Monsieur Wei-Ngan Chin

Mihaela Madame

Sighireanu

The motivation behind this thesis stems from verification tasks that check whether a given piece of code conforms to its specification. Properties of a certain state of the program are described through formulae pertaining to a chosen underlying logic, and it is often needed to test whether they hold and, more importantly, whether they entail the target specification. Satisfiability modulo theory (SMT) solvers are commonly used in practice to answer such queries. They are powerful tools due to their ability to combine decision procedures for several different theories.

We want to provide proof systems for entailments encountered when verifying programs that work with recursive data structures. This adds a layer of complexity to the entailment problem, as the formulae describing program states will need to make use of inductively defined predicates characterizing the data structures. Moreover, the programs will use dynamic allocation to create as many instances of the data as needed. Thus, we are interested in using separation logic to express properties of these programs, as it is a framework that addresses many of the difficulties posed by reasoning about dynamically allocated heaps.

The main contribution of this thesis is a sound and complete proof system for entailments between inductively defined predicates. We give a generalized cyclic proof system for firstorder logic, which uses the principle of infinite descent to close recurring branches of a proof, and then adapt it to separation logic. In order to ensure soundness and completeness, four semantic restrictions are introduced, and we analyse their decidability and complexity. We also propose a proof-search semi-algorithm that becomes a decision procedure for the entailment problem when the semantic restrictions hold. This higher-order reasoning about entailments requires first-order decision procedures for the underlying logic when applying some inference rules and during proof search. To this end, we introduce two decision procedures for separation logic, considering the quantifierfree and the ∃ * ∀ * -quantified fragments. We study the decidability and complexity of these fragments and show evaluation results of their respective decision procedures, which were integrated in the open-source, DPLL(T )-based SMT solver CVC4.

Finally, we also present an implementation of our proof system for separation logic, which makes use of the above decision procedures in CVC4. Given inductive predicate definitions and an entailment query as input, a warning is issued when one or more semantic restrictions are violated. If the entailment is found to be valid, the output is a proof. Otherwise, one or more counterexamples are provided.

Résumé

Cette thèse est motivée par les tâches de verification formelle qui établissent si un morceau de code donné est conforme à sa spécification. Les propriétés des états du programme sont décrites par des formules appartenant à la logique sous-jacente choisie, et il est souvent nécessaire de tester si elles sont correctes et, plus important encore, si elles impliquent la spécification cible. Les solveurs pour la satisfiabilité modulo des théories (SMT) sont utilisés dans la pratique pour répondre à de telles requêtes. Ce sont des outils puissants grâce à leur capacité de combiner des procédures de décision pour plusieurs théories.

Nous voulons fournir des systèmes de preuve pour les problèmes rencontrés lors de la vérification des programmes qui utilisent des structures de données récursives. Cela ajoute une couche de complexité au problème d'implication, car les formules décrivant les états du programme devront se servir de prédicats définis de façon inductive, qui caractérisent les structures de données. De plus, les programmes utiliseront l'allocation dynamique pour créer autant d'instances de données que nécessaire. D'où l'intérêt d'utiliser la logique de séparation pour exprimer les propriétés de ces programmes, car c'est un cadre qui répond aux plusieurs difficultés posées par le raisonnement sur les tas alloués dynamiquement.

La contribution principale de cette thèse est un système de preuve correct et complet pour les implications entre les prédicats définis de façon inductive. Nous donnons un système de preuve cyclique généralisé pour la logique du premier ordre, qui utilise le principe de la descente infinie pour fermer les branches récurrentes d'une preuve, puis nous l'adaptons à la logique de séparation. Afin d'assurer la correction et la complétude, quatre restrictions sémantiques sont introduites et nous analysons leur décidabilité et leur complexité. Nous fournissons également un semi-algorithme de recherche de preuve qui devient une procédure de décision pour le problème d'implication lorsque les restrictions sémantiques sont respectés.

Ce raisonnement d'ordre supérieur sur les implications nécessite des procédures de décision de premier ordre pour la logique sous-jacente lors de l'application de certaines règles d'inférence et lors de la recherche des preuves. À fin, nous introduisons deux procédures de décision pour la logique de séparation, en considérant le fragment sans quantificateurs et le fragment quantifié ∃ * ∀ * . Nous étudions la décidabilité et la complexité de ces fragments et montrons les résultats d'évaluation de leurs procédures de décision, qui ont été intégrées dans le solveur SMT open source CVC4.

Introduction

Program verification is the use of formal and mathematical methods to provide proof that a program meets its specification. The importance of specifying and verifying code lies in the numerous advantages that it brings. The formal specification of a program, usually a formula written in a suitable logic, can serve both as documentation and a guideline for implementation. It also dictates that a lot more care and scrutiny be put on software requirements, thus contributing to the elimination of inaccuracies during early development stages, when the cost of changes is much lower compared to later stages. Moreover, verification can help reduce the time and cost of testing, debugging and maintaining big systems, since code that is specified and verified is much easier to understand, reuse and maintain. In the case of safety-critical systems, the proof that the code meets its specification serves as certification for correct performance at all times.

Early approaches to program verification used manual annotation with assertions describing the state of the execution. A rigorous formalization of this process is given by Hoare logic, introduced by C. A. R. Hoare [START_REF] Hoare | An axiomatic basis for computer programming[END_REF] and based on previous work by Robert W. Floyd, who proposed a similar system for flowcharts [START_REF] Floyd | Assigning meanings to programs[END_REF]. Hoare logic is a formal system used to reason about Hoare triples {P }C{Q}, where C is a piece of code, P is a formula called the precondition, describing the state before C executes, and Q is a formula called a postcondition, describing the state after C executes.

Example 1. Consider a function swap(x, y), which swaps the values of the variables x and y. We would like such a function to satisfy the specification given by the triple {x = x 0 ∧ y = y 0 } swap(x, y) {x = y 0 ∧ y = x 0 }, where x 0 and y 0 are constants denoting the initial values of x and y.

However, manually annotating programs required a substantial effort from the user and was prone to human mistakes. As software complexity increased and verification techniques advanced, automated methods gained in popularity. It has become very easy and cheap to automatically compute the postcondition for an entire block of code starting from the precondition (or vice versa) using deduction rules. The focus has shifted from manual annotation to automated verification of entire functions or components given very little user input.

Decision procedures are building blocks that lie at the basis of automated verification. They are algorithms that, given a decision problem (i.e. a problem that can be posed as a yes or no question of the input, usually formulae limited to a particular theory), terminate with a correct answer [START_REF] Kroening | Decision Procedures: An Algorithmic Point of View[END_REF]. Given a problem, we are interested in its decidability and we want a clear definition for the decidable fragment of the underlying theory. Given a decision procedure for a problem, we want it to be sound (i.e. every instance proven by the procedure is valid) and complete (i.e. every valid instance can be proven by the procedure).

Contents

In practice, however, the decidable theory fragment that guarantees completeness can be quite restrictive and lacking in expressiveness. In consequence, we want a decision procedure to be general enough that it can be run on any instance of a problem. Then, soundness is enough to give us a semi-algorithm that might not terminate on some inputs, but can still provide a correct answer on others. Additionally, a warning can be issued to the user when termination is not guaranteed for the given input.

From a practical standpoint, the usefulness of decision procedures is highlighted by satisfiability modulo theory (SMT) solvers. They are very powerful reasoning tools, able to combine decision procedures for different theories, while preserving their soundness and completeness. It is common practice for software verifiers to translate any kind of assertion (e.g. preconditions, postconditions or loop conditions) into SMT formulae and use an SMT solver to determine whether the properties can hold.

