity rule. --------------------------------------

Identity (t . = t, E ; S ) ⇒ (E ; S ) Decompose ( f τ (t 1 , . . . , t m ) . = f τ (s 1 , . . . , s m ), E ; S ) ⇒ (t 1 . = s 1 , . . . , t m . = s m , E ; S ) if f τ (t 1 , . . . , t m ) = f τ (s 1 , . . . , s m ) Orient (t . = u, E ; S ) ⇒ (u . = t, E ; S ) if u is a variable but t is not Eliminate (u . = t, E ; S ) ⇒ (E {u → t}; u = t, (S {u → t})) if τ(u) = τ(t)
and u ∈ vars(t) In an actual implementation, the failure rules could also be considered, but since the type-symbol language is just an intermediate language, I am only interested in the existence of a unique most general unifier. Note in particular that the overall unification fails if we have an obligation of the form f τ (. . . ) . = f τ (. . . ) in E and τ = τ .

Correctness and Uniqueness of Unification I now proof that this unification algorithm computes a unique most general unifier (up to renaming) and thus that such a unifier exists. To that end, I first show that S contains only variable to term mappings, i.e. that it actually contains a substitution. Then I show that the algorithm computes a unifier and always terminates. I continue by showing that no unifier is lost by any step of the algorithm and then conclude that it computes a most general unifier and that this most general unifier is unique. Proof. Suppose that t = s, then only the Identity rule is applicable. Suppose that t = s then we have four cases either t and s have a function symbol at the top, one of them is a variable and the other is not, or both of them are a variable:

• Let t = f τ t (t 1 , .
. . , t m ) and s = g τ s (s 1 , . . . , s m ) both have function symbols at the top.

Then they are only unifiable if the top function symbols ( f = g) and their type definitions (τ t = τ s ) are identical. In this case only the Decompose rule is applicable.

• Let t = f τ t (t 1 , . . . , t m
) have a function symbol at the top and s = u be a variable. In this case only the Orient rule is applicable.

• Let t = u be a variable and s = g τ s (s 1 , . . . , s m ) have a function symbol at the top. Then they are unifiable only if s does not contain t and they are of the same type. In this case only the Eliminate rule is applicable.

• Let t = u t and s = u s both be variables. In this case only the Eliminate rule is applicable, because t = s and they are unifiable only it they are of the same type.

The unification algorithm must also terminate in order to be reasonable. Proof. Applying unification decreases the lexicographic ordering on the pair of the number of distinct variables and the number of symbols occurring in E below a . = obligation. This is not true for the Orient rule, but we can only apply it at most once for each . = obligation.

To show that the unification algorithm computes the most general unifier, I show that for each step of the unification algorithm no unifier is lost. Then, the most general unifier must be an instance (renaming) of the resulting substitution. Lemma 3.5.1.12 (Type-Symbol Unification Preserves Unifiers). Let (E; S ) ⇒ (E , S ) be one step of the unification algorithm, then if θ is a unifier for (E, S ) it is also a unifier for (E , S ).

Proof. Let t . = s be an arbitrary unification obligation in E. Let E r be E without t . = s. Suppose t = s, then the Identity rule is applicable and E = E r and S = S . Clearly, if θ is a unifier for (E, S ), then it is also a unifier for (E , S ). Suppose t = s, then it is one of the following cases:

• Let t = f τ (t 1 , . . . , t m ) and s = f τ (s 1 , . . . , s m ), then the Decompose rule is applicable and

E = t 1 . = s 1 , . . . , t m .
= s m , E r and S = S . Clearly, if θ is a unifier for (E, S ) then tθ = sθ and thus it is also a unifier for the subterms t i θ = s i θ. It is therefore also a unifier for (E , S ).

• Let t = f τ t (t 1 , . . . , t m ) and s = u. Then the Orient rule uses commutativity of equality to reorient the unification obligation. Clearly, θ is still a unifier. Now I can combine the previous lemma to show that a most general unifier is computed and that it is unique up to renaming of the variables. Lemma 3.5.1.13 (Type-Symbol Unification Computes a Most General Unifier). If there is a most general unifier θ of t and s, then ({t . = s}; / 0) ⇒ * ( / 0, S ) and θ is an instance of the unifier contained in S .

Proof. Suppose there is a most general unifier and ( / 0, S ) does not contain it. Since we know that the unification algorithm always terminates (Lemma 3.5.1.11) we have the following possibilities: Either (1.) ({t . = s}; / 0) ⇒ * (E, S ) and E = / 0 or (2.) ({t . = s}; / 0) ⇒ * ( / 0, S ) and S does not contain the most general unifier. In the first case, Lemma 3.5.1.10 guarantees that there is a unification rule that is applicable if E is unifiable. E must be unifiable if there is a most general unifier, but then (E, S ) cannot be the end result of the unification algorithm. In the second case we know that no unifier (in particular the most general unifier) is lost by a step of the unification algorithm (Lemma 3.5.1.12). Therefore, the most general unifier is an instance of the unifier contained in S .

Finally, I can conclude that there is a unique (up to renaming) most general unifier for any two type-symbol terms. Lemma 3.5.1.14 (The Most General Unifier is Unique). The most general unifier of two type-symbol terms t and s is unique up to renaming of variables.

Proof. Follows from Lemma 3.5.1.13, because all most general unifiers are instances of the unifier σ contained in S .

Semantics

Here, I define the semantics of the type-symbol language. In untyped first-order logic we have no concept of types or type symbols and their domains. In the type-symbol case we have type symbols which are part of the syntax and each type symbol is interpreted to represent a domain, a subset of the overall universe.

Definition 3.5.1.15 (Structure). A Σ T -structure is a tuple (U T , D T , I T T , I T F )
, where U T is a non-empty countable set of elements, the universe.

D T a non-empty set of non-empty disjoint subsets of U. For each type symbol κ ∈ S T T there is a domain D κ ∈ D T that corresponds to it.

I T
T is the set of interpretation function for the type symbols that maps them to their domains (D T ).

I T F is the set of interpretation function for the function symbols. For each function symbol f ∈ S T F with a declaration ( f, κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n ) ∈ F T , there is a function f I κ 1 ,...,κ m →κ, κ a 1 , ..., κ an ∈ I T F such that the function's argument domain is

I T (κ 1 ) × • • • × I T (κ m ) and its range is I T (κ).
The universe and functions are similar to untyped first-order logic. Unlike untyped first-order, the universe of the type-symbol language must be split into the domains the type symbols represent. Those subsets are represented by D T . Note that the set D T is still countable, because there are only countable many non-empty disjoint subsets of a countable set (there are only countable many disjoint subsets of size one) and the universe U is countable. The type symbols must also be mapped to those domains by I T T .

Interpretation Here we define the interpretations of the type symbol language.

Definition 3.5.1.16 (Type Symbol Interpretation). The interpretation (S T T → 2 U ) of type symbols is defined by

I T (κ) = D κ
where D κ ∈ D represents the domain of elements of that type symbol.

A variable valuation (V) is a mapping from X → U such that the result of the variable valuation V(u κ ) is always a member of the domain I V (κ) of the variable's type symbol κ. A variable valuation is always relative to a given Σ T -structure, but we leave this relation implicit.

Definition 3.5.1.17 (Term Interpretation). The interpretation (T Σ ( / 0) → U) of terms is defined by

I T V (u) = V(u) I T V ( f τ (t 1 , . . . , t m )) = f I τ (I V (t 1 ), . . . , I V (t m ))
where f I τ ∈ I T F is the function corresponding to the function symbol f ∈ S T F with type definition τ. All results of f I τ must be elements of I T T (τ( f τ (t 1 , . . . , t m ))).

Definition 3.5.1.18 (Literal Interpretation). The Interpretation of literals is defined by

I T V (⊥) = 0 I T V ( ) = 1 I T V (s ≈ t) = 1 ⇔ I T V (s) = I T V (t) I T V (s ≈ t) = 1 ⇔ I T V (s) = I T V (t)
The interpretation of a clause is true if the interpretation of any of its literals is true. The interpretation of a set of clauses is true if the interpretation for all the clauses the clause set contains is true. Let max be true if and only if at least one of its arguments is true, and min be true if and only if all of its arguments are true. Let vars(φ) be the set of all variables occurring in a clause φ. We extend interpretations to clauses by computing the set of variables and then universally quantifying over them. Definition 3.5.1.19 (Clause Interpretation). The interpretation of clauses is defined by

I V ( / 0, φ) = max L∈φ (I V (L)) I V ({u κ } V, φ) = min e∈I T (κ) (I V[u →e] (V, φ)) I(φ) = I {} (vars(φ), φ))
Refutational Completeness -Ground Case

We know that untyped ground superposition is complete, therefore we relate ground type-symbol superposition to it. The differences between untyped and ground type-symbol superposition are the type-symbol declarations and type symbols. We now present a series of translations that translate ground type-symbol first-order logic to ground first-order logic and back. We then use them to prove the ground type-symbol superposition refutationally complete. First, we translate pairs of type-symbol function symbols and their annotated type definitions (τ) to their untyped function symbol equivalent. The translation s maps each combination of function and its type definition to a new, fresh function symbol for the untyped ground case. By construction s is a bijection.

Then, the translation tv translates the terms between ground type-symbol and untyped. Using the translation s, the terms are transformed by mapping the type-symbol function and type symbol pairs to the single untyped function symbol:

tv( f τ (t 1 , . . . , t m )) = s( f, τ)(tv(t 1 ), . . . , tv(t m ))
We denote the reverse translation by tv -1 :

tv -1 (s( f, τ)(t 1 , . . . , t m ) = f τ (tv -1 (t 1 ), . . . , tv -1 (t m ))
Well-typedness is preserved by superposition, because equations can only be between terms where the top type symbol is equal (Lemma 3.5.1.20). The translation ts2ut translates type-symbol clauses and clause sets to untyped clauses and clause sets by translating all terms that occur in them. The untyped ordering ≺ for the untyped terms and clauses is induced by the type-symbol ordering ≺ for the type-symbol terms and clauses before translation is used. The untyped ordering holds for t ≺ s if and only if tv -1 (t) ≺ tv -1 (s). The selection of the type-symbol clauses is used for the translated untyped clauses.

We will now prove type-symbol and ground superposition to be equivalent by showing that, after translation, each inference in the one system is mirrored by an inference in the other system. We also need to show that ≺ is a simplification ordering. To this end we first show that we can replace a subterm of a term t by a subterm of equal type without changing the type of the term t. Lemma 3.5.1.20 (Type Judgement). For all terms t[s] where s is t or a subterm of t it holds that τ(s) = τ(s

) =⇒ τ(t[s]) = τ(t[s ]).
Proof. The proof is by induction over t.

• If t is s and is replaced by s the lemma is trivial (i.e. if t is a variable or constant).

• If t is of the form f κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n (t 1 , . . . , t m ) and one of its subterms t i is replaced by t i and that subterm is still of τ(t i ) = τ(t i ) = κ i then by definition of terms (2) it holds that τ(t) = κ.

We expect the inverse of the translation tv applied to the to result of an application of tv to result in the same term, thus the translation tv must be a bijection. For all ground type-symbol terms t it holds that tv -1 (tv(t)) = t.

Proof. The proof is by induction over t.

• If t is a constant, then f τ () is mapped to s( f, τ)() by tv which is mapped to f τ () by tv -1 , which is the initial t.

• If t is not a constant, then it is of the form f τ (t 1 , . . . , t m ). The mapping of the top level function and type symbol pair is preserved in the same way as it is for constants. The mapping of the arguments terms t 1 , . . . , t m results in the same terms by the induction hypothesis.

In order for ≺ to be total, we need that terms that are not equal before the translation tv -1 are not equal afterwards. Corollary 3.5.1.22 (Terms Stay Distinct). For all untyped ground terms t and s it holds that if t = s then tv -1 (t) = tv -1 (s).

Proof. Follows from Lemma 3.5.1.21.

For the untyped superposition calculus to work, it needs a reduction ordering as a parameter. Therefore, I have to show that the translated ordering is still one. Since the ordering is in fact also a simplification ordering, I show that ≺ is in fact a simplification ordering. Lemma 3.5.1.23 (≺ is a Simplification Ordering ). If ≺ is a simplification ordering for type-symbol first-order logic, the derived ordering ≺ for untyped first-order logic is also a simplification ordering.

Proof. Suppose the lemma does not hold, then ≺ is either not total, not irreflexive, not transitive or not compatible with Σ-operations or does not have the subterm property. We do not have to consider closedness under substitutions for the ground case. In the following, let s 1 , s 2 and s 3 be three untyped ground terms and let s 1 be tv -1 (s 1 ), s 2 be tv -1 (s 2 ) and s 3 be tv -1 (s 3 ).

1. If ≺ is not total, then there must be an s 1 and an s 2 such that s 1 = s 2 and neither s 1 ≺ s 2 nor s 2 ≺ s 1 . From Corollary 3.5.1.22 we know that s 1 = s 2 . By applying the definition of ≺ , we get that neither s 1 ≺ s 2 nor s 2 ≺ s 1 can then hold. But then ≺ cannot be a simplification ordering.

2. If ≺ is not irreflexive, then there must be an s 1 such that s 1 ≺ s 1 . By applying the definition of ≺ we get that then there must also be an s 1 such that s 1 ≺ s 1 . But then ≺ cannot be a simplification ordering.

3. If ≺ is not transitive, then there must be an s 1 , an s 2 and s 3 such that s 1 ≺ s 2 and s 2 ≺ s 3 but not s 1 ≺ s 3 . By applying the definition of ≺ we get that then there must also be an s 1 , an s 2 and s 3 such that s 1 ≺ s 2 and s 2 ≺ s 3 but not s 1 ≺ s 3 . But then ≺ cannot be a simplification ordering.

4. If ≺ is not compatible with Σ-operations, then there must be an s 1 and an s 2 such that s 1 ≺ s 2 does not imply f (t 1 , . . . , s 1 , . . . , t m ) ≺ f (t 1 , . . . , s 2 , . . . , t m ). By applying the definition of ≺ there must be an s 1 and s 2 such that s 1 ≺ s 2 does not imply f (t 1 , . . . , s 1 , . . . , t m ) ≺ f (t 1 , . . . , s 2 , . . . , t m ). But then ≺ cannot be a simplification ordering.

5. Closedness under substitutions is not applicable since there are no substitutions in the ground case 6. If ≺ does not have the subterm property, then there must be an s 1 and an s 2 such that s 2 is a proper subterm of s 1 but it does not hold that s 2 ≺ s 1 . By applying the definition of ≺ there must be an s 1 and s 2 such that it does not hold that s 2 ≺ s 1 . But then ≺ cannot be a simplification ordering.

To show that both the untyped and the type-symbol are bisimulations of each other, I show that each of their inferences can simulate the corresponding inference of the other calculus. I start with the Equality Resolution and the Equality Factoring inferences and then show the Negative Superposition and the Positive Superposition inferences. Lemma 3.5.1.24 (Bisimulation Lemma for the Equality Resolution and Equality Factoring Inferences). Let C be a ground type-symbol clause and ts2ut(C) the translated clause in untyped ground first-order logic. Then there is an equality resolution (or equality factoring) inference of ts2ut(C) if and only if there is an equality resolution (or equality factoring) inference from C.

Proof. Suppose there is a ts2ut(C) so that there is an equality resolution inference for ts2ut(C) such that the inference result is not a result of the equality resolution inference from C (or vice versa). Then there must be at least one side condition of the equality resolution inference that is fulfilled for ts2ut(C) but not for C (or vice versa). The side conditions for the equality resolution inference (Sect. 3.3), simplified for the ground case by removing the unifier, are:

1. s = s . 2. a) (s ≈ s ) is maximal in (C ∨ s ≈ s ) and no literal is selected or b) s ≈ s is the selected literal.
We now show why each side condition must also be fulfilled for C if it is fulfilled for ts2ut(C) and fulfilled for ts2ut(C) if it is fulfilled for C.

1. In the ground case there are no unifiers. Since the translations are bijective, the equality is preserved by the translation. Suppose there is a ground ts2ut(C) so that there is an equality factoring inference for ts2ut(C) such that the inference result is not a result of the equality factoring inference from C. Then there must be at least one side condition of the equality factoring inference that is fulfilled for ts2ut(C) but not for C. The side conditions for the equality factoring inference (Sect. 3.3), simplified by removing the unifier which do not occur in the ground case, are:

2. a) (s ≈ s ) is maximal in (C ∨ s ≈ s ) if
1. s = t 2. t ≈ t maximal in C ∨ s ≈ s ∨ t ≈ t
and no literal is selected.

s s and t t

We now show why each side condition must also be fulfilled for C if it is fulfilled for ts2ut(C) (and vice versa).

1. As before in the ground case, there are no unifiers. Since the translations are bijective the equality is preserved by the translation.

2. The orderings and selection are the same, because the ordering of C is used for ts2ut(C).

3. The orderings are the same, because the ordering of C is used for ts2ut(C).

Thus if the equality factoring inference is possible for ts2ut(C), it is also possible for the typesymbol inference with C.

Lemma 3.5.1.25 (Bisimulation Lemma for the Superposition Inferences). Let C = C ∨ s ≈ s and D = D ∨ t ≈ t be two ground type-symbol clauses. There is a superposition inference between ts2ut(C) and ts2ut(D) where ts2ut(s) and some subterm of ts2ut(t) if and only if there is a superposition inference between C and D.

Proof. Suppose there is a ts2ut(C) and ts2ut(D) so that there is a positive superposition inference for ts2ut(C) and ts2ut(D) such that the inference result is not a result of the positive superposition inference from C and D (or vice versa). Then there must be at least one side condition of the positive superposition inference that is fulfilled for ts2ut(C) and ts2ut(D) but not for C and D (or vice versa). The side conditions for the positive superposition inference (Sect. We now show why each side condition must also be fulfilled for C and D if it is fulfilled for ts2ut(C) and ts2ut(D) (and vice versa).

1. s s and t t hold for both, because the orderings of the translated and original terms is the same.

2. -

3.

The translation preserves all equalities.

4. The orderings and selection are the same, because the ordering of D is used for ts2ut(D).

5. The orderings and selection are the same, because the ordering of C is used for ts2ut(C).

Thus, the positive superposition inference is possible for Cθ and Dθ if and only if it is also possible for the type-symbol inference with C and D. Suppose there is a ground ts2ut(C) and ts2ut(D) so that there is a negative superposition inference for ts2ut(C) and ts2ut(D) such that the inference result is not a result of the negative superposition inference from C and D (or vice versa). Then there must be at least one side condition of the negative superposition inference that is fulfilled for ts2ut(C) and ts2ut(D) but not for C and D (or vice versa). The side conditions for the negative superposition inference (Sect. 3.3), simplified by removing the unifier, are: 1. s s and t t 2. Not applicable (There are no variables in the ground case.)

3. t = s 2 4. t ≈ t is strictly maximal in D ∨ t ≈ t and no literal is selected 5. a) s ≈ s is maximal in C ∨ s ≈ s and no literal is selected or b) s ≈ s is selected
We now show why each side condition must also be fulfilled for C and D if it is fulfilled for ts2ut(C) and ts2ut(D) (and vice versa). The side conditions and proofs 1. to 4. are identical to the side conditions and proofs of positive superposition inference.

5. a) s ≈ s is maximal in both since the same ordering is used for translated and original literals. b) If s ≈ s is selected in ts2ut(C) it is also selected in C, since the selection is the same for both clauses.

Thus, the negative superposition inference is possible for ts2ut(C) and ts2ut(D) if and only if it is also possible for the non-ground inference with C and D.

We have now shown that after translation type-symbol and ground superposition are bisimulating each other. It remains to show that the clause sets before and after translation are equisatisfiable.

Lemma 3.5.1.26 (Type-Symbol Satisfiable Implies Untyped Satisfiable). Let (U T , I T F , D) be a ground type-symbol structure, then there is an untyped structure (U, I F ) such that for all type-symbol ground terms t it holds that I T (t) = I(tv(t)).

Proof. Let U = U T and I F = I T F and let for each untyped function symbol f s( f T ,κ) the corresponding function be f I κ . Then the remaining proof is by induction over t. If t is a constant f T κ (), then its translation is s( f T , κ)() and both their interpretations are f I κ (). If t is not a constant, then it is of the form f T τ (t 1 , . . . , t m ) and its translation is s( f T , τ)(tv(t 1 ), . . . , tv(t m )). The interpretation of t is f I τ (I T (t 1 ), . . . , I T (t m )) and of its translation is f I τ (I(tv(t 1 )), . . . , I(tv(t 1 ))). From the induction hypothesis it follows that for all i with 1 ≤ i ≤ m it holds that I(t i ) = I(tv(t i )). Thus, their interpretations are equal. Lemma 3.5.1.27 (Untyped and Type-Symbol Interpretations are Equisatisfiable). Let N be a clause set of ground type-symbol first-order logic it is satisfiable if and only if the translated clause set N in untyped first-order logic is satisfiable.

Proof. ⇒ The proof is by induction over the interpretation rules from Section 3.5.1 and Section 2.1.2. The interpretation rules for ground clause sets, clauses and literals are identical. From Lemma 3.5.1.26 we know that there is a untyped structure so that the interpretation of the translated term is the same as the original interpretation. ⇐ The direction from an untyped to a type-symbol model is slightly more complicated. This is because in the untyped setting there is no separation of the domains D of the type-symbol setting. Let (U, I F ) be the untyped structure. For each type symbol κ in S T T all elements e ∈ U become new elements e κ of the domain of κ, i.e. e κ ∈ I T (κ). The new universe U T then is the union of all domains and D T is the set of all domains. The functions f τ ∈ I T F are constructed by combining s( f, τ) ∈ I F and ( f, κ, κ 1 , . . . , κ m ) ∈ F T such that f I τ (e κ 1 1 , . . . , e κ m m ) = e κ if and only if s( f, τ) I (e 1 , . . . , e m ) = e. Where e, e 1 , . . . , e m ∈ U and e κ , e κ 1 1 , . . . , e κ m m are from the respective I T (κ i ). Again, the proof is by induction over the interpretation rules and again the interpretation rules for ground clause sets, clauses and literals are identical. It is therefore necessary to show that I(t) = I(s) implies I T (tv -1 (t)) = I T (tv -1 (s)) for all untyped ground terms t and s. We know that type-symbol equations must be of the same type-symbol κ on the left hand and right hand side, which guarantees that their interpretations both are elements of I T (κ). We have constructed the type-symbol interpretation by duplicating each untyped element for each typesymbol κ. Let iso be a mapping that maps for all κ all e κ back to the e of the untyped model. Then τ(tv -1 (t)) = τ(tv -1 (s)), I(t) = iso(I T (tv -1 (t))) and I(s) = iso(I T (tv -1 (s))) imply that

I(t) = I(s) implies I T (tv -1 (t)) = I T (tv -1 (s)).
It remains to show that for all untyped ground terms t it holds that I(t) = iso(I T (tv -1 (t))). The proof is by induction over t. If t is a constant s( f T , κ)() then its translation to ground type-symbol is f T κ () and if I(s( f T , κ)()) = e then I T ( f T κ ()) = e κ by construction of our type-symbol model. Clearly e = iso(e κ ). If t is not a constant, then it is of the form s( f T , κ 1 , . . . , κ m → κ)(t 1 , . . . , t m ) and its translation is f T κ 1 , . . . , κ m → κ (tv -1 (t 1 ), . . . , tv -1 (t m )). The untyped interpretation is f I (I(t 1 ), . . . , I(t m )) = e and while by induction hypothesis f I κ 1 ,...,κ m →κ (I T (tv -1 (t 1 )), . . . , I T (tv -1 (t m ))) is the type-symbol one. I(t i ) = iso(I T (tv -1 (t i ))) for all argument terms. Thus, by construction of f I κ 1 ,...,κ m →κ the type-symbol interpretation is f I κ 1 ,...,κ m →κ (I T (tv -1 (t 1 )), . . . , I T (tv -1 (t m ))) = e κ . It follows that e = iso(e κ ).

Since I showed the translation to be satisfiability preserving and I showed the type-symbol superposition calculus and the translated untyped one to be bisimulations of each other I have shown completeness for ground type-symbol superposition. As the ground type-symbol language is an intermediate language in the overall proof, I will not show dynamic refutational completeness for it. Theorem 3.5.1.28 (Static Refutational Completeness). Superposition is refutationally complete for the ground version of type-symbol first-order logic.

Proof. We have shown that our translations preserve satisfiability (Lemma 3.5.1.27) and we have shown that the ground type-symbol superposition calculus and the translated ground untyped superposition calculus are bisimulations of each other (Lemma 3.5.1.24 and Lemma 3.5.1.25). Therefore the completeness of the ground untyped version of superposition (Lemma 2.2.4.11) is lifted to the ground type-symbol version of superposition.

Lifting to Type Symbols with Term Variables

The syntax and semantics for the type-symbol language with variables are already given in the previous section (Sect. 3.5.1). There, completeness was shown for the ground type-symbol case.

Refutational Completeness

I will now lift ground type-symbol first-order logic, proved refutationally complete in the previous section, to non-ground type-symbol first-order logic. In this lifting step the encoding is the replacement of a non-ground clause by a set of ground clauses, just as in the lifting in the untyped proof.

As a first step to justify the restriction of superposition to not superpose into variables, I have to show that variables are closed under rewriting. Lemma 3.5.2.1 (Variables are Closed Under Rewriting). Let C ∈ N and θ be a substitution such that Cθ ∈ G Σ (C) and x be a variable occurring in C then: If xθ → t is some rewrite step, then there exists a θ such that xθ = t and yθ = yθ for every variable y = x and furthermore Cθ ∈ G Σ (C).

Proof. From the definition of literals it follows that only terms of the same type symbol can be equal. Rewriting is only possible by replacing terms by other terms of the same type symbol, which does not change the overall type of a term (Lemma 3.5.1.20). Since a variable can be instantiated to any term of the type symbol it is assigned to, the lemma holds.

To lift the completeness from the ground type-symbol case to the type-symbol case with variables, the inferences need to be lifted. I first lift the Equality Resolution and the Equality Factoring inferences and then the Positive Superposition and the Negative Superposition inferences into non-variable positions. Lemma 3.5.2.2 (Lifting Lemma for the Equality Resolution and Equality Factoring Inferences). Let C be a clause and let θ be a substitution such that Cθ is ground type-symbol first-order logic. Then every equality resolution (or equality factoring) inference of Cθ is an instance of an equality resolution (or equality factoring) inference from C.

Proof. Suppose there is a ground Cθ so that there is an equality resolution inference for Cθ such that the inference result is not a result of the equality resolution inference from C. Then there must be at least one side condition of the equality resolution inference that is fulfilled for Cθ but not for C. The side conditions for the equality resolution inference (Sect. 3.3) are:

1. sσ = s σ, where σ is the most general unifier of s and s . I now show why each side condition must also be fulfilled for C if it is fulfilled for Cθ.

1. If the ground inference is applicable for Cθ, then sθ must be equal to s θ. By the existence and uniqueness of the most general unifier, there must be a most general unifier θ g of s and s such that θ = θ g θ . But then this side condition is also fulfilled for C.

2. a) If (s ≈ s )θ is maximal in (C ∨ s ≈ s )θ and nothing is selected then there is no literal L in C such that Lθ (s ≈ s )θ.
A literal is maximal with respect to a set of literals if there is a ground instance that is not smaller than any other literals in that instantiated set. Therefore, the uninstantiated literal is also maximal.

b) If s ≈ s is selected in Cθ it is also selected in C.
Thus, if the equality resolution inference is possible for Cθ it is also possible for the non-ground inference with C.

Suppose there is a ground Cθ so that there is an equality factoring inference for Cθ such that the inference result is not a result of the equality factoring inference from C. Then there must be at least one side condition of the equality factoring inference that is fulfilled for Cθ but not for C. The side conditions for the equality factoring inference (Sect. 3.3) are:

1. sσ = tσ, where σ is the most general unifier of s and t.

2. (t ≈ t )σ maximal in (C ∨ s ≈ s ∨ t ≈ t )σ and no literal is selected.

sσ s σ and tσ t σ

I now show why each side condition must also be fulfilled for C if it is fulfilled for Cθ.

1. If the ground inference is applicable for Cθ, then sθ must be equal to tθ. By the existence and uniqueness of the most general unifier, there must be a most general unifier θ g of s and t such that θ = θ g θ . But then this side condition is also be fulfilled for C.

Since

(t ≈ t )θ is maximal in (C ∨ s ≈ s ∨ t ≈ t )
θ and no literal is selected, there is no literal L in C such that Lθ (t ≈ t )θ. Therefore, the uninstantiated literal is also maximal.

3. Since the ordering is total on ground terms, I know that sθ s θ and tθ t θ. The ordering is also closed under substitutions and thus s s and t t .

Thus, if the equality factoring inference is possible for Cθ it is also possible for the non-ground inference with C. Proof. Suppose there is a ground Cθ and Dθ so that there is a positive superposition inference for Cθ and Dθ such that the inference result is not a result of the positive superposition inference from C and D. Then there must be at least one side condition of the positive superposition inference that is fulfilled for Cθ and Dθ but not for C and D. The side conditions for the positive superposition inference (Sect. 1. Since the ordering is total on ground terms, I know that sθ s θ and tθ t θ. The ordering is also closed under substitutions and thus s s and t t .

2. That the inference is not at or below a variable position is part of the assumptions of the lemma.

3. If the ground inference is applicable for Cθ, then tθ must be equal to s 2 θ. By the existence and uniqueness of the most general unifier, there must be a most general unifier θ g of t and s 2 such that θ = θ g θ . But then this side condition is also be fulfilled for C and D.

4. If (t ≈ t )θ is strictly maximal in (D ∨ t ≈ t )θ and no literal is selected then there is no literal L in D such that Lθ (t ≈ t )θ. Therefore, the uninstantiated literal is also maximal.

Thus if the positive superposition inference is possible for Cθ and Dθ it is also possible for the non-ground inference with C and D. Suppose there is a ground Cθ and Dθ so that there is a negative superposition inference for Cθ and Dθ such that the inference result is not a result of the negative superposition inference from C and D. Then there must be at least one side condition of the negative superposition inference that is fulfilled for Cθ and Dθ but not for C and D. The side conditions for the negative superposition inference (Sect. 3.3) are: 1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. tσ = s 2 σ and σ is the most general unifier of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. a) (s ≈ s )σ is maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for Cθ and Dθ. The side conditions and proofs 1. to 4. are identical to the side conditions and proofs of positive superposition inference.

5. a) If (s ≈ s )θ maximal in (C ∨ s ≈ s )θ and nothing is selected then there is no literal L in C such that Lθ (s ≈ t)θ. Therefore, there is also no L in D such that L (t ≈ t ), otherwise the ordering would not be closed under substitutions. b) If s ≈ s is selected in Cθ it is also selected in C.

Thus, if the negative superposition inference is possible for Cθ and Dθ it is also possible for the non-ground inference with C and D.

The lifting lemma for superposition only holds for superposition into non-variable position. Therefore, I also have to show that superposition into the variable positions is irrelevant. Lemma 3.5.2.4 (Lifting Lemma for the Superposition Inferences Into Variables). Let D = D ∨ t ≈ t and C = C ∨ s ≈ s be two clauses without common variables and let θ be a substitution such that Cθ and Dθ are ground clauses of type-symbol first-order logic. If there is a superposition inference from D θ ∨ tθ ≈ t θ into C θ ∨ (s[s 2 ] p )θ ≈ s θ (i.e. such that tθ = s 2 θ is rewritten to t θ) and (s 2 θ) occurs at or below a variable position in s, then the inference result is identical to a ground instance of D or redundant.

Proof. Let u be the variable of C under which s 2 θ occurs, i.e. s 2 θ is a subterm of uθ, i.e. uθ[s 2 θ] p . Since variables are closed under rewriting (Lemma 3.5.2.1), u can also be instantiated to take the rewriting of s 2 θ to t θ into account. Let θ be the corresponding substitution, i.e.

θ = θ[u → (uθ[t θ] p )].
The resulting clause of the superposition inference is

R = D θ ∨ C θ ∨ (s[t ] p )θ ≈ s θ.
If D is empty and u occurs only once in C, then the resulting clause R is Cθ and thus it is identical to a ground instance of D. If D is not empty or u occurs more than once in C, then clearly each occurrence of uθ in R can be rewritten to uθ by conditional rewriting with Dθ. The result of this rewrite step is either a ground instance Cθ of C (if D is empty) or is redundant with respect to that ground instance Cθ . I now show that the fact that variables are closed under rewriting and that the lifting lemmas hold which is sufficient for lifting a proof of the ground type-symbol case to the non-ground type-symbol case. Lemma 3.5.2.5 (Lifting). Let N be a set of type-symbol clauses. Then ⊥ ∈ Sup * (G Σ (N)) implies ⊥ ∈ Sup * (N).

Proof. Each ground Equality Resolution inference and each ground Equality Factoring inference can be replayed in the non-ground case (Lemma 3.5.2.2). Each ground Superposition inference, that is not into a variable position, can be replayed in the non-ground case (Lemma 3.5.2.3). Furthermore, each result of a ground Superposition inference, into a variable position, is redundant (Lemma 3.5.2.4). Because of these lifting lemmas (Lemma 3.5.2.2, 3.5.2.3 and 3.5.2.4), each step of the ground type-symbol proof (in Sup * (G Σ (N))) is mirrored in the type-symbol clause set (Sup * (N)).

Furthermore, I prove that any model of the ground type-symbol case can be lifted to a model of the non-ground type-symbol case. Lemma 3.5.2.6 (Model Lifting). Let N be a countable set of type-symbol clauses and let I be an interpretation. Then I G Σ (N) implies that there is an interpretation I such that I N.

Proof. Let the structure (U T , D T , I T T , I T F ) be the structure of the interpretation of G Σ (N). Let D T v be D T such that for each d ∈ D T and each e ∈ d there is a ground term t in G Σ (N) such that e is the interpretation of t. For each d ∈ D T and let d v be the union of all e ∈ d such that there is a ground term t in G Σ (N) such that e is the interpretation of t. Let D T v be the union of all such d v and let U T v be the union of all such d v . Clearly, if the ds are pair-wise disjoint, then the d v s are also pair-wise disjoint. It also holds that I G Σ (N) with the structure (U T v , D T v , I T T , I T F ), because we only removed elements of the universe that are not used in the interpretation. When using the structure (U T v , D T v , I T T , I T F ), there is no difference between the interpretation of a type-symbol κ and the union of the interpretations of all ground instances of that type, because all elements that do not have a corresponding ground term were removed. Therefore, I G Σ (N) implies I N.

I also show that a set of type-symbol clauses is satisfiable if and only if the corresponding ground type-symbol clauses are satisfiable. Lemma 3.5.2.7 (Type-Symbol and Ground Type-Symbol are Equisatisfiable). A countable set N of Σ-clauses is satisfiable if and only if its monomorphic version G Σ (N) is satisfiable.

Proof. By case distinction whether G Σ (N) is satisfiable.

• Suppose G Σ (N) does not have a model, then ⊥ ∈ Sup * (G Σ (N)). By lifting (Lemma 3.5.2.5)

we have ⊥ ∈ Sup * (N) and thus N does not have a model.

• Suppose G Σ (N) has a model, then there is an interpretation I such that I G Σ (N). By model lifting (Lemma 3.5.2.6) we also have I N.

Lifting the proofs and models from the ground type-symbol case to the non-ground one is sufficient to show that refutational completeness of superposition for the type-symbol language follows. Again, because the type-symbol language is an intermediate language in the overall proof, I will not show dynamic refutational completeness for it. Theorem 3.5.2.8 (Static Refutational Completeness). Superposition is refutationally complete for type-symbol first-order logic.

Proof. I have shown that a countable set N of type-symbol clauses is satisfiable if and only if its ground version G Σ (N) is satisfiable (Lemma 3.5.2.7). Furthermore, I have shown that a proof in the monomorphic version is lifted to the polymorphic version (Lemma 3.5.2.5). Therefore, the completeness of the ground type-symbol version of superposition (Lemma 3.5.1.28) is lifted to the type-symbol version of superposition.

Lifting to Monomorphism

Here, I proof refutational completeness of a monomorphic first-order language. Like the typesymbol language, the monomorphic language allows terms with variables. But now instead of type symbols, I allow complex type terms like in the polymorphic language with type classes, but without the type variables, type classes and type-class constraints. I will reuse the polymorphic language with type classes (Section 3.1), but restrict the syntax to disallow type variables in terms and clauses. By removing the type variables, I also remove the type classes (and constraints). As in the previous two completeness proofs, I will omit predicates and only consider clauses instead of formulas.

Syntax

I reuse the polymorphic signature and syntax (Section 3.1.1), but disallow the use of type variables in the type terms occurring in clauses and formulas. This is done by removing the first rule in the definition of type terms (Def. 3.1.1.3). Thus, type variables can only be used in the declarations.