Proving entailments is a problem that regularly arises during these verification tasks due to the rule of consequence: if a piece of code satisfies precondition P and postcondition Q, then it also satisfies precondition P and postcondition Q if P |= P and Q |= Q . Variations of this rule take into account only one of these entailments and either strengthen P with P or weaken Q with Q . In practice, proving that a program conforms to a given specification can be done by starting with the given precondition, computing the strongest postcondition of the code and then proving that it entails the postcondition from the specification. Conversely, we can start with the given postcondition, compute the weakest precondition of the code and then prove that it is entailed by the precondition from the specification. We try to verify that it satisfies the required specification by starting with the precondition and computing its strongest postcondition. Because x = x 0 + y 0 -(x 0 + y 0 -y 0 ) ∧ y = x 0 + y 0 -y 0 |= x = y 0 ∧ y = x 0 , we can conclude that this implementation of swap(x, y) meets its specification.

Function calls also introduce the necessity of proving entailments, as we need to check that the formula describing the state before the function call entails the precondition from the function specification. This ensures the safety of the function call and that the postcondition given by the function specification will hold afterwards.

Example 3. If the state before a call of swap(x, y) from Example 1 is described by the formula x = x 0 ∧y = y 0 ∧x 0 < y 0 , then, because x = x 0 ∧y = y 0 ∧x 0 < y 0 |= x = x 0 ∧y = y 0 , we can safely call the function and the triple {x = x 0 ∧ y = y 0 ∧ x 0 < y 0 } swap(x, y) {x = y 0 ∧ y = x 0 } is true.

Modern software is required to handle data in a systematic fashion and to adapt to any amount of information. This reflects onto the formulae that describe program states during verification -they must be able to capture complex data properties. Thus, the ability to arrange data into suitable data structures is essential. As defined by Cormen, data structures represent a way to organize data in order to facilitate access and modifications [START_REF] Thomas | Introduction to Algorithms[END_REF]. Of particular interest are recursive data structures, due to their ubiquitous presence in real-life software.

We can distinguish two tiers when it comes to recursive data structures. Firstly, there is a higher tier of inductive data types, which are explicitly supported by functional languages. They represent an abstraction for the lower, concrete tier of more classic recursive structures used by imperative programming languages, such as linked lists, stacks, queues, and several types of trees that may be balanced or partially balanced such as binary search trees, AVL trees, 2-3 trees or red-black trees [START_REF] Thomas | Introduction to Algorithms[END_REF].

Inductively defined predicates can be used to describe recursive data types and, in the case of programs that use dynamic allocation, they can also specify the shape of the memory where the structures are stored. Thus, the ability to automatically reason about inductive predicates becomes an important tool for program verification. Furthermore, decision procedures that incorporate inductive predicates are essential for reasoning at both the abstract and concrete data structure tiers.

Example 4. Perhaps the simplest example of an inductive predicate is the one for natural numbers that uses the successor function succ from Peano arithmetic: Natural(x) ::= x = 0 | ∃y . x = succ(y) ∧ Natural(y)

Similarly, we can define predicates that describe even and odd natural numbers: Even(x) ::= x = 0 | ∃y . x = succ(y) ∧ Odd(y) Odd(x) ::= ∃y . x = succ(y) ∧ Even(y) Abstract data structures, as proposed by Hoare [START_REF] Hoare | Recursive data structures[END_REF][START_REF] Oppen | Reasoning about recursively defined data structures[END_REF], have an associated constructor function c and k selector functions s 1 , . . . , s k , which satisfy abstract structural properties referring to:

(i) Construction: c(s 1 (x), . . . , s k (x)) = x;

(ii) Selection: s i (c(x 1 , . . . , x k )) = x i for 1 ≤ i ≤ k;

(iii) Acyclicity: s i (x) = x for 1 ≤ i ≤ k, s i (s j (x)) = x for 1 ≤ i, j ≤ k, . . . . These types can be easily defined in first-order logic under the Herbrand interpretation. Alternatively, extensions of first-order logic with recursive definitions, such as Dryad [START_REF] Parthasarathy Madhusudan | Recursive proofs for inductive tree data-structures[END_REF], have been introduced.

Example 5. A well-known implementation of an abstract data structure is the list in LISP, with constructor cons and selectors car and cdr. A list is either nil or constructed using cons by prepending an element to another list. The selector car returns the first element of a list and the selector cdr returns the rest of the list. An inductively defined predicate for this list would be list(x) ::= x = nil | ∃y, z . x = cons(y, z) ∧ list(z)

Note how inductive definitions can only cover the construction axioms, but not selection and acyclicity.

Since the amount of data a program has to work with is hardly ever predetermined, dynamic allocation is used to create as many instances as needed. Reasoning about dynamically allocated heaps poses several difficulties. Expressing the state of the memory within a formula is hard, as it needs to cover the properties of the unbounded heap, while also taking care of other aspects such as aliasing and reachability. Furthermore, it has been observed that, in practice, pre-and postconditions can become very large and complex, describing parts of the heap that a function, for instance, does not touch, but whose properties have to be carried through the body of the function during verification.

Separation logic is a framework introduced by Ishtiaq, O'Hearn, Reynolds and Yang [START_REF] Samin | BI as an assertion language for mutable data structures[END_REF][START_REF] O'hearn | Local reasoning about programs that alter data structures[END_REF][START_REF] Reynolds | Separation logic: A logic for shared mutable data structures[END_REF] that emerged to address these issues. Its separating operators together with the frame rule enable local reasoning by breaking down the heap into disjoint parts and allowing only those manipulated by a certain portion of the code to be taken into consideration while performing verification tasks. Example 6. Consider swap SL , a variant of the swap function from Example 1 that works with variables representing memory locations and swaps their content. Its specification is given by the triple {x → x 0 * y → y 0 } swap SL (x, y) {x → y 0 * y → x 0 }. The → predicate indicates a single allocated cell and the * connective indicates two disjoint heaps (i.e. heaps in which two disjoint sets of locations are allocated). The implementation and verification of swap SL are done in a similar fashion as in Example 2, the difference being that, instead of variable assignment, we use mutation to change the values stored at the addresses indicated by the variables x and y.

Moreover, switching from first-order logic under the canonical interpretation to separation logic allows for more expressiveness when defining recursive data structures. Instead of being limited to types that can only be represented as trees, separation logic allows us to define more complex and realistic data structures, such as doubly linked lists and trees with parent pointers or linked leaves.

Example 7. Structurally, a separation logic definition for a doubly-linked list is analogous to the LISP definition of a list from Example 5 -it is either empty or obtained by prepending an element to another list. The difference lies in how the focus is shifted towards the heap in which the list is allocated. For the former case, the head of the list x is nil and nothing is allocated in the heap. For the latter case, the head of the list points to the next and previous locations y and p, and, disjointly, there is a doubly-linked list starting at y with previous location x.

dll(x, p) ::= x = nil ∧ emp | ∃y . x → (y, p) * dll(y, x) Defining a binary tree is similar. Either the root is nil and the heap is empty, or the root is allocated and points to the left and right subtrees. This definition of a tree can be expanded to obtain a binary tree with at least one allocated node and linked leaves (i.e. there is a linked list from its leftmost leaf to its rightmost leaf). tree ll (x, ll, lr) ::= x = ll ∧ x → (nil, nil, lr)

| ∃y, z, u . x → (y, z, nil) * tree ll (y, ll, u) * tree ll (z, u, lr)

Contributions

The main contribution of this thesis targets proof systems for entailments involving inductively defined predicates. Influenced by an antichain-based method designed for checking language inclusion of nondeterministic finite tree automata [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF], we build a generic cyclic proof system for first-order logic, which we later adapt to separation logic. The actions performed by our proof system are generalized to fit a wider class of entailment problems, but certain successions of steps can be translated back to those of the above language inclusion check. A key aspect is the reliance on the principle of Infinite Descent [START_REF] Bussey | Fermat's method of infinite descent[END_REF], initially formalized by Fermat, which is ubiquitous in cyclic proof systems [START_REF] Brotherston | Sequent calculi for induction and infinite descent[END_REF]. In short, this principle allows us to close recurring branches of a proof on the premise that, if a counterexample were to be discovered on that branch, then it would lead to an infinite sequence of strictly decreasing counterexamples in a well-founded domain, which constitutes a contradiction.