Signature Even though I reuse the original signature (Def. 3.1.1.1), only a part of it is necessary. After well-typedness of the initial clause set is established, the unnecessary part of the signature can be removed. The relevant part of the signature for the monomorphic first-order language without type variables is a tuple Σ M = (S F , S T , F) where S F is the set of function symbols, S T is the set of type constructor symbols and F declares the arity and the argument and return types.

The other elements are not required, after the initial well-typedness check for the terms that occur in clauses. The predicate symbols (S P ) and predicate type declarations (P) are not necessary, since I omit predicates for the completeness proof. The type class symbols (S K ) and subclass class declarations (T C) are not necessary, since I disallow type variables and thus type classes. The type declarations (T ) are not necessary, since the clause set only contains ground types and does not introduce new ground type terms.

Semantics

Refutational Completeness

I have already shown that type-symbol superposition is refutationally complete (Theorem 3.5.2.8), therefore I translate the monomorphic language to it for the refutational completeness proof. The proof is similar to the lifting from ground untyped first-order logic to ground type-symbol first-order logic. The main differences between the type-symbol language and the monomorphic language is, that the type-symbol one only has type symbols whereas the monomorphic one has complex type terms (both have no type variables).

I now present the translations between monomorphic and type-symbol first-order language. The translation ty maps pairs of function symbols and a list of ground type terms to distinct type symbols, i.e. ty( f, τ 1 , . . . , τ n ) = κ such that ty( f, τ 1 , . . . , τ n ) = ty( f r , τ r 1 , . . . , τ r n ) if and only if f = f r and for all i it holds that τ i = τ r i . The translation ty is bijective by construction.

First, I need to introduce notation to refer to the type of a function term and its translation. I define τ( f, τ r ) to be ty(τ r ). Let furthermore κ be a type symbol and σ be such that τ = τ f σ then I define τ -1 ( f, κ) to be α 1 σ , . . . , α n σ .

The translation tv translates the monomorphic terms to type symbol terms. For the translation I annotate the term variables in the subscript with their corresponding type term respectively type symbol.

tv(u τ ) ⇒ u ty(τ) tv( f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m )) ⇒ f ty , ty(τ 1 ), . . . , ty(τ n ) (tv(t 1 ), . . . , tv(t m ))

where ty is defined as ty = ty(τ(t 1 )), . . . , ty(τ(t m )) → ty(τ r )

Then the translation tv -1 is the reverse translation.

tv -1 (u κ ) ⇒ u ty -1 (κ) tv -1 ( f κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n (t 1 , . . . , t m )) ⇒ f τ (tv -1 (t 1 ), . . . , tv -1 (t m ))
where τ is defined as τ = ty -1 (κ), ty -1 (κ a 1 ), . . . , ty -1 (κ a n )

For the ordering ≺ of the translated terms and clauses, the ordering ≺ of the terms and clauses before translation is used. Formally: t ≺ s if and only if tv -1 (t) ≺ tv -1 (s). Finally, the translation m2ts translates monomorphic clauses to type-symbol clauses by translating all monomorphic terms in them to type-symbol terms. The selection of the clauses is used for the translated clauses.

The type-symbol signature uses the function symbols of the monomorphic signature (S F ), the set of type symbols is the (S T ) translation by t of all possible ground type term instances allowed by the monomorphic signature. The function type declarations (F) are all possible ground type term instances of the type variables of each function symbols monomorphic signature's type declaration.

I first show that the translation tv is a bijection, that inequalities and unifiers are preserved and that the ≺ ordering is a simplification order. Then I show the lifting lemmas as bisimulations of the type-symbol and monomorphic inferences. Lemma 3.5.3.1 (Bijection of tv). For all monomorphic terms t it holds that tv -1 (tv(t)) = t.

Proof. By induction over t.

• If t is a variable u τ then tv -1 (tv(u τ )) ⇒ tv -1 (u ty(τ) ) ⇒ u ty -1 (ty(τ)) . Since ty -1 (ty(τ)) = τ by construction, the property holds for variables.

• If t is a term of the structure f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m ) then tv -1 (tv( f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m ))) ⇒ tv -1 ( f ty(τ(t 1 )), . . . , ty(τ(t m )) → ty(τ r ), ty(τ 1 ), . . . , ty(τ n ) (tv(t 1 ), . . . , tv(t m ))) ⇒ f ty -1 (ty(τ r )), ty -1 (ty(τ 1 )), . . . , ty -1 (ty(τ n )) (tv -1 (tv(t 1 )), . . . , tv -1 (tv(t m ))) which is by induction hypothesis (tv -1 (tv(t i )) = t i ) f ty -1 (ty(τ r )), ty -1 (ty(τ 1 )), . . . , ty -1 (ty(τ n )) (t 1 , . . . , t m ) by the fact that ty is bijective by construction f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m )

In order for ≺ to be total on ground terms, we need that (ground) terms which are not equal before the translation tv -1 are not equal afterwards. Lemma 3.5.3.2 (Terms Stay Distinct). For all type-symbol terms t and s it holds that if t = s then tv -1 (t) = tv -1 (s).

Proof. By induction over t and s. If both t and s are distinct variables before translation, then both are distinct variables after translation. If t (s) is a variable and s (t) a non-variable term, then tv -1 (t) (tv -1 (s)) is still a variable and tv -1 (s) (tv -1 (t)) still a non-variable term. If both t and s are non-variable terms then either

• Their top function symbol is different. It is not changed and therefore it is still different after translation.

• Their top function symbol is equal, but the return type is different. Then τ( f, τ 1 , . . . , τ n ) is different and thus they have a different type symbol after translation.

• A subterm is different, then by induction hypothesis those subterms are different after translation.

In the bisimulation lemmas below we require that terms that are unifiable before the translation tv are also unifiable after. Therefore, I show this fact now. Proof. The translation tv(u) of a variable u is still a variable, so {tv(u 1 ) → tv(s 1 ), . . . } is still a substitution. The remaining proof is by induction on the rules of tv.

• Clearly, the variable case holds: tv(u{u → s, . . . }) = tv(u){tv(u) → tv(s), . . . }.

• For the function case, tv( f τ 1 , . . . , τ n (t 1 , . . . , t m ){u 1 → s 1 , . . . }) . = f τ( f, τ 1 , . . . , τ n ) (tv(t 1 ), . . . , tv(t m )){tv(u 1 ) → tv(s 1 ), . . . }. Since f is a function symbol and τ 1 , . . . , τ n are ground, they are unaffected by substitutions. Thus, the equality depends only on the subterms t i . From the induction hypothesis we know for each t i that tv(t i {u 1 → s 1 , . . . }) = tv(t i ){tv(u 1 ) → tv(s 1 ), . . . }.

For the type-symbol superposition calculus to work it needs as a parameter a simplification ordering, therefore, I have to show that the translated ordering is still one. Lemma 3.5.3.4 (≺ is a Simplification Ordering). If ≺ is a simplification ordering for monomorphic first-order logic, the derived ordering ≺ for type-symbol first-order logic is also a simplification ordering.

Proof. Suppose the lemma does not hold, then ≺ is either not ground total, not irreflexive, not transitive, not compatible with Σ-operations or not closed under substitutions. In the following, let s 1 , s 2 and s 3 be three type-symbol ground terms and s 1 be tv -1 (s 1 ), s 2 be tv -1 (s 2 ) and s 3 be tv -1 (s 3 ) be their monomorphic translation.

1. If ≺ is not ground total, then there must be a ground s 1 and a ground s 2 such that s 1 = s 2 and neither s 1 ≺ s 2 nor s 2 ≺ s 1 . From Lemma 3.5.3.2 I know that s 1 = s 2 and I know that s 1 and s 2 are ground. By applying the definition of ≺ I get that neither s 1 ≺ s 2 nor s 2 ≺ s 1 can then hold. But then ≺ cannot be a simplification ordering.

2. If ≺ is not irreflexive then there must be an s 1 such that s 1 ≺ s 1 . By applying the definition of ≺ I get that there must also be an s 1 such that s 1 ≺ s 1 . But then ≺ cannot be a simplification ordering.

3. If ≺ is not transitive then there must be an s 1 , an s 2 and s 3 such that s 1 ≺ s 2 and s 2 ≺ s 3 but not s 1 ≺ s 3 . By applying the definition of ≺ I get that there must also be an s 1 , an s 2 and s 3 such that s 1 ≺ s 2 and s 2 ≺ s 3 but not s 1 ≺ s 3 . But then ≺ cannot be a simplification ordering.

4. If ≺ is not compatible with Σ-operations then there must be an s 1 and an s 2 such that s 1 ≺ s 2 does not imply f (t 1 , . . . , s 1 , . . . , t m ) ≺ f (t 1 , . . . , s 2 , . . . , t m ). By applying the definition of ≺ there must be an s 1 and s 2 such that s 1 ≺ s 2 does not imply f (t 1 , . . . , s 1 , . . . , t m ) ≺ f (t 1 , . . . , s 2 , . . . , t m ). But then ≺ cannot be a simplification ordering.

5. If ≺ is not closed under substitutions then there must be a σ = {u 1 → t 1 , . . . , u n → t n }, s 1 and s 2 such that s 1 ≺ s 2 does not imply s 1 σ ≺ s 2 σ . Let σ be {u 1 → tv -1 (t 1 ), . . . , u n → tv -1 (t n )}, since u i and t i are of the same type symbol, this is well-typed as well. Then there must be an s 1 and s 2 such that s 1 ≺ s 2 does not imply s 1 σ ≺ s 2 σ. But then ≺ cannot be a simplification ordering.

6. If ≺ does not have the subterm property, then there must be an s 1 and an s 2 such that s 2 is a proper subterm of s 1 but it does not hold that s 2 ≺ s 1 . By applying the definition of ≺ there must be an s 1 and s 2 such that it does not hold that s 2 ≺ s 1 . But then ≺ cannot be simplification ordering.

To show that both the monomorphic superposition calculus and the type-symbol superposition calculus are bisimulations of each other, I show that each of their inferences can simulate the corresponding inference of the other calculus. I start with the Equality Resolution and the Equality Factoring inferences and then show the Negative Superposition and the Positive Superposition inferences.

Lemma 3.5.3.5 (Bisimulation Lemma for the Equality Resolution and Equality Factoring Inferences). Let C be a monomorphic clause and m2ts(C) the translated clause in type-symbol first-order logic. Then there is an equality resolution (or equality factoring) inference of m2ts(C) if and only if there is an equality resolution (or equality factoring) inference from C.

Proof. Suppose there is an m2ts(C) so that there is an equality resolution inference for m2ts(C), such that the inference result is not a result of the equality resolution inference from C (or vice versa). Then there must be at least one side condition of the equality resolution inference that is fulfilled for m2ts(C), but not for C (or vice versa). The side conditions for the equality resolution inference (Sect. 3.3) are:

1. σ mgu of s and s 2. a) (s ≈ s )σ is maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is the selected literal.

I now show why each side condition must also be fulfilled for C if it is fulfilled for m2ts(C) and fulfilled for m2ts(C) if it is fulfilled for C.

1. The translation preserves the most general unifier (Lemma 3.5.3.3).

2. a) (s ≈ s ) is maximal in (C ∨ s ≈ s ) if and only if it is maximal in the translated clause, because translated literals are compared by translating them back to type-symbol and comparing them there. b) s ≈ s is the selected literal either in both or in neither because the same selection of literals is used for m2ts(C) and C.

Thus, the equality resolution inference is possible for m2ts(C) if and only if the type-symbol inference is possible with C. Suppose there is a ground m2ts(C) so that there is an equality factoring inference for m2ts(C), such that the inference result is not a result of the equality factoring inference from C. Then there must be at least one side condition of the equality factoring inference that is fulfilled for m2ts(C), but not for C. The side conditions for the equality factoring inference (Sect. 3.3) are:

1. sσ = s σ, where σ is the most general unifier of s and s . 2. (s ≈ t)σ maximal in (C ∨ s ≈ t ∨ s ≈ t)σ and no literal is selected.

s σ t σ and sσ tσ

I now show why each side condition must also be fulfilled for C if it is fulfilled for m2ts(C) (and vice versa).

1. The translation preserves the most general unifier (Lemma 3.5.3.3).

2. The orderings and selection are the same, because the ordering of C is used for m2ts(C).

The orderings are the same, because the ordering of C is used for m2ts(C).

Thus, the equality factoring inference is possible for m2ts(C) if and only if the type-symbol inference is possible with C. Lemma 3.5.3.6 (Bisimulation Lemma for the Superposition Inferences). Let C = C ∨ s ≈ s and D = D ∨ t ≈ t be two monomorphic clauses. There is a superposition inference between m2ts(C) and m2ts(D) where m2ts(s) and some subterm of m2ts(t) if and only if there is a superposition inference between C and D.

Proof. Suppose there is an m2ts(C) and m2ts(D) so that there is a positive superposition inference for m2ts(C) and m2ts(D) such that the inference result is not a result of the positive superposition inference from C and D (or vice versa). Then there must be at least one side condition of the positive superposition inference that is fulfilled for m2ts(C) and m2ts(D) but not for C and D (or vice versa). The side conditions for the positive superposition inference (Sect. 3.3) are: 1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. σ mgu of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. (s ≈ s )σ is strictly maximal in (C ∨ s ≈ s )σ and no literal is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for m2ts(C) and m2ts(D) (and vice versa) 1. sσ s σ and tσ t σ hold for both, because the orderings of the translated and original terms is the same.

2. The translation preserves term variables, it never exchanges them to or from non-variable terms.

3. The translation preserves the most general unifier (Lemma 3.5.3.3).

4. The orderings and selection are the same, because the ordering of D is used for m2ts(D).

5. The orderings and selection are the same, because the ordering of C is used for m2ts(C).

Thus, the positive superposition inference is possible for C and D if and only if it is also possible for the type-symbol inference with m2ts(C) and m2ts(D). Suppose there is a ground m2ts(C) and m2ts(D) so that there is a negative superposition inference for m2ts(C) and m2ts(D) such that the inference result is not a result of the negative superposition inference from C and D (or vice versa). Then there must be at least one side condition of the negative superposition inference that is fulfilled for m2ts(C) and m2ts(D) but not for C and D (or vice versa). The side conditions for the negative superposition inference (Sect. 3.3) are: 1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. σ mgu of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. a) (s ≈ s )σ is maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for m2ts(C) and m2ts(D) (and vice versa). The side conditions and proofs 1. to 4. are identical to the side conditions and proofs of positive superposition inference. 5. a) (s ≈ s )σ is maximal in both, since the same ordering is used for translated and original literals. b) If s ≈ s is selected in m2ts(C) it is also selected in C, since the selection is the same for both clauses.

Thus, the negative superposition inference is possible for m2ts(C) and m2ts(D) if and only if it is also possible for the non-ground inference with C and D.

Lemma 3.5.3.7 (Inference Results are Bisimular).

Let R be the result of a monomorphic inference, then m2ts(R) is the result of the corresponding translated inference.

Proof. The translation is bijective. From the bisimulation lemmas I now that there is always a corresponding inference for the translated and type-symbol clauses. Equality Resolution just removes a literal, so the remaining literals are by construction the translations of each other. Equality Factoring rearranges terms within two (in)equalities, since both the translated and the monomorphic inference rearrange the same terms, the result is still a translation of the other result. The Superposition inferences also rearrange terms, but within terms, still the same argument as for Equality Factoring applies.

Before concluding refutational completeness for monomorphic first-order logic, I show that the encoding from monomorphic to type-symbol is satisfiability preserving. To this end I first show that a monomorphic interpretation can be translated to the type-symbol one and then the other direction. I do this by first creating a bijection between models for monomorphic and the translated type-symbol sets.

Let (U, D, I T , I F ) be a monomorphic structure, then tv I (U, D, I T , I F ) is a corresponding type-symbol structure for the problem translated with tv. It is defined as

tv I (U, D, I T , I F ) = (U, D, I T T , I T F )
where I T T mappings are defined by

I T T (κ) = I T (ty -1 (κ))
I T F is function interpretations are defined by

f I τ (e 1 , . . . , e m ) = f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (e 1 , . . . , e m )
where τ = κ 1 , . . . , κ m → κ, κ a 1 , . . . , κ a n and τ r = ty -1 (κ), τ 1 = ty -1 (κ a 1 ), . . . , τ n = ty -1 (κ a n ) To show monomorphic and the translated type-symbol clause sets to be equisatisfiable, I first show that the terms (with the same/translated context) evaluate identical. Then I show that the clause sets are equisatisfiable. First, I start with the translation of terms from monomorphic to type symbol. Lemma 3.5.3.8 (Monomorphic to Type Symbol Structure -Terms). Let I be a monomorphic interpretation with the monomorphic structure (U, D, I T , I F ) of a monomorphic clause set N. For any monomorphic variable valuation V, let a type-symbol variable valuation be defined as V T (u ty(τ) ) = V(u τ ). Then for the type-symbol interpretation I T with the type-symbol structure (U T , D T , I T T , I T F ) = tv I (U, D, I T , I F ) and any monomorphic variable valuation V such that V T (u ty(τ) ) = V(u τ ), it holds that for all monomorphic terms t, I V (t) = I T V T (tv(t)). Proof. By induction over t.

• In the case that t is a variable u τ .

Then tv(u τ ) = u ty(τ) and therefore

I T V T (tv(t)) = I T V T (u ty(τ) )
. By the semantics of typesymbol language, it follows that I T V T (u ty(τ) ) = V T (u ty(τ) ). By the definition of tv I , we have I T T (κ) = I T (ty -1 (κ)) and because ty is a bijection we have I T T (ty(τ)) = I T (τ). Therefore, V T (u ty(τ) ) = V(u τ ) confirms to the interpretations. By the monomorphic semantics V(u τ ) = I V (u τ ).

• In the case that t is a function term f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m ).

Then tv( f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m ) = f τ (tv(t 1 ), . . . , tv(t m )) and therefore

I T V T (tv(t)) = I T V T ( f τ (tv(t 1 ), . . . , tv(t m ))).
By the type-symbol semantics it follows that

I T V T ( f τ (tv(t 1 ), . . . , tv(t m ))) = f I τ (I T V T (tv(t 1 )), . . . , I T V T (tv(t m )))
. By induction hypothesis, we know that for each i it holds that I T V T (tv(t i )) = I V (t i ) and thus it holds that

f I τ (I T V T (tv(t 1 )), . . . , I T V T (tv(t m ))) = f I τ (I V (t 1 ), . . . , I V (t m ))
. By the definition of tv, we know that there is a bijection between τ and τ r , τ 1 , . . . , τ n . From the definition of tv I , we know that f I τ (I V (t 1 ), . . . , I V (t m )) = f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I V (t 1 ), . . . , I V (t m )), Therefore and from the monomorphic semantics, it follows that f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I V (t 1 ), . . . , I V (t m )) = I V ( f τ r , τ 1 , . . . , τ n (t 1 , . . . , t m )). Now, I continue with the translation of terms from type symbol to monomorphic. Lemma 3.5.3.9 (Type Symbol to Monomorphic Structure -Terms). Let I T be a type-symbol interpretation with the type-symbol structure (U T , D T , I T T , I T F ) of a type-symbol clause set N generated by the translation m2ts from a monomorphic clause set N. For any type-symbol variable valuation V T , let a monomorphic variable valuation be defined as V(u ty -1 (κ) ) = V T (u κ ). Then, for any type-symbol variable valuation and for the monomorphic interpretation I with the monomorphic structure (U, D, I T , I F ) = tv -1 I (U T , D T , I T T , I T F ), it holds that for all type-symbol terms t, I V (tv -1 (t)) = I T V T (t). Proof. By induction over t.

• In the case that t is a variable u κ .

Then tv -1 (u κ ) = u ty -1 (κ) and therefore, I V (tv -1 (t)) = I V (u ty -1 (κ) ). By the monomorphic semantics it follows that I V (u ty -1 (κ) ) = V(u ty -1 (κ) ). By the definition of tv I we have I T T (κ) = I T (ty -1 (κ)). Therefore, V(u ty -1 (τ) ) = V T (u κ ) confirms to the interpretations. By the type-symbol semantics V T (u κ ) = I T V T (u κ ).

And continue with the inverse direction from type symbol to monomorphic.

Lemma 3.5.3.11 (Type Symbol to Monomorphic Structure). Let I T be a type-symbol interpretation with the type-symbol structure (U T , D T , I T T , I T F ) of a clause set generated by the translation m2ts. For any type-symbol variable valuation V T , let a monomorphic variable valuation be defined as V(u ty -1 (κ) ) = V T (u κ ). Then for any typesymbol variable valuation and for the monomorphic interpretation I with the type-symbol structure (U, D, I T , I F ) = tv -1 I (U T , D T , I T T , I T F ), it holds that for all type-symbol clauses C,

I V (m2ts -1 (C)) = I T V T (C).
Proof. By induction over the interpretation rules for the type-symbol clause C.

• The case C = t ≈ s follows from Lemma 3.5.3.9.

• In the case C = ¬φ. Then I V (m2ts -1 (¬φ)) = I V (¬m2ts -1 (φ)). By induction hypothesis (and because the definition of the interpretation of ¬ are identical), it follows that

I V (¬m2ts -1 (φ)) = I T V T (¬φ). • In the case C = φ l ∨ φ r . Then I V (m2ts -1 (φ l ∨ φ r )) = I V (m2ts -1 (φ l ) ∨ m2ts -1 (φ r ))
. By induction hypothesis (and because the definition of the interpretation of ∨ are identical), it follows that

I V (m2ts -1 (φ l ) ∨ m2ts -1 (φ r )) = I T V T (φ l ∨ φ r ).
• In the case C = ∀u : κ. φ. Then I V (m2ts -1 (∀u : κ. φ)) = I V (∀u : ty -1 (κ). m2ts -1 (φ)). And by the monomorphic interpretation rules I V (∀u :

ty -1 (κ). m2ts -1 (φ)) = min e∈I(ty -1 (κ)) (I V[u →e] (m2ts -1 (φ))).
Because ty is bijective and by construction of tv I it holds that I(ty -1 (κ)) = I T (κ) and in particular V T (u κ ) = V(u ty -1 (κ) ) for each valuation of u. Thus, it holds that min e∈I(ty -1 (κ))

(I V[u →e] (m2ts -1 (φ))) = min e∈I T (κ) (I V[u →e] (m2ts -1 (φ))).
Furthermore, by the induction hypothesis we have I V[u →e] (m2ts -1 (φ)) = I T V T [u →e] (φ) and thus min

e∈I T (κ) (I V[u →e] (m2ts -1 (φ))) = min e∈I T (κ) (I T V T [u →e] (φ))
. By the type-symbol interpretation rules we have that min

e∈I T (κ) (I V[u →e] (φ)) = ∀u : κ. φ.
By showing both directions, I can conclude that the translation is satisfiability preserving. Lemma 3.5.3.12 (Monomorphic to Type Symbol Translation Satisfiabilty Preserving). Let N be a clause set of monomorphic first-order logic it is satisfiable if and only if the translated clause set N in type-symbol first-order logic is satisfiable.

Proof. The interpretation rules for clause sets are identical. Furthermore, with the translation tv I , a monomorphic interpretation can be translated into a type-symbol one and with tv -1 I , a type-symbol interpretation can be translated into a monomorphic one in such a way that for the original and the translated clauses satisfiability is preserved (Lemma 3.5.3.10 and 3.5.3.11).

Because I showed the translation to be satisfiability preserving and I showed the type-symbol superposition calculus and the translated one to be bisimulations of each other, I have shown completeness for monomorphic superposition. Theorem 3.5.3.13 (Static Refutational Completeness). Superposition is refutationally complete for monomorphic first-order logic.

Proof. I have shown that the translations preserves satisfiability (Lemma 3.5.3.12) and I have shown that the monomorphic superposition and the translated type-symbol superposition are bisimulations of each other (Lemma 3.5.3.5 and Lemma 3.5.3.6). Therefore, the completeness of the type-symbol version of superposition (Lemma 3.5.2.8) is lifted to the monomorphic version of superposition.

Lifting to Polymorphism

Here, I present the finial step of the soundness and completeness proof. I lift the monomorphic language to the initially described polymorphic language with type classes. As in the previous completeness proofs, I will omit predicates and only consider clauses instead of formulas.

Refutational Completeness

I will now lift monomorphic first-order logic, proved refutationally complete in the previous section, to the polymorphic first-order logic with type classes. First, I show that the typing is local, i.e. if an argument term is replaced by different term of the same type the overall type of the term does not change. Then, I lift the inferences and show that the monomorphic and polymorphic versions are equisatisfiable. Lemma 3.5.4.1 (Type Judgement). For all terms t[s] where s is t or a subterm of t it holds that τ(s) = τ(s

) =⇒ τ(t[s]) = τ(t[s ]).
Proof. The proof is by induction of t. If t is s and replaced by s the lemma is trivial (i.e. if t is a variable or constant). If t is of the form f τ 1 , . . . , τ n (t 1 , . . . , t m ) and one of its subterms t i is replaced by t i and that subterm is still of the same type, i.e. τ(t i ) = τ(t i ), then by the typing rule for function (fun, Def. 3.1.2.2) it holds that τ(t[s]) = τ(t[t i ]).

An important property of first-order logic is that variables are closed under rewriting, i.e. if an instance of a variable can be rewritten to some term t then, that term t is also an instance of the variable. This property is useful for superposition, because it allows to eliminate superposition inferences below variable positions. Lemma 3.5.4.2 (Variables are Closed Under Rewriting with R Cθ ). Let C ∈ N and θ be a substitution such that Cθ ∈ G Σ (C) and x be a variable occurring in C then: If xθ → R Cθ t then there exists a θ such that xθ = t and yθ = yθ for every variable y = x and furthermore Cθ ∈ G Σ (C).

Proof. From the definition of literals it follows that only terms of the same type symbol can be equal. R Cθ is formed from equations where left hand and right hand side are of the same type symbol and replacing subterms by other terms of the same type symbol does not change the overall type of a term (Lemma 3.5.4.1). Since a variable can be instantiated to any term of the type it is assigned to, the lemma holds.

I also need to lift the inferences from the monomorphic case to the polymorphic one. First, for the Equality Resolution and the Equality Factoring inferences and for the Positive Superposition and the Negative Superposition inferences. Lemma 3.5.4.3 (Lifting Lemma for the Equality Resolution and Equality Factoring Inferences). Let C be a clause and let θ be a substitution of only type variables such that Cθ contains no type variables. Then every equality resolution (or equality factoring) inference of Cθ is an instance of an equality resolution (or equality factoring) inference from C.

Proof. Suppose there is a Cθ so that there is an equality resolution inference for Cθ such that the inference result is not a result of the equality resolution inference from C. Then there must be at least one side condition of the equality resolution inference that is fulfilled for Cθ, but not for C. The side conditions for the equality resolution inference (Sect. 3.3) are:

1. sσ = s σ, where σ is the most general unifier of s and s . 2. a) (s ≈ s )σ maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is the selected literal.

I now show why each side condition must also be fulfilled for C if it is fulfilled for Cθ.

1. If the inference is applicable for Cθ, then sθ must be equal to s θ. By the existence and uniqueness of the most general unifier (Lemma 3.1.3.12), there must be a most general unifier θ g of s and s such that θ = θ g θ . But then this side condition is also fulfilled for C. 2. a) If (s ≈ s )θ is maximal in (C ∨ s ≈ s )θ and nothing is selected, then there is no literal L in C such that Lθ (s ≈ s )θ. Therefore, the uninstantiated literal is also maximal. b) If s ≈ s is selected in Cθ it is also selected in C. Thus, if the equality resolution inference is possible for Cθ, it is also possible for the inference with C.

Suppose there is a ground Cθ so that there is a equality factoring inference for Cθ such that the inference result is not a result of the equality factoring inference from C. Then there must be at least one side condition of the equality factoring inference that is fulfilled for Cθ, but not for C. The side conditions for the equality factoring inference (Sect. 3.3) are:

1. sσ = s σ, where σ is the most general unifier of s and s . 2. (s ≈ t)σ maximal in (C ∨ s ≈ t ∨ s ≈ t)σ and no literal is selected. 3. s σ t σ and sσ tσ I now show why each side condition must also be fulfilled for C if it is fulfilled for Cθ.

1. If the inference is applicable for Cθ, then sθ must be equal to s θ. By the existence and uniqueness of the most general unifier, there must be a most general unifier θ g of s and s such that θ = θ g θ . But then this side condition is also be fulfilled for C. 2. Since (s ≈ t)θ is maximal in (C ∨ s ≈ t ∨ s ≈ t)θ and no literal is selected, there is no literal L in C such that Lθ (s ≈ t)θ. Therefore, the uninstantiated literal is also maximal. No literal is selected in C if none is selected in Cθ, thus this side condition is also fulfilled for C. 3. To be fulfilled s σ t σ, s θ and t θ can either be incomparable, equal or less. If they are incomparable, then with substitution stability s and t must also be incomparable. If they are equal, then s and t are either also equal or they are incomparable, otherwise substitution stability cannot hold. In the case where s θ is less, then t θ, s must either be less than t or incomparable, again otherwise substitution stability cannot hold. The same argument holds for sσ tσ.

Thus, if the equality factoring inference is possible for Cθ it is also possible for the non-ground inference with C.

Lemma 3.5.4.4 (Lifting Lemma for the Superposition Inferences). Let C = C ∨ s ≈ s and D = D ∨ t ≈ t be two clauses without common variables and let θ be a substitution of only type variables such that Cθ and Dθ contain no type variables. If there is a superposition inference between Cθ and Dθ where sθ and some subterm of tθ are overlapped and sθ does not occur in tθ at or below a term variable position of t, then the inference is an instance of a superposition inference from C and D.

Proof. Suppose there is a Cθ and Dθ so that there is a positive superposition inference for Cθ and Dθ such that the inference result is not a result of the positive superposition inference from C and D. Then there must be at least one side condition of the positive superposition inference that is fulfilled for Cθ and Dθ, but not for C and D. The side conditions for the positive superposition inference (Sect. 3.3) are:

1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. sσ = s 2 σ and σ is the most general unifier of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. (s ≈ s )σ is strictly maximal in (C ∨ s ≈ s )σ and no literal is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for Cθ and Dθ.

1. To be fulfilled, sσ s σ, sθ and s θ can either be incomparable, equal or less. If they are incomparable, then with substitution stability s and s must also be incomparable. If they are equal, then s and s are either also equal or they are incomparable, otherwise substitution stability cannot hold. In the case where sθ is less, then s θ, s must either be less than s or incomparable, again otherwise substitution stability cannot hold. The same argument holds for tσ t σ.

2. That the inference is not at or below a variable position is part of the assumptions of the lemma. 3. If the ground inference is applicable for Cθ, then sθ must be equal to s 2 θ. By the existence and uniqueness of the most general unifier, there must be a most general unifier θ g of s and s 2 such that θ = θ g θ . But then this side condition is also be fulfilled for C and D. 4. If (t ≈ t )θ is strictly maximal in (D ∨ t ≈ t )θ and no literal is selected, then there is no literal L in D such that Lθ (t ≈ t )θ. Therefore, there is also no L in D such that L (t ≈ t ), otherwise the ordering would not be closed under substitutions and (t ≈ t )θ could not be strictly maximal. Thus, t ≈ t is strictly maximal and no literal is selected. 5. If (s ≈ s )θ is maximal in (C ∨ s ≈ s )θ and nothing is selected, then there is no literal L in C such that Lθ (s ≈ t)θ, because the ordering is closed under substitutions. Therefore, there is also no L in D such that L (t ≈ t ), otherwise the ordering would not be closed under substitutions.

Thus, if the positive superposition inference is possible for Cθ and Dθ it is also possible for the non-ground inference with C and D. Suppose there is a Cθ and Dθ so that there is a negative superposition inference for Cθ and Dθ such that the inference result is not a result of the negative superposition inference from C and D. Then there must be at least one side condition of the negative superposition inference that is fulfilled for Cθ and Dθ but not for C and D. The side conditions for the negative superposition inference (3.3) are: 1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. sσ = s 2 σ and σ is the most general unifier of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. a) (s ≈ s )σ is maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for Cθ and Dθ. The side conditions and proofs 1. to 4. are identical to the side conditions and proofs of positive superposition inference.

5. a) If (s ≈ s )θ maximal in (C ∨ s ≈ s )θ and nothing is selected, then there is no literal L in C such that Lθ (s ≈ t)θ. Therefore, there is also no L in D such that L (t ≈ t ), otherwise the ordering would not be closed under substitutions. b) If s ≈ s is selected in Cθ it is also selected in C.

Thus, if the negative superposition inference is possible for Cθ and Dθ it is also possible for the non-ground inference with C and D.

Let N be a set of clauses, then G τ Σ (N) is defined as the union of all type-ground (monomorphic) instances of all clauses of N. I have also shown that a set of polymorphic clauses with type variables is satisfiable if and only if its monomorphic instances are satisfiable. First, by lifting refutations from the monomorphic to the polymorphic (plus type classes) setting. Then, by lifting models from the monomorphic to the polymorphic (plus type classes) setting. Because both the refutations and the models can be lifted from the monomorphic to the polymorphic (plus type classes) setting, I can conclude that both the monomorphic and the polymorphic setting are equisatisfiable.

Lemma 3.5.4.7 (Polymorph and Monomorph are Equisatisfiable). A countable set N of Σ-clauses is satisfiable if and only if its monomorphic version

G τ Σ (N) is satisfiable. Proof. By case distinction if G τ Σ (N) is satisfiable. • Suppose G τ Σ (N) does not have a model, then ⊥ ∈ Sup * (G τ Σ (N))
. By lifting (Lemma 3.5.4.5) we have ⊥ ∈ Sup * (N) and thus N does not have a model.

• Suppose G τ Σ (N) has a model, then there is an interpretation I such that I G τ Σ (N). By model lifting (Lemma 3.5.4.6) we also have I N.

I have now shown that the polymorphic first-order language with type classes can be encoded into the monomorphic one by exhaustively instantiating the type variables. I have also shown that this preserves satisfiability. Therefore, the static completeness already shown for the monomorphic case can be lifted to the polymorphic case with type classes. Theorem 3.5.4.8 (Static Refutational Completeness). Superposition is refutationally complete for polymorphic first-order logic with type variables.

Proof. I have shown that a countable set N of Σ-clauses is satisfiable if and only if its monomorphic version G τ Σ (N) is satisfiable (Lemma 3.5.4.7). Furthermore, I have shown that a proof in the monomorphic version is lifted to the polymorphic version (Lemma 3.5.4.5). Therefore, the completeness of the monomorphic version of superposition (Lemma 3.5.3.13) is lifted to the polymorphic (with type classes) version of superposition.

In the previous lifting steps I stopped with static refutational completeness, because they were intermediate steps. The refutational completeness of superposition for the polymorphic first-order language with type classes is the final step. Therefore, I also show that dynamic refutational completeness holds. The difference is that static refutational completeness states that any saturated set of clauses that does not contain the empty clause is satisfiable, whereas dynamic completeness states that for any (fair) sequence of inferences that the initial clause set is satisfiable if and only if all intermediate clause sets do not contain the empty clause. Lemma 2.2.4.12, which states that a fair run has a saturated limit, also holds for the superposition calculus for polymorphic first-order logic with type classes. Lemma 3.5.4.9 (Limit is saturated). If a run is fair, then its limit is saturated up to redundancy.

Proof. If the limit is not saturated up to redundancy, there must be an inference that can still be applied. Thus, both its premises must be in N * , but the result is not in N * and is not redundant with respect to N * . Such an inference must be enabled in N * and thus must be enabled in all j that are j ≥ i for some i. By definition, such a run cannot be fair.

An important property of first-order logic is compactness, i.e. a clause set is unsatisfiable if and only if a finite subset of that clause set is unsatisfiable. In particular, the property implies that all proofs are finite. This property also holds for my polymorphic first-order logic with type classes. Lemma 3.5.4.10 (Compactness). Let N be a set of polymorphic first-order logic first-order formulas with type classes. Then N is unsatisfiable if and only if some finite subset of N is unsatisfiable.

Proof. ⇐ If a finite subset is unsatisfiable the whole set is unsatisfiable. ⇒ Let N be unsatisfiable. Then Sup * (N) is also unsatisfiable and by refutational completeness I have ⊥ ∈ Sup * (N). Because of the well-foundness constraint of the orderings the proof of ⊥ (its inference derivation tree) is of finite size. Then the finite subset of N is the set of assumptions of the finite proof of ⊥.

Finally, I can show that the superposition calculus for the polymorphic first-order language with type classes is refutationally complete also in the dynamic view. This is important because the static view does not lend itself to an implementation, while the dynamic view guarantees that any fair run (i.e. fair execution of an implementation) on an unsatisfiable clause set results in the discovery of the empty clause. Theorem 3.5.4.11 (Dynamic Refutational Completeness). Let N 0 N 1 N 2 . . . be a fair run and N * its limit. Then N 0 has a model if and only if ⊥ ∈ N * .

Proof. ⇒ Obvious. ⇐ The run is fair and therefore N * is saturated up to redundancy (Lemma 3.5.4.9). If ⊥ ∈ N * and since we know that N * is saturated up to redundancy it has to have a model (Theorem 3.5.4.8). Every clause in N 0 is an element of N * or is redundant with respect to N * and thus the model of N * is also a model of N 0 .

I have now shown static and dynamic completeness of superposition for the presented polymorphic language with type classes.

Related Work

The resolution calculus, invented by Robinson [START_REF] Robinson | A machine-oriented logic based on the resolution principle[END_REF], first introduced saturation-based theorem proving. Resolution is refutationally complete for first-order logic, i.e. from any unsatisfiable set of clauses it can (eventually) derive the empty clause. Resolution has no build-in equality reasoning, but equality can be axiomatized. Reasoning with an axiomatization of equality can result in significant overhead. To overcome the overhead introduced by axiomatizating equality, Robinson and Wos introduced paramodulation [START_REF] Robinson | Paramodulation and theorem-proving in first-order theories with equality[END_REF]. An import goal for them was to increase "convergence" by reducing "unnecessary 'noise' in the proof-search space" by deriving no "sideeffect" clauses which for example stem from the axiomatization of equality and reasoning with that axiomatization. The initial unrestricted paramodulation calculus fell short of this goal. Knuth and Bendix [START_REF] Knuth | Simple word problems in universal algebras[END_REF] showed that confluence of terminating rewrite systems (i.e. equational logic) can be tested by normalization via critical pairs. Lankford [START_REF] Lankford | Canonical inference[END_REF] restricted rewriting and critical pairs with the use of reduction orderings such that only larger sides of equations had to be considered. Hsiang and Rusinowitch introduced ordered paramodulation [START_REF] Hsiang | Proving refutational completeness of theorem-proving strategies: The transfinite semantic tree method[END_REF] a restriction of paramodulation where only maximal literals of clauses need to be considered for inferences. Bachmair and Ganzinger [START_REF] Bachmair | On restrictions of ordered paramodulation with simplification[END_REF] introduced (strict) superposition, a restriction of ordered paramodulation in combination with insights from ordered rewriting that does not require inferences into smaller sides of equations. 3They showed refutational completeness for first-order logic with equality by adding the equality factoring inference to the superposition calculus. Furthermore, they introduced the notion of (saturation up to) redundancy. Bachmair and Ganzinger [START_REF] Bachmair | Equational reasoning in saturation-based theorem proving[END_REF] give a comprehensive overview of superposition, its variants and origins.

I differentiate between types and sorts, even though they have similar origins and the same goal of separating different domains. If domain membership is (easily) decidable, I will consider the separation of domains to be types. If domain membership is more difficult, e.g. defined via first-order predicates, I will consider the separation of domains to be sorts. Extreme examples of sorts allow arbitrary first-order formulas as sorts, e.g. those presented by Hailperin [START_REF] Hailperin | A theory of restricted quantification I[END_REF].

Sorted first-order calculi and their completeness have been investigated dating back even to Herbrand [START_REF] Herbrand | Recherches sur la théorie de la démonstration[END_REF]. Incidentally, according to Schmidt [START_REF] Schmidt | Über deduktive Theorien mit mehreren Sorten von Grunddingen[END_REF], Herbrand's completeness proof for his many-sorted calculus was incorrect. Schmidt then gave a monomorphic (many-sorted) calculus. Schmidt-Schauss [START_REF] Schmidt-Schauß | Computational aspects of an order-sorted logic with term declarations[END_REF] showed refutational completeness of an order-sorted calculus with resolution, factoring and unrestricted paramodulation. The order-sorted first-order logic is a many-sorted first-order logic extended with a subsort relation, such that each term is of a particular sort. Weidenbach [START_REF] Weidenbach | Combining superposition, sorts and splitting[END_REF] presented a general sort-system for superposition.

Programming languages generally favor types over sorts. An example is ML, for which Milner [START_REF] Milner | A theory of type polymorphism in programming[END_REF] introduced the concept of (parametric) polymorphism. Parametric polymorphism captures that one function can handle arguments of different types in the same way. Wadler and Blott [START_REF] Wadler | How to make ad-hoc polymorphism less ad hoc[END_REF] introduced type classes in Haskell, to allow functions to be defined in different ways for different types (i.e. overloading also called ad-hoc polymorphism). The type classes guarantee that certain functions are defined on each type that is contained in the type class. In general, type classes can declare not only functions but also additional properties these functions must have. Waldmann [START_REF] Waldmann | Semantics of order-sorted specifications[END_REF] shows that concepts of overloading and parametricity were not always treated sufficiently different in the literature of order-sorted systems. ML's polymorphism is now called ML-style polymorphism or, more formally, rank-1 polymorphism without phantom type variables but with let-polymorphism and an equality type class. Phantom type variables are type-variable arguments of predicates and functions that do not occur in any argument's type or in the return type. Rank-0 Polymorphism is monomorphism, rank-1 polymorphism allows outermost type quantification and rank-n+1 allows up to n nested occurrences of type quantifications in left-hand sides of the function type constructor.

Isabelle/HOL [START_REF] Nipkow | Isabelle/HOL: A Proof Assistant for Higher-order Logic[END_REF] is a proof assistant based on higher-order logic and functional programming. Isabelle is written mainly in ML and its type system is based on rank-1 polymorphism without phantom type variables. Nipkow [START_REF] Nipkow | Order-sorted polymorphism in Isabelle[END_REF] extended the polymorphism used in Isabelle/HOL by introducing order-sorted polymorphism. The extension allows types to be restricted by sorts, which allow subsorts. Haftmann and Wenzel [START_REF] Haftmann | Constructive type classes in Isabelle[END_REF] introduced constructive type classes, which combine the logic aspect of order-sorted polymorphism with the operative aspect of Haskell's type classes. In particular, this means that polymorphism with constructive type classes falls into my definition of type system (and not sort system). It is also the variant supported by my formalization. Isabelle is mostly based on declarative style, where functions and type classes are declared and not axiomatized. This enables Isabelle to enforce the type system to ensure that functions are used as declared and that properties of type classes are fulfilled. My formalization is based on first-order logic extended with a type system. This means its input is a set of first-order formulas (axioms). Integration of the type system into the calculus allows the use of the type system and thus removes the burden to axiomatize the restriction the type system provides. Isabelle's declarative functions nonetheless turn into first-order formulas, i.e. (conditional) equations.

The formalization of this chapter supports rank-1 polymorphism (including phantom type variables) extended with type classes. Interestingly enough, phantom type arguments for predicates are useful in the translation (of type classes) from Isabelle/HOL, even though they are not used in Isabelle/HOL. Pirate therefore implements phantom type arguments for predicates.

The origins of monomorphic type systems in automated theorem prover implementations can be found in Otter [START_REF] Mccune | OTTER 3.3 reference manual[END_REF]. While Otter has no type system as such, it has support for multiple equality predicates. It is commonly known that using a different equality predicate for each type allows sound type erasure (in the absence of overloaded symbols). SNARK [START_REF] Stickel | Deductive composition of astronomical software from subroutine libraries[END_REF], which like Otter handles first-order logic with equality (via resolution and paramodulation), also supports unary-predicates as sorts and subsorts. This is similar to superposition-based SPASS, which also supports special handling of sorts. Most automated provers that support theories also support some form of monomorphic types. This is in particular the case for SMT solvers, which must separate the Int and Real domains from the remainder of the problem. Both Vampire [START_REF] Kovács | First-order theorem proving and vampire[END_REF] and our previous work on SPASS [START_REF] Blanchette | More SPASS with Isabelle[END_REF] support first-order logic with native monomorphic types. The native types are more efficient than an encoding into many-sorted sorts, which are an instance of the sorts available in SPASS.

There are also a few automated theorem provers that support stronger type systems. The SMT solver Alt-Ergo [START_REF] Bobot | Implementing Polymorphism in SMT solvers[END_REF] implements ML-style polymorphism. An evaluation shows that its implementation of polymorphism does not scale well, i.e. while it is better than other encodings at 50 facts. with 500 facts its native implementation falls behind efficient encodings [START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF]. For 500 facts the success rate for polymorphism also falls behind the success rate for monomorphism. The superposition-based prover Zipperposition [START_REF] Schulz | 4th Workshop on Practical Aspects of Automated Reasoning, PAAR@IJCAR 2014[END_REF] implements rank-1 polymorphism, but no type classes. LEO-II [START_REF] Benzmüller | LEO-II -a cooperative automatic theorem prover for classical higher-order logic (system description)[END_REF] implements high-order logic with a prefix-polymorphism. It restricts polymorphism, because "full polymorphism adds many non-trivial choice points to the already challenging search space of LEO-II", which is caused by its higher-order setting. LEO-III's LeoPARD data structures [START_REF] Wisniewski | LeoPARD -A generic platform for the implementation of higher-order reasoners[END_REF] implement polymorphism without type constructors (except for function types). SMT solvers like Alt-Ergo are necessarily incomplete for first-order logic. LEO-II and LEO-III are also incomplete for first-order logic. As far as I am aware there is no refutational completeness proof for Zipperposition or its calculus.

In contrast to automated theorem provers, most proof assistants have a rich type system but generally require user interaction. The HOL family, e.g. HOL Light [START_REF] Harrison | HOL Light: An overview[END_REF] and Isabelle/HOL, supports ML-style polymorphism. Proof assistants not only have rich type systems, but generally also a richer logic. The HOL family is based on higher order logic, instead of the first-order logic of many automated theorem provers. Proof assistants like Agda, Coq, Lean and Matita implement dependent types. Coq extends those with type classes which are implemented on top of the dependent types.

Translation tools from and to different logics or from verification problems to logics also have to deal with differences in type systems. Some of them introduce their own intermediate languages. Sledgehammer [START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF] uses a variety of encodings to get from Isabelle/HOL's higherorder polymorphic type system with type classes to one supported by an automated prover. For first-order provers it has to remove higher-order features like higher-order quantifications and lambdas. Type encodings generally use predicates (type guards) or additional term arguments (type tags) to encode type systems into less expressive ones. Using monotonicty analysis, many of the type guards or type tags can be omitted [START_REF] Blanchette | Encoding monomorphic and polymorphic types[END_REF]. Boogie 2 [START_REF] Leino | A polymorphic intermediate verification language: Design and logical encoding[END_REF] features its own intermediate language, which supports higher-ranked polymorphism. It translates its rich type language to untyped logic, with type guards and type tags, so that SMT solvers can handle it. Dafny [START_REF] Leino | Dafny: An automatic program verifier for functional correctness[END_REF] features its own imperative intermediate language, which supports polymorphism via generic classes. Dafny encodes its language into Boogie's to profit from automation provided by SMT solvers. Why3 [START_REF] Bobot | Why3: Shepherd your herd of provers[END_REF][START_REF] Bobot | Expressing polymorphic types in a many-sorted language[END_REF] has a ML-style polymorphic first-order language extended with algebraic data types and inductive predicates. It can encode the polymorphic language to monomorphic and untyped first-order logic in order to provided automation by using a variety of SMT and superposition-based tools. Its language is very close to the one we introduce here and in chapter 4. HOL(y)Hammer [START_REF] Kaliszyk | Learning-assisted automated reasoning with Flyspeck[END_REF] encodes from HOL Light's polymorphic higher-order logic to first-order in order to profit from automation by SMT and superposition-based tools. It mainly uses encodings that are similar to those available in Sledgehammer. There is also recent work to encode dependently-typed systems into less expressive type systems, e.g. to encode F to (monomorphic) SMT solvers [START_REF] Hritcu | From F to SMT[END_REF]. Furthermore, there is ongoing work on building Sledgehammer-style tools for Coq [START_REF] Czajka | Goal translation for a hammer for Coq (extended abstract)[END_REF].

The main standardized exchange formats for automated theorem provers are the TPTP syntax family and the SMT-LIB syntax. The TPTP syntax family defines a syntax which includes support for rank-1 polymorphic first-order and higher-order logic [START_REF] Blanchette | TFF1: The TPTP typed first-order form with rank-1 polymorphism[END_REF]. It does not support type classes and the ordering information of equations supported by our input syntax [START_REF] Blanchette | More SPASS with Isabelle[END_REF]. The SMT-LIB 2.5 standard [START_REF] Barrett | The SMT-LIB Standard: Version 2[END_REF] defines a monomorphic first-order logic which can have polymorphic theory declarations.

Induction

Introduction

Proving conjectures of functions over recursive data types is challenging, because it almost always requires proofs by induction. Automating such inductive proofs by structural induction raises four main issues. A proof procedure for non-inductive conjectures, in particular for the induction cases, is needed. This proof procedure must be extendable with induction. For a given conjecture a suitable instance of the induction schema must be selected. This suffices for easily automated conjectures. However, inductive proofs often require additional lemmas, which themselves require an inductive proof. Therefore, to automatically complete an inductive proof auxiliary propositions must be guessed. Since the guessed propositions can be non-theorems, a reliable way to purge unprovable propositions is useful.

My first contribution is the design of an automated inductive theorem prover that proposes solutions to all four challenges. Starting from the refutationally complete superposition calculus for polymorphic first-order logic with equality and type classes (Ch. 3), I introduce the SupInd calculus, an extension of superposition with structural induction over data types (Sect. 4.2). Just like superposition, SupInd requires first-order formulas to be transformed to first-order clauses and conjectures are proven by refuting their negation, i.e. by showing the negated conjecture together with the axioms is unsatisfiable. To this end, the conjecture is negated, Skolemized and clausified and the axioms are Skolemized and clausified. The resulting clause sets, one for the negated conjecture and one for the axioms, together with the (initially empty) set of induction hypotheses clauses form a triple, which I call a simple state. I keep the clause sets separate because each induction step requires the negated conjecture and the induction hypotheses to be separate. Each induction step requires proving several induction cases, where every induction case has to be shown. Successful automating inductive proofs requires to introduce additional helpful propositions and in SupInd I distinguish one particular case of such propositions: those propositions that imply a previous simple state. Such a proposition is an alternative way to prove that simple state and I call it a strengthening of that simple state. To be able to express nested induction and nested strengthenings I need a tree-like structure to express cases where the refutation of one subtree is sufficient and cases where all subtrees are to be refuted. I capture this by the notation of a state, which is either a simple state, an or-state or an and-state. A simple state is proven if its clause sets contain the empty clause, an or-state is proven if one of its substates is proven and an and-state is proven if all its substates are proven. SupInd's inferences operate on states. The approach preserves completeness for pure first-order logic (i.e. without data types) while supporting guessing and proving propositions, in particular strengthenings, and nested induction proofs of arbitrary depth.

In this chapter, function symbols start with lowercase letters (e.g. the Skolem function xs and the function minus) and universally quantified variables with uppercase letters (e.g. X and Ys).

One challenge in automating induction is to find a good instance of the induction schemata, i.e. finding a good (sub)term to which to apply induction. In the refutational setting of SupInd, finding a good instance of the structural induction schemata is reduced to finding a good Skolem function (of the conjecture) to apply induction to. SupInd's structural induction rule then generates a new state with the necessary induction cases from the combination of simple state and Skolem function. Instead of guessing which Skolem function is a good choice or exhaustively applying induction to all Skolem functions, I propose a heuristic that lets a prover determine which Skolem function should be chosen next (Sect. 4.3). Consider the negated conjecture for the associativity of addition over the natural numbers (N), constructed by 0 and the successor function s: x + (y + z) ≈ (x + y) + z, where addition is defined by 0 + Y ≈ Y and s(X) + Y ≈ s(X + Y). Since + is defined in terms of its first argument, selecting induction over y or z does not immediately yield a refutation, but selecting x does. Often, the base cases are already an indication of which Skolem should be preferred. This insight yields a technique where all potential induction positions can be tested for being preferable by solving a single first-order clause set and analyzing the resulting (unsatisfiablity) proof. Furthermore, even if there is no such proof, i.e. if this clause set is (first-order) satisfiable, then, the base cases of induction of any of the Skolem functions are in general also (first-order) satisfiable without additional inductive lemmas. Therefore in this case, a successful proof needs search for additional propositions instead of further nested inductions.

Induction proofs often require additional lemmas which themselves can be proven by induction. Strengthening the conjecture is one way to discover such lemmas (Sect. 4.4). A standard technique to strengthen a conjecture is generalization, which replaces complex subterms of the conjecture by fresh variables. In SupInd, because of the refutational setting, generalization replaces complex subterms in the negated conjecture by fresh Skolem constants (Sect. 4.4.1). For example, let len be the length and rev be the reverse of a list,and ≤ be the familiar operations over N, all specified axiomatically (in first-order logic). Let the conjecture be len(Xs) ≈ len(Ys) → len(rev (Xs)) -len(Ys) ≤ len(Ys) and the negated Skolemized conjecture, on which the SupInd calculus operates, be len(xs) ≈ len(ys) ∧ len(rev (xs)) -len(ys) ≤ len(ys) Generalization strengthens this by replacing len(ys) by a fresh Skolem y to len(xs) ≈ y ∧ len(rev (xs)) -y ≤ y Induction on y results in a stronger induction hypothesis than induction over ys would have. Therefore, if the strengthened proposition holds, it tends to be easier to prove. Performing generalization on, for example, len(xs) would yield a proposition that does not hold, because the dependency with len(rev(xs)) is lost. This is where my next contribution, extending generalization to exploit term dependencies, comes into play (Sect. 4.4.2). Generalization introduces a strengthened proposition by replacing subterms by a fresh Skolem constant for each syntactically different subterm that is replaced. The underlying idea of term-dependency preserving generalization is that multiple (syntactically different) subterms can be replaced by the same Skolem constant if those subterms can be shown to be equal. Thus where standard generalization computes a single proposition that implies the conjecture, term-dependency preserving generalization computes multiple propositions that together imply the conjecture. Term-dependency preserving generalization refines this idea by picking at least two super-terms of the same Skolem function (occurring in the negated conjecture) and then computes a generalization that is stronger than the standard generalization, by assuming that those super-terms are equal. The new propositions are then the stronger generalization and the proposition that those super-terms are in fact equal. Alone the stronger generalization might not imply the previous simple state, but together with the additional (equality) proposition it implies the previous simple state. For the example conjecture, term-dependency preserving generalization guesses the following two propositions:

(1) rev (Xs) ≈ Xs

(2) len(rev (Xs)) ≈ len(Xs)

Both imply that len(xs) equals len(rev (xs)) and thus justify the term-dependency preserving generalization of the negated conjecture to

x ≈ y ∧ x -y ≤ y
For SupInd to prove the initial conjecture directly by term-dependency preserving generalization, the generalized conjecture and either proposition (1) or proposition (2) must be proven, because one of the propositions must hold to justify the generalization step. Property ( 2) can be automatically proven by induction and first-order reasoning, without guessing further propositions. While SupInd can disprove property (1) by finding a counter example (the the two-element-list case) after three subsequent induction steps by reducing the negated conjecture to the axioms (Sect. 4.5).

The solver always simplifies as much as it can. After simplification the negated conjecture becomes

xx ≤ x

Unfortunately even this conjecture cannot be proven, yet. This is because after induction over x, in the case where x ≈ s(x ), the defining equations for subtraction (-), in particular s(X) -s(Y) ≈ X -Y, act as a "constructor sink". Because subtraction only occurs on the lefthand side, the successor constructors (s) disappear on the left-hand side of the ≤ predicate but not on the right-hand side. Hence, with each nested induction step, the negated conjecture accumulates a successor constructor (s) on the right-hand side of the ≤ predicate:

x -x ≤ s(x ) After one induction 0 -0 ≤ s(0) Base case (x = 0), trivial s(x ) -s(x ) ≤ s(s(x ))
Step case (x = s(x )) xx ≤ s(s(x ))

Step case (simplified) . . . The induction hypothesis never matches the conjecture and a proof cannot be found without additional lemmas. My final contribution copes with constructor sinks by deriving a strengthened conjecture and side-conditions that do not contain the constructor sink term but imply the original conjecture (Sect. 4.4.3). The technique can be applied to any data type and conjecture, as long as a bound can be derived and all values up to that bound fulfill the conjecture. The underlying principle is the following: Let t be a term of the natural number data type and let u be an upper bound for t. A term u is an upper bound for t if all values of t are structurally smaller than those for u (Sect. 4.4.3). Then if P(u) and P(s(X)) =⇒ P(X) hold so must P(t).

I call terms representing such upper bounds cap terms. Argument positions of function symbols that are cap term positions are discovered with the help of a syntactic criterion from the defining equations of every function symbol. In the example, the result of subtraction (-) must be (structurally) smaller or equal to its first argument and thus the first argument is a cap subterm. Applying this knowledge in the example yields two cases, the constructor-sink term replaced by its cap subterm (x -x replaced by x in xx ≤ x):

x ≤ x and the proposition that if the constructor-sink term holds with some bound, it holds for all n that are smaller, i.e. the proposition s(N) ≤ X =⇒ N ≤ X and its negation:

s(n) ≤ x ∧ n ≤ x
With the presented techniques the initial conjecture can be automatically proven. Both induction cases can be refuted by nested induction and first-order reasoning alone. The strengthenings of the conjectures and the required property (len(rev (Xs)) ≈ len(Xs)) for the term-dependency preserving generalization are (easily) provable using SupInd.

I have implemented my contributions in a tool called Pirate and evaluated it on the CLAM [33] and the IsaPlanner [START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF] benchmark suites (Sect. 4.7).

Superposition for Induction

Well-founded induction states that a property holds for all elements e, assuming that the property holds for all elements that are smaller (with respect to a well-founded relation) than e. Wellfounded induction is called (strong) structural induction, when the well-founded relation is defined using the proper subterm relation. SupInd uses (strong) structural induction on algebraic data types such as lists (when represented as empty list (nil) and cons function (cons)) and the natural numbers (when represented as zero (0 ) and successor function (s)).

Typed First-Order Logic and Algebraic Data Types

The basis of the SupInd calculus is a polymorphic first-order language with type classes and data-type declarations. A type is an algebraic data type if it has a set of constructor function symbols that generate the elements of that type.

Syntax

A signature of the polymorphic first-order language with type classes and data types is a signature for the polymorphic first-order language with type classes (Sect. 3.1.1) extended by a set of data-type declarations DT , declaring the data types. Definition 4.2.1.1 (Signature). A signature for a polymorphic first-order language with type classes and data types is a tuple Σ = (S F , S P , S T , S K , T C, T , F, P, DT ) where S F is the set of function symbols, S P is the set of predicate symbols, S T is the set of type constructor symbols and S K is the set of type class symbols, T C is the set of subclass declarations, T is the set of type declarations, F is the set of function declarations and P is the set of predicate declarations.

They are defined just like for the polymorphic first-order language with type classes (Sect. 3.1.1). And where

DT is the set of data type declarations. Each element (τ,

f 1 [τ 1 1 , . . . , τ m 1 ], . . . , f n [τ 1 n , . . . , τ m n ])
∈ DT is a data type declaration of the type term τ. Each such type term τ is called a data type, which is constructed by the function symbols f 1 , . . . , f n , which are called constructors.

For each f i it must hold that the type variables present in the type terms τ 1 , . . . , τ m i are also present in τ. Furthermore, for each f i it must hold that f i :

∀ τ α 1 , . . . , α m i . τ 1 , . . . , τ m → τ f i ∈ F and that τ f i σ i is equal to τ if σ i is {α 1 → τ 1 i , . . . , α m i → τ m i }.
A constructor must not be unifiable with other constructors (of any data type).

A data-type's type-symbol must still be declared in S T and its type declaration in T . A constructor is recursive if it has an argument that is of the data type (or an instance of that data type) the constructor belongs to. A set of data types is mutually recursive if each data type has for each other data type at least one constructors with arguments of that data type.

Semantics

Definition 4.2.1.2 (Structure). Given a signature Σ for polymorphic first-order language with type classes and data types the corresponding Σ-structure is a tuple Σ = (U, D, I T , I F , I P ) where U is a non-empty countable set of elements, the universe. D a non-empty set of non-empty disjoint subsets of U. It represents the set of the types (domains). For each type we require that it is non-empty. I T is the set of type constructors (κ I ) which map domains to a domain (D n → D). I F is the set of functions ( f I ) which maps a cross product of domains and elements to an element (D n × U m → U). I P is the set of predicates (p I ) which map a cross product of domains and elements to true or false (D n × U m → {0, 1}). This is the same as the structure for the polymorphic first-order language with type classes (Sect. 3.1.4) with additional requirement on D and I F (Def. 4.2.1.3). I.e. the semantics of types has to be adapted so that a data type's interpretation is generated by its constructors.

A data type is a type with an interpretation that is generated by its constructors. The simplest case is a data type without any constructors that have non data type arguments. One such example are the natural numbers (τ N ), constructed by 0 and the successor function s. In the simplest case, the simple restriction on the interpretation of the data type (I(τ N )) is that, considering only (term-)ground terms constructed from the constructors (0 and s), every element (d ∈ I(τ N )) of the interpretation of the data type must be the interpretation of exactly one such (term-)ground term.

In our setting, constructors with non data type arguments are allowed. Otherwise list, constructed by nil and cons, would not be possible, because one argument of cons is not necessarily a data type. This complicates the restriction, because multiple (term-)ground terms of a non data type can have the same interpretation. Thus, the simple restriction is not possible and a restriction that takes the interpretation of the non data type arguments into account is necessary.

Our definition that extends to data types with constructors that have non data type arguments is given by the following property that must hold for every interpretation: there exists at least one (term-)ground term t of type τθ such that I(t) = d. Furthermore, for all (term-)ground terms t = f τ 1 , . . . , τ n (t 1 , . . . , t m ) and s = f τ 1 , . . . , τ n (s 1 , . . . , s m ) such that t, s are of type τθ, I(t) = d and I(s) = d, it holds that f = f , that f is a constructor of the data type declaration of τ, that I(τ 1 ) = I(τ 1 ), . . . , I(τ n ) = I(τ n ) and that I(t 1 ) = I(s 1 ), . . . , I(t m ) = I(s m ).

The Semantic Restriction of Data Types Is Not Finitely Expressible in First-Order

This restriction cannot be expressed by a finite first-order axiomatization. Its goal is to uniquely characterize the interpretation of the data type to exactly the set that is generated by the data type's constructor terms such that the constructor terms are distinct. The distinct part can be axiomatized in first-order logic: Definition 4.2.1.4 (Distinct). Terms with different constructors as top symbols are not equal:

f i τ 1 , . . . , τ m 1 (t 1 , . . . , t n 1 ) ≈ f j τ 1 , . . . , τ m 2 (s 1 , . . . , s n 2 ) if i = j
Definition 4.2.1.5 (Injective). Terms with the same constructor top symbol and type arguments are only equal if all their term arguments are equal:

f i τ 1 , . . . , τ m (t 1 , . . . , t n ) ≈ f i τ 1 , . . . , τ m (s 1 , . . . , s n ) =⇒ (s 1 ≈ t 1 ∧ . . . ∧ s n ≈ t n )
The 'no-junk' part, i.e. that there is no element of the type's interpretation that does not have a corresponding constructor term, cannot be finitely axiomatized in first-order logic. It follows from the Induction principle: Definition 4.2.1.6 (Induction). A property (over a data type) holds if for all elements e (of that data type) the assumption that the property holds for all elements that are smaller (according to the well-founded relation, i.e. for structural induction the proper subterm relation) then e implies that the property holds for e: I(∀X : τ. φ) if for all d ∈ I(τ) it holds that for all e ∈ I ≺ d (τ), I {X →e} (φ) implies I {X →d} (φ)

and τ is a data type, t d is the constructor term such that d = I(t d ) and I ≺ d (τ) is the set of all interpretations of proper constructor subterms of t d

The (semantic) induction principle can also be expressed by an induction schema, which can be axiomatized in first-order logic by countably many axioms. This is captured by the following schema: Definition 4.2.1.7 (Induction Schema). Let φ be an arbitrary first-order formula and X be a variable such that its type τ is a data type and such that X occurs in φ. Then the following is the induction schema for data types in first-order logic:

(Case 1 ∧ • • • ∧ Case n ) =⇒ φ[X]
where there is an induction Case i for each constructor f i of τ defined as:

∀X 1 , . . . , X m . (IH 1 ∧ • • • ∧ IH m ) =⇒ φ[ f i (X 1 , . . . , X m )]
where each X i is a fresh (schema) variable and all IH i are omitted (i.e. ) if the type of the corresponding X i is not τ. If the type of the corresponding X i is τ, then IH i is defined as: forall terms X i (of type τ) smaller or equal (by the subterm relation) than

X i it holds that φ[X i ]
Because of the refutational setting, when we turn the induction schema into an SupInd inference, it is applied to Skolem functions. In SupInd, the individual cases of induction are therefore negated and then refuted: I.e. the Case i turn into showing unsatisfiablity (together with the axioms and previous induction hypotheses) of

¬(∀X 1 , . . . , X m . (IH 1 ∧ • • • ∧ IH m ) =⇒ φ[ f i (X 1 , . . . , X m )])
respectively, after Skolemization (i.e. replacing each variable X i by its Skolemization sk i ), showing unsatisfiablity (together with the axioms and previous induction hypotheses) of

IH 1 ∧ • • • ∧ IH m ∧ ¬φ[ f i (sk 1 , . . . , sk m )]

The SupInd Calculus

Proving a (first-order) conjecture is equivalent to showing its negation to be unsatisfiable. Superposition requires that the axioms and the negated conjecture are Skolemized and clausified. In the refutational setting, universal quantification of a conjecture turns into an existential one in the negated conjecture. The existential quantification is then represented by Skolem functions.

One of the main strengths of superposition is redundancy elimination. Superposition can remove clauses if they are reducible to smaller ones. A set of clauses N is reducible to a set of clauses N if N is entailed by N and all clause in N are smaller than the ones in N (according to a clause and a term ordering). The smaller clauses could, for example, be introduced by rewriting or by inferences. Superposition supports any simplification that can be phrased in terms of redundancy elimination. Superposition (and in turn SupInd) perform simplification during the proof search. To profit from simplifications performed on the conjecture, the induction cases and their hypothesis are directly generated from the (simplified) negated conjecture's clauses, instead of using the initial conjecture's clauses. The evaluation (Sect. 4.7) shows that Pirate can solve 6 more problems (+9%) than the next closed tool (HipSpec), when using no strengthening techniques. I believe that the use of the simplified negated conjecture is the main reason for this.

Therefore, the calculus must keep track of the (negated) conjecture and induction hypotheses by splitting the clauses superposition operates on into three parts: the (negated) conjecture clauses (N C ), the induction hypotheses clauses (N IH ), and the axioms and all inference result clauses (N A ). The SupInd calculus' inferences rules work on states. A triple (N A , N IH , N C ) corresponds to a simple state of our calculus. A simple state is unsatisfiable if one of its clause sets contains the empty clause. Complex states represent a split into two cases. A complex state is unsatisfiable if either both substates are unsatisfiable (&) or if one of the two substates (|) is unsatisfiable. Complex states are introduced by induction steps. The initial state is the simple state (N A , / 0, N C ) where N A are the initial axiom clauses and the N C the initial negated conjecture clauses.

state ::= (N A , N IH , N C ) state & state state | state A simple state (N A , N IH , N C ) is a first-order consequence of another simple state (N A , N IH , N C ) if N A ∪ N IH ∪ N C is a first-order consequence of N A ∪ N IH ∪ N C . A simple state (N A , N IH , N C ) is entailed (implied) by a simple state (N A , N IH , N C ) if N A ∪ N IH ∪ N C is entailed by N A ∪ N IH ∪ N C .
I use the symbol & for the states where both substates must be unsatisfiable for the &-state to be unsatisfiable, because that state represents the conjunction of the conjectures of the two substates (i.e. both cases have to be refuted/proven). Similarly, I use the symbol | for the states where one of the two substates must be unsatisfiable, because that state represents the disjunction of the conjectures of the two substates (i.e. only one case has to be refuted/proven). The SupInd calculus consists of inference rules that can be applied to any state or substate which fulfills their premise and side conditions, creating a new state which replaces the premises by the inference rule's conclusion. We will now formally define all inference rules and their side conditions followed by a short description of the inference rules. The rules themselves are presented as inferences, where the upper part is the premise (sub)state and the lower part is a state that replaces the premise.

Superposition Let n ∈ {1, 2} and for all i ≤ n let C i ∈ N A ∪ N IH ∪ N C . (N A , N IH , N C ) (N A ∪ {C }, N IH , N C ) INF if C 1 • • • C n C is a superposition inference

Redundancy Elimination

Let N, N be sets of clauses such that N is reducible to N with respect to Proof. The goal is to show that a SupInd run that is fair for SupInd's Superposition rule is a fair run for superposition on the union of each simple state's clause sets.

N A ∪ N IH ∪ N C . (N A N, N IH , N C ) (N A ∪ N , N IH , N C ) RED A (N A , N IH N, N C ) (N A , N IH ∪ N , N C ) RED IH (N A , N IH , N C N) (N A , N IH , N C ∪ N ) RED C Theorem 4.
The Derive Facts and the Structural Induction inference rules of SupInd preserve a copy of the simple state that they are applied to. Thus, they do not interfere with first-order reasoning, because it can continue on the preserved copy.

The Unsatisfiability Propagation inference rule removes states (and their simple substates) when they are no longer required for the overall proof. Since the states are removed they cannot be part of N * .

The Redundancy Elimination rules, perform only changes in the clause sets of the simple state that would also be allowed in superposition on the union of the clause sets. The Superposition rule applies all inferences of the superposition calculus, that the dynamic refutational completeness for polymorphic first-order language with type classes requires for the union of the clause sets of the simple state (Theorem 3.5.4.11). Thus, purely first-order dynamic refutational completeness for the simple state holds.

Refutational Completeness

Assuming fairness (as defined below) SupInd guarantees that for any simple state that is unsatisfiable when combined with the countable set of instances of the structural induction schema, it will eventually derive the empty clause.

The induction principle of a data type cannot be expressed in first-order logic, because it is quantified over all properties. Therefore, it has to be an inference rule in the SupInd calculus, instead of being stated as an axiom. But for a fixed first-order property, the induction principle can be stated in first-order logic. As explained before, this is done with the help of an induction schema (Def. 4.2.1.7). Furthermore, a given (countable) first-order signature only allows countably many properties, i.e. it is possible to enumerate all possible properties (and their induction principles). They are enumerable, because they have a syntactic representation as first-order formulas and that representation is enumerable.

Let N Ind be the set of clauses resulting from all such properties, i.e. the clauses resulting from all instances of the induction schema for all possible properties.

Static refutational completeness of superposition (saturated sets without ⊥ have a model, Lemma 3.5.4.8) and compactness of first-order logic (proofs are finite, Lemma 3.5.4.10) extend to countable signatures and countable clause sets. In practice, static refutational completeness of infinite saturated sets is not useful, because we can not handle infinite sets of clauses in a solver. By integrating induction into SupInd's calculus, the countable set of instances of the induction schema can be finitely represented and thus be handled in practice. I call a clause set N inductively unsatisfiable if N ∪ N Ind is unsatisfiable. Dynamic refutational completeness for SupInd holds, i.e. for any inductively unsatisfiable simple state there is a sequence of SupInd inference steps that leads to the simple state being refuted. Theorem 4.2.2.8 (Dynamic Refutational Completeness). Let N Ind be the clause set corresponding to the countable set of (first-order) structural induction principles for the declared data types. Let N 0 be a simple state containing only finitely many clauses and N 0 N 1 N 2 • • • be a SupInd run that is fair for all of SupInd rules (except possibly Redundancy Elimination) and let N * be its limit. Then N Ind ∪ N 0 has a model if and only if N * is not a simple state containing the empty clause.

Proof. If N * does not have a model (i.e. is a simple state containing the empty clause), then obviously N Ind ∪ N 0 cannot have a model. If N Ind ∪ N 0 does not have a model, then compactness ensures that there is a finite superposition proof using finitely many clauses from N Ind . Those clauses are present in N * , because a fair run of SupInd introduces them eventually. Suppose they are not, then the run would not be fair, because the corresponding Derive Facts rule(s) would have to be enabled forever (because N * is the limit). Thus, N * contains the empty clause if N Ind ∪ N 0 does not have a model.