Since language inclusion is decidable for nondeterministic finite tree automata [12, Corollary 1.7.9], our proof system is sure to be complete for entailment problems equivalent to those of this restricted class. In consequence, we tried to establish some boundaries for the inductive predicates within which the proof system remains sound and complete for more general problems. As a result, we obtained one semantic condition that ensures soundness, and three additional other restrictions that warrant completeness. All four constraints can be checked using existing decision procedures, with varying complexities dictated by the chosen underlying logic. This contrasts with other similar approaches, in which the inductive predicate definitions are bounded by syntactic constraints.

Multiple inference rules from our proof system rely on existing decision procedures for the non-inductive fragment of the underlying logic. In this sense, there are extensive, wellestablished results for first order logic [START_REF] Comon | Equational problems and disunification[END_REF][START_REF] Pichler | On the complexity of equational problems in CNF[END_REF], but this is not also the case for separation logic. Therefore, we provide two decision procedures geared towards the quantifier free and the ∃ * ∀ * -quantified fragments of separation sogic, respectively. We study the decidability and complexity of the satisfiability problem in both of these fragments. Furthermore, these procedures were integrated in the DPLL(T )-based SMT solver CVC4 and we show the results of their performance evaluation.

Finally, we present an entailment checker tool, Inductor, which implements our proof search method for the specialized separation logic proof system. Inductor is written in C++ and utilizes our dedicated decision procedures for separation logic from CVC4. Given a proof search strategy, along with an SMT-LIB script containing inductive predicate definitions and entailments that need to be checked, Inductor uses a compact tree structure to explore all the possible derivations enabled by the strategy, in a breadth-first fashion. The search stops whenever a proof or a counterexample is discovered and the output is either a successful one, accompanied by the proof, or an unsuccessful one, supported by the counterexample. The result of the search may also be inconclusive, when all possibilities are explored without yielding either a proof or a counterexample. The search strategy and whether the inductive system satisfies the constraints ensuring soundness and completeness are key factors that can lead to such situations. Appropriate warnings are displayed whenever one or more of the constraints are violated.

Organization

This thesis studies complete proof systems for entailments involving inductive predicates, in both first-order logic and separation logic. Chapter 1 introduces the syntax and semantics of Contents inductive systems of predicates, while Chapter 2 presents proof systems for the entailment of predicates defined by an inductive system, together with the necessary restrictions that an inductive system needs to satisfy in order to allow for the soundness and completeness of the proof system. Adjacently, Chapter 3 focuses on decision procedures for separation logic in SMT, for both the quantifier-free and the ∃ * ∀ * -quantified fragments. Chapter 4 describes an implementation for our proof system targeting inductive entailments in separation logic, which employs the decision procedures from Chapter 3, and then goes on to analyse some insightful case studies.

Notations

The following notations will be frequently used throughout this work:

-[i, j], [i] -For two integers 0 ≤ i ≤ j, [i, j] denotes the set {i, i + 1, . . . , j} and [i] is shorthand for [1, i], with [0] being the empty set;

-||S||-Given a finite set S, ||S|| denotes its cardinality;

-P(S), P fin (S) -Given a set S, P(S) denotes its powerset and P fin (S) the set of finite subsets of S;

-dom(f ), img(f ) -For a (total or partial) mapping f : A → B, dom(f ) = A denotes the set of values on which f is defined and img(f ) = f (dom(f )) ⊆ B is the set of values in the range of f ; -B A -For two sets A and B, B A denotes the set of all functions f : A → B;

-f n -For a function f : A → B and n ∈ N, f n denotes the result of composing f with itself n -1 times. By convention, f 0 = id A (i.e. the identity function on the domain of f ) and f 1 = f ; -N, Z, R -We use N, Z, R to denote the sets of natural, integer and real numbers, respectively;

-{E i } n i=1 -For conciseness, we use this notation to mean the set {E 1 , . . . , E n } (or, equivalently, {E i | i ∈ [n]}), where each E i is an element indexed in some way by i ∈ [n]; -f↓ D -Given a function f , we use this notation to refer to its restriction to the domain D ⊆ dom(f ).

s, s -We use s = {s 1 , . . . , s n } and s = s 1 , . . . , s n for sets and ordered tuples, respectively. Given a tuple s, we denote its length by ||s||, the element at position i ∈ [||s||] by pos i (s), and the set of all variables in s by set(s) = {x | x = pos i (s) for some i ∈ [||s||]}. We call a tuple s unique when each of its elements occurs only once (i.e. ||s|| = ||set(s)||). Given two tuples s = s 1 , . . . , s n and s = s 1 , . . . , s m , we use s • s to denote their concatenation, i.e. s • s = s 1 , . . . , s n , s 1 , . . . , s m .

Chapter 1

Inductive Systems

In this chapter, we first introduce basic syntax and semantics for both first-order logic (Section 1.1) and separation logic (Section 1.2). We consider general first-order theories and show how separation logic formulae can be built on top of them. We then define systems of inductive definitions, together with their (least) solutions (Section 1.3), for a fixed firstorder theory and a more restricted class of separation logic formulae. Lastly, we describe the entailment problem for inductive systems and show how it is undecidabile under several interpretations (Section 1.4).

1.1 First-Order Logic (FOL)

Syntax

We introduce the syntax of first-order logic (FOL) in the context of a pair Σ = (Σ s , Σ f ), which we call a signature, such that:

• Σ s = {σ 1 , σ 2 , . . .} is a set of sort symbols. We assume the existence of a location sort Loc ∈ Σ s and a boolean sort Bool = { , ⊥} ∈ Σ s , where we write and ⊥ for the constants true and false, respectively;

• Σ f = {f, g, h, ...} is a set of function symbols. For a function symbol f σ1...σnσ , n ≥ 0 is its arity and σ 1 . . . σ n σ is its signature, where σ 1 , . . . , σ n ∈ Σ s are the sorts of its arguments and σ ∈ Σ s is the sort of its result. A function symbol with arity 0 is a constant symbol c σ of sort σ ∈ Σ s . We omit specifying the signature of a function symbol when it is not important.

Let Var = {x, y, z, ...} be a countable set of first-order variables. Each variable x σ ∈ Var has an associated sort σ ∈ Σ s . As we do with function symbols, we omit the sort of a variable if it is not necessary. We write x, y, z, . . . ⊆ Var and x, y, z, . . . ∈ n∈N Var n for sets of first-order variables and tuples of first-order variables, respectively. Definition 1.1.1 (Term). A term t of sort σ ∈ Σ s , denoted as t σ , over a signature Σ (also called a Σ-term) is defined recursively by the grammar:

t σ ::= x, x σ ∈ Var (variable) | c, c σ ∈ Σ f (constant)
| t 1 , . . . , t n , t σ1 1 , . . . , t σn n terms, σ = σ 1 × . . . × σ n (tuple)

| f (t 1 , . . . , t n ), f σ1...σnσ ∈ Σ f , t σ1 1 , . . . , t σn n terms (function application)

Any variable or constant symbol of sort σ is a term of sort σ. If t 1 , . . . , t n are terms of sorts σ 1 , . . . , σ n and f σ1...σnσ ∈ Σ f , then t 1 , . . . , t n is a term of sort σ 1 ×. . .×σ n and f (t 1 , . . . , t n ) is a term of sort σ.