A Strategy for Applying Structural Induction

As we have seen, SupInd is refutationally complete with respect to the countable set of first-order instances of the induction schema, i.e. for a conjecture N such that N ∪ N Ind is unsatisfiable SupInd will eventually derive the empty clause. In practice, refutational completeness must be augmented by heuristics that guide the proof search into practically relevant parts. Otherwise prolific inferences, e.g. the Derive Facts rule, make exploring the search space unrealistic and thus finding a refutation unfeasible. In the this section I describe a heuristic to determine how to automatically chose the next Skolem function, of a simple state, to apply induction on (Sect. 4.3.1) and a technique to recover from choosing Skolem functions that turn out to be irrelevant for the current partial proof (Sect. 4.3.2).

The restriction of the induction inference to Skolem functions is possible, because induction over arbitrary terms is covered by the Derive Facts inference introducing the corresponding lemmas. Since many inductive proofs require additional lemmas, techniques to determine the lemmas which should be derived next are especially important and are described in the next section (Sect. 4.4).

Which Skolem Function to Apply Induction On

One of the main challenges of inference-based automated theorem proving is to choose the next inference to perform. Always picking the right inference would eliminate the need to explore most of the search space. This is even more so a challenge for automating induction with prolific inference rules like the Structural Induction rule and the Derive Facts rule. In particular, we would like to automatically determine where to apply the induction inference next.

Let us return to the associativity property of addition (+) on the natural numbers (N), constructed by 0 and the successor function s and the initial state (N A , N IH , N C ) where

N A = {0 + Y ≈ Y, s(X) + Y ≈ s(X + Y)} N IH = / 0 N C = {x + (y + z) ≈ (x + y) + z}
and addition is recursively defined by N A . In the introduction (Sect. 4.1), we observed that selecting induction over y and z requires further inductive reasoning, but induction over x immediately yields first-order refutations. Nonetheless, it is hard to come up with a comprehensive set of rules that capture which Skolems are preferable for all possible cases, e.g. that some recursively defined argument positions are preferable. This is especially difficult for more complex settings with many function symbols and many axioms. Instead of a complex and fixed rule set, we use the insight that, in practice, base cases (e.g. for N: 0 ) often require only purely first-order reasoning. In particular, no nested inductions are possible in the base cases, if the base-case constructors' arguments are not of a data type. While auxiliary lemmas might still be necessary (Sect. 4.4), this section focuses on applying the Structural Induction rule. For example, in the case of nil and 0 no nested inductions are possible, but an nat-pair data type would have an argument of data type (nat) for its (base-case) constructor. Furthermore, finding a proof for the base cases is an obvious prerequisite to proving all induction cases.

To use this idea, one could try all base cases of all Skolem functions and then choose one of the Skolem functions that has first-order proofs for (most of) its base cases. Unfortunately, this approach requires all base cases for all Skolem functions to be tried. In addition, no information can be gained if (nested) inductions on multiple Skolem functions are necessary.

To solve this issue, I create an intermediate clause set, which simultaneously over-approximates all base cases of all Skolem functions of the original simple state. In particular, if one combination of base cases has a proof, then so does the over-approximated clause set. Refuting the overapproximated clause set gives us some base cases that are provable. Thus, an induction on those Skolem functions is (at least for the base cases) relevant for the proof. Creating an overapproximation enables testing the suitability of all Skolem functions occurring in the conjecture by a single proof attempt.

Creating an Over-Approximation of the Base Cases

To create the over-approximated clause set, all Skolem functions are treated as if they were base-case constructors. This allows the heuristic to be applied also in cases with multiple base-case constructors. The starting point of the intermediate clause set is the union of the clause sets (N A , N IH , N C ) of the simple state. This clause set is then extended by adding a new axiom for each triple of an original axiom (i.e. each clause occurring in N A ), a Skolem function (occurring in the negated conjecture N C ) and a base case constructor (occurring in the axiom). The new axiom is created by replacing the base-case constructor terms occurring in the original axiom by the Skolem functions (of the same type).

Replacing the Skolem functions by the base case constructors (and not vice-versa) enables the use of this heuristic also in the presence of multiple base-case constructors. For example, from the original axioms [START_REF] Amin | The essence of dependent object types[END_REF] 1) contains a base-case constructor (i.e. the constructor 0 ). Axiom clause (1) is then over-approximated for the basecases by adding the new clause (3) for the combination with 0 and x, the new clause (4) for the combination with 0 and y and the new clause (5) for the combination with 0 and z. This results in the following clause set (N A ):

0 + Y ≈ Y and (2) s(X) + Y ≈ s(X + Y) only (
(1)

0 + Y ≈ Y (3) x + Y ≈ Y (2) s(X) + Y ≈ s(X + Y) (4) y + Y ≈ Y (N C ) x + (y + z) ≈ (x + y) + z (5) z + Y ≈ Y
If the clause set is shown unsatisfiable, we analyze the resulting proof to find out which Skolem functions are preferable. The generated clause set can allow multiple different proofs, which possibly use different axioms or have different dependencies. After finding the first proof, it is possible to continue the proof search to get alternative proofs (e.g. up to a time limit). In Pirate I only consider the first proof, to avoid wasting time that might be better spent elsewhere. Let us consider an example proof of the negated conjecture using the generated clauses:

(N C ) x+(y + z) ≈ (x + y) + z
The Negated Conjecture (a)

x + z ≈ (x + y) + z using ( 4 The new axiom (5) for z is not used in the proof and hence z is not considered for induction. The axioms (3) and (4) for x and y are both used in the proof. We consider the dependencies between the steps and prefer those Skolem functions where the application of the respective clause does not depend on another clause of a different Skolem function. All inferences belonging to y depend on the inferences of x. Thus, x is selected for induction. In case we have multiple preferred Skolem functions, I try to determine if one of those functions alone is sufficient for the (base-case) proof, by running another proof attempt which excludes the axioms of the other of the possibly-preferred Skolem functions. One Induction step on x yields a proof. Here we show the corresponding state (omitting the content of the N A set, which is the same for all simple states):

|-state initial state N A , N IH = / 0, N C = {x + (y + z) ≈ (x + y) + z} &-state state for case 0 N A , N IH = / 0, N C = {0 +(y + z) ≈ (0 + y) + z} state for case s N A , N IH = {x'+(Y + Z) ≈ (x' + Y) + Z}, N C = {s(x')+(y + z) ≈ (s(x') + y) + z}
The first-order refutations for the base case (0 ) and the step case (s) are as follows:

(0 a) 0 +(y + z) ≈ (0 + y) + z (0 b) y + z ≈ (0 + y) + z by (2) (0 c) y + z ≈ y + z by (2) (0 d) ⊥ (sa) s(x')+(y + z) ≈ (s(x') + y) + z (sb) s(x'+(y + z)) ≈ (s(x') + y) + z by (1) (sc) s(x'+(y + z)) ≈ (s(x' + y)) + z by (1) (sd) s(x'+(y + z)) ≈ s((x' + y) + z) by (1) (se) s((x' + y) + z) ≈ s((x' + y) + z) by N IH (sf) ⊥
In Pirate we always use this heuristic to determine the next Skolem function. In the case of a time out we randomly select a Skolem function.

Guarantees of the Heuristic

In general, we have to apply superposition on the generated clause set with a (time) limit, because we cannot guarantee that the clause set is first-order unsatisfiable. Nonetheless, if one of the base cases is first-order unsatisfiable, then so is the generated clause set. Furthermore, if the clause set is first-order satisfiable then we know that the (nested) induction's base cases are first-order satisfiable, too. Thus, we know that (nested) induction is futile without discovering additional lemmas.

One of the main applications of automating structural induction is proving properties of functional programs. In particular proving properties of primitive recursive functions. In essence, primitive recursive functions are those functions that are defined using exhaustive case distinction over data-type constructors. Furthermore, the defining equations (i.e. the axioms) are universally quantified, which implies the absence of Skolem functions. Thus, in this setting and with a suitable (term) ordering the axioms are (ground) confluent.

If the axioms are (ground) confluent and if we further assume that no base-case constructor has an argument of a data type, then superposition on the clause set generated by the heuristics terminates. This holds even if each base case on its own is satisfiable, i.e. even if all base cases would requires further nested inductions. Moreover, in this particular case the generated clause set is satisfiable only if the conjecture is not a theorem. This is particularly useful, because it can be used to discard propositions for auxiliary lemmas that are not valid.

In the more general cases, i.e. in the presence of base-case constructors with data type arguments, we can guarantee that if is some combination of base cases is first-order unsatisfiable, the generated clause set is also first-order unsatisfiable.

Extension to Step-Case Proofs

In the presented refutational completeness proofs for SupInd, fairness requires that eventually all applications of the induction inference rule are applied to each simple state (i.e. induction on all Skolems). It is possible to restrict the Structural Induction inference rule so that it is applied only once per simple state, i.e. that it is not applied again to the unchanged simple states that are results of the induction rule (which are only kept to ensure first-order completeness).

Applying the inference only once, i.e. to one Skolem function, results in a exploration of the search space similar to depth-first search. Applying it exhaustively results in a breadth-first like exploration. Both variants are equally expressive if an additional fairness property is observed: induction steps are those that do not only occur in the instantiated part and can be discovered by one iteration over the proof.

The combination of the base-case heuristic and the step-case proof analysis allows us to guide the proof search to those Skolem Functions that have more useful base cases and efficiently recover from situations where futile induction steps were performed.

Conjecture Strengthening

A further challenge for automated induction is that many valid conjectures cannot be proven directly by induction, but they follow from lemmas that are provable by induction. Therefore, heuristics to propose such lemmas are essential. A systematic (but necessarily incomplete) approach to introduce new lemmas is to strengthen the conjecture. The strengthened conjecture is proposed as a new lemma, which can then be used to prove the conjecture. Lemmas introduced by strengthening always imply the original conjecture. Thus, it is ensured that a successful proof of them is useful, which in turn justifies spending time to prove them.

I show how to integrate generalization, a standard strengthening technique, into SupInd (Sect. 4.4.1). Standard Generalization picks a complex term in the conjecture and replaces all its occurrences by a fresh variable. In the refutational setting of SupInd generalization picks a complex term in the negated conjecture and replaces its occurrences by a fresh Skolem constant. Generalization operates syntactically and thus it is dependent on the syntactic representation of the conjecture, which, for example, can already be altered by applying rewriting in a different direction. Thus, I also consider if alternative representation (derived from the axioms) of the conjecture are more suitable for generalization.

A shortcoming of generalization is that it ignores dependencies between the generalized term and the remaining conjecture. Term-dependency preserving generalization uses those dependencies to derive side-conditions that lead to better strengthenings (Sect. 4.4.2).

Finally, I describe a new technique, bounded strengthening, to generate helpful propositions, that remove constructor-sink functions (Sect. 4.4.3). Constructor sink-functions are hard for induction, because they often make it impossible to apply the induction hypotheses.

All strengthening techniques are derived from and restrictions of the Derive Facts inference rule, such that unsatisfiablity of the the new (strengthened) state implies unsatisfiablity of the original state. Therefore, I extend SupInd with (specializations of) a strengthening inference rule, which extends the current state instead of requiring a new state with its own search, which the Derive Facts rule requires (to show that the newly derived proposition is a consequence).

Conjecture Strengthening Let S be a simple state and S be a state such that if S is inductively unsatisfiable, then S is also inductively unsatisfiable.

S S | S STRENGTHEN

Conjecture Strengthening Is a Derived Rule The Conjecture Strengthening rule can be derived from the SupInd calculus presented earlier. If there is a proof using the SupInd and the Conjecture Strengthening rules, then there is proof using only the SupInd rules. Suppose the proof contains a refutation of S (i.e. the left-hand side of the |-node introduced), then the strengthening step can be simply removed. Suppose the proof does not contains a refutation of S , then it contains a refutation of S . S is only inductively unsatisfiable if S is inductively unsatisfiable, because of the definition of the Conjecture Strengthening rule. Thus, S is an consequence of S . Therefore, by the Derive Facts rule the clauses in S can be added to S and thus the proof for S can be used for the extended S .

Completeness For refutational completeness (nested) strengthenings are not sufficient, because without an unrestricted Derive Facts inference not all possibly useful propositions are generated. An enumeration based on an unrestricted Derive Facts inference can be interleaved, i.e. performed only once in a while, with the in practice more useful strengthening techniques to retain completeness. There are approaches to enumerating all propositions for the equational case. For example Hip-Spec/QuickSpec [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF] uses a depth-limited testing-based generation of equations. The approach works by building equivalence classes of terms using testing and seems to be useful in practice. However, how to extend this approach to work in a clausal setting (e.g. conditional equations), is still an open question.

Nonetheless, I expect that restricting enumeration to strong strengthening techniques is superior for a large number of practical applications, because those strengthening techniques, while generating a wide range of propositions, only generate propositions whose proof is relevant to the proof of the current (sub)conjectures.

Generalization in SupInd

The intuition behind generalization [START_REF] Chamarthi | The ACL2 sedan theorem proving system[END_REF][START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF][START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF]] is that by replacing a complex term of the conjecture by a fresh Skolem constant, the corresponding induction hypotheses become more powerful. It is particular useful on conjectures containing the same (complex) term multiple times.

Superposition (and in turn SupInd) uses a powerful reduction mechanism to simplify all clauses. This means in particular that all negated conjecture clauses are simplified and that the non-simplified clauses are removed from the simple state. Unfortunately, for many (negated) conjectures some non-simplified clauses are a better basis for generalization, than the simplified versions present in the simple state. This is an important point often overlooked for generalization and is especially important for SupInd because of the powerful reduction mechanism of superposition (which is necessary for efficient first-order reasoning).

Consider the conjecture rev (rev (Xs)) ≈ Xs from the IsaPlanner benchmark [START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF] and the axioms

N A =        (1) app(nil, Ys) ≈ Ys       
(2) app(cons(X, Ys 1 ), Ys 2 ) ≈ cons(X, (app(Ys 1 , Ys 2 )))

(3) rev (nil) ≈ nil (4) rev (cons(X, Ys)) ≈ app(rev (Ys), cons(X, nil))

and the negated conjecture:

rev (rev (ys)) ≈ ys

After applying the induction inference once, the base-case ys = nil is trivially proven and the simplified negated conjecture for the step-case ys = cons(x, xs) is

N C = { (5) rev (app(rev (xs), cons(x, nil))) ≈ cons(x, xs) }
together with the induction hypothesis

N IH = { (6) rev (rev (xs)) ≈ xs }
Unfortunately, we are unable to use the induction hypothesis, because there is no (first-order reasoning) way to eliminate the app between the two occurrences of rev . With a suitable ordering, no further clauses are inferred at all, which means this simple state is not first-order refutable.

Applying generalization to the only clause (5) of the negated conjecture does not progress towards a proof. Nonetheless, there are consequences of the clauses (1) to ( 6) that contain the same complex subterm several times (at different positions). Thus, they would be suitable candidates for generalization. The following clauses are consequences of the clauses (1) to ( 6):

(a) rev (app(rev (xs), cons(x, nil))) ≈ cons(x, xs)

) rev (app(rev (xs), cons(x, nil))) ≈ cons(x, rev (rev (xs)))

Clauses (e), (f) and (g) contain a term multiple times and can be generalized. But clauses (a) to (g) are redundant with respect to clauses (1) to [START_REF] Bachmair | Equational reasoning in saturation-based theorem proving[END_REF] Clauses (e ) and (f ) are the negation of non-theorems and are eventually removed (Sect. 4.5). Clause (g ) is the negation of a theorem (rev (app(Xs, cons(x, nil))) ≈ cons(x, rev (Xs)) and can be automatically refuted (proven). The generalization (g') is a strengthening of the negated conjecture (clause ( 5)), therefore refuting the generalization (g') also refutes the negated conjecture (clause (5)). Since clause (5) represents the negated conjecture of the step case of the initial conjecture (rev (rev (XS )) ≈ XS ) and the proof of the base case is trivial, the initial conjecture can be automatically shown.

We have just seen that for generalization to be useful, it must also be applied to clauses that would normally not be present in a simple state's negated conjecture. To be able to find generalizations, we introduce an inference rule (NEWEQ), which applies the axioms, specifying the defined functions, in the inverse direction to that used for superposition and rewriting, generating additional candidates on which generalization can be performed:

C ∨ s # s[u] C ∨ s # s[t ] NEWEQ if t ≈ t ∈ N A ∪ N IH ∪ N C
where # ∈ {≈, ≈}, u = tσ, t σ ≺ tσ and ≺ is the reduction ordering of the superposition calculus.

Since the rule NEWEQ potentially generates an infinite number of clauses, it is applied only a fixed number of times per (sub)term. In Pirate we generate all combinations where it is applied at most once per subterm. With this limit, clauses (a) to (g) are all the clauses that are generated by NEWEQ from the negated conjecture (clause 5). NEWEQ is not added to the calculus, but only used within generalization to generate additional candidates. The process is as follows: First candidates are generated by applying NEWEQ rule to some combination of terms in the conjecture. The Generalization rule then introduces new simple states for each term that occurs multiple times in one of the candidates. The new state's conjectures are created by replacing the term that occurs multiple times by a fresh Skolem constant. The following inference rule is a special case of the Strengthening rule and can therefore be used to extend SupInd by generalization: Generalization Let N be a clause set constructed by applying NEWEQ to N C , let t be term that occurs in N. Let sk be a fresh Skolem constant and A be

N A ∪ N IH ∪ N C . (N A , N IH , N C ) (N A , N IH , N C ) | (A, / 0, N[t → sk]) GEN
In Pirate we apply the Generalization rule exhaustively to the original state each time we apply the Structural Induction inference rule. We apply it to all terms that occur in the negated conjecture (N C ) or at least twice in a NEWEQ-extension (N) of the negated conjecture (N C ) of the simple state that the induction rule was applied on.

Term-Dependency Preserving Generalization

Despite its usefulness, generalization does not consider dependencies between different terms. Let P be an arbitrary predicate, len the length and rev the reverse of a list and the conjecture be P(len(Xs)) → P(len(rev (Xs))) and thus let the negated conjecture be

P(len(xs)) ∧ ¬P(len(rev (xs)))

Generalization could replace len(xs) to x 1 deriving the generalized negated conjecture:

P(x 1 ) ∧ ¬P(len(rev (xs)))
or rev (xs) to x 2 , len(rev (xs)) to x 3 or some combination. However, in all combinations the connection between len(xs) and len(rev (xs)) is lost. Losing such a connection typically means deriving a non-theorem. The problem here is how to generate a generalization that does not lose any connections between different occurrences of the same Skolem function.

The solution is to prove that some contexts of the different occurrences of the Skolem function are equal. In the example the different contexts of the only Skolem function xs are:

xs len(xs) rev (xs) len(rev (xs))
The only well-typed combinations are xs with rev (xs) and len(xs) with len(rev (xs)), deriving the following two propositions:

(1) rev (Xs) ≈ Xs (2) len(rev (Xs)) ≈ len(Xs)

Both justify the generalization of the original negated conjecture to

P(x) ∧ ¬P(x)
The resulting generalization is trivial to prove. That it is solvable at all is due to the fact that the dependency between both occurrences of xs is preserved by the freshly introduced generalization Skolem constant x. To ensure that the generalization implies the original conjecture, one of the side-condition propositions must be proven. While proposition (1) is not a theorem, proposition (2) can be shown by induction and first-order reasoning. I show how to detect and remove non-theorems from SupInd's search in Sect. 4.5.

In general, a combination of side-condition propositions can be used together to rewrite multiple terms of the negated conjecture to generate the term-dependency preserving generalization. Several of such side-condition combinations can derive the same term-dependency preserving generalization and thus a proof of the generalization and one of the combinations of sideconditions is sufficient. Parts of the conjecture that are not rewritten in order to derive the generalization, can be kept also for the side conditions. As an example consider the (non-negated) conjecture:

Q ∨ P(t 1 , t 2 )
This conjecture can be generalized to

Q ∨ P(X, X)
as long as both the following side conditions hold:

Q ∨ t 1 ≈ s Q ∨ t 2 ≈ s From Q ∨ t 1 ≈ s and Q ∨ t 2 ≈ s we can derive Q ∨ t 1 ≈ t 2 , which together with Q ∨ P(X, X) implies Q ∨ P(t 1 , t 2 ).
For SupInd we have to consider the negated conjecture, where the same approach is possible. The negated conjecture which we have to refute that corresponds to the conjecture

Q ∨ P(t 1 , t 2 ) is ¬Q ∧ ¬P(t 1 , t 2 )
This negated conjecture can be generalized to ¬Q ∧ ¬P(X, X)

as long as both the following (non-negated) side conditions hold:

Q ∨ t 1 ≈ s Q ∨ t 2 ≈ s
where the corresponding negated conjecture for the side conditions are

¬Q ∧ t 1 ≈ s ¬Q ∧ t 2 ≈ s
This approach is captured by the following inference rule that infers one term-dependency preserving generalization using different combinations of side-condition propositions. All are combined into one state that tracks their dependencies. Term-Dependency Preserving Generalization is special case of the Strengthening rule.

Term-Dependency Preserving Generalization Let N l and N r be clause sets such N l N r = N C . Let N be a set of clauses constructed by applying NewEq to N r . Let t 1 , . . . , t n be terms that occur in N and contain Skolem functions. Let sk be a fresh Skolem constant and let A be

N A ∪ N IH ∪ N C . (N A , N IH , N C ) (N A , N IH , N C ) | ((A, / 0, N l ∪ N[t 1 → sk, . . . , t n → sk]) & (SideC 1 | • • • | SideC m )) DEPGEN
Each set of side conditions SideC i is defined as

(A, / 0, N l ∪ s 1 l ≈ s 1 r ) & • • • & (A, / 0, N l ∪ s o l ≈ s o r )
such that t 1 , . . . , t n are equal after rewriting with instances of the equations s

1 l ≈ s 1 r , . . . , s o l ≈ s o r .
In Pirate we apply the Term-Dependency Preserving Generalization rule whenever we apply Generalization. In Pirate Term-Dependency Preserving Generalization is implemented separately of (but dependent on) Generalization for historical reasons. For all Skolem functions (sk t ) occurring in the conjecture we find potential terms (t 1 , . . . , t n ) such that they are the first or second superterms (of the same data type as sk t ) of some occurrence of sk t .

Strengthening Conjectures with Bounds

Generalization and term-dependency preserving generalization are heuristics and thus alone not sufficient to prove every type of conjecture. In particular, they are less useful in cases where functions occur whose return value is always a subterm of one of its argument values. Examples of such functions are the minimum and subtraction of natural numbers and the unconditional drop for lists (drop removes the N first elements from a list). I call those functions constructor-sink functions, because they remove constructors from terms they are applied to. Constructor-sink functions generally lead to conjectures where the induction hypothesis cannot be applied and are thus hard to prove without further (inductive) lemmas. As an example, consider such a constructorsink function, the unconditional drop for lists, the conjecture len(drop(N, Xs)) ≤ len(Xs), the corresponding negated conjecture:

len(drop(n, xs)) ≤ len(xs)
and the axioms defining the functions drop and len, and the predicate ≤:

drop(0, Xs) ≈ Xs 0 ≤ Y drop(N, nil) ≈ nil s(X) ≤ 0 drop(s(N), cons(X, Xs)) ≈ drop(N, Xs) s(X) ≤ s(Y) ↔ X ≤ Y len(nil)
≈ 0 len(cons(X, Xs)) ≈ s(len(Xs))

When performing induction on n and xs the induction cases where n is 0 or xs is nil are trivially proven. Consider the negated conjectures for the induction step cases on both n and xs, i. My solution to this problem is to replace (in the negated conjecture) the term containing the constructor-sink function with a term that is less hostile to induction, while ensuring that the resulting conjecture implies the original one.

To find such a term, consider one distinctive feature that many constructor-sink functions share: In all models, the constructor term representing (i.e. that is equal to the interpretation of) the term with a construct-sink function as top-level symbol is a (non-strict) subterm of at least one of the constructor terms representing the argument terms. In the example, the constructor term representing drop(n, xs) will always be a subterm of the constructor term representing xs. Below we will show a syntactic criterion to automatically determine such "cap subterms" of constructor-sink functions. The first part of my solution is to replace drop(n, xs) in the negated conjecture by its cap xs. This results in the new conjecture (1) len(Xs) ≤ len(Xs) and its negation, which while seemingly obvious still requires induction on xs:

len(xs) ≤ len(xs)
Alone, the new conjecture (1) does not imply the original one, because the constructor term representing drop(n, xs) could be a proper subterm of the constructor term representing xs. I rectify this by additionally showing that if the conjecture holds for some constructor term representing drop(n, xs), it holds for all its immediate constructor subterms and thus for all its constructor subterms. This is done by showing that replacing drop(n, xs) in the negated conjecture for each step-case constructor (in the case of lists by cons(y, ys)) implies replacing drop(n, xs) by each of the step-constructors immediate subterms of the same type (in the case of cons(y, ys) by ys).

This leads to the new side-condition conjecture

(2) len(cons(Y, Ys)) ≤ len(cons(X, Xs)) =⇒ len(Ys) ≤ len(cons(X, Xs))

and its negated conjecture:

len(ys') ≤ len(xs) ∧ len(cons(y, ys')) ≤ len(xs)
Together the new conjectures ( 1) and ( 2) imply the original conjecture. Both conjecture (1) and conjecture ( 2) are provable by one induction inference and first-order reasoning. The conjectures are easier, mainly because the constructor-sink function was removed. I now properly define the ideas that were presented in the above example.

Constructor Normal Form A term of the form f (t 1 , . . . , t n ) of type τ is in constructor normal form if and only if τ is a data type, f is a constructor of that data type and all t i that are of type τ are in constructor normal form. By the restricted semantics of data types, it follows that for every term t of a data type τ and each interpretation I there is exactly one term t in constructor normal form such that I(t) = I(t ). I call such a t the constructor normal form of t.

Cap Subterm A cap subterm is a proper subterm s of a term t such that the constructor normal form of t is a (non-strict) subterm of the constructor normal form of s. A cap argument position of a function symbol f is an argument position i of f such that for every term f (t 1 , . . . , t m ) and every interpretation it is guaranteed that t i is a cap subterm of f (t 1 , . . . , t m ).

Exhaustive Recursion To determine a syntactic criterion for cap argument positions, it is necessary to find sets of axioms that specify one function symbol, so that all models have to obey that specification. In principle, we want universally quantified axioms about such a function symbol f , i.e. axioms of the form f (X 1 , . . . , X n ) ≈ t. For data types we know that all elements of a data type are build by constructors (i.e. 'no-junk') thus we can also use all axioms of the form f (X 1 , . . . , nil, . . . , X n ) and f (X 1 , . . . , cons(Y, Ys), . . . , X n ) as long as each position is exhaustively specified (e.g. by a complete pattern matching on all constructors of a data type). I restrict the definitions to top-level constructor symbols for each argument. An extension to arbitrary depth and number of constructor symbol is straight forward, but adds no further insights while significantly complicating the presentation.

Let F be a set of conditional equations C i ∨ f (t 1 i , . . . , t n i ) ≈ t r i where each C i is a (possibly empty) disjunction of literals and each t j i is either a universally quantified variable or a term consisting only of a top-level constructor symbol with universally quantified variables as arguments. I further assume that for the purpose of this section, corresponding variables in different conditional equations are actually the same variable, e.g. that N in the defining equations of gcd (its defining equations are given below) always denotes the same variable. I also assume, that the t j i are distinct. If the t j i are not distinct, we can make them distinct and add equality constraints to the corresponding condition C i . Furthermore, for each t j i that is not a variable let τ i be its data type and for each constructor f j of τ i there must be a at least one t j i that is equal to f j (X 1 , . . . , X m ). Let J f j be the union of all C i such that t j i is equal to f j (X 1 , . . . , X m ) then it must holds that ¬(C 1 ∨ • • • ∨ C w ) is unsatisfiable (where each C k ∈ J f j ). If that is the case then the function symbol f is called exhaustively recursive.

The constructor-sink functions drop, minus and subtraction all are exhaustively recursive. So is the greatest common divisor of two numbers gcd, if the conditions N ≈ M (from equation 1), N < M (equation 2) and M < N (equation 3) are exhaustive, i.e. if ¬(N ≈ M ∨ N < M ∨ M < N) can be shown to be unsatisfiable:

(gcd equation 1) gcd(N, M) ≈ N if N ≈ M (gcd equation 2) gcd(N, M) ≈ gcd(M, N) if N < M (gcd equation 3) gcd(N, M) ≈ gcd(N -M, M) if M < N A Syntactic
A term t c is a constructor subterm (c-subterm) of a term t if t c is syntactically equal to t or if t = f i (t 1 , . . . , t n ), t is of the data type τ, f i is a constructor of τ, for some i it holds that t i is of the same type as t (i.e. τ) and t c is a c-subterm of t i . For all models and terms t c and t it holds that if t c is a c-subterm of t then t c 's constructor normal form is a (non-strict) subterm of t's constructor normal form. Each of the defining equations of f can be mapped to a set of argument positions where the right-hand side is a c-subterm of an argument of the left-hand side or to a set of positions, where the argument of the right-hand side is a c-subterm of the corresponding argument on the left-hand side: To derive a simple syntactic criterion for cap argument positions, I first map the equations to a set of argument positions. Then the intersection of those sets contains the argument positions that are cap argument positions. The mapping distinguishes between the both forms of equations that we consider:

1. f (t 1 , . . . , t n ) ≈ t r → {i | t r is a c-subterm of t i } (non-recursive) 2. f (t 1 , . . . , t n ) ≈ f (r 1 , . . . , r n ) → {i | r i is a c-subterm of t i } (recursive)
The intersection of these sets contains only cap argument positions of f . This is because only positions that remove constructors, from top-most argument term at the position, are in the sets created by the mapping. I.e. only positions where (in the non-recursive case) the result (t r ) is a c-subterm of the argument position or (in the recursive case) the same position, in the recursive call, is a c-subterm. The computation of cap argument positions can be strengthened by allowing permutations in the recursive definitions, within those argument positions that are cap argument positions. This is achieved by first assuming the intersection of argument positions of the non-recursive equations are cap argument positions. Then, iteratively, argument positions are removed that do not preserve c-subterms under permutation in the recursive equations. The cap argument positions are those that are still in the set when a fixpoint is reached:

1. CAP 0 ::= intersection of all f (t 1 , . . . , t n ) ≈ t r → {i | t r is a c-subterm of t i } (non-recursive)
k. CAP k ::= intersection of CAP k-1 and the intersection of all f (t 1 , . . . ,

t n ) ≈ f (r 1 , . . . , r n ) → {i | i ∈ CAP k-1 ∧ ∃ j. r i is a c-subterm of t j } (recursive)
This can be further strengthened by not requiring c-subterms but also allowing cap subterms. This means replacing the conditions "t r is a c-subterm of t i " by "t r is a c-subterm of t i or t r has a cap subterm that is a c-subterm of t i " and "r i is a c-subterm of t j " by "r i is a c-subterm of t j or r i has a cap subterm that is a c-subterm of t j ". Furthermore, for increased prevision, the equality constraints of the conditions C i of each defining equation can be taken into account when testing if terms are c-subterms of each other. This syntactic criterion is not complete, i.e. it does not detect all cap argument positions, but it is sufficient for many practically interesting cases. In particular, it is sufficient for all constructor-sink functions mentioned so far. For example for subtraction (-):

1. 0 -M ≈ 0 → {1} because 0 is a c-subterm of 0 1 .

N -0 ≈ N → {1} because N is a c-subterm of N and not a c-subterm of 0.

2. s(N ) -s(M ) ≈ N -M → {1} because 2 ∈ CAP 1 and N is a c-subterm of s(N ).

Fixpoint reached for subtraction (-): {1}

The fixpoint results is correct, because position 1 is indeed a cap argument position for subtraction (-). The cap-argument position computation for the greatest common divisor gcd(N, M) is as follows:

1. gcd(N, M) ≈ N → {1, 2} when considering the side condition that N ≈ M It remains to show that if the right substate of the |-state is unsatisfiable, then the original state is unsatisfiable. Suppose ((A, / 0,

N C [t 1 → t 2 ]) & Step κ 1 & • • • & Step κ n ) is unsatisfiable but (N A , N IH , N C ) is not.
The negated conjecture of each Step κ i , j , for each constructor κ i and each j which is an argument position of t 1 of the same data type, is

cnf (¬N C [t 1 → κ i (sk 1 , . . . , sk m )]) ∪ N C [t 1 → sk j ]
Without changing the satisfiability, we can remove the clause normal transformation and use ∧ to signify ∪, because the clause set represents a conjunction of the clauses it contains

¬N C [t 1 → κ i (sk 1 , . . . , sk m )] ∧ N C [t 1 → sk j ]
The corresponding non-negated conjecture for each Step κ i , j is

N C [t 1 → κ i (X 1 , . . . , X m )] =⇒ N C [t 1 → X j ]
Each of these Step κ i , j follows from N A ∪ N IH ∪ N C and thus must also hold in every interpretation of (N A , N IH , N C ). Therefore, ((A, / 0, N C [t 1 → t 2 ]) must be unsatisfiable and (N A , N IH , N C ) must not be unsatisfiable for

((A, / 0, N C [t 1 → t 2 ]) & Step κ 1 & • • • & Step κ n ) to be unsatisfiable but (N A , N IH , N C
) not to be unsatisfiable. The only possible way for all Step κ i , j to hold and

((A, / 0, N C [t 1 → t 2 ]
) to be unsatisfiable is therefore if the constructor normal form of t 2 is not a (non-strict) subterm of the constructor normal form of t 1 . Because t 2 is a c-subterm of t 1 , this is not possible.

An Optimized Variant of SupInd

In this section, I describe two additions to SupInd, that make an implementation more efficient. First, I introduce a global axiom clause set (Sect. 4.5.1) and then show how to detect and remove invalid propositions (Sect. 4.5.2)

A Shared Global Axiom Clause Set

In the SupInd calculus presented so far the initial axiom set is duplicated for each simple state. This is wasteful and unnecessary, because inferences within that clause set are repeatedly performed in each simple state. An alternative is to introduce a global axiom clause set (N GA ) that extends every simple state's clause sets so that inferences between the axioms are only performed once. The inferences of the superposition calculus (lifted to SupInd) must then also be applied to N GA and the result of those inferences must be added back to N GA . SupInd's Superposition inference is therefore replaced by the following two inference rules.

The new status of an SupInd proof state is represented by the pair (N GA , S ), where N GA is the global axiom clause set and S is state. The pair representing the proof state is unsatisfiable if the global axiom clause set N GA contains the empty clause or the state S is unsatisfiable. Simple states are still the triples (N A , N IH , N C ), where N A now contains results of local first-order reasoning instead of the global axioms and their reasoning. Let N A be the initial axioms and N C be the initial negated conjecture then the initial proof state is (N A , ( / 0, / 0, N C )). The only inference rule that directly alters the global axioms clause set is the superposition rule for that clause set.

Optimized Conjecture Superposition for Global Axioms

Let N GA be a clause set, S be a state and C 1 ,C 2 ∈ N GA .

(N GA , S ) (N GA ∪ {C }, S ) INF GA if C 1 C 2 C or C 1 C is a superposition inference
For a simpler and more uniform presentation, I still present the remaining inference rules as if they operate only on a state and leave the global axiom clause set implicit, if necessary I refer to it as N GA . The Superposition inference rule of SupInd must be replaced by superposition rules that take the global axiom clause set into account. First, the Conjecture Superposition inference rule, that performs the inferences between all clause sets and the clause sets for the the axioms (N A ) and negated conjecture (N C ). The inference results of this inference go to the axiom clause set N A . The clause sets for axioms and the negated conjecture are still separate to achieve smaller induction hypotheses in the Structural Induction inference.

Optimized Conjecture Superposition Let n ∈ {1, 2}, let C 1 ∈ N A ∪ N C and let C 2 ∈ N GA ∪ N A ∪ N IH ∪ N C . (N A , N IH , N C ) (N A ∪ {C }, N IH , N C ) INF C if C 1 C 2 C , C 2 C 1 C or C 1 C is a superposition inference
And then the inference rule that does inferences within the induction hypotheses clause set (N IH ) with help of the global axiom clause set (N GA ), where the inference results can stay in the induction hypotheses clause set.

Optimized Induction Hypotheses Superposition

Let n ∈ {1, 2}, let C 1 ∈ N IH and let C 2 ∈ N GA ∪ N IH . (N A , N IH , N C ) (N A , N IH ∪ {C }, N C ) INF IH if C 1 C 2 C , C 2 C 1 C or C 1 C is a superposition inference
The rules ensure that inferences are only applied with clauses from the simple state's clauses or with a clause from the simple state and a clause from the a global axiom clause set. An additional benefit of splitting the Superposition rule this way is that less inferences within N IH must be repeated, after an induction inference. Inference results from (global) axioms and the induction hypotheses are preserved (and adapted) in N IH by the induction inference. The Redundancy Elimination rule must also be changed to take N GA into account and is therefore replaced by

Optimized Redundancy Elimination

Let N, N be sets of clauses such that N is reducible to N with respect to N GA ∪ N IH ∪ N .

(N A N, N IH , N C ) (N A ∪ N , N IH , N C ) RED A (N A , N IH N, N C ) (N A , N IH ∪ N , N C ) RED IH (N A , N IH , N C N) (N A , N IH , N C ∪ N ) RED C
With these changes, the duplication of inferences between the global axioms can be avoided, because they are only performed once in the global axiom clause set.

Purging Invalid Propositions

Detecting invalid propositions is useful to reduce the search space by removing the corresponding simple states. It also helps end-users to detect erroneous conjectures. For example Pirate can automatically detect that one problem (problem 87) of the IsaPlanner benchmark is not a theorem:

minus(minus(X, Y), Z) ≈ minus(X, minus(Y, Z))
Here, minus is subtraction over the natural numbers. None of the tools described in the evaluation section Sect. 4.7 is capable of detecting that this is not a theorem. To the best of my knowledge, including a non-theorem in the benchmark was not intentional.

In the presence of induction, a first-order saturation of the axioms and the negated conjecture is not sufficient to show that the conjecture is invalid. There could be additional lemmas (provable by induction) that, when added to the previously saturated set, yield a contradiction. A test that is still useful in the presence of induction is: A conjecture is invalid if its negation follows from a consistent set of axioms. In the case of superposition this can be restated as follows: a conjecture is invalid if its negation reduces to the consistent axioms. Furthermore, we know that if the axioms are consistent and a proposition is valid with respect to the axioms, then the union of every of the proposition's induction hypotheses with the axioms is consistent. If the global axiom clause set is not consistent, the Optimized Conjecture Superposition for Global Axioms inference rule of SupInd will eventually derive the empty clause, thereby proving the initial conjecture. Therefore, the individual inference rules of the optimized variant of SupInd dealing with states can always assume that the global axiom clause set is consistent.

If the negated conjecture set (N C ) of a simple state is the empty set, it is implied by the axioms, induction hypothesis and inference results. Thus, the conjecture cannot hold. Because consistency of the axioms can be assumed and because induction hypotheses of valid propositions together with a consistent set of axioms cannot be unsatisfiable, simple states with an empty conjecture (N C ) can be removed. Thus, optimized SupInd can be extended by the following simplification rules.

Optimized Purge Invalid Propositions

Let S be an arbitrary state.

(N A , N IH , {}) & S ({}, {}, {}) & l S & (N A , N IH , {}) ({}, {}, {}) & r (N A , N IH , {}) | S S | l S | (N A , N IH , {}) S | r

Implementation

In this section I give an overview over the way the SupInd calculus is implemented in the version of Pirate that supports induction. There are three main data structures that hold all necessary information:

N GA the global axiom clause set. Initially, this set holds all input axioms. During the proof search all those inductive consequences that Pirate has proved to follow directly from the global axiom clause set are added.

tree the and/or-tree representing the state. The simple states, which are all at the leaves and contain the clause set triples, are not part of the and/or-tree but only referenced by it.

Simplifying the tree means to propagate the (dis)proofs. An or-node of the tree is proven if one of its subnodes is proven and disproven if all its subnodes are disproven. An and-node of the tree is proven if all of its subnodes are proven and disproven if one of its subnodes are disproven. In keeping with SupInd states I also refer to the or-nodes as |-states and the and-nodes as &-states.

states a list of simple states annotated with additional information that is useful in a practical implementation. One such information is if further induction is necessary or only first-order reasoning is required and the other main information is a reference counter for each state, counting how often that state is referenced in the and/or-tree. This list of simple states is deduplicated so that a simple-state can occur multiple time in the tree but only occurs once in the states.

Initially, the global axiom clause set is filled with the input axioms. The negated conjecture N C is represented by new simple state ( / 0, / 0, N C ) that is added to the states list. The tree is initialized with a single reference to the currently only simple state. Optionally, Pirate has a setting so that it starts with attempts to proof associativity and commutativity for all binary function symbols, before starting the actual proof attempt.

The Main Loop

After initialization the main loop (Alg. 1) is started. At the beginning of each loop iteration the next simple-state is selected (line 2). Then superposition is performed on the global axiom

Distinctness and Injectivity

For the superposition calculus used in SupInd we integrated special reduction rules to for distinctness (Def. 4.2.1.4) and injectivity (Def. 4.2.1.5). The main motivation for this is to ensure that distinctness and injectivity properties are used to reduce a clause as soon as possible. Additionally, the integration leads to more compact and readable proofs, because the application of those properties is immediately obvious instead of hidden behind other reduction rules.

Distinctness of data type constructors means that clauses that contain a disequation between to distinct constructors are true. Furthermore, equations between two distinct constructors can be removed from clauses. The rules treating injectivity for negative and positive literals of clauses are as follows.

Distinct Let f i and f j be data type constructors such that i = j.

f i (. . .) ≈ f j (. . .) ∨ C NEG DISTINCT f i (. . .) ≈ f j (. . .) ∨ C C POS DISTINCT
Injectivity of data type constructors means that disequation between to distinct constructors are true only if one of the arguments is not equal. Furthermore, equations between two distinct constructors can only be true if all arguments are equal. The rules treating injectivity for negative and positive literals of clauses are as follows.

Injective Let f i be a data type constructor.

f i (s 1 , . . . , s n ) ≈ f i (t 1 , . . . , t n ) ∨ C s 1 ≈ t 1 ∨ . . . ∨ s n ≈ t n ∨ C NEG INJ. f i (s 1 , . . . , s n ) ≈ f i (t 1 , . . . , t n ) ∨ C (s 1 ≈ t 1 ∨ C) ∧ . . . ∧ (s n ≈ t n ∨ C) POS INJ.
I also added two special rules that handles the (dis)equation of variables (only for single literal clauses). Two variables of a data type with more than one constructor cannot be equal for all instantiations. Such single literal clauses are often introduced by using injectivity, therefore special reduction rules seem advisable.

Data Type Variable Let X, Y be variables of a data type, with more than one constructor.

X ≈ Y NEG VARS X ≈ Y ⊥ POS VARS

Structural Induction

To perform the Structural Induction inference rule the current goal is analyzed first, in order to determine the Skolem constant c whose induction cases we want to generate next (line 1, Sect. 4.3). Then the goals for the induction cases including the induction hypotheses are generated (lines 3-9, Sect. 4.2). The induction hypotheses will not be created for base cases since there is no argument of the same data type (lines 5-7). Previous induction hypotheses are kept for all cases (line 8). Note that in order to create the proper induction hypotheses, only the clauses from the negated conjecture N C , i.e. those clauses that represent the (potentially reduced) negated conjecture are 'unnegated' (line 6). Because of previous reasoning steps, the negated conjecture of the simple state can be different from the initial negated conjecture of the simple state. Thus, the additional negation step is required.

N H += N H [c → c i ]; 8 N H += N H [c → f (c 1 , . . . , c n )]; 9 cases += (N H ,N C [c → f (c 1 , . . . , c n )]); 10 return cases;
unnegate negates the negated conjecture to retrieve the current conjecture from the negated conjecture. When unnegating, all Skolem constants, except the Skolem constant c of the current induction step, can be treated as existentially quantified and thus are turned into universally quantified variables. Then the result is clausified again to initialize the new induction hypotheses (N H , line 6). In Pirate I have also implemented an alternative unnegate which preserves the Skolem constants, yielding less powerful ground induction hypotheses which have easier first-order goals.

Induction hypotheses of strong structural induction hold for all structurally smaller terms. In each induction case (f (c 1 ,. . . ,c n ) ≈ c), the arguments (c i ) of the data type constructor (f ) are structurally smaller than the whole constructor term. Thus all induction hypotheses that hold for c also hold for c i and the corresponding induction hypotheses are added (line 7). This way the (generally infinite) set of terms smaller than c and their induction hypotheses are gradually constructed in subsequent induction steps (then over the c i ) when the Skolem constants representing those smaller terms are introduced.

Generalization

Generalization first preprocesses the simple state by generating a set of negated conjectures, which are different representations of the negated conjecture (N C ) of the simple state generated by applying the NEWEQ inference rule (line 2, Sect. 4.4.1). The generated set contains the negated conjecture (N C ) and all negated conjectures that can be derived by applying NEWEQ at most once per subterm of the negated conjecture. Then, for each generated clause we apply generalization to every complex term that occurs at least once in N C or more than once in a NEWEQ-extension (line 3). The complex terms are then replaced by fresh Skolem constants in the negated conjecture, the axioms and the induction Hypotheses(lines 5-7). Furthermore, new simple states representing the generalizations are created (line 8). Finally, the dependency preserving generalization is performed using the information gathered by the standard generalization (line 9).

Term-Dependency Preserving Generalization

Term-Dependency Preserving Generalization (the inference rule is described in Sect. 4.4.2) requires as input a simple state, a term (t) contained in the negated conjecture and a fresh Skolem constant (b t ). The simple state is the one which contains the negated conjecture we are using to generalize. The term t is the term that generalization picked to generalize and the Skolem constant b t is by what the term t was replaced. Then, for each Skolem constant occurring in the term t term-dependency preserving generalization is performed (line 2). First, the negated conjecture is split into an unchanging part (N l ) and a generalization part (N r ) according to the Term-Dependency Preserving Generalization inference rule (line 3). In our evaluations (Sect. 4.7) the unchanged part N l , in the generalizations used in successful proofs, is empty. This is because most negated conjectures of the evaluation only have one or two clauses. From the generalization part (N r ) of the negated conjecture a set of terms is selected that contain the Skolem constant b t (line 4). In Pirate we consider all first or second superterms (of the same data type as b t ) of some occurrence of b t . Then an &-state that contains both the term-dependency preserving generalization and the side conditions is created (lines 5-9). The generalization is created by replacing all chosen superterms (S ) by the generalization Skolem constant b t (line 6). For each such superterm (t i ∈ S ) the side condition that it must be equal to t is required. This is ensured by adding the appropriate simple state (representing the conjecture that t i ≈ t) to the &-state (line 8).

of the initial call (such that that argument is still marked as a cap argument position, lines 5-6). Alternatively, the complete right hand side (t r ) can be smaller than some argument t i (lines 7-8). This algorithm assumes that the marked initial axioms fully define the used functions.

Strengthening Conjectures

The second phase generalizes a negated conjecture according to the information gathered by the analysis phase. For each negated conjecture that is to be strengthened, each (sub)term (t) that has a cap subterm is taken as a basis for strengthening (line 2). For each cap subterm t c of t the Bound Strengthening inference is applied (line 3). The inference results in an &-state consisting of the strengthened conjecture and the inverse steps (lines 4-9). The strengthening is derived by replacing t by t c in the negated conjecture (N C , line 5). For each constructor of the data type of t an inverse step is necessary (line 6). Each inverse step ensures that if the conjecture holds, with t replaced by each constructor with fresh Skolem constants as argument, it also holds for t replaced with the Skolem constant arguments of the same data type (lines 7-9).

Input

The input of Pirate is the DFG file format used for the monomorphic SPASS [START_REF] Blanchette | More SPASS with Isabelle[END_REF], extended with polymorphism and data type declarations. In the preamble, the DFG format has a number of descriptions, that we do not use in Pirate. They are still present in the input file, because the DFG format requires them. The function, predicates and type symbols are declared after the preamble. For function and predicate symbols, the format is (name-of-the-symbol, number-of-type-arguments+number-ofterm-arguments). If the number of type arguments is zero, the number and the + can be omitted. For types only the number of type arguments is needed, for background compatibility types can also be named sorts. Next come the function and predicate declarations (F, P). The format of the declarations begins with function( or predicate(. Then comes the function-symbol (which must have been defined above), followed by a comma. The next component is the type variable declarations [A,. . . ], list(A)), again followed by a comma. The number of type variables must agree with the declared number of type arguments. The last component is a tuple of the arguments followed by white space and the return type (only for functions). The number of argument types must agree with the declared number of term arguments. The declaration is finished by a closing bracket and a dot.

The data type declarations (DT ) are also declared here. The format of the data type declarations begins with datatype( and is followed by the type constructor that build the data type (e.g. nat) and a common. Next is a comma separated list of constructors. The declaration is finished by a closing bracket and a dot. [A] , l i s t (A) ) . f u n c t i o n ( cons , [A] , (A, l i s t (A) ) l i s t (A) ) . f u n c t i o n ( z , n a t ) . f u n c t i o n ( s , ( n a t ) n a t ) . f u n c t i o n ( append , [A] , ( l i s t (A) , l i s t (A) ) l i s t (A) ) . f u n c t i o n ( c o u n t ,

[A] , (A, l i s t (A) ) n a t ) .

p r e d i c a t e ( l e s s , [A] , A, A) . d a t a t y p e ( n a t , z , s ) . d a t a t y p e ( l i s t , n i l , c o n s ) . e n d o f l i s t .

After the declarations, the next part of the input are the axiom formulas. The formulas have a name attached to them, so that the proof output can refer to the formulas by name. The logical part of the formulas is build from type quantification (forall sorts), term quantification (forall) and the usual connectives (equal, implies,. . . ). Terms are build from variables or the function symbol with first the type arguments < • • • > followed by the term arguments in round brackets. The :lr annotation (for equations and equivalences), informs the solver that the equations should be oriented from left to right. We introduced it in previous work on SPASS [START_REF] Blanchette | More SPASS with Isabelle[END_REF]. e q u a l : l r ( append<A>( n i l <A>,LS ) , LS ) ) ) , a p p e n d n i l ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) , Y : A, YS : l i s t (A) ] , e q u a l : l r ( append<A>( cons<A>(Y, YS ) , LS ) , cons<A>(Y, append<A>(YS , LS ) ) ) ) ) , a p p e n d c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, LS : l i s t (A) ] , e q u a l ( c o u n t <A>(X, n i l <A>) , z ) ) ) , c o u n t n i l ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, L : A, LS : l i s t (A) ] , i m p l i e s ( e q u a l (X, L ) , e q u a l ( c o u n t <A>(X, cons<A>(L , LS ) ) , s ( c o u n t <A>(X, LS ) ) ) ) ) ) , c o u n t c o n s e q u a l ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, L : A, LS : l i s t (A) ] , i m p l i e s ( n o t ( e q u a l (X, L ) ) , e q u a l ( c o u n t <A>(X, cons<A>(L , LS ) ) , c o u n t <A>(X, LS ) ) ) ) ) , c o u n t c o n s n o t e q u a l ) . e n d o f l i s t .

The last part of the input is the conjecture. Superposition will negate the conjecture before trying to show the axioms and the conjecture to be unsatisfiable. e q u a l ( c o u n t <A>(X, append<A>(XS , cons<A>(X, n i l <A>) ) ) , s ( c o u n t <A>(X, XS ) ) ) ) ) , c o n j p r o p 3 8 ) . e n d o f l i s t . end problem .

Output

I now show the output of the inductive version of Pirate on the problem file presented above. First the preamble is printed. The reduceDFGtoFacts script is used to replay first-order proof obligations in the monomorphic version of SPASS. This is done during development to ensure that the proofs found are actually correct. I did not use the replay during evaluation. S t a r t i n g s c a l a v e r s i o n 2 . 1 1 . 2 Unkown / Legacy-s t y l e Argument : / home / dwand / p i r a t e / r e d u c e D F G t o F a c t s

The negated, clausified and Skolemized conjecture is printed next. Clauses always start with a hash of the clause (here: FB832), followed by a counter that is independent of the clause structure (00007). Next comes the priority (rank) of the clause. Axioms have priority 1000 while the negated conjecture has priority 1. Newly inferred clauses have a priority one higher than the minimum priority of their parents. Then, the tab-separated list of negative literals is printed. The output -> separates the list of positive literals from the negative literals. Finally, the origin is printed. It refers to input formulas by their name and to previous clauses by their hash. After printing the conjecture, the proof search is started. This proof is relatively simple and therefore one few outputs were made. Every time a new globally valid axiom (i.e. without any assumptions) is found it is printed. Optionally, its proof can also be printed. For this proof, Pirate discovered that nil is also a neutral argument to append if its in the second argument position. The CaseProofTask represent the states of the SupInd calculus. At the beginning of the line, after the @, the time in milliseconds is shown (since program start). After the successful proof search , either a proof or a counter example is found. Otherwise, a time out occurs. If a proof or counter example was found, it is printed. For a proof, the axiom and conjecture formulas that were used are also listed. Finally, the remaining output consists of the full refutation proof (without clausification). The clauses are printed in the order they were derived, which for smaller proofs (like this one) gives a good separation into the induction cases. The conclusion of the refutation proof is the last clause derived and thus the last clause printed.

The first part of the proof output are the clausified input clauses and the initial reduction results. o r i g i n ( I n p u t ( c o u n t c o n s e q u a l ) ) 0CF07 -00006

( 1 0 0 0 ) {} | | -> c o u n t ( V2 , c o n s ( V4 , V6 ) ) = c o u n t ( V2 , V6 ) V2 = V4 . o r i g i n ( I n p u t ( c o u n t c o n s n o t e q u a l ) ) FB832 -00007 ( 1 ) {} | | c o u n t ( s k f 1 , a p p e n d ( s k f 2 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , s k f 2 ) ) -> . o r i g i n ( Conj ( c o n j p r o p 3 8 from : S e t ( B94AA ) ) ) 6F4F1 -00010 ( 1 0 0 0 ) {} | | V2 = V2 -> c o u n t ( V2 , c o n s ( V2 , V4 ) ) = s ( c o u n t ( V2 , V4 ) ) . o r i g i n (NuV( E3A4E ) ) 96D58-00011 ( 1 0 0 0 ) {} | | -> c o u n t ( V2 , c o n s ( V2 , V4 ) ) = s ( c o u n t ( V2 , V4 ) ) .
o r i g i n ( L i t E l i m ( 6 F4F1 ) )

After the input clauses, the inference results appear. In this proof they are separated into the induction case for nil and cons of skf2. The following clause is the negation of the negated conjecture (keeping the Skolemization). It is needed to generate the induction Hypothesis. First, the clauses for the nil-case are printed. Because it is a base case, no induction hypothesis is included, thus the clause BC7A5 is only relevant in the step case. The induction case (clause 88E01) is generated by replacing skf2 with nil in the initial conjecture (clause FB832)

( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , n i l ) ) -> . o r i g i n ( I n d C a s e ( n i l , s k f 2 , FB832 ) ) 8E55B-00157 ( 1 ) {} | | s ( c o u n t ( s k f 1 , n i l ) ) = s ( z ) -> . o r i g i n ( Rew ( 8 8 E01 w i t h S e t [ CE930 , 6E897 , 96D58 ] ) ) AAE6D-00161 ( 1 ) {} | | c o u n t ( s k f 1 , n i l ) = z -> . o r i g i n (DT-I n j e c t i v e ( 8 E55B ) ) BB8E7-00162 ( 1 ) {} | | -> . o r i g i n (MRR(AAE6D,-CE930 ) )
Then, the clauses for the cons-case are printed. For this case, the induction case (clause 47F39) is generated by replacing skf2 with cons(i1003, i1004) in the initial conjecture (clause FB832), where i1003, i1004 are fresh Skolem constants. The induction hypothesis (clause 0A9F1) is generated from the negation of the negated-conjecture (clause BC7A5) by replacing the induction Skolem skf2 by the fresh Skolem i1004, which was created as an argument (of the same type as skf2) to cons for the induction case (clause 47F39). Finally, the induction cases are combined and a contradiction is derived between the negated conjecture of the inital property and the clauses derived by induction. More examples can be found in the appendix (Ch. A), including a disproof of the conjecture by finding a counter example (Sect. A.1.4).

) 2 F309 -00242 ( ) {} | | c o u n t ( s k f 1 , i 1 0 0 4 ) = c o u n t ( s k f 1 , i 1 0 0 4 ) -> s k f 1 = i 1 0 0 3 s k f 1 = i 1 0 0 3 . o r i g i n ( Sup ( 3 EA25 by 0CF07 ) ) 37EF4-00245 ( ) {} | | -> s k f 1 = i 1 0 0 3 s k f 1 = i 1 0 0 3 . o r i g i n ( L i t E l i m ( 2 F309 ) ) 37EF4-00246 ( ) {} | | -> s k f 1 = i 1 0 0 3 . o r i g i n ( RemDup ( 3 7

Evaluation and Comparison with Related Work

There are several related inductive theorem proving methods. Some inductive theorem provers' proof methods are based on rewriting and support only equational formulas, e.g. IsaPlanner [START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF] based on rippling and case-splitting. Some approaches rely on satisfiability modulo theories (SMT): HipSpec [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF] and Dafny [START_REF] Leino | Automating induction with an SMT solver[END_REF] integrate SMT as a blackbox, whereas the SMT solver CVC4 [START_REF] Reynolds | Induction for SMT solvers[END_REF] integrates support for structural induction. SMT is often successful for theorem proving in first-order logic, but typically it does not provide any completeness guarantees. Its interpreted symbols and theories can be beneficial, e.g. dedicated support for natural numbers, can (for larger values) be better than the unary term representation. Other tools provide their own calculus. One example is Zeno [START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF], whose calculus is based on critical pairs and path, but does not support existential quantification and negation. The interactive proof assistant ACL2 [START_REF] Chamarthi | The ACL2 sedan theorem proving system[END_REF] also has powerful induction heuristics. Unlike SMT, superposition-based theorem provers for first-order logic are typically refutationally complete. Thus, it is guaranteed to terminate on an inconsistent first-order clause set, but might diverge on a consistent one. It is used in explicit and consistency based induction methods. Consistency based methods [START_REF] Comon | Inductionless induction[END_REF], also called inductionless induction, reduce inductive reasoning to first-order consistency checking. While their reduction phase is powerful, finite saturation of first-order theories can often not be obtained. Explicit induction methods, such as structural induction, compute an induction schema at the start of the proof attempt of each conjecture, whereas implicit induction is usually based on term rewrite systems and the induction schema is constructed during the proof attempt [START_REF] Falke | Rewriting induction + linear arithmetic = decision procedure[END_REF]. Kersani and Peltier [START_REF] Kersani | Combining superposition and induction: A practical realization[END_REF] show how an infinite set of (explicit) induction schemata for natural numbers can be integrated into superposition by a loop detection rule. This rule provides syntactic criteria to detect inference loops and derive inductive conclusions from those loops. Our induction method is also based on explicit induction, namely strong structural induction, but our approach also supports other data types and serves as a basis for our other main contributions, i.e. explicit (heuristic) control of where to apply induction and strengthenings for complex conjectures.

A proof of an inductive conjecture might require additional lemmas, which typically are not directly obvious from the axioms and the conjecture. Automatically deriving useful lemmas is crucial to any serious automation of induction [START_REF] Comon | Inductionless induction[END_REF]. Lemma generation is in principle a variation of the naive idea of enumerating all possible propositions (e.g. by enumerating all formulas). Conjecture strengthening considers only those lemmas that are immediately useful to prove an unproven conjecture. Generalization is an instance of strengthening that is widely used and applicable to arbitrary first-order conjectures [START_REF] Chamarthi | The ACL2 sedan theorem proving system[END_REF][START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF][START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF]. We contributed two other strengthening methods which we believe can be incorporated by most other approaches. Another avenue is to consider all properties that can be guessed from the (initial) problem. One such tool is HipSpec which integrates QuickSpec to compute equalities from terms constructed by declared functions by integrating testing [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF]. Those equalities that remain are then proposed as possible lemmas and processed by the inductive prover. CVC4 also includes such a lemma generation module. It is also restricted to (unconditional) equational lemmas.

Since additional lemmas must be proposed and many of the guesses might not be theorems, it is important to purge non-theorems. For explicit superposition based methods it is sufficient to show that the negated conjecture is reduced to the axioms to detect a non-theorem. Saturation itself is not sufficient, because it only shows that the theorem is not a first-order consequence of the axioms. CVC4 uses (syntactic) rule-based filtering of proposed lemmas augmented by instantiation-based testing. Despite the clear benefits of removing non-theorems, surprisingly little research has been published on this.

To evaluate our approach, we use two induction benchmarks. The evaluation results are available under http://people.mpi-inf.mpg.de/ ~dwand/thesis/

The first benchmark was originally used to evaluate IsaPlanner [START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF]. In its original form it consists of 87 problems, one of which is not a theorem. We process the problems individually, meaning that we are not reusing results from previous proof attempts. For each problem, we only include the relevant function definitions as axioms. We report the results published for this benchmark for IsaPlanner [START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF], Zeno [START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF], HipSpec [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF], Dafny [START_REF] Leino | Automating induction with an SMT solver[END_REF], ACL2s [START_REF] Chamarthi | The ACL2 sedan theorem proving system[END_REF] (as evaluated by Zeno in [START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF]) and CVC4 [START_REF] Reynolds | Induction for SMT solvers[END_REF]. We ran our tool, Pirate, with a single setting on a Xeon E5-2643 3.5 GHz within a Java 8 VM with 80 gigabytes of heapspace and used a timeout of 300 seconds. Pirate completed 83 problems within 10 seconds and 4 problems took up to 200 seconds. Our tool is the only one that can solve the complete benchmark. Even though Zeno reports that the benchmark has only 85 provable problems [START_REF] Sonnex | Zeno: An automated prover for properties of recursive data structures[END_REF] and Hip-Spec also only uses those [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF], we can prove 86 problems and find a counterexample for the remaining one, which we also count as success. The counterexample is for the 87th problem:

Zeno

minus(minus(X, Y), Z) ≈ minus(X, minus(Y, Z)) and is detected by repeated induction steps until X and Z are instantiated to s(0 ) and Y to 0 . The lost (86th) problem is The other tools either lack support for conditional theorems (HipSpec), do not propose conditional lemmas (IsaPlanner, CVC4), do not support negation (Zeno) or cannot perform nested inductions (Dafny). In our approach there is no fundamental difference between a single literal conjecture or a complex one with multiple clauses. Many problems from the IsaPlanner benchmark are relatively easy: HipSpec can prove 67 theorems by induction without generating lemmas, whereas we can solve 73 problems the same way. This includes problem 50 (see Sect. A.1.1 for the full problem and proof output): butlast(Xs) ≈ take(minus(len(Xs), s(0 )), Xs) Neither HipSpec, ACL2s, IsaPlanner nor Dafny can prove it.

X < Y → (element(X, insert(Y, Xs)) ↔ element(X, Xs)) which is provable since X is different from Y if X is
The second benchmark set was used by CLAM [START_REF] Ireland | Productive use of failure in inductive proof[END_REF] to evaluate its proof-critics. For a large fraction, 20 of 50 theorems, we find proofs without generating any additional lemmas. A portfolio version of Pirate combining several settings is the most successful on this benchmark. The single most successful setting for Pirate is the one where all features are enabled. There are four main settings for Pirate: The portfolio uses three settings:

• the one where all features are enabled (42 problems),

• one where Skolems are not turned into variables in the induction's CNF translation and initially no properties are guessed (+3 problems) and • one where term-dependency generalization is disabled (+2 problems)

For this benchmark we used a timeout of 2 hours. Pirate completed 34 problems within 1 minute, further 7 within 400 seconds and one problem took 50 minutes. We again report the published numbers in the literature [START_REF] Claessen | Automating inductive proofs using theory exploration[END_REF][START_REF] Ireland | Productive use of failure in inductive proof[END_REF][START_REF] Reynolds | Induction for SMT solvers[END_REF] IsaPlanner and Zeno can certify their proofs with Isabelle. HipSpec and Dafny do not appear to have a detailed proof output. Pirate generates proofs including all first-order reasoning and induction steps. Isabelle's Sledgehammer [START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF] has support for replaying our first-order steps in Isabelle. We are also interested in integrating into other tools as well, e.g., program verifiers such as Why3 [START_REF] Bobot | Why3: Shepherd your herd of provers[END_REF]. Currently, there is a focus on creating and extending a new benchmark set called "tons of inductive problems" (TIP) [START_REF] Rosén | Tons of inductive problems[END_REF]. TIP was officially started at the second workshop for automated induction theorem-proving (WAIT 2015). It currently mainly contains the IsaPlanner and CLAM benchmark and some new benchmark problems. We plan on supporting the TIP format, which is based on the SMT-LIB format [START_REF] Barrett | The SMT-LIB Standard: Version 2[END_REF]. There are some open problems to solve, e.g. the SMTtheories have to be integrated into our superposition based solver. Our current focus is a stronger integration into Isabelle. In particular, support for arbitrary induction schemata and automatic proof reconstruction by Sledgehammer.

Conclusion

In the (mechanized) theorem proving community there are two main fields, the automated theorem provers and the proof assistants. Automated theorem provers for first-order logic, like those based on the superposition calculus, provide full, push button, automation. Proof assistants, e.g. for higher-order logic (HOL), like Isabelle/HOL, lack this automation. But they provide abstractions, e.g. type systems, that make them convenient to use for humans. It is generally known in the higher-order research community that no proof assistant can be complete with respect to the standard semantics of HOL. That completeness is only possible for the Henkin semantics [START_REF] Henkin | Completeness in the theory of types[END_REF]. The Henkin semantics restricts the function types in such a way that the logic becomes compact and thus refutational completeness is possible. Furthermore, it seems that tools (and humans) do not construct or find proofs that are possible in the standard semantics, but are not available with the Henkin semantics. Higher order logic, interpreted with the Henkin semantics, can be encoded into first-order logic, in a complete fashion. This motivates an overall research program that attempts to build an automated theorem prover for higher-order logic, by directly supporting the abstractions of proof assistants in an automated theorem prover, instead of encoding them. This thesis presented one step of this research program by making induction and a polymorphic type system with type classes available for superposition in an efficient manner. It thereby enables automated theorem provers that share more features with proof assistants, further closing the gap between the two fields. I presented a superposition calculus, including all necessary machinery (such as unification and orderings), that incorporates a polymorphic type system extended with type classes. I have shown the polymorphic superposition calculus to be refutationally complete. The only and minor restriction over the untyped calculus is that the typed calculus requires a simplification ordering instead of a reduction ordering that is total on ground terms. This change is caused by the fact that there can now be typed terms that do not share any context. In practice, this is negligible, because the widely used orderings for superposition are simplification orderings, for example both KBO and LPO, are simplification orderings. The polymorphic type system extended with type classes removes all type system related encoding overhead for the HOL family of proof assistants. I have also shown that the presented type system is competitive with monomorphization, especially for larger fact sizes. Monomorphization is generally considered to be an efficient native type encoding. The evaluation shows that the polymorphic type system extended with type classes requires, in average, less time and fewer inferences than the monomorphic and the other type encodings.

I introduced an extension of the typed first-order logic with data types and the SupInd calculus which combines strong structural induction and superposition. An implementation and an evaluation on a set of benchmarks has promising results. To make the SupInd calculus efficient, I developed a heuristic which guides the application of the induction inference into promising directions. This heuristic is complemented by a novel technique that mitigates irrelevant (nested) induction steps, based on the analysis of (partial) proofs. I have shown heuristics on how to generate propositions to discover useful auxiliary lemmas. In contrast to other tools, the heuristics also work in the full (clausal) first-order setting. The heuristics include a novel preprocessing step to the well established generalization. Furthermore, I introduced term-dependency based generalization which discovers stronger generalizations and useful propositions from the required side conditions. My final heuristic to generate auxiliary lemmas is based on the use of an upper bound and is targeted to conjectures that use orderings. I have also presented an optimized variant of SupInd that reduces the number of inference steps that are necessary. The integration between superposition and inductive reasoning also enables the discovery and removal of invalid propositions, which allows us to disprove conjectures. This combination of redundancy and nested induction, without guessing lemmas, is already capable of proving conjectures many other tools struggle with. This is also shown by the promising benchmark results.

Future Work Directions

This thesis provided one step on bridging the gap between proof assistants and automated theorem provers by providing a type system and support for induction over data type. However, there are other areas of research that remain to be explored until this gap is fully closed.

One such area is the encoding of features of higher-order logic. While implementing the type system has removed one of the encoding phases, the encoding of higher-order features into first-order still remains. This includes encoding λ as combinators, in order to simulate higher-order unification. A superposition calculus that directly supports λ would be interesting. Support for curried functions, e.g. native support for partial applications of functions, would also help efficiency. High-order logic does not differentiate between terms and formulas. While the distinction between those are crucial for superposition, better encodings for boolean connectives and formulas could also help.

Furthermore, the type system could be extended. I have shown refutational completeness for superposition with a polymorphic type system extended by type classes. This type system is sufficient for the HOL family of proof assistants. Supporting dependent type theory would help improve automation for proof assistants such as Coq and Lean and possibly for programming languages such as Scala. A reasonable first step could be support for path-dependent types, like those features in the DOT calculus [START_REF] Amin | The essence of dependent object types[END_REF], the underlying and formal description of (a simplified) Scala. Path-dependent types are types that can express (object-oriented) type hierarchies. They strictly subsume polymorphism, but I expect that an approach similar to the one presented here would work for them.

Moving the relevance filtering from the proof assistant to the automated theorem prover by providing all theorems and all open conjectures to the automated theorem prover, could enable the automated theorem prover to do potentially a better job. It would also enable it to preprocess the axioms. This could enable a cooperation between proof assistant and automated theorem prover where automated theorem provers spend significant amounts of time processing the axioms without the user being required to wait on the automated prover. In the current setting the user formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ L : A, LS : l i s t (A) ] ,

e q u a l : l r ( l e n <A>( cons<A>(L , LS ) ) s ( l e n <A>(LS ) ) ) ) ) , l e n c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) ] , e q u a l : l r ( append<A>( n i l <A>,LS ) , LS ) ) ) , a p p e n d n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) ,Y : A, YS : l i s t (A) ] ,

e q u a l : l r ( append<A>( cons<A>(Y, YS ) , LS ) , cons<A>(Y, append<A>(YS , LS ) ) ) ) ) , a p p e n d c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , e q u a l : l r ( b u t l a s t <A>( n i l <A>) , n i l <A>) ) , b u t l a s t n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A] ,

e q u a l : l r ( b u t l a s t <A>( cons<A>(X, n i l <A>) ) , n i l <A>) ) ) , b u t l a s t c o n s n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, Y : A, LS : l i s t (A) ] ,

e q u a l : l r ( b u t l a s t <A>( cons<A>(X, cons<A>(Y, LS ) ) ) , cons<A>(X, b u t l a s t <A>( cons<A>(Y, LS ) ) ) ) ) ) , b u t l a s t c o n s c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ XS : l i s t (A) ] , e q u a l : l r ( t a k e <A>(z , XS ) , n i l <A>) ) ) , f a c t t a k e d e f z ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : n a t , XS : l i s t (A) ] ,

e q u a l : l r ( t a k e <A>(X, n i l <A>) , n i l <A>) ) ) , f a c t t a k e d e f n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : n a t , Y : A, YS : l i s t (A) ] ,

e q u a l : l r ( t a k e <A>( s (X) , cons<A>(Y, YS ) ) , cons<A>(Y, t a k e <A>(X, YS ) ) ) ) ) , f a c t t a k e d e f c o n s ) . e n d o f l i s t .