We denote by T Σ (x) the set of all terms constructed using function symbols in Σ f and variables in the set x and extend this notation to tuples x such that T Σ (x) = T Σ (set(x)). We write T Σ for the set T Σ (∅) of ground terms, which contain no variable occurrences. Definition 1.1.2 (First-order formula). A first-order formula over a signature Σ (also called a Σ-formula) is defined recursively by the grammar:

φ FOL ::= (true) | ⊥ (false) | t, t Bool term (boolean term) | t 1 ≈ t 2 , t σ 1 , t σ 2 terms (equality) | ¬ψ FOL , (negation)
| ψ FOL 1 ∧ ψ FOL 2 , (conjunction) | ψ FOL 1 ∨ ψ FOL 2 , (disjunction) | ∃x . ψ FOL , x ∈ FV(ψ FOL ) (existential quantification) | ∀x . ψ FOL , x ∈ FV(ψ FOL ) (universal quantification)
The constants and ⊥, a boolean term, and the equality between two terms of the same sort are FOL formulae. The negation, conjunction, disjunction, existential and universal quantification of FOL formulae are also FOL formulae.

For a formula φ, we denote by FV(φ) the set of variables not occurring under the scope of a quantifier in φ. Writing φ(x 1 , . . . , x n ) means that n i=1 set(x i ) ⊆ FV(φ), where n ≥ 0. These notations are lifted to sets of formulae F such that FV(F ) = φ∈F FV(φ) and F (x 1 , . . . , x n ) means that n i=1 set(x i ) ⊆ FV(F ), where n ≥ 0. Given a formula φ and a tuple of variables x = x 1 , . . . , x n (a set x = {x 1 , . . . , x n }) we use ∃x . φ (∃x . φ) as a shorthand for ∃x 1 . . . ∃x n . φ. We do the same for ∀x . φ (∀x . φ). For formulae φ, ψ and ψ , we denote by φ[ψ] the fact that ψ is a subformula of φ and by φ[ψ /ψ] the result of replacing ψ with ψ in φ. We also write φ ⇒ ψ for ¬φ ∨ ψ.

We also introduce variable substitutions, which will be useful in defining certain properties of inductive systems. Definition 1.1.3 (Substitution and flat substitution). Given sets of variables x and y, a substitution θ : x → T Σ (y) maps each variable in x to a term in T Σ (y). We denote the image of x under the substitution θ by xθ

= {θ(x) | x ∈ x}. A substitution θ is flat if Varθ ⊆ Var, i.e. each variable is mapped to a variable. A flat substitution θ : x → y is injective if, for all x 1 , x 2 ∈ x, θ(x 1 ) = θ(x 2 ) implies x 1 = x 2 .
A flat substitution is surjective if for any y ∈ y there exists x ∈ x such that θ(x) = y or, in other words, xθ = y.

For a formula φ(x), we denote by φθ the result obtained by replacing each occurrence of x ∈ x in φ with the term θ(x). This notation is lifted to sets of formulae such that

F θ = {φθ | φ ∈ F }.

Semantics

The semantics of FOL formulae are defined using interpretations of the sorts and functions in the signature Σ, and valuations of the variables in Var. Definition 1.1.4 (Interpretation). An interpretation I for Σ (also called a Σ-interpretation) maps each sort symbol σ ∈ Σ s to a non-empty set σ I , each function symbol f σ1...σnσ ∈ Σ f with n > 0 to a total function f I : σ I 1 × . . . × σ I n → σ I , and each constant symbol c σ ∈ Σ f to an element of σ I .

Let I be an interpretation, f σ1...σnσ a function symbol and α : σ

I 1 × . . . × σ I n → σ I a function. We write I[f ← α] for an interpretation such that: (i) I[f ← α](σ) = I(σ) for any sort σ ∈ Σ s , (ii) I[f ← α](f ) = α, and (iii) I[f ← α](g) = g I for any g ∈ Σ f with g = f .
We extend this notation to tuples f = f 1 , . . . , f n of function symbols and α = α 1 , . . . , α n of functions and write

I[f ← α] for the interpretation I[f 1 ← α 1 ] . . . [f n ← α n ].
Definition 1. 1.5 (Valuation). Given an interpretation I, a valuation ν maps each variable x σ ∈ Var to an element of σ I .

We use Val = σ∈Σ s σ I to refer to the set of all possible sort values under the interpretation I. Also, we denote by V I the set of all possible valuations under I. Given a valuation ν, a tuple of variables x = x 1 , . . . , x n , and a set of variables x, we write ν(x) for the tuple ν(x 1 ), . . . , ν(x n ) and ν(x) for the set {ν(x) | x ∈ x}.

Let I be an interpretation, ν ∈ V I a valuation, x σ ∈ Var a variable, and α ∈ σ I a value. We write ν[x ← α] for a valuation such that: (i) ν[x ← α](x) = α, and (ii) ν[x ← α](y) = ν(y) for any y ∈ Var with y = x. We extend this notation to tuples x = x 1 , . . . , x n of variables and α = α 1 , . . . , α n of values, writing ν

[x ← α] for the valuation ν[x 1 ← α 1 ] . . . [x n ← α n ].
Definition 1.1.6 (Interpretation of a term). Given an interpretation I and a valuation ν ∈ V I , we denote by t I ν the interpretation of t, defined inductively on the structure of t:

x I ν = ν(x), x σ ∈ Var c I ν = c I , c σ ∈ Σ f t 1 , . . . , t n I ν = t 1 I ν , . . . , t n I ν , t σ1 1 , . . . , t σn n terms (f (t 1 , . . . , t n )) I ν = f I (t 1 I ν , . . . , t n I ν ), f σ1...σnσ ∈ Σ f , t σ1 1 , . . . , t σn n terms
In other words, the interpretation of t relative to I and ν is obtained by replacing each function symbol f occurring in t by its interpretation f I and each variable x occurring in t by its valuation ν(x).

Knowing how to interpret terms when given a valuation, as per Definition 1.1.6, we can further extend the notion of interpretation to first-order formulae. Definition 1.1.7 (Semantics of first-order formulae). Given an interpretation I and a valuation ν ∈ V I , we write I, ν |= φ if the first-order formula φ is interpreted to true under I and ν. This relation is defined inductively on the structure of φ:

I, ν |= always holds I, ν |= ⊥ never holds I, ν |= t iff t I ν = , t Bool term I, ν |= t 1 ≈ t 2 iff t 1 I ν = t 2 I ν , t σ 1 and t σ 2 terms I, ν |= ¬ψ iff I, ν |= ψ does not hold I, ν |= ψ 1 ∧ ψ 1 iff I, ν |= ψ 1 and I, ν |= ψ 2 I, ν |= ψ 1 ∨ ψ 1 iff I, ν |= ψ 1 or I, ν |= ψ 2 I, ν |= ∃x . ψ iff I, ν[x ← α] |= ψ, x σ ∈ FV(ψ), for some α ∈ σ I I, ν |= ∀x . ψ iff I, ν[x ← α] |= ψ, x σ ∈ FV(ψ), for any α ∈ σ I
Using these semantics, we define satisfiability and entailment for FOL formulae under a given interpretation I. Definition 1.1.8 (Satisfiability and validity). An FOL formula φ is satisfiable in the interpretation I if there exists a valuation ν such that I, ν |= φ and unsatisfiable otherwise. If I, ν |= φ for any ν, then φ is valid and ¬φ is unsatisfiable. Definition 1.1.9 (Entailment and equivalence). Given FOL formulae φ and ψ, we write φ |= I ψ and say that φ entails ψ in the interpretation I if and only if I, ν |= φ implies I, ν |= ψ, for any valuation ν. We call φ and ψ equivalent whenever φ |= I ψ and ψ |= I φ.

We encapsulate all the notions pertaining to FOL into a first-order theory. Definition 1.1.10 (First-order theory). A first-order theory is a pair T = (Σ, M) such that Σ is a signature and M is a non-empty set of (I, ν) pairs, called the models of T , where I is a Σ-interpretation and ν ∈ V I is a valuation.

Given a first-order theory T = (Σ, M), any Σ-term t can also be called a T -term and, similarly, any Σ-formula φ can also be called a T -formula. Throughout the rest of Chapter 1 and also in Chapter 2, we only refer to satisfiability and entailment under a specific interpretation (Definitions 1.1.8 and 1.1.9). In Chapter 3, when discussing the satisfiability of separation logic formulae built on top a first-order theory, we refer to the more general Definitions 1.1.11 and 1.1.12, where multiple interpretations can be considered.

= (Σ, M), a T -formula φ is T -satisfiable if [[φ]] T = ∅, and T -unsatisfiable otherwise. If φ is T -satisfiable if and only if ψ is T -satisfiable, then φ and ψ are equisatisfiable in T . If [[φ]] T = M, then φ is T -valid and ¬φ is T -unsatisfiable.

Separation Logic (SL) 1.2.1 Syntax

The syntax for separation logic (SL) is built upon the syntax for FOL, defined in Section 1.1.1. We consider a first-order theory T = (Σ, M) such that Σ s contains the sorts Loc and Data, while Σ f contains a special constant nil Loc . Definition 1.2.1 (Separation logic formula). A separation logic formula over the first-order theory T = (Σ, M), also called an SL(T )-formula, is defined recursively by the grammar:

φ SL ::= (true)
The true and false constants, a boolean T -term, and the equality between two T -terms are SL(T ) formulae. The two new atoms describing empty and singleton heaps are also SL(T ) formulae. The negation, conjunction, disjunction, separating conjunction and implication, existential and universal quantification of SL(T ) formulae are SL(T ) formulae as well.

If an SL(T )-formula contains at least one occurrence of emp, →, * or -- * , it is called a spatial formula. Otherwise, it is a pure formula. We extend the * operator to an iterated version * that can be applied on a set of formulae such that * ∅ = emp and * {φ 1 , . . . , φ n } =

φ 1 * . . . * φ n if n ≥ 1.
We retain the notations FV(φ) (FV(F )) for the free variables of the SL(T )-formula φ (set of SL(T )-formulae F ), ∃x . φ and ∃x . φ (∀x . φ and ∀x . φ) for ∃x 1 . . . ∃x n . φ (∀x 1 . . . ∃x n . φ) when x = x 1 , . . . , x n and x = {x 1 , . . . , x n }, φ[ψ] for when ψ is a subformula of φ, φ[ψ /ψ] for the result of replacing ψ with ψ in φ, and also φ ⇒ ψ for ¬φ ∨ ψ.

Most definitions of common recursive data structures, such as lists or trees, use a restricted fragment of quantifier-free SL(T ) called symbolic heaps, which has a simpler syntax. Definition 1.2.2 (Symbolic heap formula). A symbolic heap formula is a conjunction Π ∧ Θ between a pure (Π) and a spatial (Θ) part, defined as:

Π ::= (true) | ⊥ (false) | t, t Bool is a T -term (boolean variable) | t 1 ≈ t 2 , t Loc 1 , t Loc 2 are T -terms (equality) | ¬(t 1 ≈ t 2 ), t Loc 1 , t Loc 2 are T -terms (disequality) | Π 1 ∧ Π 2 , (conjunction)
Θ ::= emp

(empty heap) | t → u, t Loc , u Data are T -terms (singleton heap) | Θ 1 * Θ 2 , ( separating conjunction)
The pure part may consist of true and false constants, a boolean variable, the equality and disequality between two T -terms, and the conjunction of pure parts. The spatial part, on the other hand, may consist of the empty and singleton heaps, as well as the separating conjunction of two spatial parts.

Semantics

In order to define the semantics of SL(T ), we use the same notion of interpretation and valuation described in Definition 1.1.5, but, additionally, we introduce heaps.

Definition 1.2.3 (Heap). Given an interpretation I, a heap is a finite partial mapping h : Loc I fin Data I associating locations with data. We use Heaps I to denote the set of all heaps under the interpretation I.

Two heaps h 1 and h 2 are disjoint if dom(h 1 ) ∩ dom(h 2 ) = ∅ and we write h 1 #h 2 . In this case, h 1 h 2 denotes their disjoint union, which is undefined if h 1 and h 2 are not disjoint. We write H for the disjoint union of the heaps in the set H ⊆ Heaps. Definition 1.2.4 (Semantics of separation logic formulae). Given an interpretation I, a valuation ν ∈ V I and a heap h ∈ Heaps, we write I, ν, h |= SL φ if the SL formula φ is interpreted to true under I, ν and h. This relation is defined inductively on the structure of φ: For the notions discussed throughout the rest of Chapter 1 and also in Chapter 2, we consider a restricted fragment of SL(T ). The first-order theory T = (Σ, M) is fixed such that Σ s = {Loc, Data, Bool}, Σ f = {nil Loc } and Data = Loc k with k ≥ 1 also fixed. Terms are reduced to just nil and variables, while T Σ (x) = x for any x ⊆ Var. Moreover, we also fix an interpretation I, where I(Loc) = L is a countably infinite set containing a value nil such that nil I = nil . Then M = {(I, ν) | ν ∈ V I }. In this context, we omit to specify T or I any further and we use simpler definitions for satisfiability and equivalence, closer to their FOL equivalents described by Definitions 1.1.8 and 1.1.9. Definition 1.2.7 (Satisfiability and validity). An SL formula φ is satisfiable if there exists a valuation ν and a heap h such that ν, h |= SL φ and unsatisfiable otherwise. If ν, h |= SL φ for any ν and h, then φ is valid and ¬φ is unsatisfiable. Definition 1.2.8 (Entailment and equivalence). Given SL formulae φ and ψ, we write φ |= SL ψ and say that φ entails ψ if and only if ν, h |= SL φ implies ν, h |= SL ψ, for any valuation ν and heap h. We call φ and ψ equivalent whenever φ |= SL ψ and ψ |= SL φ.

I, ν, h |= SL ⊥ never holds I, ν, h |= SL always holds I, ν, h |= SL t iff t I ν = , t Bool is a T -term I, ν, h |= SL t 1 ≈ t 2 iff t 1 I ν = t 2 I ν , t σ 1 , t σ 2 are T -terms I, ν, h |= SL emp iff dom(h) = ∅ I, ν, h |= SL t → u iff t I ν = nil I and h = (t I ν , u I ν ) , t Loc , u Loc are T -terms I, ν, h |= SL ¬ψ iff I, ν, h |= SL ψ does not hold I, ν, h |= SL ψ 1 ∧ ψ 1 iff I, ν, h |= SL ψ 1 and I, ν, h |= SL ψ 2 I, ν, h |= SL ψ 1 ∨ ψ 1 iff I, ν, h |= SL ψ 1 or I, ν, h |= SL ψ 2 I, ν, h |= SL ψ 1 * ψ 2 iff ∃h 1 ∃h 2 . h = h 1 h 2 and I, ν, h 1 |= SL ψ 1 and I, ν, h 2 |= SL ψ 2 I, ν, h |= SL ψ 1 -- * ψ 2 iff ∀h 0 . h#h 0 and I, ν, h 0 |= SL ψ 1 imply that I, ν, h h 0 |= SL ψ 2 I, ν, h |= SL ∃x . ψ iff I, ν[x ← v], h |= SL ψ, x σ ∈ FV(ψ), for some v ∈ σ I I, ν, h |= SL ∀x . ψ iff I, ν[x ← v], h |= SL ψ, x σ ∈ FV(ψ),

Systems of Inductive Definitions

Throughout this work we will use the phrases "system of inductive (predicate) definitions" and "inductive system (of predicates)" interchangeably. To prevent confusion with the proof systems introduced in Chapter 2, we will avoid using the word "system" by itself.