Output

The boxed parts are the unedited output of Pirate (except for adding bold for keywords). Pirate was using only induction, i.e. no strengthenings. f u n c t i o n ( z , n a t ) . f u n c t i o n ( s , ( n a t ) n a t ) . f u n c t i o n ( append , [A] , ( l i s t (A) , l i s t (A) ) l i s t (A) ) . f u n c t i o n ( r e v , [A] , ( l i s t (A) ) l i s t (A) ) . f u n c t i o n ( z i p , [A, B ] , ( l i s t (A) , l i s t ( B ) ) l i s t ( p a i r (A, B ) ) ) . f u n c t i o n ( l e n , [A] , ( l i s t (A) ) n a t ) .

p r e d i c a t e ( l e s s , [A] , A, A) . d a t a t y p e ( p a i r , p ) . d a t a t y p e ( n a t , z , s ) . d a t a t y p e ( l i s t , n i l , c o n s ) . e n d o f l i s t .

l i s t o f f o r m u l a e ( a x i o m s ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) ] ,
e q u a l : l r ( append<A>( n i l <A>,LS ) , LS ) ) ) , a p p e n d n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) , Y : A, YS : l i s t (A) ] ,

e q u a l : l r ( append<A>( cons<A>(Y, YS ) , LS ) , cons<A>(Y, append<A>(YS , LS ) ) ) ) ) , a p p e n d c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , e q u a l : l r ( r e v<A>( n i l <A>) , n i l <A>) ) , r e v n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ Y : A, YS : l i s t (A) ] ,

e q u a l : l r ( r e v<A>( cons<A>(Y, YS ) ) , append<A>( r e v<A>(YS ) , cons<A>(Y, n i l <A>) ) ) ) ) , r e v c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , e q u a l : l r ( l e n <A>( n i l <A>) , z ) ) , l e n n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ L : A, LS : l i s t (A) ] ,

e q u a l : l r ( l e n <A>( cons<A>(L , LS ) ) , s ( l e n <A>(LS ) ) ) ) ) , l e n c o n s ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ XS : l i s t (A) ] , e q u a l : l r ( z i p <A, A>(XS , n i l <A>) , n i l <p a i r (A, A) >) ) ) , z i p n i l r i g h t ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ YS : l i s t (A) ] ,

e q u a l : l r ( z i p <A, A>( n i l <A>,YS ) , n i l <p a i r (A, A) >) ) ) , z i p n i l l e f t ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, XS : l i s t (A) , Y : A, YS : l i s t (A) ] , e q u a l : l r ( z i p <A, A>( cons<A>(X, XS ) , cons<A>(Y, YS ) ) , cons<p a i r (A, A) >(p<A, A>(X, Y) , z i p <A, A>(XS , YS ) ) ) ) ) , z i p c o n s ) . e n d o f l i s t .

k f 2 , 7DD03 ) ) A5244 -00170 ( 1 ) {} | | n i l = n i l -> . o r i g i n ( Rew ( 3 6DB6 w i t h S e t [ 7 1DCE, 4622A ] ) ) DEAD1-00171 ( 1 ) {} | | -> . o r i g i n ( L i t E l i m F ( A5244 ) ) A4424 -00172 ( 1 ) {} | | z i p ( r e v ( s k f 1 ) , r e v ( c o n s ( i 1 0 0 1 , i 1 0 0 2 ) ) ) = r e v ( z i p ( s k f 1 , c o n s ( i 1 0 0 1 , i 1 0 0 2 ) ) ) -> . o r i g i n ( I n d C a s e ( cons , s k f 2 , 7DD03 ) ) CC891-00173 ( 1 ) {} | | -> l e n ( s k f 1 ) = l e n ( c o n s ( i 1 0 0 1 , i 1 0 0 2 ) ) . o r i g i n ( I n d C a s e ( cons , s k f 2 , 8A2C7 ) ) F27CB-00176 ( 1 ) {} | | z i p ( r e v ( s k f 1 ) , a p p e n d ( r e v ( i 1 0 0 2 ) , c o n s ( i 1 0 0 1 , n i l ) ) ) = r e v ( z i p ( s k f 1 , c o n s ( i 1 0 0 1 , i 1 0 0 2 ) ) ) -> . o r i g i n ( Rew ( A4424 w i t h S e t [ 7 4 5AD] ) ) FCB76-00177 ( 1 ) {} | | -> l e n ( s k f 1 ) = s ( l e n ( i 1 0 0 2 ) ) . o r i g i n ( Rew ( CC891 w i t h S e t [ E1EC9 ] ) ) 8 F158 -00307 ( 1 ) {} | | -> l e n ( n i l ) = s ( l e n ( i 1 0 0 2 ) ) . o r i g i n ( I n d C a s e ( n i l , s k f 1 , FCB76 ) ) 84A5B-00311 ( 1 ) {} | | -> z = s ( l e n ( i 1 0 0 2 ) ) . o r i g i n ( Rew ( 8 F158 w i t h S e t [ B7230 ] ) ) CD288-00312 ( 1 ) {} | | -> . o r i g i n (DT-D i s t i n c t ( 8

f u n c t i o n ( n i l , [A] , l i s t (A) ) . f u n c t i o n ( cons ,

[A] , (A, l i s t (A) ) l i s t (A) ) .

f u n c t i o n ( i n s , [A] , (A, l i s t (A) ) l i s t (A) ) .

p r e d i c a t e ( l e s s , [A] , A, A) .

p r e d i c a t e ( elem , [A] , A, l i s t (A) ) .

d a t a t y p e ( n a t , z , s ) . d a t a t y p e ( l i s t , n i l , c o n s ) . e n d o f l i s t .

l i s t o f f o r m u l a e ( a x i o m s ) . formula ( f o r a l l ( [ X : n a t ] , n o t ( l e s s <n a t >(X, z ) ) ) , l e s s z r i g h t ) . formula ( f o r a l l ( [ X : n a t ] , l e s s <n a t >(z , s (X) ) ) , l e s s z l e f t ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u i v : l r ( l e s s <n a t >( s (X) , s (Y) ) , l e s s <n a t >(X, Y) ) ) , l e s s z ) .

formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, LS : l i s t (A) ] , n o t ( elem<A>(X, n i l <A>) ) ) ) , e l e m n i l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, L : A, LS : l i s t (A) ] ,

i m p l i e s ( e q u a l : l r (X, L ) , elem<A>(X, cons<A>(L , LS ) ) ) ) ) , e l e m c o n s e q u a l ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, L : A, LS : l i s t (A) ] ,

i m p l i e s ( n o t ( e q u a l : l r (X, L ) ) , e q u i v : l r ( elem<A>(X, cons<A>(L , LS ) ) , elem<A>(X, LS ) ) ) ) ) , e l e m c o n s n o t e q u a l ) .

formula ( f o r a l l ( [ X : n a t ] , e q u a l : l r ( i n s <n a t >(X, n i l <n a t >) , cons<n a t >(X, n i l <n a t >) ) ) , i n s n i l ) . formula ( f o r a l l ( [ X : n a t , Y : n a t , YS : l i s t ( n a t ) ] ,

i m p l i e s ( l e s s <n a t >(X, Y) , e q u a l : l r ( i n s <n a t >(X, cons<n a t >(Y, YS ) ) , cons<n a t >(X, cons<n a t >(Y, YS ) ) ) ) ) , i n s l e s s ) . formula ( f o r a l l ( [ X : n a t , Y : n a t , YS : l i s t ( n a t ) ] ,

i m p l i e s ( n o t ( l e s s <n a t >(X, Y) ) , e q u a l : l r ( i n s <n a t >(X, cons<n a t >(Y, YS ) ) , cons<n a t >(Y, i n s <n a t >(X, YS ) ) ) ) ) , i n s n o t l e s s ) . e n d o f l i s t . l i s t o f f o r m u l a e ( c o n j e c t u r e s ) . formula ( f o r a l l ( [ X : n a t , Y : n a t , LS : l i s t ( n a t ) ] ,

i m p l i e s ( l e s s <n a t >(X, Y) , e q u i v ( elem<n a t >(X, i n s <n a t >(Y, LS ) ) , elem<n a t >(X, LS ) ) ) ) , c o n j 8 6 ) . e n d o f l i s t . end problem .

Output

The boxed parts are the unedited output of Pirate (except for adding bold for keywords). o r i g i n ( C o n t r a d i c t i n g S e t ( 5 1 1 EF , B9A26 , 88A75 ) and S e t ( E3E4C ) ) ) 00AE6-06196 ( ) {} | | l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) -> elem ( s k f 1 , c o n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) .

o r i g i n ( Sup ( FED48 by 8B37E ) ) BBA64-06198 ( ) {} | | elem ( s k f 1 , c o n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) l e s s ( s ( i 1 0 0 3 ) , i 0 0 6 ) -> .

o r i g i n ( Sup ( 0 FE6E by 8B37E ) ) B288B-06419 ( ) {} | | -> elem ( s k f 1 , c o n s ( i 1 0 0 6 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) l e s s ( s ( i 1 0 0 3 ) , i 0 0 6 ) .

o r i g i n ( Sup ( FED48 by 7B2F6 ) ) 4A957 -06421 ( ) {} | | elem ( s k f 1 , c o n s ( i 1 0 0 6 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) .

o r i g i n ( Sup ( 0 FE6E by 7B2F6 ) ) 88FD4-06584 ( ) {} | | elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> l e s s ( s ( i 1 0 0 3 ) , i 0 0 6 ) s k f 1 = i 1 0 0 6 . o r i g i n ( Res ( 4 A957 ,-5C661 ) ) 5B066 -06727 ( ) {} | | elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) -> s k f 1 = s ( i 1 0 0 3 ) . l i s t o f d e c l a r a t i o n s . f u n c t i o n ( minus , ( n a t , n a t ) n a t ) . d a t a t y p e ( n a t , z , s ) . e n d o f l i s t . l i s t o f f o r m u l a e ( a x i o m s ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus ( z , Y) , z ) ) , m i n u s z l e f t ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus (X, z ) , X) ) , m i n u s z r i g h t ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus ( s (X) , s (Y) ) , minus (X, Y) ) ) , m i n u s s ) . e n d o f l i s t . l i s t o f f o r m u l a e ( c o n j e c t u r e s ) . formula ( f o r a l l ( [ Y : n a t , X : n a t , Z : n a t ] , e q u a l ( minus ( minus (X, Y) , Z ) , minus (X, minus (Y, Z ) ) ) ) , c o n j 8 7 ) . e n d o f l i s t . end problem .

Output

The boxed parts are the unedited output of Pirate (except for adding bold for keywords). S t a r t i n g s c a l a v e r s i o n 2 . 1 1 . 2

Definition 2 . 1 . 2 . 1 (

 2121 Structure). A Σ-structure is a tuple (U, I F , I P ), where • U = / 0 is the universe, a non-empty set • I F is the set of functions f I : U m → U for each function symbol f ∈ S F , with arity( f ) = m • I P is the set of predicates p I : U m → {0, 1} for each predicate symbol p ∈ S P , with arity(p) = m I will use e for elements of U.

Lemma 2 . 2 . 4 . 1 .Lemma 2 . 2 . 4 . 2 .

 22412242 s is irreducible with respect to R C and 7. no negative literal is selected in C . In this case, C is called productive. Otherwise E C = / 0. Finally, R ∞ = D∈G Σ (N) E D . If E C = {s → t} and E D = {u → v}, then s u if and only if C c D. The rewrite systems R C and R ∞ are convergent (i.e. confluent and terminating).

Corollary 2 . 2 . 4 . 3 .

 2243 If D ∈ G Σ (N) is true in R D , then D is true in R ∞ and R C for all C c D. Corollary 2.2.4.4. If D = D ∨ u ≈ v is productive, then D is false and D is true in R ∞ and R C for all C c D.

Theorem 3 . 1 . 3 . 11 (

 31311 Unification Preserves Unifier).

Definition 3 . 1 . 4 . 1 (

 3141 Structure). Given a signature Σ for polymorphic first-order language with type classes, the corresponding Σ-structure is a tuple Σ = (U, D, I T , I F , I P ) where

Definition 3 . 1 . 4 . 8 (

 3148 Increasing Function [62]). A function f , A → A, is increasing if for any two elements a, b ∈ A it holds that a ≤ b implies f (a) ≤ f (b).

2 .

 2 type var, i.e. α : {k}. Then by the definition of the type var typing rule α has the type-class constraint K such that k ∈ K. The interpretation of α is I(α) = θ(α) and θ(α) is bound by the semantic of the type quantification of α to a domain d ∈ I(K).

Corollary 3 . 1 . 4 . 14 (

 31414 Type-Class Constraint Interpretations are the Union of Ground Type Term Interpretations). The interpretation of a type-class constraint K = / 0 is the union of the interpretations of its ground type terms: I(K) = {I(τ) | τ : K and τ is ground}.Proof. Follows from Lemmas 3.1.4.13 and 3.1.4.11.

Figure 3 . 1 .

 31 Figure 3.1.: Success rate and scalability of each type encoding

Figure 3 .

 3 Figure 3.1 shows the success rate and scalability of the tested encodings. The horizontal axis denotes the number of facts in logarithmic scale and the vertical axis the percentage of problems proved in a single run of up to one hour.The native monomorphic and the native type class encodings are clearly superior to the encodings into untyped first-order logic. From 16 until 512 facts, the monomorphic encoding has the highest success rate and the type class encoding the second highest success rate. From 1024 to 4096 facts, the type class encoding has the highest success rate and the monomorphic encoding the second highest success rate -except for 4096 facts, where the poly native encoding is the second best and the monomorphic encoding only third. The encoding into untyped first-order logic with the highest success rate for 16, 128 and 256 facts is the light poly tags encoding; for the other fact sizes it is the light poly guards encoding.The number of facts determines the success rate. With few facts, many problems do not have

Figure 3 . 3 .

 33 Figure 3.3.: Average number of main loop iterations per proof

Figure 3 . 4 .

 34 Figure 3.4.: Stability of the type encodings 16 facts, hundreds of saturation can be found. Whereas larger fact sizes overwhelm the solver by increasing the search space and making proofs found in smaller problems harder to find.

Figure 3 . 8 .

 38 Figure 3.8.: Average time until proof: Type Classes versus Monomorphic

Figure 3 .

 3 Figure 3.10.: Completeness proof

  Definition 3.5.1.6 ((Term Substitutions). Substitutions are extended to non-variable terms by

Lemma 3 .

 3 5.1.11 (Type-Symbol Unification Terminates). Applying unification on ({t 1 . = t 2 }; / 0) always terminates.

Lemma 3 .

 3 5.1.21 (Bijection of tv).

  2. a) (s ≈ s )σ maximal in (C ∨ s ≈ s )σ and no literal is selected or b) s ≈ s is the selected literal.

Lemma 3 . 5 . 2 . 3 (

 3523 Lifting Lemma for the Superposition Inferences). Let C = C ∨ s ≈ s and D = D ∨ t ≈ t be two clauses without common variables and let θ be a substitution such that Cθ and Dθ are ground type-symbol first-order logic. If there is a superposition inference between Cθ and Dθ where sθ and some subterm of tθ are overlapped and sθ does not occur in tθ at or below a variable position of t, then the inference is an instance of a superposition inference from C and D.

I

  reuse the polymorphic semantics without changes (Sect. 3.1.4). The definition of a structure is given in Definition 3.1.4.1. Due to the restricted syntax, the rules concerning type variables (first rule of Def. 3.1.4.2), type classes (Def. 3.1.4.5) and type-class constraints (Def. 3.1.4.4) cannot apply.

Lemma 3 . 5 . 3 . 3 (

 3533 Unifiers are Preserved by Translation).The translation tv preserves unifier: tv(t{u 1 → s 1 , . . . }) = tv(t){tv(u 1 ) → tv(s 1 ), . . . }.

Lemma 3 . 5 . 4 . 5 (

 3545 Lifting). Let N be a set of clauses. Then ⊥ ∈ Sup * (G τ Σ (N)) implies ⊥ ∈ Sup * (N).Proof. Because of the lifting lemmas (Lemma 3.5.4.3 and 3.5.4.4), each step of the monomorphic proof (in Sup * (G τ Σ (N))) is mirrored in the polymorphic clause set (Sup * (N)). Lemma 3.5.4.6 (Model Lifting). Let N be a countable set of clauses. Then I G τ Σ (N) implies I N. Proof. The lemma holds if it holds for the individual clauses C ∈ N. The proof is by induction over the number of type variables I show I G τ Σ (C) implies I C. • If C does not contain any type variables, then C ∈ G τ Σ (C) and thus I C. • Otherwise, let α be a type variable occurring in C, i.e. C = ∀ τ α : K. C and let K = / 0. Because I G τ Σ (C) and by induction hypothesis we know that I C {α → τ} for all ground instances τ of α. From Corollary 3.1.4.14, we know that I(K) = {I(τ) | τ : K and τ is ground}, i.e. the interpretation of a type-class constraint is exactly the union of the interpretations of the ground type terms that are in that type-class constraint. Thus min d∈I(K) (I / 0[α→d], / 0 (C )) = 1 and therefore I C. • Finally, let α be a type variable occurring in C, i.e. C = ∀ τ α : K. C and let K = / 0. Because I G τ Σ (C) and by induction hypothesis we know that I C {α → τ} for all ground instances τ of α, which are all possible ground terms (because K = / 0). If there is a domain d ∈ D such that the is no ground type term τ such that I / 0 (τ) = d, then the interpretation is still a model with the set of domains replaced by D = D\{d}. With D , the interpretation of the ground instances of α is an interpretation of all its domains and thus I C.

Definition 4 . 2 . 1 . 3 (

 4213 Semantic Restriction of Data Types). For each data type declaration (τ, f 1 [τ 1 1 , . . . , τ m 1 ], . . . , f n [τ 1 n , . . . , τ m n ]) ∈ DT , for each instance τθ of τ and for each d ∈ I(τθ)

  ) and (N C ) (b) z ≈ (x+y) + z using (3) and (a) (c) z ≈ y + z using (3) and (b) (d) z ≈ z using (4) and (c) (e) ⊥ using (d) A first-order reasoning step (e.g. (b)) depends on another step (e.g. (a)) if step (b) uses a clause whose derivation involves step (a).

  e. where n = s(n ), xs = cons(x , xs ) and n = s(n ), xs = cons(x , xs ) and so on: len(drop(n, xs)) ≤ len(xs) len(drop(n , xs )) ≤ s(len(xs )) len(drop(n , xs )) ≤ s(s(len(xs ))) . . . and the corresponding induction hypotheses: len(drop(n , xs )) ≤ len(xs ) len(drop(n , xs )) ≤ len(xs ) . . . Every (combined) induction step on n and xs leads to another constructor (s) accumulating in a non-generalizable position on the right-hand side of the ≤ predicate. The nested inductions are futile because the constructor-sink function prevents the application of the induction hypothesis by removing the constructors from left-hand side of the conjecture.

2 .

 2 gcd(N, M) ≈ gcd(M, N) → {1, 2} because N c-subterm of N and M c-subterm of M gcd(N, M) ≈ gcd(N -M, M) → {1, 2} because N -M has the cap subterm N which is a c-subterm of N and M is a c-subterm of M

Theorem 4 . 5 . 2 . 1 (

 4521 Invalid Conjecture).If the negated conjecture clause set N C of a simple state is empty then the corresponding conjecture is invalid.

Algorithm 2 :

 2 Structural Induction Input: N A axioms, N H hypotheses, N C conjectures, 1 c := analyze(N A , N H , N C ); /* Sect. 4.3 */ 2 cases := new &-state; 3 foreach constructor f of the data type of c do 4 let c 1 , . . . , c n be fresh Skolem constants such that f (c 1 ,. . . ,c n ) is well-typed; 5 foreach c i of the same data type as c do 6 N H := unnegate(N C [c → c i ]) and clausify;

7

 7

b e g i

  n p r o b l e m ( benchmark ) .

l i s t

  o f d e s c r i p t i o n s . name ( { * * } ) . a u t h o r ( { * * } ) . s t a t u s ( unknown ) . d e s c r i p t i o n ( { * * } ) . e n d o f l i s t .

  l i s t o f s y m b o l s . f u n c t i o n s [ ( n i l , 1 + 0 ) , ( cons , 1 + 2 ) , ( z , 0 ) , ( s , 1 ) , ( append , 1 + 2 ) , ( c o u n t , 1 + 2 ) ] . p r e d i c a t e s [ ( l e s s , 1 + 2 ) ] . s o r t s [ ( l i s t , 1 ) , ( n a t , 0 ) ] . e n d o f l i s t .

  l i s t o f d e c l a r a t i o n s . f u n c t i o n ( n i l ,

  l i s t o f f o r m u l a e ( a x i o m s ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ LS : l i s t (A) ] ,

  l i s t o f f o r m u l a e ( c o n j e c t u r e s ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, XS : l i s t (A) ] ,

I

  n i t i a l C o n j e c t u r e s : : FB832 -00007 ( 1 ) {} | | c o u n t ( s k f 1 , a p p e n d ( s k f 2 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , s k f 2 ) ) -> . o r i g i n ( Conj ( c o n j p r o p 3 8 from : S e t ( B94AA ) ) )

@ 233 @

 233 head ( 1 r a n k : 10 ) : C a s e P r o o f T a s k -TID : 4 ( p a r e n t TID : 3 , D e r i v e C a s e ( -> a p p e n d ( V2 , n i l ) = V2 . ) ) Welcoming new knowledge : : 5A0D0-00105 ( 1 0 0 0 ) {} | | -> a p p e n d ( V2 , n i l ) l r => V2 * . o r i g i n ( D e r i v e d ( E60F3 ) ) @ 326 @head ( 0 r a n k : 12 ) : C a s e P r o o f T a s k -TID : 6 ( p a r e n t TID : 5 , I n i t i a l )

Found f a l

  s e Formulas used : c o n j p r o p 3 8 c o u n t c o n s e q u a l a p p e n d n i l c o u n t n i l a p p e n d c o n s c o u n t c o n s n o t e q u a l

I n v o

  l v e d c l a u s e s : B94AA-00001 ( 1 0 0 0 ) {} | | -> c o u n t ( V2 , a p p e n d ( V4 , c o n s ( V2 , n i l ) ) ) = s ( c o u n t ( V2 , V4 ) ) . o r i g i n ( I n p u t ( c o n j p r o p 3 8 ) ) 6E897 -00002 ( 1 0 0 0 ) {} | | -> a p p e n d ( n i l , V2 ) = V2 . o r i g i n ( I n p u t ( a p p e n d n i l ) ) 761AF-00003 ( 1 0 0 0 ) {} | | -> a p p e n d ( c o n s ( V2 , V4 ) , V6 ) = c o n s ( V2 , a p p e n d ( V4 , V6 ) ) . o r i g i n ( I n p u t ( a p p e n d c o n s ) ) CE930 -00004 ( 1 0 0 0 ) {} | | -> c o u n t ( V2 , n i l ) = z . o r i g i n ( I n p u t ( c o u n t n i l ) ) E3A4E-00005 ( 1 0 0 0 ) {} | | V2 = V4 -> c o u n t ( V2 , c o n s ( V4 , V6 ) ) = s ( c o u n t ( V2 , V6 ) ) .

BC7A5-00153 ( 1 )

 1 {} | | -> c o u n t ( s k f 1 , a p p e n d ( s k f 2 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , s k f 2 ) ) .o r i g i n ( N e g a t e ( S e t ( FB832 ) ) )

88 E01 -00156 ( 1 )

 1 {} | | c o u n t ( s k f 1 , a p p e n d ( n i l , c o n s

47 F39

 47 -00163 ( ) {} | | c o u n t ( s k f 1 , a p p e n d ( c o n s ( i 1 0 0 3 , i 1 0 0 4 ) , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , i 1 0 0 4 ) ) ) -> . o r i g i n ( I n d C a s e ( cons , s k f 2 , FB832 ) ) 0A9F1-00165 ( ) {} | | -> c o u n t ( s k f 1 , a p p e n d ( i 1 0 0 4 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , i 1 0 0 4 ) ) . o r i g i n ( IndHyp ( s k f 2 , c o n s : BC7A5 ) ) 4E4C2-00166 ( ) {} | | c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , a p p e n d ( i 1 0 0 4 , c o n s ( s k f 1 , n i l ) ) ) ) = s ( c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , i 1 0 0 4 ) ) ) -> . o r i g i n ( Rew ( 4 7 F39 w i t h S e t [ 7 6 1AF ] ) ) 7D761 -00174 ( ) {} | | c o u n t ( s k f 1 , a p p e n d ( i 1 0 0 4 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , i 1 0 0 4 ) ) ) -> s k f 1 = i 1 0 0 3 . o r i g i n ( Sup ( 4 E4C2 by 0CF07 ) ) 3E9A2-00177 ( ) {} | | s ( c o u n t ( s k f 1 , i 1 0 0 4 ) ) = s ( c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , i 1 0 0 4 ) ) ) -> s k f 1 = i 1 0 0 3 . o r i g i n ( Rew ( 7 D761 w i t h S e t [ 0 A9F1 ] ) ) 3EA25-00186 ( ) {} | | c o u n t ( s k f 1 , i 1 0 0 4 ) = c o u n t ( s k f 1 , c o n s ( i 1 0 0 3 , i 1 0 0 4 ) ) -> s k f 1 = i 1 0 0 3 . o r i g i n (DT-I n j e c t i v e ( 3 E9A2 )

  EF4 ) ) E7E00 -00255 ( ) {} | | s ( c o u n t ( s k f 1 , a p p e n d ( i 1 0 0 4 , c o n s ( s k f 1 , n i l ) ) ) ) = s ( s ( c o u n t ( s k f 1 , i 1 0 0 4 ) ) ) -> . o r i g i n ( Rew ( 4 E4C2 w i t h S e t [ 3 7 EF4 , 96D58 ] ) ) D6027 -00261 ( ) {} | | c o u n t ( s k f 1 , a p p e n d ( i 1 0 0 4 , c o n s ( s k f 1 , n i l ) ) ) = s ( c o u n t ( s k f 1 , i 1 0 0 4 ) ) -> . o r i g i n (DT-I n j e c t i v e ( E7E00 ) ) 603D8-00262 ( ) {} | | -> . o r i g i n (MRR( D6027 ,-0A9F1 ) )

F8DD1- 00263

 00263 ( ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ c o n s by 603D8 , n i l by BB8E7 ] ) ) B94AA-00264 ( 1 0 ) {} | | -> c o u n t ( V2 , a p p e n d ( V4 , c o n s ( V2 , n i l ) ) ) = s ( c o u n t ( V2 , V4 ) ) . o r i g i n ( D e r i v e d ( F8DD1 ) ) 72304 -00265 ( ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( FB832 ) and S e t ( B94AA ) ) ) I n v o l v e d c l a u s e s : 29 T o t a l t i m e : 2 . 5 1 7 4 1 4 3 1 4 s

1 .

 1 Transformation of Skolems into variables in the Structural Induction rule (Sect. 4.2.2) 2. The use of the Skolem selection heuristic (Sect. 4.3) 3. Use of the (term-dependency preserving) generalization (Sect. 4.4.1 and 4.4.2) and/or bound strenghtening (Sect. 4.4.3) 4. Initial guessing of properties (Sect. 4.6)

  l i s t o f f o r m u l a e ( c o n j e c t u r e s ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ XS : l i s t (A) , YS : l i s t (A) ] , e q u a l ( b u t l a s t <A>(XS ) , t a k e <A>( minus ( l e n <A>(XS ) , s ( z ) ) ,XS ) ) ) ) , c o n j p r o b 5 0 ) . e n d o f l i s t . end problem .

S

  t a r t i n g s c a l a v e r s i o n 2 . 1 1 . 2 Unkown / Legacy-s t y l e Argument : / home / dwand / p i r a t e / r e d u c e D F G t o F a c t s I n i t i a l C o n j e c t u r e s : : FE538 -00015 ( 1 ) {} | | b u t l a s t ( s k f 1 ) = t a k e ( minus ( l e n ( s k f 1 ) , s ( z ) ) , s k f 1 ) -> . o r i g i n ( Conj ( c o n j p r o b 5 0 from : S e t ( 8 9 4 4B) ) ) @ 252 @head ( 0 r a n k : 10 ) : C a s e P r o o f T a s k -TID : 5 ( p a r e n t TID : 4 , I n i t i a l ) @ 452 @head ( 0 r a n k : 22 ) : C a s e P r o o f T a s k -TID : 6 ( p a r e n t TID : 5 , Case ( c o n s o f s k f 1 ) ) Found f a l s e Formulas used : l e n c o n s f a c t t a k e d e f c o n s m i n u s z l e f t c o n j p r o b 5 0 l e n n i l f a c t t a k e d e f z f a c t t a k e d e f n i l m i n u s s b u t l a s t n i l b u t l a s t c o n s n i l m i n u s z r i g h t b u t l a s t c o n s c o n s I n v o l v e d c l a u s e s : 8944B-00001 ( 1 0 0 0 ) {} | | -> b u t l a s t ( V2 ) = t a k e ( minus ( l e n ( V2 ) , s ( z ) ) , V2 ) . o r i g i n ( I n p u t ( c o n j p r o b 5 0 ) ) 36218 -00002 ( 1 0 0 0 ) {} | | -> minus ( z , V2 ) = z . o r i g i n ( I n p u t ( m i n u s z l e f t ) ) C3313 -00003 ( 1 0 0 0 ) {} | | -> minus ( V2 , z ) = V2 . o r i g i n ( I n p u t ( m i n u s z r i g h t ) ) 29DEB-00004 ( 1 0 0 0 ) {} | | -> minus ( s ( V2 ) , s ( V4 ) ) = minus ( V2 , V4 ) . o r i g i n ( I n p u t ( m i n u s s ) ) B7230 -00005 ( 1 0 0 0 ) {} | | -> l e n ( n i l ) = z . o r i g i n ( I n p u t ( l e n n i l ) ) E1EC9-00006 ( 1 0 0 0 ) {} | | -> l e n ( c o n s ( V2 , V4 ) ) = s ( l e n ( V4 ) ) . o r i g i n ( I n p u t ( l e n c o n s ) ) D0DA3-00009 ( 1 0 0 0 ) {} | | -> b u t l a s t ( n i l ) = n i l . o r i g i n ( I n p u t ( b u t l a s t n i l ) ) 87351 -00010 ( 1 0 0 0 ) {} | | -> b u t l a s t ( c o n s ( V2 , n i l ) ) = n i l . o r i g i n ( I n p u t ( b u t l a s t c o n s n i l ) ) 0FD30-00011 ( 1 0 0 0 ) {} | | -> b u t l a s t ( c o n s ( V2 , c o n s ( V4 , V6 ) ) ) = c o n s ( V2 , b u t l a s t ( c o n s ( V4 , V6 ) ) ) . o r i g i n ( I n p u t ( b u t l a s t c o n s c o n s ) ) 0F9DA-00012 ( 1 0 0 0 ) {} | | -> t a k e ( z , V2 ) = n i l . o r i g i n ( I n p u t ( f a c t t a k e d e f z ) ) 8DC7A-00013 ( 1 0 0 0 ) {} | | -> t a k e ( V2 , n i l ) = n i l . o r i g i n ( I n p u t ( f a c t t a k e d e f n i l ) ) 30122 -00014 ( 1 0 0 0 ) {} | | -> t a k e ( s ( V2 ) , c o n s ( V4 , V6 ) ) = c o n s ( V4 , t a k e ( V2 , V6 ) ) . o r i g i n ( I n p u t ( f a c t t a k e d e f c o n s ) ) f u n c t i o n ( p , [A, B ] , (A, B ) p a i r (A, B ) ) .

  l i s t o f f o r m u l a e ( c o n j e c t u r e s ) . formula ( f o r a l l s o r t s ( [ A] , f o r a l l ( [ X : A, XS : l i s t (A) , Y : A, YS : l i s t (A) ] ,i m p l i e s ( e q u a l ( l e n <A>(XS ) , l e n <A>(YS ) ) , e q u a l ( z i p <A, A>( r e v<A>(XS ) , r e v<A>(YS ) ) , r e v<p a i r (A, A)>( z i p <A, A>(XS , YS ) ) ) ) ) ) , c o n j p r o b 8 5 ) . e n d o f l i s t .end problem . Found f a l s e Formulas used : l e n c o n s c o n j p r o b 8 5 r e v c o n s G e n e r a l i z a t i o n -w i t h -s i d e -c o n d i t i o n -B91EE l e n n i l S i d e -Cond-B91EE a p p e n d n i l r e v n i l z i p c o n s G e n e r a l i z a t i o n -60BD0 z i p n i l r i g h t a p p e n d c o n s I n v o l v e d c l a u s e s : A720D-00001 ( 1 0 0 0 ) {} | | l e n ( V2 ) = l e n ( V4 ) -> z i p ( r e v ( V2 ) , r e v ( V4 ) ) = r e v ( z i p ( V2 , V4 ) ) . o r i g i n ( I n p u t ( c o n j p r o b 5 ) ) 77D48-00002 ( 1 0 0 0 ) {} | | -> a p p e n d ( n i l , V2 ) = V2 . o r i g i n ( I n p u t ( a p p e n d n i l ) ) A6F4B-00003 ( 1 0 0 0 ) {} | | -> a p p e n d ( c o n s ( V2 , V4 ) , V6 ) = c o n s ( V2 , a p p e n d ( V4 , V6 ) ) . o r i g i n ( I n p u t ( a p p e n d c o n s ) ) 4622A-00004 ( 1 0 0 0 ) {} | | -> r e v ( n i l ) = n i l . o r i g i n ( I n p u t ( r e v n i l ) ) 745AD-00005 ( 1 0 0 0 ) {} | | -> r e v ( c o n s ( V2 , V4 ) ) = a p p e n d ( r e v ( V4 ) , c o n s ( V2 , n i l ) ) . o r i g i n ( I n p u t ( r e v c o n s ) ) B7230 -00006 ( 1 0 0 0 ) {} | | -> l e n ( n i l ) = z . o r i g i n ( I n p u t ( l e n n i l ) ) E1EC9-00007 ( 1 0 0 0 ) {} | | -> l e n ( c o n s ( V2 , V4 ) ) = s ( l e n ( V4 ) ) . o r i g i n ( I n p u t ( l e n c o n s ) ) 71DCE-00008 ( 1 0 0 0 ) {} | | -> z i p ( V2 , n i l ) = n i l . o r i g i n ( I n p u t ( z i p n i l r i g h t ) ) 51B06-00010 ( 1 0 0 0 ) {} | | -> z i p ( c o n s ( V2 , V4 ) , c o n s ( V6 , V8 ) ) = c o n s ( p ( V2 , V6 ) , z i p ( V4 , V8 ) ) . o r i g i n ( I n p u t ( z i p c o n s ) ) 8A2C7-00011 ( 1 ) {} | | -> l e n ( s k f 1 ) = l e n ( s k f 2 ) . o r i g i n ( Conj ( c o n j p r o b 8 5 from : S e t ( A720D ) ) ) 7DD03-00012 ( 1 ) {} | | z i p ( r e v ( s k f 1 ) , r e v ( s k f 2 ) ) = r e v ( z i p ( s k f 1 , s k f 2 ) ) -> . o r i g i n ( Conj ( c o n j p r o b 8 5 from : S e t ( A720D ) ) ) 36DB6-00167 ( 1 ) {} | | z i p ( r e v ( s k f 1 ) , r e v ( n i l ) ) = r e v ( z i p ( s k f 1 , n i l ) ) -> . o r i g i n ( I n d C a s e ( n i l , s

1 ) 1 ) 1 ) 1 ) 1 ) 1 )