We can define inductive systems using both first-order and separation logic. The only syntactical difference lies in the types of formulae accepted as constraints for the predicate rules of an inductive system, which are specific to the underlying logic. As a result, we will describe the syntax (Section 1.3.1) in the context of any signature Σ = (Σ s , Σ f ) and refer to formulae without specifying their type (FOL or SL). The semantics of inductive systems, however, are highly reliant on formula semantics and on the valuation of predicate rules (e.g. using either classic or separating conjunction). As such, we independently describe the semantics for inductive systems in FOL (Section 1.3.2) and in SL (Section 1.3.3).

Syntax

Consider a signature Σ = (Σ s , Σ f ) and let Pred be a countable set of predicate symbols. For a predicate symbol p σ1...σn ∈ Pred, n ≥ 1 is its arity and σ 1 , . . . , σ n ∈ Σ s are the sorts of its arguments. Given a tuple of terms t σ1 1 , . . . , t σn n , we call p(t 1 , . . . , t n ) a predicate atom. We denote by Atom = {p(t 1 , . . . , t n ) | p σ1,...,σn ∈ Pred, t σi i ∈ T Σ (Var) for each i ∈ [n]} the set of all possible predicate atoms. Definition 1.3.1 (Predicate rule). A predicate rule is a pair p(x), {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} , n ≥ 0 where x, x 1 , . . . , x n are unique tuples of variables such that set(x), set(x 1 ), . . . , set(x n ) are pairwise disjoint sets. Then φ is a formula called the constraint, p(x) is a predicate atom called the goal, and q 1 (x 1 ), . . . , q n (x n ) are predicate atoms called subgoals. Consequently, the variables in x are called goal variables, whereas the ones in n i=1 set(x i ) are subgoal variables. Equalities between the variables in x, x 1 , . . . , x n may be captured by the constraint. We refer to {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} as the body of the predicate rule.

Whenever we consider a predicate rule p(x), {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} , it is implied that x, x 1 , . . . , x n respect the conditions from Definition 1.3.1. We often refer to a predicate rule body R = {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} by fixing specific tuples of goal and subgoal variables and writing R(x, x 1 , . . . , x n ) or, more compactly, R(x, y), where y = x 1 •. . .•x n . Regardless of the variables with which R was initially specified, by R(x, y) we mean the variant of R in which x and y replace the goal and subgoal variables, respectively. By writing only R(x) or R we consider all variants of R with fixed goal variables x or without any fixed variables, respectively. Definition 1.3.2 (Inductive system of predicates). An inductive system of predicates S is a finite set of predicate rules.

Without loss of generality, we assume there are no goals with the same predicate and different goal variables. We use the condensed notation p(x) ← S R 1 (x) | . . . | R m (x) when { p(x), R 1 (x) , . . . , p(x), R m (x) } is the set of all predicate rules with goal p(x) in S. We also write S p and S c for the sets of predicate symbols and of constraints, respectively, that occur in the rules of S. Definition 1.3.3 (Size of an inductive system). The size of an inductive system S is the sum of the sizes of all constraints occurring in its predicate rules:

|S| = φ∈S c |φ| 1.3.

Solution of an Inductive System in FOL

Let S be an inductive system in FOL and I an interpretation for the sorts and function symbols in S. An assignment X maps each predicate p σ1...σn ∈ S p to a set X (p) ⊆ σ I 1 × . . . × σ I n . We extend the application of X to a predicate atom p(t 1 , . . . , t n ) such that

X (p(t 1 , . . . , t n )) = {ν | (t 1 I ν , . . . , t n I ν ) ∈ X (p)} to a set F = {φ 1 , . . . φ k , q 1 (x 1
), . . . , q n (x n )} of formulae and predicate atoms such that

X ( F ) = {ν | I, ν |= φ 1 ∧ . . . ∧ φ k and ν ∈ X (q i (x i )), ∀i ∈ [n]}
and to a predicate rule p(x), R(x) such that

X ( R(x)) = {ν | ν(x) = γ(x) and γ ∈ X ( R(x, y))}
Given two sets F 1 and F 2 of formulae and predicate atoms, the following holds:

X ( F 1 ∧ F 2 ) = X ( F 1 ) ∩ X ( F 2 )
and we also define the application of X on a disjunction of such sets

X ( F 1 ∨ F 2 ) = X ( F 1 ) ∪ X ( F 2 )
The set of all assignments on the predicates in S is Assign(S p ). We identify two special elements of this set: X ∅ as the assignment that maps all predicates in S p to the empty set, and X σ as the assignment that maps each predicate p σ1...σn ∈ S p to the set σ I 1 × . . . × σ I n . Given X 1 , X 2 ∈ Assign(S p ), we introduce the relation , together with its strict variant ≺, such that

X 1 X 2 ⇔ ∀p ∈ S p . X 1 (p) ⊆ X 2 (p) X 1 ≺ X 2 ⇔ X 1 X 2 ∧ X 1 = X 2
We define the union of two assignments X 1 , X 2 ∈ Assign(S p ) as

(X 1 X 2 )(p) = X 1 (p) ∪ X 2 (p), ∀p ∈ S p
and their intersection as

(X 1 X 2 )(p) = X 1 (p) ∩ X 2 (p), ∀p ∈ S p
We write X and X for the application of and , respectively, among the elements of the set X ⊆ Assign(S p ).

Partial orderings and complete lattices. We briefly go over some notions about partial orderings and complete lattices that are relevant for assignments, as they are described in [START_REF] Nielson | Principles of Program Analysis[END_REF]Appendix A]. A partial ordering on a set L is a relation

≤ L ⊆ L × L that is reflexive (i.e. ∀l ∈ L . l ≤ L l), transitive (i.e. ∀l 1 , l 2 , l 3 ∈ L . l 1 ≤ L l 2 ∧ l 2 ≤ L l 3 ⇒ l 1 ≤ L l 3 ) and anti- symmetric (i.e. ∀l 1 , l 2 ∈ L . l 1 ≤ L l 2 ∧ l 2 ≤ L l 1 ⇒ l 1 = l 2 ). A partially ordered set (L, ≤ L ) is a set L equipped with a partial ordering ≤ L . A set Y ⊆ L has a lower bound l if ∀l ∈ Y . l ≤ L l .
The greatest lower bound of Y is a lower bound l 0 such that l ≤ L l 0 for any other lower bound l of Y. Conversely, Y ⊆ L has an upper bound l if ∀l ∈ Y . l ≤ L l, and the least upper bound of Y is an upper bound l 0 such that l 0 ≤ L l for any other upper bound l of Y. Not all subsets of a partially ordered set L need to have an greatest lower bound or a least upper bound, but, due to ≤ L being anti-symmetric, they are unique when they do exist and are denoted Y and Y , where is called the meet operator and the join operator. A complete lattice L = (L, ≤ L ) = (L, ≤ L , , , ⊥ L , L ) is a partially ordered set such that any of its subsets has a least upper bound and greatest lower bound. Furthermore, ⊥ L = ∅ = L is the least element of L and L = ∅ = L is the greatest element of L.

A classic example of complete lattice is the powerset of any set S together with the set inclusion relation -(P(S), ⊆, , , ∅, S). The join and meet operators are set union and intersection, respectively. The least element of P(S) is ∅ and its greatest element is S.