 111111 {} | | -> l e n ( c o n s ( i 1 0 0 5 , i 1 0 0 6 ) ) = s ( l e n ( i 1 0 0 2 ) ) .o r i g i n ( I n d C a s e ( cons , s k f 1 , FCB76 ) ) 97C61-00314 ( 1 ) {} | | z i p ( r e v ( c o n s ( i 1 0 0 5 , i 1 0 0 6 ) ) , a p p e n d ( r e v ( i 1 0 0 2 ) , c o n s ( i 1 0 0 1 , n i l ) ) ) = r e v ( z i p ( c o n s ( i 1 0 0 5 , i 1 0 0 6 ) , c o n s ( i 1 1 , i 1 0 0 2 ) ) ) -> .o r i g i n ( I n d C a s e ( cons , s k f 1 , F27CB ) ) ED4BD-00325 ( 1 ) {} | | -> s ( l e n ( i 1 0 0 6 ) ) = s ( l e n ( i 1 0 0 2 ) ) . o r i g i n ( Rew ( 3 FE76 w i t h S e t [ E1EC9 ] ) ) B91EE-00326 ( 1 ) {} | | z i p ( a p p e n d ( r e v ( i 1 0 0 6 ) , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( r e v ( i 1 0 0 2 ) , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( r e v ( z i p ( i 1 0 0 6 , i 1 0 0 2 ) ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> .o r i g i n ( Rew ( 9 7 C61 w i t h S e t [ 5 {} | | -> l e n ( i 1 0 0 6 ) = l e n ( i 1 0 0 2 ) . o r i g i n (DT-I n j e c t i v e (ED4BD) ) DFF55-00915 ( 1 ) {} | | l e n ( V2 ) = l e n ( V4 ) -> z i p ( a p p e n d ( V2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( V4 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( V2 , V4 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) . o r i g i n ( I n p u t ( non neg c o n j ) ) 7E880 -00916 ( 1 ) {} | | -> l e n ( s k f 9 ) = l e n ( s k f 1 0 ) . o r i g i n ( Conj ( G e n e r a l i z a t i o n -w i t h -s i d ec o n d i t i o n -B91EE from : S e t ( DFF55 ) ) ) FA5C4-00917 ( 1 ) {} | | z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( s k f 1 0 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( s k f 9 , s k f 1 0 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> . o r i g i n ( Conj ( G e n e r a l i z a t i o n -w i t h -s i d e -c o n d i t i o n -B91EE from : S e t ( DFF55 ) ) ) 0ECF8-01046 ( 1 ) {} | | -> l e n ( V2 ) = l e n ( r e v ( V2 ) ) . o r i g i n ( I n p u t ( S i d e -Cond-non-Neg-B91EE ) ) 14 F20 -01047 ( 1 ) {} | | l e n ( s k f 1 7 ) = l e n ( r e v ( s k f 1 7 ) ) -> . o r i g i n ( Conj ( S i d e -Cond-B91EE from : S e t ( 0 ECF8 ) ) ) 64 F41 -01219 ( 1 ) {} | | l e n ( n i l ) = l e n ( r e v ( n i l ) ) -> . o r i g i n ( I n d C a s e ( n i l , s k f 1 7 , 14 F20 ) ) 2F5DE-01220 ( 1 ) {} | | z = z -> . o r i g i n ( Rew ( 6 4 F41 w i t h S e t [ B7230 , 4622A ] ) ) 756DD-01221 ( 1 ) {} | | -> . o r i g i n ( L i t E l i m F ( 2 F5DE ) ) 60BD0-01225 ( 1 ) {} | | s ( l e n ( i 1 0 1 2 ) ) = l e n ( a p p e n d ( r e v ( i 1 0 1 2 ) , c o n s ( i 1 0 1 1 , n i l ) ) ) -> . o r i g i n ( Rew ( 2 D869 w i t h S e t [ E1EC9 , 745AD] ) ) C5074 -03855 ( 1 ) {} | | l e n ( s k f 9 ) = l e n ( s k f 1 0 ) -> z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( s k f 1 0 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( s k f 9 , s k f 1 0 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) . o r i g i n ( N e g a t e ( S e t ( FA5C4 , 7 E880 ) ) ) 91218 -03860 ( 1 ) {} | | z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( n i l , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( s k f 9 , n i l ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> . o r i g i n ( I n d C a s e ( n i l , s k f 1 0 , FA5C4 ) ) DBF5A-03861 ( 1 ) {} | | -> l e n ( s k f 9 ) = l e n ( n i l ) . o r i g i n ( I n d C a s e ( n i l , s k f 1 0 , 7 E880 ) ) 5D4D3-03862 ( 1 ) {} | | z i p ( a p p e n d ( s k f 9 , c o n s( i 1 0 0 5 , n i l ) ) , c o n s ( i 1 0 0 1 , n i l ) ) = c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) -> . o r i g i n ( Rew ( 9 1 2 1 8 w i t h S e t [ 7 1DCE, 77D48 ] ) ) 226BF-03863 ( 1 ) {} | | -> l e n ( s k f 9 ) = z . o r i g i n ( Rew ( DBF5A w i t h S e t [ B7230 ] ) ) D0306 -03920 ( 1 ) {} | | z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( c o n s ( i 1 0 3 5 , i 1 0 3 6 ) , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( s k f 9 , c o n s ( i 1 0 3 5 , i 1 0 3 6 ) ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> . o r i g i n ( I n d C a s e ( cons , s k f 1 0 , FA5C4 ) ) D35CD-03921 ( 1 ) {} | | -> l e n ( s k f 9 ) = l e n ( c o n s ( i 1 0 3 5 , i 1 0 3 6 ) ) . o r i g i n ( I n d C a s e ( cons , s k f 1 0 , 7 E880 ) ) B68C6-03923 ( 1 ) {} | | l e n ( s k f 9 ) = l e n ( i 1 0 3 6 ) -> z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( s k f 9 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) . o r i g i n ( IndHyp ( s k f 1 0 , c o n s : C5074 ) ) 66512 -03924 ( 1 ) {} | | -> l e n ( s k f 9 ) = s ( l e n ( i 1 0 3 6 ) ) . o r i g i n ( Rew ( D35CD w i t h S e t [ E1EC9 ] ) ) 7E53F -03925 ( 1 ) {} | | z i p ( a p p e n d ( s k f 9 , c o n s ( i 1 0 0 5 , n i l ) ) , c o n s ( i 1 0 3 5 , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) ) = a p p e n d ( z i p ( s k f 9 , c o n s ( i 1 0 3 5 , i 1 0 3 6 ) ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> . o r i g i n ( Rew ( D0306 w i t h S e t [ A6F4B ] ) ) 35A58-04058 ( 1 ) {} | | z i p ( a p p e n d ( n i l , c o n s ( i 1 0 0 5 , n i l ) ) , c o n s ( i 1 0 0 1 , n i l ) ) = c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) -> . o r i g i n ( I n d C a s e ( n i l , s k f 9 , 5D4D3 ) ) 0A341 -04059 ( 1 ) {} | | c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , z i p ( n i l , n i l ) ) = c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) -> . o r i g i n ( Rew ( 3 5 A58 w i t h S e t [ 5 1 B06 , 77D48 ] ) ) C42E9 -04060 ( 1 ) {} | | z i p ( n i l , n i l ) = n i l p ( i 1 0 0 5 , i 1 0 0 1 ) = p ( i 1 0 0 5 , i 1 0 0 1 ) -> . o r i g i n (DT-I n j e c t i v e ( 0 A341 ) ) 1B501 -04061 ( 1 ) {} | | z i p ( n i l , n i l ) = n i l -> . o r i g i n ( L i t E l i m ( C42E9 ) ) 6778B-04062 ( 1 ) {} | | -> . o r i g i n (MRR( 1 B501 ,-71DCE) ) FE9E8 -04063 ( 1 ) {} | | -> l e n ( c o n s ( i 1 0 3 7 , i 1 0 3 8 ) ) = z . o r i g i n ( I n d C a s e ( cons , s k f 9 , 226BF ) ) 90922 -04068 ( 1 ) {} | | -> s ( l e n ( i 1 0 3 8 ) ) = z . o r i g i n ( Rew ( FE9E8 w i t h S e t [ E1EC9 ] ) ) A7CD7-04069 ( 1 ) {} | | -> . o r i g i n (DT-D i s t i n c t ( 9 0 9 2 2 ) ) 142A0-04070 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i lby 6778B , c o n s by A7CD7 ] ) ) 5CD72-04071 ( 1 0 0 0 ) {} | | z = l e n ( V2 ) -> z i p ( a p p e n d ( V2 , c o n s ( V4 , n i l ) ) , c o n s ( V6 , n i l ) ) = c o n s ( p ( V4 , V6 ) , n i l ) . o r i g i n ( D e r i v e d ( 1 4 2 A0 ) ) E97D7-04072 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( 5 D4D3 , 226BF ) and S e t ( 5 CD72 ) ) ) 41691 -04265 ( 1 ) {} | | s ( l e n ( s k f 2 8 ) ) = l e n ( a p p e n d ( s k f 2 8 , c o n s ( i 1 0 1 1 , n i l ) ) ) -> . o r i g i n ( Conj ( G e n e r a l i z a t i o n -60BD0 from : S e t ( 6 0BD0 ) ) ) 0F1FF -07739 ( 1 ) {} | | -> s ( l e n ( s k f 2 8 ) ) = l e n ( a p p e n d ( s k f 2 8 , c o n s ( i 1 0 1 1 , n i l ) ) ) . o r i g i n ( N e g a t e ( {} | | s ( l e n ( n i l ) ) = l e n ( a p p e n d ( n i l , c o n s ( i 1 0 1 1 , n i l ) ) ) -> . o r i g i n ( I n d C a s e ( n i l , s {} | | s ( z ) = s ( l e n ( n i l ) ) -> . o r i g i n ( Rew ( 7 1 C49 w i t h S e t [ B7230 , E1EC9 , 77 D48 ] ) ) D6A23-07746 ( 1 ) {} | | l e n ( n i l ) = z -> . o r i g i n (DT-I n j e c t i v e ( 3 4 6BC) ) F9091 -07747 ( 1 ) {} | | -> . o r i g i n (MRR( D6A23,-B7230 ) ) E6401 -07748 ( 1 ) {} | | s ( l e n ( c o n s ( i 1 0 6 7 , i 1 0 6 8 ) ) ) = l e n ( a p p e n d ( c o n s ( i 1 0 6 7 , i 1 0 6 8 ) , c o n s ( i 1 0 1 1 , n i l ) ) ) -> . o r i g i n ( I n d C a s e ( cons , s k f 2 8 , 4 1 6 9 1 ) ) B593D-07755 ( 1 ) {} | | -> s ( l e n ( i 1 0 6 8 ) ) = l e n ( a p p e n d ( i 1 0 6 8 , c o n s ( i 1 0 1 1 , n i l ) ) ) . o r i g i n ( IndHyp ( s k f 2 8 , c o n s : 0F1FF ) ) 6DB94-07757 ( 1 ) {} | | s ( s ( l e n ( i 1 0 6 8 ) ) ) = s ( l e n ( a p p e n d ( i 1 0 6 8 , c o n s ( i 1 0 1 1 , n i l ) ) ) ) -> . o r i g i n ( Rew ( E6401 w i t h S e t [ A6F4B , E1EC9 ] ) ) 3E49B-07758 ( 1 ) {} | | s ( l e n ( i 1 0 6 8 ) ) = l e n ( a p p e n d ( i 1 0 6 8 , c o n s ( i 1 0 1 1 , n i l ) ) ) -> . o r i g i n (DT-I n j e c t i v e ( 6 DB94 ) ) 23DC0-07759 ( 1 ) {} | | -> . o r i g i n (MRR( 3 E49B,-B593D ) ) F6F97 -07760 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by F9091 , c o n s by 23DC0 ] ) ) 6BC4C-07763 ( 1 ) {} | | -> s ( l e n ( V2 ) ) = l e n ( a p p e n d ( V2 , c o n s ( i 1 0 1 1 , n i l ) ) ) . o r i g i n ( D e r i v e d ( F6F97 ) ) 032E0-07764 ( 1 ) {} | | s ( l e n ( s k f 2 8 ) ) = s ( l e n ( s k f 2 8 ) ) -> . o r i g i n ( Rew ( 4 1 6 9 1 w i t h S e t [ 6 BC4C ] ) ) 368A6-07765 ( 1 ) {} | | -> . o r i g i n ( L i t E l i m F ( 0 3 2 E0 ) ) 1BC46-07766 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by 756DD, c o n s by 368A6 ] ) ) 0ECF8-07767 ( 1 0 0 0 ) {} | | -> l e n ( V2 ) = l e n ( r e v ( V2 ) ) . o r i g i n ( D e r i v e d ( 1 BC46 ) ) 062 F6 -13532 ( 1 ) {} | | -> l e n ( n i l ) = s ( l e n ( i 1 0 3 6 ) ) . o r i g i n ( I n d C a s e ( n i l , s k f 9 {} | | -> z = s ( l e n ( i 1 0 3 6 ) ) . o r i g i n ( Rew ( 0 6 2 F6 w i t h S e t [ B7230 ] ) ) BBFD0-13539 ( 1 ) {} | | -> . o r i g i n (DT-D i s t i n c t ( E2ECB ) ) D0964 -13540 ( 1 ) {} | | -> l e n ( c o n s ( i 1 1 1 1 , i 1 1 1 2 ) ) = s ( l e n ( i 1 0 3 6 ) ) . o r i g i n ( I n d C a s e ( cons , s k f 9 {} | | z i p ( a p p e n d ( c o n s ( i 1 1 1 1 , i 1 1 1 2 ) , c o n s ( i 1 0 0 5 , n i l ) ) , c o n s ( i 1 0 3 5 , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) ) = a p p e n d ( z i p ( c o n s ( i 1 1 1 1 , i 1 1 1 2 ) , c o n s ( i 1 0 3 5 , i 1 0 3 6 ) ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> .o r i g i n ( I n d C a s e ( cons , s k f 9 , 7E53F ) ) 4E6E4 -13543 ( 1 ) {} | | l e n ( i 1 1 1 2 ) = l e n ( i 1 0 3 6 ) -> z i p ( a p p e n d ( i 1 1 1 2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( i 1 1 1 2 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) .o r i g i n ( IndHyp ( s k f 9 , c o n s : B68C6 ) ) C2FB1-13552 ( 1 ) {} | | c o n s ( p ( i 1 1 1 1 , i 1 0 3 5 ) , z i p ( a p p e n d ( i 1 1 1 2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) ) = c o n s ( p ( i 1 1 1 1 , i 1 0 3 5 ) , a p p e n d ( z i p ( i 1 1 1 2 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) ) -> . o r i g i n ( Rew ( B1C55 w i t h S e t [ A6F4B , 51B06 ] ) ) 4C358 -13553 ( 1 ) {} | | -> s ( l e n ( i 1 1 1 2 ) ) = s ( l e n ( i 1 0 3 6 ) ) . o r i g i n ( Rew ( D0964 w i t h S e t [ E1EC9 ] ) ) 05196 -13558 ( 1 ) {} | | -> l e n ( i 1 1 1 2 ) = l e n ( i 1 0 3 6 ) . o r i g i n (DT-I n j e c t i v e ( 4 C358 ) ) C1ECD-13559 ( 1 ) {} | | z i p ( a p p e n d ( i 1 1 1 2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( i 1 1 1 2 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) p ( i 1 1 1 1 , i 1 0 3 5 ) = p ( i 1 1 1 1 , i 1 0 3 5 ) -> . o r i g i n (DT -I n j e c t i v e ( C2FB1 ) ) 4375A-13560 ( 1 ) {} | | z i p ( a p p e n d ( i 1 1 1 2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( i 1 1 1 2 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) -> . o r i g i n ( L i t E l i m ( C1ECD ) ) A0487 -13562 ( 1 ) {} | | -> z i p ( a p p e n d ( i 1 1 1 2 , c o n s ( i 1 0 0 5 , n i l ) ) , a p p e n d ( i 1 0 3 6 , c o n s ( i 1 0 0 1 , n i l ) ) ) = a p p e n d ( z i p ( i 1 1 1 2 , i 1 0 3 6 ) , c o n s ( p ( i 1 0 0 5 , i 1 0 0 1 ) , n i l ) ) . o r i g i n (MRR(05196 , -4E6E4 ) ) 724C8-13567 ( 1 ) {} | | -> . o r i g i n (MRR( A0487 ,-4375A) ) CFF69 -13568 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by BBFD0 , c o n s by 724C8 ] ) ) C1C89-13569 ( 1 0 0 0 ) {} | | l e n ( V2 ) = s ( l e n ( V4 ) ) -> z i p ( a p p e n d ( V2 , c o n s ( V6 , n i l ) ) , c o n s ( V8 , a p p e n d ( V4 , c o n s ( V10 , n i l ) ) ) ) = a p p e n d ( z i p ( V2 , c o n s ( V8 , V4 ) ) , c o n s ( p ( V6 , V10 ) , n i l ) ) . o r i g i n ( D e r i v e d ( CFF69 ) ) AB7BC-13570 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( 7 E53F , 6 6 5 1 2 ) and S e t ( C1C89 ) ) ) 35234 -13571 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by E97D7 , c o n s by AB7BC ] ) ) 424 F8 -13572 ( 1 0 0 0 ) {} | | l e n ( V2 ) = l e n ( V4 ) -> z i p ( a p p e n d ( V2 , c o n s ( V6 , n i l ) ) , a p p e n d ( V4 , c o n s ( V8 , n i l ) ) ) = a p p e n d ( z i p ( V2 , V4 ) , c o n s ( p ( V6 , V8 ) , n i l ) ) . o r i g i n ( D e r i v e d ( 3 5 2 3 4 ) ) A2C66-13575 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( B91EE , 0 9 1 6 5 ) and S e t ( 4 2 4 F8 , 0ECF8 ) ) ) ABE6D-13576 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by CD288 , c o n s by A2C66 ] ) ) 8991D-13577 ( 1 0 0 0 ) {} | | l e n ( V2 ) = s ( l e n ( V4 ) ) -> z i p ( r e v ( V2 ) , a p p e n d ( r e v ( V4 ) , c o n s ( V6 , n i l ) ) ) = r e v ( z i p ( V2 , c o n s ( V6 , V4 ) ) ) . o r i g i n ( D e r i v e d (ABE6D) ) CE2A4-13578 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( F27CB , FCB76 ) and S e t ( 8 9 9 1D) ) ) 38 F66 -13579 ( 1 ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by DEAD1, c o n s by CE2A4 ] ) ) A720D-13580 ( 1 0 0 0 ) {} | | l e n ( V2 ) = l e n ( V4 ) -> z i p ( r e v ( V2 ) , r e v ( V4 ) ) = r e v ( z i p ( V2 , V4 ) ) . o r i g i n ( D e r i v e d ( 3 8 F66 ) ) 137DF-13581 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( 7 DD03 , 8A2C7 ) and S e t ( A720D ) ) ) I n v o l v e d c l a u s e s : 98 T o t a l t i m e : 8 . 6 0 7 5 4 3 7 6 7 s A.1.3. Problem 86 Input The problem in DFG format, edited for better readability.

  b e g i n p r o b l e m ( benchmark ) .

  l i s t o f d e s c r i p t i o n s . name ( { * * } ) . a u t h o r ( { * * } ) . s t a t u s ( unknown ) . d e s c r i p t i o n ( { * * } ) . e n d o f l i s t . l i s t o f s y m b o l s . f u n c t i o n s [ ( z , 0 ) , ( s , 1 ) , ( cons , 1 + 2 ) , ( n i l , 1 + 0 ) , ( i n s , 1 + 2 ) ] . p r e d i c a t e s [ ( l e s s , 1 + 2 ) , ( elem , 1 + 2 ) ] . s o r t s [ ( l i s t , 1 ) , ( n a t , 0 ) ] . e n d o f l i s t . l i s t o f d e c l a r a t i o n s . f u n c t i o n ( z , n a t ) . f u n c t i o n ( s , ( n a t ) n a t ) .

S t a r 1 ) 1 ) 1 ))

 111 t i n g s c a l a v e r s i o n 2 . 1 1 . 2 Unkown / Legacy-s t y l e Argument : / home / dwand / p i r a t e / r e d u c e D F G t o F a c t s I n i t i a l C o n j e c t u r e s : : 917BF-00015 ( 1 ) {} | | -> elem ( s k f 1 , i n s ( s k f 2 , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) : 46111 -00016 ( 1 ) {} | | elem ( s k f 1 , i n s ( s k f 2 , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) -> . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) : 78 F19 -00014 ( 1 ) {} | | -> l e s s ( s k f 1 , s k f 2 ) . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) @ 299 @head ( 1 r a n k : 2 ) : C a s e P r o o f T a s k -TID : 4 ( p a r e n t TID : 3 , D e r i v e C a s e ( -> l e s s ( V2 , V4 ) l e s s ( V4 , V2 ) . ) ) @ 778 @head ( 2 r a n k : 3 ) : C a s e P r o o f T a s k -TID : 6 ( p a r e n t TID : 5 , I n i t i a l ) @ 983 @head ( 2 r a n k : 4 ) : C a s e P r o o f T a s k -TID : 8 ( p a r e n t TID : 7 , Case ( z o f s k f 4 ) ) @ 1061 @head ( 2 r a n k : 8 ) : C a s e P r o o f T a s k -TID : 9 ( p a r e n t TID : 7 , Case ( s o f s k f 4 ) ) 163 @ 1142 @head ( 1 r a n k : 8 ) : C a s e P r o o f T a s k -TID : 1 4 ( p a r e n t TID : 6 , Case ( s o f s k f 2 ) ) @ 2606 @head ( 2 r a n k : 6 ) : C a s e P r o o f T a s k -TID : 1 6 ( p a r e n t TID : 1 4 , Case ( n i l o f s k f 3 ) ) @ 2662 @head ( 1 r a n k : 15 ) : C a s e P r o o f T a s k -TID : 1 5 ( p a r e n t TID : 8 , Case ( z o f s k f 5 ) ) @ 2687 @head ( 0 r a n k : 15 ) : C a s e P r o o f T a s k -TID : 1 7 ( p a r e n t TID : 1 4 , Case ( c o n s o f s k f 3 ) ) @6852 @head ( 2 r a n k : 20 ) : C a s e P r o o f T a s k -TID : 2 0 ( p a r e n t TID : 1 9 , S p l i t C a s e ( 1 ) ) @ 7164 @head ( 1 r a n k : 20 ) : C a s e P r o o f T a s k -TID : 2 1 ( p a r e n t TID : 1 9 , S p l i t C a s e ( 2 ) )Found f a l s e Formulas used : i n s n i l s p l i t -ground -p o s e l e m c o n s n o t e q u a l s p l i t -ground -neg e l e m c o n s e q u a l e l e m n i l l e s s z r i g h t i n s n o t l e s s i n s l e s s l e s s z c o n j 8 6I n v o l v e d c l a u s e s : 6E1FE-00001 ( 1 0 0 0 ) {} | | elem ( V2 , i n s ( V4 , V6 ) ) l e s s ( V2 , V4 ) -> elem ( V2 , V6 ) . o r i g i n ( I n p u t ( c o n j 8 6 ) ) 71276 -00002 ( 1 0 0 0 ) {} | | elem ( V2 , V4 ) l e s s ( V2 , V6 ) -> elem ( V2 , i n s ( V6 , V4 ) ) . o r i g i n ( I n p u t ( c o n j 8 6 ) ) 0D298 -00003 ( 1 0 0 0 ) {} | | l e s s ( V2 , z ) -> . o r i g i n ( I n p u t ( l e s s z r i g h t ) ) E1868 -00005 ( 1 0 0 0 ) {} | | l e s s ( s ( V2 ) , s ( V4 ) ) -> l e s s ( V2 , V4 ) . o r i g i n ( I n p u t ( l e s s z ) ) 74758 -00006 ( 1 0 0 0 ) {} | | l e s s ( V2 , V4 ) -> l e s s ( s ( V2 ) , s ( V4 ) ) . o r i g i n ( I n p u t ( l e s s z ) ) 511EF-00007 ( 1 0 0 0 ) {} | | elem ( V2 , n i l ) -> . o r i g i n ( I n p u t ( e l e m n i l ) ) 59740 -00008 ( 1 0 0 0 ) {} | | V2 = V4 -> elem ( V2 , c o n s ( V4 , V6 ) ) .o r i g i n ( I n p u t ( e l e m c o n s e q u a l ) ) F0650 -00009( 1 0 0 0 ) {} | | elem ( V2 , c o n s ( V4 , V6 ) ) -> elem ( V2 , V6 ) V2 = V4 .o r i g i n ( I n p u t ( e l e m c o n s n o t e q u a l ) ) 5C661 -00010( 1 0 0 0 ) {} | | elem ( V2 , V4 ) -> elem ( V2 , c o n s ( V6 , V4 ) ) V2 = V6 . o r i g i n ( I n p u t ( e l e m c o n s n o t e q u a l ) ) 5C1C9-00011 ( 1 0 0 0 ) {} | | -> i n s ( V2 , n i l ) = c o n s ( V2 , n i l ) . o r i g i n ( I n p u t ( i n s n i l ) ) 8B37E-00012 ( 1 0 0 0 ) {} | | l e s s ( V2 , V4 ) -> i n s ( V2 , c o n s ( V4 , V6 ) ) = c o n s ( V2 , c o n s ( V4 , V6 ) ) . o r i g i n ( I n p u t ( i n s l e s s ) ) 7B2F6 -00013 ( 1 0 0 0 ) {} | | -> l es s ( V2 , V4 ) i n s ( V2 , c o n s ( V4 , V6 ) ) = c o n s ( V4 , i n s ( V2 , V6 ) ) . o r i g i n ( I n p u t ( i n s n o t l e s s ) ) 78 F19 -00014 ( 1 ) {} | | -> l e s s ( s k f 1 , s k f 2 ) . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) 917BF-00015 ( 1 ) {} | | -> elem ( s k f 1 , i n s ( s k f 2 , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) 46111 -00016 ( 1 ){} | | elem ( s k f 1 , i n s ( s k f 2 , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) -> . o r i g i n ( Conj ( c o n j 8 6 from : S e t ( 6 E1FE , 7 1 2 7 6 ) ) ) A507B-00019 ( 1 0 0 0 ) {} | | V2 = V2 -> elem ( V2 , c o n s ( V2 , V4 ) ) . o r i g i n (NuV( 5 9 7 4 0 ) ) B9A26-00020 ( 1 0 0 0 ) {} | | -> elem ( V2 , c o n s ( V2 , V4 ) ) . o r i g i n ( L i t E l i m ( A507B ) ) BA31D-00836 ( 1 ) {} | | -> l e s s ( s k f 1 , z ) . o r i g i n ( I n d C a s e ( z , s k f 2 , 78 F19 ) ) C9099 -00842 ( 1 0 0 0 ) {} | | -> . o r i g i n (MRR( 0 D298 ,-BA31D ) ) 27412 -00843 ( 1 ) {} | | -> elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) . o r i g i n ( I n d C a s e ( s , s k f 2 , 917BF ) ) F25C3 -00844 ( 1 ) {} | | -> l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) . o r i g i n ( I n d C a s e ( s , s k f 2 , 78 F19 ) ) 87558 -00845 ( 1 ) {} | | elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , s k f 3 ) ) elem ( s k f 1 , s k f 3 ) -> . o r i g i n ( I n d C a s e ( s ,s k f 2 , 4 6 1 1 1 ) ) D7328 -01762 ( 1 ) {} | | elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , s k f 3 ) ) l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) -> elem ( s k f 1 , s k f 3 ) . o r i g i n ( N e g a t e ( S e t ( F25C3 , 8 {} | | elem ( s k f 1 , s k f 3 ) l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) -> elem ( s k f 1 , i n s ( s ( i 0 3 ) , s k f 3 ) ) . o r i g i n ( N e g a t e ( S e t ( F25C3 , 8 {} | | -> elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , n i l ) ) elem ( s k f 1 , n i l ) . o r i g i n ( I n d C a s e ( n i l , s k f 3 , 2 7 4 1 2 ) ) F25C3 -01779 ( 1 ) {} | | -> l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) . o r i g i n ( I n d C a s e ( n i l , s k f 3 , F25C3 ) ) BCC96-01786 ( 1 ) {} | | -> elem ( s k f 1 , c o n s ( s ( i 1 0 0 3 ) , n i l ) ) elem ( s k f 1 , n i l ) . o r i g i n ( Rew ( C3247 w i t h S e t [ 5 C1C9 ] ) ) 7D520 -01821 ( 1 ) {} | | -> elem ( s k f 1 , c o n s ( s ( i 1 0 03 ) , n i l ) ) . o r i g i n (MRR( BCC96,-511EF ) ) EC543 -01841 ( 2 ) {} | | -> elem ( s k f 1 , n i l ) s k f 1 = s ( i 1 0 0 3 ) . o r i g i n ( Res ( 7 D520 ,-F0650 ) ) 315 F8 -01844 ( 2 ) {} | | -> s k f 1 = s ( i 1 0 0 3 ) . o r i g i n (MRR( EC543 ,-511EF ) ) 88A75-01898 ( 1 ) {} | | -> l e s s ( s k f 1 , s k f 1 ) . o r i g i n ( Rew ( F25C3 w i t h S e t [ 3 1 5 F8 ] ) ) FED48-02373 ( 1 ) {} | | -> elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i10 ) ) . o r i g i n ( I n d C a s e ( cons , s k f 3 , 2 7 4 1 2 ) ) 0FE6E-02374 ( 1 ) {} | | elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 ) ) -> . o r i g i n ( I n d C a s e ( cons , s k f 3 , 8 7 5 5 8 ) ) F25C3 -02375 ( 1 ) {} | | -> l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) . o r i g i n ( I n d C a s e ( cons , s k f 3 , F25C3 ) ) BB79B-02387 ( 1 ) {} | | elem ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) -> elem ( s k f 1 , i 1 0 0 7 ) . o r i g i n ( IndHyp ( s k f 3 , c o n s : D7328 ) ) ECBDB-02391 ( 1 ) {} | | elem ( s k f 1 , i 1 0 0 7 ) l e s s ( s k f 1 , s ( i 1 0 0 3 ) ) -> elem ( s k f 1 , i n s ( s ( i 0 3 ) , i 1 0 0 7 ) ) . o r i g i n ( IndHyp ( s k f 3 , c o n s : 2A820 ) ) 3C405 -02398 ( 1 ) {} | | elem ( s k f 1 , i n s ( s ( i {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( s k f 1 , s k f 1 ) -> elem ( V2 , n i l ) . o r i g i n ( N e g a t e ( S e t ( 5 1 1 EF , B9A26 , 88A75 ) ) ) 17406 -05956 ( 1 ) {} | | -> l e s s ( z , z ) . o r i g i n ( I n d C a s e ( z , s k f 1 , 88A75 ) ) 2C5ED-05965 ( 1 ) {} | | -> . o r i g i n (MRR(17406 , -0D298 ) ) 511EF-05966 ( 1 0 0 0 ) {} | | elem ( V2 , n i l ) -> . o r i g i n ( I n d C a s e ( s , s k f 1 , 511EF ) ) 44697 -05967 ( 1 ) {} | | -> l e s s ( s ( i 1 0 0 8 ) , s ( i 1 0 0 8 ) ) . o r i g i n ( I n d C a s e ( s , s k f 1 , 88A75 ) ) B9A26-05968 ( 1 0 0 0 ) {} | | -> elem ( V2 , c o n s ( V2 , V4 ) ) . o r i g i n ( I n d C a s e ( s , s k f 1 , B9A26 ) ) A05AC-05978 ( 1 ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( i 1 0 0 8 , i 1 0 0 8 ) -> elem ( V2 , n i l ) . o r i g i n ( IndHyp ( s k f 1 , s : 2 {} | | -> elem ( V2 , n i l ) . o r i g i n (MRR( 6A6BD,-5B612 ) ) 36 F33 -06017 ( ) {} | | -> . o r i g i n (MRR( D552C,-511EF ) ) 05200 -06018 ( ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ z by 2C5ED , s by 36 F33 ] ) ) E3E4C-06019 ( 1 0 ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( V6 , V6 ) -> elem ( V2 , n i l ) . o r i g i n ( D e r i v e d ( 0 5 2 0 0 ) ) 39EE5-06020 ( ) {} | | -> .

1 )

 1 o r i g i n ( Res ( BBA64,-5C661 ) ) 351CF-06840 () {} | | -> elem ( s k f 1 , i n s ( s ( i elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) elem ( s k f 1 , i 1 0 0 7 ) -> l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) s k f 1 = i 1 0 0 6 . o r i g i n ( Res ( F08A5 ,-88FD4 ) ) FF5D8-08656 ( ) {} | | elem ( s k f 1 , i 1 0 0 7 ) -> l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) s k f 1 = i 1 0 0 6 . o r i g i n ( Res ( 5 C661 ,-1ACCD) ) F3F30 -24223 ( 1 0 ) {} | | l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) -> . o r i g i n ( I n p u t ( s p l i t -ground -neg) ) 5B46C-24224 ( 1 0 ) {} | | -> i n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) = c o n s ( i 1 0 0 6 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) . o r i g i n ( Res ( F3F30 ,-7B2F6 ) ) C5321 -24225 ( 1 0 ) {} | | -> l e s s ( s ( i 1 0 0 3 ) , i 1 0 0 6 ) . o r i g i n ( I n p u t ( s p l i t -ground -p o s ) ) 93366 -24226 ( 1 0 ) {} | | -> i n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) = c o n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) . o r i g i n ( Res ( C5321 ,-8B37E ) ) 80AF4-24335 ( ) {} | | elem ( s k f 1 , c o n s ( i 1 0 0 6 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> . o r i g i n ( Rew ( 0 FE6E w i t h S e t [ 5 B46C ] ) ) 3A9D5-24338 ( ) {} | | elem ( s k f 1 , i 1 0 0 7 ) -> s k f 1 = i 1 0 0 6 . o r i g i n (MRR( FF5D8,-F3F30 ) ) 0C699 -24357 ( ) {} | | -> elem ( s k f 1 , i 1 0 0 7 ) s k f 1 = i 1 0 0 6 . o r i g i n (MRR( A6F69 ,-F3F30 ) ) 5D37C-25023 ( ) {} | | -> s k f 1 = i 1 0 0 6 . o r i g i n ( Res ( 3 A9D5,-0C699 ) ) 23964 -25073 ( ) {} | | elem ( s k f 1 , c o n s ( s k f 1 , i n s ( s ( i 1 0 0 3 ) , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( s k f 1 , i 1 0 0 7 ) ) -> . o r i g i n ( Rew ( 8 0 AF4 w i t h S e t [ 5 D37C ] ) ) 8F0AA-25149 ( ) {} | | elem ( s k f 1 , c o n s ( s k f 1 , i 1 0 0 7 ) ) -> . o r i g i n (MRR(23964 , -B9A26 ) ) D7686 -25185 ( ) {} | | -> . o r i g i n (MRR( 8 F0AA,-B9A26 ) ) 08B6D-25186 ( ) {} | | elem ( s k f 1 , c o n s ( s ( i 1 0 0 3 ) , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> . o r i g i n ( Rew ( 0 FE6E w i t h S et [ 9 3 3 6 6 ] ) ) 315 F8 -25198 ( ) {} | | -> s k f 1 = s ( i 1 0 0 3 ) . o r i g i n (MRR( 5 5 3 C2,-C5321 ) ) 88A75-25341 ( ) {} | | -> l e s s ( s k f 1 , s k f 1 ) . o r i g i n ( SRew ( F25C3 by 315 F8 ) ) 7B2F8 -25552 ( ) {} | | elem ( s k f 1 , c o n s ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) ) elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> . o r i g i n ( Rew ( 0 8B6D w i t h S e t [ 3 1 5 F8 ] ) ) 3F5D5-25628 ( ) {} | | elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> . o r i g i n (MRR( 7 B2F8 ,-B9A26 ) ) EE209 -27108 ( ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( s k f 1 , s k f 1 ) -> elem ( s k f 1 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) . o r i g i n ( N e g a t e ( S e t ( 3 F5D5 , B9A26 , 88A75 ) ) ) 17406 -27112 ( ) {} | | -> l e s s ( z , z ) . o r i g i n ( I n d C a s e ( z , s k f 1 , 88A75 ) ) C3E76 -27130 ( 1 0 ) {} | | -> . o r i g i n (MRR( 0 D298 ,-1 7 4 0 6 ) ) 9D08C-27131 ( ) {} | | -> l e s s ( s ( i 1 0 1 0 ) , s ( i 1 0 1 0 ) ) . o r i g i n ( I n d C a s e ( s , s k f 1 , 88A75 ) ) B9A26-27133 ( 1 0 ) {} | | -> elem ( V2 , c o n s ( V2 , V4 ) ) . o r i g i n ( I n d C a s e ( s , s k f 1 , B9A26 ) ) C14A0-27151 ( ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( i 1 0 1 0 , i 1 0 1 0 ) -> elem ( i 1 0 1 0 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) . o r i g i n ( IndHyp ( s k f 1 , s : EE209 ) ) B7AE6-27156 ( ) {} | | elem ( i 1 0 1 0 , c o n s ( i 1 0 0 6 , i 1 0 0 7 ) ) -> . o r i g i n ( IndHyp ( s k f 1 , s : 3F5D5 ) ) 03C29-27192 ( ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( i 1 0 1 0 , i 1 0 1 0 ) -> . o r i g i n (MRR( C14A0,-B7AE6 ) ) D1845 -27249 ( ) {} | | -> l e s s ( i 1 0 1 0 , i 1 0 1 0 ) . o r i g i n ( IPSC ( 9 D08C by E1868 and 7 4 7 5 8 ) ) 47D12-27255 ( ) {} | | l e s s ( i 1 0 1 0 , i 1 0 1 0 ) -> . o r i g i n (MRR( 0 3 C29,-B9A26 ) ) 4EC41-27257 ( ) {} | | -> . o r i g i n (MRR( 4 7 D12,-D1845 ) ) B82D3-27258 ( ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ z by C3E76 , s by 4EC41 ] ) ) B4241 -27259 ( 1 0 ) {} | | elem ( V2 , c o n s ( V2 , V4 ) ) l e s s ( V6 , V6 ) -> elem ( V6 , c o n s ( V8 , V10 ) ) . o r i g i n ( D e r i v e d ( B82D3 ) ) 04B82-27260 ( ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( 3 F5D5 , B9A26 , 88A75 ) and S e t ( B4241 ) ) ) C58A8-27261 ( ) {} | | -> . o r i g i n ( B y S p l i t ( D7686 ,-04B82 ) ) CCC35-27262 ( ) {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ n i l by 39EE5 , c o n s by C58A8 ] ) ) DBE1F-27263 ( 1 0 ) {} | | elem ( V2 , V4 ) l e s s ( V2 , s ( V6 ) ) -> elem ( V2 , V4 ) . o r i g i n ( D e r i v e d ( CCC35 ) ) DA9E7-27264 ( 1 0 ) {} | | elem ( V2 , V4 ) l e s s ( V2 , s ( V6 ) ) -> elem ( V2 , i n s ( s ( V6 ) , V4 ) ) . o r i g i n ( D e r i v e d ( CCC35 ) ) E73B3 -27265 ( 1 0 ) {} | | elem ( V2 , i n s ( s ( V4 ) , V6 ) ) l e s s ( V2 , s ( V4 ) ) -> elem ( V2 , V6 ) . o r i g i n ( D e r i v e d ( CCC35 ) ) CE01E-27266 ( 1 0 ) {} | | elem ( V2 , i n s ( s ( V4 ) , V6 ) ) l e s s ( V2 , s ( V4 ) ) -> elem ( V2 , i n s ( s ( V4 ) , V6 ) ) . o r i g i n ( D e r i v e d ( CCC35 ) ) DD3E9-27267 ( ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( F25C3 , 8 {} | | -> . o r i g i n ( I n d u c t i o n ( L i s t [ z by C9099 , s by DD3E9 ] ) ) 71276 -27269 ( 1 0 0 0 ) {} | | elem ( V2 , V4 ) l e s s ( V2 , V6 ) -> elem ( V2 , i n s ( V6 , V4 ) ) . o r i g i n ( D e r i v e d ( 8 E937 ) ) 3A852 -27270 ( 1 0 0 0 ) {} | | elem ( V2 , i n s ( V4 , V6 ) ) l e s s ( V2 , V4 ) -> elem ( V2 , i n s ( V4 , V6 ) ) . o r i g i n ( D e r i v e d ( 8 E937 ) ) 904 F3 -27271 ( 1 0 0 0 ) {} | | elem ( V2 , V4 ) l e s s ( V2 , V6 ) -> elem ( V2 , V4 ) . o r i g i n ( D e r i v e d ( 8 E937 ) ) 6E1FE-27272 ( 1 0 0 0 ) {} | | elem ( V2 , i n s ( V4 , V6 ) ) l e s s ( V2 , V4 ) -> elem ( V2 , V6 ) . o r i g i n ( D e r i v e d ( 8 E937 ) ) DCD34-27273 ( 1 ) {} | | -> . o r i g i n ( C o n t r a d i c t i n g S e t ( 7 8 F19 , 4 6 1 1 1 , 917BF ) and S e t ( 3 A852 , 6E1FE , 7 1 2 7 6 , 904 F3 ) ) ) I n v o l v e d c l a u s e s : 108 T o t a l t i m e : 8 . 6 0 8 8 4 2 8 2 s A.1.4. Problem 87 Input The problem in DFG format, edited for better readability.

  b e g i n p r o b l e m ( benchmark ) .

  l i s t o f d e s c r i p t i o n s . name ( { * * } ) . a u t h o r ( { * * } ) . s t a t u s ( unknown ) . d e s c r i p t i o n ( { * * } ) . e n d o f l i s t . l i s t o f s y m b o l s . f u n c t i o n s [ ( z , 0 ) , ( s , 1 ) , ( minus , 2 ) ] . p r e d i c a t e s [ ( l e s s , 1 + 2 ) ] . s o r t s [ ( n a t , 0 ) ] . e n d o f l i s t .