Since ,

and are defined pointwise based on set inclusion, union and intersection, respectively, it is easy to show that is a partial ordering and that Assign(S p ) = (Assign(S p ), ) = (Assign(S p ), , , , X ∅ , X σ ) is a complete lattice.

The relation is reflexive because, given any X ∈ Assign(S p ),

∀p ∈ S p . X (p) ⊆ X (p) ⇔ X X The relation is transitive because, for any X 1 , X 2 , X 3 ∈ Assign(S p ), ∀p ∈ S p . X 1 (p) ⊆ X 2 (p) ∧ X 2 (p) ⊆ X 3 (p) ⇒ X 1 (p) ⊆ X 3 (p) ⇒ ∀p ∈ S p . X 1 (p) ⊆ X 2 (p) ∧ ∀p ∈ S p . X 2 (p) ⊆ X 3 (p) ⇒ ∀p ∈ S p . X 1 (p) ⊆ X 3 (p) ⇔ X 1 X 2 ∧ X 2 X 3 ⇒ X 1 X 3
The relation is anti-symmetric because, for any

X 1 , X 2 ∈ Assign(S p ), ∀p ∈ S p . X 1 (p) ⊆ X 2 (p) ∧ X 2 (p) ⊆ X 1 (p) ⇒ X 1 (p) = X 2 (p) ⇒ ∀p ∈ S p . X 1 (p) ⊆ X 2 (p) ∧ ∀p ∈ S p . X 2 (p) ⊆ X 1 (p) ⇒ ∀p ∈ S p . X 1 (p) = X 2 (p) ⇔ X 1 X 2 ∧ X 2 X 1 ⇒ X 1 = X 2
Thus, (Assign(S p ), ) is partially ordered set. For any X ⊆ Assign(S p ), its greatest lower bound is X and its least greater bound is X. It follows that (Assign(S p ), ) is a complete lattice with X ∅ = ∅ = Assign(S p ) and X σ = Assign(S p ) = ∅ as its least and greatest elements, respectively.

The inductive system S and the interpretation I induce a function on assignments, F I S : Assign(S p ) → Assign(S p ), such that

F I S (X )(p) = m i=1 {ν(x) | ν ∈ X ( R i (x))} where p(x) ← S R 1 (x) | . . . | R m (x).
Definition 1.3.4 (Solution of an FOL inductive system). A solution of S is an assignment X ∈ Assign(S p ) such that F I S (X ) X . The set of all solutions of S is

Sol I S = {X | F I S (X ) X }. A least solution of S is µS I ∈ Sol I S such that, for any assignment X ≺ µS I , X ∈ Sol I S . Lemma 1.3.1. The extension of an assignment is monotonically increasing, i.e. if X 1 , X 2 ∈ Assign(S p ) such that X 1 X 2 , then X 1 (p(t 1 , . . . , t n )) ⊆ X 2 (p(t 1 , . . . , t n )) for any p(t 1 , . . . , t n ) ∈ Atom and p ∈ S p (1.1) X 1 R(x) ⊆ X 2 R(x) for any p(x), R(x) ∈ S (1.2) Proof. Since X 1 X 2 , it follows that X 1 (p) ⊆ X 2 (p), ∀p ∈ S p . Therefore, X 1 (p(t 1 , . . . , t n )) = {ν | (t 1 I ν , . . . , t n I ν ) ∈ X 1 (p)} ⊆ {ν | (t 1 I ν , . . . , t n I ν ) ∈ X 2 (p)} = X 2 (p(t 1 , . . . , t n ))
for any p(t 1 , . . . , t n ) ∈ Atom with p ∈ S p . We have successfully proven (1.1).

Let R(x, y) = {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} such that p(x), R(x) ∈ S and y = x 1 • . . . • x n . By the extension of assignments, for any i ∈ [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF] we obtain

X i R(x, y) = {ν | I, ν |= φ(x, x) and ν ∈ X i (q j (x j )), ∀j ∈ [n]} = {ν | I, ν |= φ(x, y)} ∩ {ν | ν ∈ X i (q j (x j )), ∀j ∈ [n]} = {ν | I, ν |= φ(x, y)} ∩ n j=1 X i (q j (x j )) (1.3) Since X 1 X 2 , it follows from (1.1) that X 1 (q j (x j )) ⊆ X 2 (q j (x j )), ∀j ∈ [n]. Therefore, n j=1 X 1 (q j (x j )) ⊆ n j=1 X 2 (q j (x j )) (1.
{ν | I, ν |= φ} ∩ n j=1 X 1 (q j (x j )) ⊆ {ν | I, ν |= φ} ∩ n j=1 X 2 (q j (x j ))
and, thus, that X 1 ( R(x, y)) ⊆ X 2 ( R(x, y)). We also obtain

X 1 ( R(x)) ⊆ X 2 ( R(x)).
As R was chosen arbitrarily, we conclude that (1.2) was successfully proven.

Theorem 1.3.2 (Monotonicity of F I S ). The function F I S : Assign(S p ) → Assign(S p ), induced by the inductive system S and the FOL interpretation I, is monotonically increasing, i.e

F I S (X 1 ) F I S (X 2 ) if X 1 , X 2 ∈ Assign(S p ) such that X 1 X 2 .
Proof. Let p ∈ S p be any predicate symbol defined by the inductive system S such that p(x)

← S R 1 (x) | . . . | R m (x).
Then, as per the definition of F I S ,

F I S (X i )(p) = m j=1 {ν(x) | ν ∈ X i R j (x) } = {ν(x) | ν ∈ m j=1 X i R j (x) }, ∀i ∈ [2] (1.5) Because X 1 X 2 , it follows from Lemma 1.3.1 that X 1 R j (x) ⊆ X 2 R j (x) , ∀j ∈ [m] ⇒ m j=1 X 1 R j (x) ⊆ m j=1 X 2 R j (x)
(1.6) From (1.5) and (1.6) we can quickly gather that

F I S (X 1 )(p) = {ν(x) | ν ∈ m j=1 X 1 R j (x) } ⊆ {ν(x) | ν ∈ m j=1 X 2 R j (x) } = F I S (X 2 )(p)
As p was chosen arbitrarily, we can conclude that F I S (X 1 ) F I S (X 2 ).

Ascending chains. To make a case for the continuity of F I S , we introduce ascending chains, as they are defined in [START_REF] Nielson | Principles of Program Analysis[END_REF]Appendix A]. Given a partially ordered set (L,

≤ L ), a subset Y ⊆ L is a chain if ∀l 1 , l 2 ∈ Y . l 1 ≤ L l 2 or l 2 ≤ L l 1 , i.e. a chain is a (possibly empty) subset of L that is totally ordered. A sequence (l i ) i∈N of elements from L is an ascending chain if ∀i, i ∈ N . i ≤ i ⇒ l i ≤ L l i .
In the following lemma and theorem, we use ascending chains of assignments from Assign(S p ), denoted (X i ) i∈N , where, as per the above definition, ∀i, i ∈ N . i ≤ i ⇒ X i X i .

Lemma 1.3.3. The extension of an assignment is continuous, i.e. if (X i ) i∈N is an ascending chain in Assign(S p ), then

i∈N X i (p(t 1 , . . . , t n )) = i∈N X i (p(t 1 , . . . , t n )), for any p(t 1 , . . . , t n ) ∈ Atom, p ∈ S p (1.7) i∈N X i R(x) = i∈N X i R(x) , for any p(x), R(x) ∈ S (1.8)
Proof. By the extension of assignments and the definition of assignment union,

i∈N X i (p(t 1 , . . . , t n )) = {ν | (t 1 I ν , . . . , t n I ν ) ∈ i∈N X i (p)} = {ν | (t 1 I ν , . . . , t n I ν ) ∈ i∈N X i (p)} = i∈N {ν | (t 1 I ν , . . . , t n I ν ) ∈ X i (p)} = i∈N X i (p(t 1 , . . . , t n ))
for any p(t 1 , . . . , t n ) ∈ Atom with p ∈ S p . We have successfully proven (1.1).