  1 and Corollaries 2.2.4.3 and 2.2.4.4. So it remains to show condition 2 and the "only if" part of condition 1. As N is saturated up to redundancy, the conclusion C σ of the inference from C is contained in N or is redundant with respect to N. Therefore, C θ is either contained in G Σ (N) and smaller than Cθ, or it follows from clauses in G Σ (N) that are smaller than itself (and therefore smaller than Cθ). By the induction hypothesis, clauses in G Σ (N) that are smaller than Cθ are true in R Cθ , thus C θ and Cθ are true in R Cθ .

1. Cθ is redundant with respect to G Σ (N). If Cθ is redundant with respect to G Σ (N), then it follows from clauses in G Σ (N) that are smaller than Cθ. By condition 3 of the induction hypothesis, these clauses are true in R Cθ . Hence Cθ is true in R Cθ . 2. xθ is reducible by R Cθ . Suppose there is a variable x occurring in C such that xθ is reducible by R Cθ , say xθ → R Cθ t. Since variables are closed under rewriting with R Cθ (Lemma 2.2.4.5), there exists a substitution θ such that xθ = t and yθ = yθ for every variable y = x. The clause Cθ is smaller than Cθ. By condition 3 of the induction hypothesis, it is true in R Cθ . By congruence, every literal of Cθ is true in R Cθ if and only if the corresponding literal of Cθ is true in R Cθ ; hence Cθ is true in R Cθ . 3. Cθ contains a maximal negative literal. Suppose that Cθ does not fall into Case 1 or 2 and that Cθ = C θ ∨ sθ ≈ s θ, where sθ ≈ s θ is maximal in Cθ. If sθ ≈ s θ is false in R Cθ , then Cθ is clearly true in R Cθ and we are done. So assume that sθ ≈ s θ is true in R Cθ , that is, sθ ↓ R Cθ s θ. Without loss of generality, assume that sθ s θ. a) sθ = s θ. If sθ = s θ, then there is an equality resolution inference C θ ∨ sθ ≈ s θ C θ As shown in the Lifting Lemma (Lemma 2.2.4.6), this is an instance of an equality resolution inference C ∨ s ≈ s C σ where C = C ∨ s ≈ s is contained in N and σ is the most general unifier of s and s . Since Cθ is not redundant with respect to G Σ (N), C is not redundant with respect to N. b) sθ s θ. Without loss of generality assume that C and D are variable disjoint; so the same substitution θ can be used. If sθ ↓ R Cθ s θ and sθ s θ, then sθ must be reducible by some rule in some

  s θ applies. From the Lifting Lemma (Lemma 2.2.4.7) it follows that this is a ground instance of a superposition inference from D and C. Since tθ t θ (otherwise there would be no rewrite rule) we know that sθ[t θ] ≈ s θ is smaller then sθ[tθ] ≈ s θ. Since sθ[tθ] ≈ s θ is strictly maximal, we also know that it is larger than all literals in C θ.

It is also larger than all literals in D θ. and thus the conclusion is smaller than Cθ. By saturation up to redundancy and the induction hypothesis we know that the conclusion is true in R Cθ . Since D θ and C θ are false in R Cθ , sθ[t θ] ≈ s θ must be true in R Cθ . On the other hand, tθ ≈ t θ is true in R Cθ , so by congruence, sθ[tθ] ≈ s θ and Cθ are true in R Cθ . c) sθ ≈ s θ is strictly maximal in Cθ and sθ is irreducible.

Suppose that sθ ≈ s θ is strictly maximal in Cθ and sθ is irreducible by R Cθ . Then it must be one of three possibilities:

i. Cθ can be true in R Cθ . ii. E Cθ = {sθ → s θ}.

  Eθ; u τ u = t τ t , S θ) u ∈ vars(t) and θ = {u τ u → t τ t }

	For unification of terms I additionally need the Orient and Eliminate rules. Let vars(t) be the set
	of all (type) variables that are t or subterms of t.
	6 Orient 7 Eliminate (u τ u . (t = u, E; S ) ⇒ (u . = t τ t , E; S ) ⇒ (τ u = t, E; S ) . . = τ t , For unification of type terms I need the τ-Orient and the Eliminate rules for type variables t is not a variable
	(α-Eliminate) and non-variable type terms (τ-Eliminate). Those depend on the restricting type
	terms to fulfill type-class constraints.
	1 Identity 2 τ-Identity (τ (t	. = t, E; S) ⇒ (E; S) . = τ, E; S) ⇒ (E; S)
	The fun-& pred(-Decompose), Orient and Eliminate rules are the typed analogues to the unifica-
	tion rules used in untyped first-order logic. Note that preprocessing has simplified unification for
	functions and predicates. The remaining rules are only applied if the (τ-)Identity rules are not
	applicable. First I present the κ-, fun-and pred-Decompose rules:
	3 κ 4 fun ( f τ l 1 , . . . , τ l n (t l 1 , . . . , t l m ) (κ(τ 1 l , . . . , τ n l ) . = f τ r 1 , . . . , τ r n (t r 1 , . . . , t r m ), E; S) ⇒ . = κ(τ 1 r , . . . , τ n r ), E; S) ⇒ (τ l 1 . = τ r 1 , . . . , τ l n (τ l 1 . = τ r 1 , . . . , t l 1 . = t r 1 , . . . , E; S) . = τ r n ,E; S) 5 pred (p τ l 1 , . . . , τ l n (t l 1 , . . . , t l m ) . = p τ r 1 , . . . ; τ r n (t r 1 , . . . , t r m ), E; S) ⇒ (τ l 1 . = τ r 1 , . . . , t l 1 . = t r 1 , . . . , E; S)

  = s then there are four cases: either t and s have a function symbol at the top, one of them is a variable and the other is not, or both of them are a variable:• Let t = f τ 1 , . . . , τ n (t 1 , . . . , t m ) and s = g τ s 1 , . . . , τ s n (s 1 , . . . , s m ) both with function symbols at the top. Then they are only unifiable if the top function symbols ( f = g) and the type terms and terms are unifiable. In this case, only the fun-Decompose rule is applicable.• Let t = f τ 1 , . . . , τ n (t 1 , . . . , t m ) have a function symbol at the top and s = u be a variable. In this case, only the Orient rule is applicable.• Let t = u be a variable and s = g τ 1 , . . . , τ n (s 1 , . . . , s m ) have a function symbol at the top.Then they are unifiable only if s does not contain t. In this case, only the Eliminate rule is applicable.• Let t = u t and s = u s both be variables. In this case, only the Eliminate rule is applicable. Suppose that both t and s are type terms. If t = s then only the τ-Identity rule is applicable. Otherwise, if t = s then there are four cases either t and s have a type symbol at the top, one of them is a variable and the other is not, or both of them are a variable:• Let t = κ t (τ t 1 , . . . , τ t n ) and s = κ s (τ s 1 , . . . , τ s n ) both have type symbols at the top. Then they are only unifiable if the top type symbols (κ t = κ s ) are unifiable. In this case, only the κ-Decompose rule is applicable.

	Lemma 3.1.3.8 (Unification Terminates). Applying unification on ({t 1 . = t 2 }; / 0) always terminates.
	Proof. Applying unification decreases the lexicographic ordering on the pair of number of distinct variables and number of symbols occurring in E below a . = obligation. This is not true for the Orient rule, but it can only be applied at most once for each . = obligation.
	Knowing that only one unification rule is applicable per equation simplifies the following
	proofs and thus we show that property now.
	Lemma 3.1.3.9 (At any point in the unification only one unification rule is applicable per
	equation). If (t . = s, E ; S ) and t unifiable with s, then exactly one rule of the unification algorithm is applicable on t . = s.
	Proof. Unification is only possible between predicates, between terms or between types. There
	is only the pred-Decompose rule for predicates, thus only that rule can apply.
	Suppose that both t and s are terms. If t = s then, per definition, only the Identity rule is
	applicable. Otherwise, if t

  τ t m (t 1 , . . . , t n ) and s 1 = Term t 1 , . . . , s i-1 = Term t i-1 and s i KBO t

i and s TKBO t to hold if and only if:

1. s KBO t, or 2. s = Term t, and there exists a function symbol f such that s

  Proof. By induction over the unification rules. The Identity, Decompose and Orient rule do not change S at all. The Eliminate rule introduces a new left hand side variable u to S which cannot be instantiated, because it does not occur in E anymore (Lemma 3.5.1.8). Lemma 3.5.1.10 (Type-Symbol Unification Computes a Unifier). If (t . = s, E ; S ) and t unifiable with s, then exactly one rule of the unification algorithm is applicable on t . = s.

	Lemma 3.5.1.9 (S contains a substitution). Let t 1 , t 2 be two terms, then (t 1 . = t 2 ; / 0) ⇒ Next, I show the algorithm is deterministic for each	. =, i.e. for each unification obligation in E
	exactly one unification rule is applicable.

Lemma 3.5.1.8 (S 's Variables not in E). Let (E; S ) ⇒ (E ; S ) be one unification step, if E does not contain any variable that occurs in the left hand side of an equation of S then E does not contain any variable that occurs in the left hand side of an equation of S .

Proof. By induction over the unification rules. The Identity, Decompose and Orient rules do not change S and S at all and do not change the variable occurring in E and E . The Eliminate rule introduces a new left-hand side variable u in S but instantiates all of u's occurrences in E . It also instantiates u in the remainder of S , but by induction hypothesis u does not occur on the left hand side of the substitution represented by S . Now, I show that the computed mapping S is a substitution, because a unifier is a substitution that makes two terms syntactically equal. * (E; S ) is a series of unification steps then S only contains variable to term mappings.

•

  Let t = u and s = g τ s (s 1 , . . . , s m ). If θ is a unifier for (E, S ), then tθ = sθ. Therefore, θ remains a unifier if we replace t by s. After application of the Eliminate rule, E is E r {t → s} and S is t = s, (S {t → s}). Because we only instantiate t to s and move the uninstantiated obligation t . = s to S , θ remains a unifier.• Let t = u t and s = u s . If θ is a unifier for (E, S ), then tθ = sθ. Therefore, θ remains a unifier if we replace t by s. After application of the Eliminate rule E is E

r {t → s} and S is t = s, (S {t → s}). Because we only instantiate t to s and move the uninstantiated obligation t . = s to S , θ remains a unifier.

  and only if it is maximal in the translated clause, because translated literals are compared by translating them back to type-symbol and comparing them there. b) s ≈ s is the selected literal either in both or in neither because the same selection of literals is used for ts2ut(C) and C.

Thus, if the equality resolution inference is possible for ts2ut(C) if and only if it the inference is possible with C.

  3.3) are:1. sσ s σ and tσ t σ 2. s 2 is not a term variable 3. tσ = s 2 σ and σ is the most general unifier of s and s 2 4. (t ≈ t )σ is strictly maximal in (D ∨ t ≈ t )σ and no literal is selected 5. (s ≈ s )σ is strictly maximal in (C ∨ s ≈ s )σ and no literal is selected I now show why each side condition must also be fulfilled for C and D if it is fulfilled for Cθ and Dθ.

  2.2.7 (Dynamic Refutational Completeness for Purely First-Order Logic). Let N 0 N 1 N 2 • • • be a SupInd run that is fair for SupInd's Superposition rule and N * be its limit. Then each simple state (N A , N IH , N C ) in N * has a purely first-order model if and only if it does not contain the empty clause, i.e. ⊥ ∈ N A ∪ N IH ∪ N C .

  Criterion for Cap Argument Positions Let f be a exhaustively-recursive function symbol whose defining set of equations (ignoring potential side-conditions C i ) can be partitioned into two sets, the recursive equations and the non-recursive equations. 1. f (t 1 , . . . , t n ) ≈ t r (non-recursive, i.e. t r does not have f as top symbol) 2. f (t 1 , . . . , t n ) ≈ f (r 1 , . . . , r n )

Algorithm 3 :

 3 Generalization Input: N A axioms, N IH hypotheses and N C negated conjectures clauses of a simple-state 1 generalizations := new |-state; 2 foreach n C in Preprocess(N A , N H , N C ) do 3 commonterms := compute set of subterms of n C that occur at least twice in n C (at least once if n C is N C ); := c[t 1 → b t , . . . , t n → b t for each t i ∈ S ] for some fresh Skolem constants b t ; := N A [t 1 → b t , . . . , t n → b t for each t i ∈ S ] 7 n IH := N IH [t 1 → b t , . . . , t n → b t for each t i ∈ S ] 8 generalizations += (n A , n IH , n C );9 generalizations += DepPreserve(N A , N IH , N C , n C , b t ); /* Sect. 4.4.2 */

	4	foreach S ⊆ commonterms do
	10 return generalizations;

5 n C 6 n A

Algorithm 6 :

 6 Strengthening Conjectures with Bounds Input: N A axioms, N IH hypotheses and N C negated conjectures clauses of a simple-state 1 strengthenings := new |-state; 2 foreach t occurring in N C and t is of a data type do := κ i (s 1 , . . . , s n ) for fresh Skolem constants si ; cnf (¬N C [t i → t κ ]) ∪ N C [t i → s i ]);In this section I show one example file and Pirate's output on that file. The file is in the DFG format. It is the 38th problem of the IsaPlanner[START_REF] Dixon | Isaplanner: A prototype proof planner in Isabelle[END_REF] benchmark set (Sect. 4.7).

	3	foreach t c that is a cap subterm of t do
	4	boundstates := new &-state;
	5	boundstates += (N A , / 0, N C [t → t c ]);
	6	foreach κ i constructor of t's data type do
	8	foreach s i that is of t's data type do
	9 0, 10 boundstates += (N A , / strengthenings += boundstates;
	11 return strengthenings;
	4.6.7. Example

7

t κ

  strictly smaller than Y. CVC4 is the only other tool capable of proving problem 86 (see Sect. A.1.3 for the full problem and proof output).To the best of my knowledge, Pirate is currently the only tool capable of disproving problem 87 and proving the complex problem 85 (see Sect. A.1.2 and A.1.4 for the full problem and proof output): len(Xs) ≈ len(Ys) =⇒ zip(rev (Xs), rev (Ys)) ≈ rev (zip(Xs, Ys))

I evaluated on Arrow Order, FFT, FTA, Hoare, TypeSafe, StrongNorm and NS Shared[START_REF] Blanchette | Extending Sledgehammer with SMT solvers[END_REF].

16,

[START_REF] Hsiang | Proving refutational completeness of theorem-proving strategies: The transfinite semantic tree method[END_REF][START_REF] Waldmann | Semantics of order-sorted specifications[END_REF] 128, 256, 512, 1024, 2048 and 4096 facts before translation. Note that Sledgehammer can not reliably generate more than 4096 facts (see also comment to Figure3.2)

Note that this is an approximation of only requiring them in larger sides.

Because 0 is a constant and the only base-case constructor, it can be considered as a c-subterm of M, in that case 0 -M ≈ 0 → {1,

2}. CAP 1 would still be {1} because of the other non-recursive equation

i n i t i a l found c o u n t e r ex f o r c a s e Case ( z o f s k f 1 : minus ( minus ( s ( i 1 0 0 2 ) , s k f 1 ) , s ( i 1 0 0 1 ) ) = minus ( s ( i 1 0 0 2 ) , minus ( s k f 1 , s ( i 1 0 0 1 ) ) ) -> . )

Acknowledgements

I would like to thank my thesis advisor Christoph Weidenbach for his constant support, guidance and for introducing me to the world of logic and automated reasoning. I am thankful for the opportunity to work in his group, where I had the freedom to pursue both the theoretical and practical aspects of automated reasoning. I am grateful to my thesis co-advisor Jasmin Christian Blanchette for his numerous discussions and for sharing his expertise on Isabelle and Sledgehammer. I would also like to thank Geoff Sutcliffe, who kindly agreed to review this thesis.

Working on the thesis and with my colleagues in both the Automation of Logic group and the Theorem Proving Group in Munich was an enriching experience. Special thanks go to Tobias Nipkow, for hosting me several times in Munich and allowing me to work for the TU Munich for a year, Uwe Waldmann, for the many times he explained the details of superposition to me, Arnaud Fietzke and Martin Suda, for helping me get started with induction and superposition, Patrick Wischnewski, for his invaluable help navigating and understanding the SPASS source code, Willem Hagemann, for being a sounding board for ideas and philosophical-logical discussions, Martin Bromberger and Mathias Fleury, for proof reading drafts of this thesis, Gabor Alagi, Noran Azmy, Marek Kosta, Evgeny Kruglov, Thomas Sturm, Andrei Popescu, Ching Hoo Tang, Andreas Teucke, Marco Vogt and Tianxiang Lu, for many interesting discussions and interactions. I also want to thank my wife Laura for her love and support.

I would also like to thank the Max Planck Society and the Max Planck Institute for Infor-Without the computing cluster none of my evaluations would have been possible in their current This work was partly supported by International Max Planck Research School, the Saarbrücken Graduate School of Computer Science and the German Research Foundation (DFG), in particular by the DFG Priority Programme 1496 -'Reliably Secure Software Systems (RS3)' and the DFG Project 'Hardening the Hammer'. vii

• In the case that t is a function term f τ (t 1 , . . . , t m ).

Then by construction of tv it holds that tv -1 ( f τ (t 1 , . . . , t m ) = f τ r , τ 1 , . . . , τ n (tv -1 (t 1 ), . . . , tv -1 (t m )) and therefore I V (tv -1 (t)) = I V ( f τ r , τ 1 , . . . , τ n (tv -1 (t 1 ), . . . , tv -1 (t m ))).

By the monomorphic semantics it follows that I V ( f τ r , τ 1 , . . . , τ n (tv -1 (t 1 ), . . . , tv -1 (t m ))) = f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I V (tv -1 (t 1 )), . . . , I V (tv -1 (t m ))). By induction hypothesis we know that for each i it holds that I V (tv -1 (t i )) = I T V T (t i ) and thus it holds that f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I V (tv -1 (t 1 )), . . . , I V (tv -1 (t m ))) = f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I T V T (t 1 ), . . . , I T V T (t m )). From the construction of tv I , we know that f I I / 0 (τ r ), I / 0 (τ 1 ), . . . , I / 0 (τ n ) (I V (t 1 ), . . . , I V (t m )) = f I τ (I V (t 1 ), . . . , I V (t m )), because from the construction of tv we know that there is a bijection between τ and τ r , τ 1 , . . . , τ n . Therefore and from the type-symbol semantics, it follows that f I τ τ (I T V T (t 1 ), . . . , I V T (t m )) = I T V T ( f τ (t 1 , . . . , t m )).

After showing the lemmas for the terms, I can now show the respective clause sets to be equisatisfiable. Again, I start with the direction from monomorphic to type symbol. Lemma 3.5.3.10 (Monomorphic to Type Symbol Structure). Let I be a monomorphic interpretation with the monomorphic structure (U, D, I T , I F ) of a monomorphic clause set N. For any monomorphic variable valuation V, let a type-symbol variable valuation be defined as V T (u ty(τ) ) = V(u τ ). Then, for any monomorphic variable valuation and for the type-symbol interpretation I T with the type-symbol structure (U T , D T , I T T , I T F ) = tv I (U, D, I T , I F ), it holds that for all monomorphic clauses C ∈ N, I V (C) = I T V T (m2ts(C)). Proof. By induction over the interpretation rules for the monomorphic clause C.

• The case C = t ≈ s follows from Lemma 3.5.3.8.

• In the case C = ¬φ. Then I T V T (m2ts(¬φ)) = I T V T (¬m2ts(φ)). By induction hypothesis (and because the definition of the interpretation of ¬ are identical), it follows that I T V T (¬m2ts(φ)) = I V (¬φ). • In the case C = φ l ∨ φ r . Then I T V T (m2ts(φ l ∨ φ r )) = I T V T (m2ts(φ l ) ∨ m2ts(φ r )). By induction hypothesis (and because the definition of the interpretation of ∨ are identical), it follows that I T V T (m2ts(φ l ) ∨ m2ts(φ r )) = I V (φ l ∨ φ r ). • In the case C = ∀u : τ. φ. Then I T V T (m2ts(∀u : τ. φ)) = I T V T (∀u : ty(τ). m2ts(φ)). And by the type-symbol interpretation rules I T V T (∀u : ty(τ). m2ts(φ)) = min e∈I T (ty(τ)) (I T V T [u →e] (m2ts(φ))). Because ty is bijective and by construction of tv I , it holds that I T (ty(τ)) = I T (τ) and in particular V T (u ty(τ) ) = V(u τ ) for each valuation of u.

Thus, it holds that min

. Furthermore, by the induction hypothesis we have

. By the monomorphic interpretation rules we have that min e∈I(τ)

Derive Facts Let N be an arbitrary set of clauses, let cnf (¬N) be the clause normal form of the negation of N and let SupInd * be any finite chain of applications of SupInd's rules.

Unsatisfiability Propagation

Let S be an arbitrary state and let

Structural Induction

Let sk be occurring in N C , let sk be a Skolem constant of a data type and let f 1 , . . . , f n be the data type's constructors.

where Case f i is defined as

sk 1 , . . . , sk m are fresh Skolem constants and the new induction hypotheses (hyps f i ) are defined as

where cnf (¬N C ) is the clause normal form of the negation of N C (the negated conjecture), where the implicit universal quantifiers are placed directly below the negation and where sk must be treated as a constant, i.e. not be replaced by a variable. The other Skolems can be treated as implicit existential quantifications directly below the negation. In Pirate there is an option for both behaviors.

For a simpler presentation, the Structural Induction rule is defined for Skolem constants. To generalize it to Skolem functions, we must add the arguments of the initial Skolem function (sk) to each freshly created Skolem function.

The inferences of the standard superposition calculus are lifted by SupInd's Superposition rule to be inferences on simple states in such a way that inference results are always added to the axiom set N A . Superposition's redundancy is lifted by the Redundancy Elimination rule such that simplified clauses are added to the set their main premise came from.

With induction it is often necessary to guess and prove auxiliary lemmas that would not be derived by first-order inferences, i.e. lemmas with proofs that require induction. Therefore, we allow to add arbitrary clause sets with the Derive Facts rule if they can be shown to follow (by possibly nested induction and first-order reasoning) from the axioms, induction hypotheses and conjecture. The Propagation rules simplifies complex states by collapsing complex states where the premises already have the required unsatisfiablity results. Finally the Structural Induction rules generates the appropriate induction cases with the induction hypotheses, that would otherwise require an induction schema. Because the conjecture was negated and Skolemized, the Structural Induction rule applies to Skolem functions instead of universally quantified variables. Induction preserves the premise's simple state in order to guarantee refutational completeness of each simple state for the purely first-order fragment (i.e. without data-type declarations). In the presence of nested inductions it is not obvious if it is possible to (efficiently) preserve refutational completeness for the purely first-order fragment without preserving the premise's simple state.

Soundness

The rules of the SupInd calculus are sound. Lemma 4.2.2.1 (The Superposition Rule is Sound). The result of the Superposition rule is implied by its premise.

Proof. The superposition calculus is sound, therefore the inferred clause (C ) is a consequence of the premises (C 1 and C 2 ) of the superposition inference. Since the premises (C 1 and C 2 ) are also part of the simple state premise ((N A , N IH , N C )) of the Superposition rule, the resulting simple state ((N A ∪ {C }, N IH , N C )) is a first order consequence of the premise. Proof. The Redundancy Elimination rule RED A replace a subset N of the axiom clause set (N A ) by a clause set N such that N implies N (with respect to the remaining clauses of the simple set, N A ∪ N IH ∪ N C ). Since the clause set N implies the clause set N, the clause set N A ∪ N implies the clause set N A ∪ N. Thus, the resulting simple state of the inference rule is a first-order consequence of the premise.

The proof for the two other Redundancy Elimination rules is analogous. The induction principle justifies the splitting of the conjecture in a case (Case i ) for each datatype constructor ( f i ). All cases have to be shown, i.e. for each case the negated conjecture has to be shown unsatisfiable. Thus, the replacement of sk by f i (sk 1 , . . . , sk m ) in the creation of the cases ((

) is justified by the induction principle (and the negation of the conjecture). The previous induction hypotheses can be treated as axioms, and all axioms can be kept. Thus, it remains to show that the newly introduced induction hypotheses (hyps f i ) are justified.

The induction principle justifies an induction hypothesis for each argument of the same type. Therefore, for each argument sk j of f i (sk 1 , . . . , sk m ) that is of the same type as f i (sk 1 , . . . , sk m ) and an induction hypothesis is added. Since N C is the negated conjecture, to derive the induction hypothesis N C is negated. This justifies the sk j is of sk's type (cnf (¬N C ))[sk → sk j ] part of the induction hypothesis. Because I use strong induction, the induction hypothesis hold for all structurally smaller terms. Therefore, the previous induction hypotheses also hold for all terms structurally smaller terms (than sk), i.e. all arguments of f i . So while the induction hypothesis clauses for the sk j are not yet present, they are justified by previous induction steps. Thus, the sk j is of sk's type N IH [sk → sk j ] part of the induction is permissible.

Refutational Completeness for the First-Order Fragment

Assuming fairness (as defined below), SupInd guarantees that for any simple state that is first-order unsatisfiable it will eventually derive the empty clause.

The purely first-order fragment of polymorphic first-order language with type classes and data types is the part without the data-type declarations (DT ). A run of the SupInd calculus is a sequence of states N 0 N 1 N 2 • • • such that N i+1 follows by an application of a SupInd rule to N i . Let be a well-founded ordering on states. A state N is redundant with respect to a state N if N N and there exists a run such that N • • • N . A SupInd rule is enabled with respect to a state N if all its premises are contained in N and its result is not redundant. A run is fair if for each i and SupInd rule inf that is enabled at N i , there exists a j with j > i such that inf is not enabled in N j .

For all induction cases, every Skolem function is eventually selected for performing induction in some nested induction step.

I expect the heuristic presented above to generally choose good Skolem functions. Nonetheless, each Skolem function that was selected and turns out to be irrelevant causes longer proofs. If such an irrelevant Skolem function is selected for the induction inference, the proof is duplicated (and must therefore be refound) for each of its induction cases. For example, choosing z (in the proof of the associativity conjecture above) before choosing x leads to a proof that is at least twice the size, because it duplicates the successful proof by induction over x for the two cases of induction over z. For an efficient solver, we need a solution that removes or at least reduces the costs of irrelevantly selected Skolem functions. This allows us to always apply the induction rule once per simple state, reducing the search space that needs to be explored.

A solution originates from the tight integration of induction and superposition, which allows us to (immediately) inspect and analyze the (partial) proof for each proven (nested) induction case. This analysis determines which induction steps are necessary and which can be omitted. In general, the proof analysis is (substantially) more efficient than the proof search that results in the proof. The analysis works in two phases. First the proof is minimized by removing unnecessary first-order reasoning steps. An example of a common cause of superfluous first-order reasoning steps is (greedy) rewriting. Then the proof is minimized by removing unnecessary inductive reasoning steps. Let t be a constructor term and z be a Skolem function such that both occur in the proof and t was introduced as a case of the induction inference on z. The analysis checks for each such t if the proof is still correct if t is replaced by z.

Let us return to the current example conjecture, the associativity property. Assume we have already performed two inductions, first on z and then on x and we have discovered a proof for the case where z = s(z') and x = s(x'): Then we can check if one of the induction steps was superfluous:

Induction on z not relevant? Induction on x not relevant? Replay with s(z') → z Replay with s(x')

The replay of the proof is always successful if the term t introduced by induction (here s(z')) only occurs in the instantiated part of the rules used in first-order reasoning. The possibly relevant 3. Fixpoint reached for gcd(N, M): {1, 2} Indeed, both argument positions are cap-argument positions for the greatest common divisor (gcd).

The Bound Strengthening Inference As an initial preprocessing step, all exhaustively recursive functions of the initial axiom set and their cap argument positions are determined by the syntactic criterion introduced above.

The Bound Strengthening inference itself then checks if the conjecture of a simple state contains a term t 1 that has a cap subterm t 2 . Then it creates several new simple states. The first simple state is generated by replacing t 1 by its cap subterm t 2 . The remaining simple "Inverse Step" states are then generated to guarantee that the new simple state implies the original one. Because t 2 is a cap subterm of t 1 , we know that the constructor term corresponding to the interpretation of t 1 is a subterm of the constructor term corresponding to the interpretation of t 2 . Therefore, the simple "Inverse Step" states must ensure that removing (top-level) constructors from the position t 2 occurs in the conjecture is possible. This ensures that all constructor terms from the base-cases up to the cap subterm t 2 fulfill the original conjecture.

The following inference rule extends SupInd to support strengthenings by using known upperbounds and (several) inverse induction steps. It is a special case of the Strengthening rule.

Bound Strengthening Let t 1 be a term of a data type, let t 2 be a cap subterm, let κ 1 , . . . , κ n be the data type's constructors and let A be

Let a be the arity of κ i . Then Step κ i is defined as

where Step κ i , j is defined as ({⊥}, {⊥}, {⊥}) if argument j of κ i is not of the same type as κ i . Otherwise, it is the inverse induction step for argument j of constructor κ i and defined as

where sk 1 , . . . , sk m are fresh Skolem constants and cnf (¬N

In Pirate we apply the Bound Strengthening rule exhaustively to the original simple state each time we apply the Structural Induction inference rule. We apply it to all terms of the simple state's N C that have an cap subterm. clause set and the selected simple-state (lines 3-4). If this results in a proof or disproof the tree is updated, and the corresponding states are removed from states (line 5). If a proof was obtained and the conjecture is not dependent on any side conditions (e.g. the N A and N IH parts of the simple state are empty), then the conjecture can be added to the global axiom clause set N GA (line 6). The simple state is added to the end of the states list (line 7). If the simple state requires inductive reasoning, the tree and as appropriate the states are updated and structural induction and strengthenings are performed (line 9). If the loop terminates the tree contains the result and the annotations necessary to reconstruct a proof.

Superposition

Superposition is applied to the global axiom set and the union of the clause set triple of the currently processed simple state. In addition to the reduction rules implemented for the typed calculus (Sect. 3.4.1), a restricted from of splitting is implemented. Superposition is run with a time limit and a limit on the number of inferences that are performed. The global axiom set and the simple states are updated, i.e. the resulting inferences are added to them. If an empty clause is derived, i.e. the current state is shown unsatisfiable, then the tree is updated accordingly. Additionally, the first-order reasoning steps are recorded for the later proof output. Similarly, when the current conjecture is shown to be invalid, the state is removed from the tree.

Strengthening Conjectures with Bounds

Strengthening conjectures with bounds has two phases and its inference rule is described in section 4.4.3. The first is an initial phase to gather cap argument positions of all function symbols. The second phase is run each time a negated conjecture is strengthened.

Initial Analysis Phase

The first phase determines which function symbols have cap argument positions. This is achieved by initially (before starting the SupInd main loop) computing the structural analysis fixpoint for each function symbol. The fixpoint starts with the assumption that all positions of all functions if t == f (r 1 , . . . , r n ) and r i is not c-subterm of t i and r i has no cap subterm that is a c-subterm of some t i such that i ∈ positions( f ) then 6 positions( f ) := positions( f ) \ { i };

7 else if t r is not c-subterm of some t i and t r has no cap subterm that is a c-subterm of some t i then 8 positions( f ) := positions( f ) \ { i };

9 return positions;

are structurally bigger than their result (line 1). The algorithm then proceeds by iterating over all defining equations (which are marked in the input) to check if they obviously uphold the subterm property (line 3-8). To that end, the right hand side must either be a recursive call to the same function, such that all arguments of the recursive call are smaller than some argument has to wait for the automated prover to process both the axioms and the conjecture. Preprocessing the axioms can be designed in such a way that it does not require the reasoning over the axioms to start from scratch for every conjecture. Such a integration feature preprocessing would gives an automated theorem prover more time, then the current 30 seconds default in Sledgehammer, to process the axioms. Thus, more of the time the user is waiting can be spent processing the actual conjecture (instead of unchanging axioms).

For structural inductions, detecting and removing invalid properties is important. For users of proof assistants, the information that they are proving a non-theorem can avoid wasted effort. Extending the rather simple detection to finding counter examples used in SupInd, to a more general approach that is also useful for purely first-order settings, would be a nice addition to any integration between proof assistants and automatic tools.

The integration of theories, such as (linear) arithmetic into superposition that also supports a type system would further help automating some tasks that arise in proof assistants. It would also be required to fully support the SMT-based format for the TIP benchmark set. An example of such integration is the hierarchical superposition calculus.

Besides structural induction over data types, another very common induction schema is rule induction, used to proof conjectures over inductive definitions, such as inductively defined sets or predicates. Rule induction is useful, for example, to proof that a property holds for all even numbers, when even numbers are inductively defined. Extending the SupInd calculus further to enable induction over such definitions would further help the integration between proof assistants and automated theorem provers.

A. Example Files with Pirate's Proofs

A. 1. IsaPlanner In this section I present the complete problems mentioned in the chapter on Induction. A commented example (problem 38) can be found in section 4.6.7.

A.1.1. Problem 50 Input

The problem in DFG format, edited for better readability. l i s t o f d e c l a r a t i o n s . f u n c t i o n ( z , n a t ) . f u n c t i o n ( s , ( n a t ) n a t ) . f u n c t i o n ( n i l , [A] , l i s t (A) ) . f u n c t i o n ( cons , [A] , (A, l i s t (A) ) l i s t (A) ) . f u n c t i o n ( minus , ( n a t , n a t ) n a t ) . f u n c t i o n ( l e n , [A] , ( l i s t (A) ) n a t ) . f u n c t i o n ( t a k e , [A] , ( n a t , l i s t (A) ) l i s t (A) ) . f u n c t i o n ( b u t l a s t , [A] , ( l i s t (A) ) l i s t (A) ) . d a t a t y p e ( n a t , z , s ) . d a t a t y p e ( l i s t , n i l , c o n s ) . e n d o f l i s t . l i s t o f f o r m u l a e ( a x i o m s ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus ( z , Y) , z ) ) , m i n u s z l e f t ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus (X, z ) , X) ) , m i n u s z r i g h t ) . formula ( f o r a l l ( [ Y : n a t , X : n a t ] , e q u a l : l r ( minus ( s (X) , s (Y) ) , minus (X, Y) ) ) , m i n u s s ) .

formula ( f o r a l l s o r t s ( [ A] , e q u a l : l r ( l e n <A>( n i l <A>) , z ) ) , l e n n i l ) .

Output

The boxed parts are the unedited output of Pirate (except for adding bold for keywords). S t a r t i n g s c a l a v e r s i o n 2 . 1 1 . 2

The problem contains two negated-conjecture clauses.