Let R(x, y) = {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} such that p(x), R(x) ∈ S and y = x 1 • . . . • x n . By the extension of assignments,

i∈N X i R(x, y) = {ν | I, ν |= φ(x, y) and ν ∈ i∈N X i (q j (x j )), ∀j ∈ [n]} = {ν | I, ν |= φ(x, y)} ∩ {ν | ν ∈ i∈N X i (q j (x j )), ∀j ∈ [n]} = {ν | I, ν |= φ(x, y)} ∩ n j=1 i∈N
X i (q j (x j )) (1.9) (X i ) i∈N is an ascending chain, so it follows from (1.7) that i∈N X i (q j (x j )) = i∈N X i (q j (x j )) and we can rewrite (1.9) as

i∈N X i R(x, y) = {ν | I, ν |= φ(x, y)} ∩ n j=1 i∈N X i (q j (x j )) (1.10)
Moreover, since (X i ) i∈N is an ascending chain and the extension of assignments is monotonically increasing, as per Lemma 1.3.1, then ∀i, i ∈ N . i ≤ i ⇒ X i (q j (x j )) ⊆ X i (q j (x j )) and

n j=1 i∈N X i (q j (x j )) = i∈N n j=1 X i (q j (x j )), ∀j ∈ [n]. In consequence, (1.10) becomes i∈N X i R(x, y) = {ν | I, ν |= φ} ∩ i∈N n j=1 X i (q j (x j )) = i∈N {ν | I, ν |= φ} ∩ n j=1 X i (q j (x j )) = i∈N X i R(x, y)
It easily follows that also i∈N X i ( R(x)) = i∈N X i ( R(x)) and, as R was chosen arbitrarily, we can conclude that (1.2) was successfully proven. Theorem 1.3.4 (Continuity of F I S ). The function F I S : Assign(S p ) → Assign(S p ), induced by the FOL inductive system S and the interpretation I, is continuous, i.e

F I S i∈N X i = i∈N F I S (X i ) if (X i )
i∈N is an ascending chain in Assign(S p ).

Proof. Let p ∈ S p be any predicate symbol defined by the inductive system S such that p(x)

← S R 1 (x) | . . . | R m (x).
Then, as per the definition of F I S ,

F I S i∈N X i (p) = m j=1 {ν(x) | ν ∈ i∈N X i R j (x) } (1.11)
Since (X i ) i∈N is an ascending chain, it follows by Lemma 1.3.

3 that i∈N X i ( R j (x)) = i∈N X i ( R j (x)), ∀j ∈ [m]
, so we can rewrite (1.11) as

F I S i∈N X i (p) = m j=1 {ν(x) | ν ∈ i∈N X i R j (x) } = m j=1 i∈N {ν(x) | ν ∈ X i R j (x) } = i∈N m j=1 {ν(x) | ν ∈ X i R j (x) } = i∈N F I S (X i )(p) = i∈N F I S (X i ) (p)
As p was chosen arbitrarily, we can conclude that F I S i∈N X i = i∈N F I S (X i ). Proof. Let Fp(F I S ) = X | F I S (X ) = X be the set of all fixed points of F I S . Since (Assign(S p ), ) is a complete lattice and F I S is monotonically increasing, as shown by Theorem 1.3.2, it follows from Tarski's fixed point theorem [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF] that (Fp(F I S ), ) is also a complete lattice. This ensures the existence of a unique least fixed point for F I S and, furthermore, [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF] gives us a way to compute this least fixed point as

lfp(F I S ) = {X | F I S (X ) X } = Sol I S
Thus, lfp(F I S ) is the greatest lower bound of Sol I S ⊆ Assign(S p ) and it is unique because any subset of a complete lattice has a unique greatest lower bound. Also, due to the reflexiveness of ,

F I S (lfp(F I S )) = lfp(F I S ) lfp(F I S ) ⇒ lfp(F I S ) ∈ Sol I S So lfp(F I S
) is also a solution of S. Suppose lfp(F I S ) is not a least solution of S. Then, by definition 1.3.4, there must exist some X ≺ lfp(F I S ) such that X ∈ Sol I S . But, since lfp(F I S ) is the greatest lower bound of Sol I S , it must be the case that lfp(F I S ) X , which leads to a contradiction. Consequently, lfp(F I S ) is the unique least solution of S.

Additionally, because F I S is also continuous, it follows from Kleene's fixed point theorem that we can compute lfp(F I S ) as the least upper bound of the chain

X ∅ F I S (X ∅ ) F I S 2 (X ∅ ) . . . F I S i (X ∅ ) . . . , i ∈ N
obtained by iterating F I S on the least element X ∅ of Assign(S p ). Thus,

lfp(F I S ) = µS I = i∈N F I S i (X ∅ ) = F I S n (X ∅ )
where n ∈ N is the smallest value for which

F I S n+1 (X ∅ ) = F I S n (X ∅ ).

Solution of an Inductive System in SL

Let S be an inductive system in SL. An assignment X maps each predicate p ∈ S p of arity n to a set X (p) ⊆ L n × Heaps. We extend X to a predicate atom p(x) such that

X (p(x)) = {(ν, h) | (ν(x), h) ∈ X (p)}
to a set F = {φ 1 , . . . φ k , q 1 (x 1 ), . . . , q n (x n )} of formulae and predicate atoms such that

X ( * F ) = {(ν, h 0 n j=1 h j ) | ν, h 0 |= SL φ 1 * . . . * φ k and (ν, h i ) ∈ X (q i (x i )), ∀i ∈ [n]}
and to a predicate rule p(x), R(x) such that

X ( * R(x)) = {(ν, h) | ν(x) = γ(x) and (γ, h) ∈ X ( * R(x, y))}
The set of all assignments on the predicates in S is Assign SL (S p ). We write X ∅ for the assignment that maps all predicates in S p to the empty set, and X σ for the assignment that maps each predicate p ∈ S p of arity n to the set L n × Heaps.

We use the relation , its strict variant ≺, and the operators and with a similar meaning as in Section 1.3.2, except they are now applied to assignments in Assign SL (S p ). Furthermore, by a similar argument as in Section 1.3.2, Assign SL (S p ) = (Assign SL (S p ), ) = (Assign SL (S p ), , , , X ∅ , X σ ) is a complete lattice The inductive system S induces a function F SL S : Assign SL (S p ) → Assign SL (S p ) such that

F SL S (X )(p) = m i=1 {(ν(x), h) | (ν, h) ∈ X ( * R i (x))} where p(x) ← S R 1 (x) | . . . | R m (x).
Due to the semantics introduced above, the proofs for the following lemmas and theorems will handle subsets of V × Heaps and L n × Heaps. We introduce the following notation such that, when A, B ⊆ V × Heaps,

A B = {(γ, h h ) | (γ, h) ∈ A, (γ, h ) ∈ B and h, h disjoint} and, when A, B ⊆ L n × Heaps, A B = {(v • v , h h ) | (v, h) ∈ A, (v , h ) ∈ B and h, h disjoint}
Consider two other sets A , B such that A, A , B, B are all subsets of either V × Heaps or L n × Heaps. Then it easily follows that

(A ∪ A ) B = (A B) ∪ (A B) because, when A, B ⊆ V × Heaps, (A ∪ A ) B ={(γ, h h ) | (γ, h) ∈ A ∪ A , (γ, h ) ∈ B, and h, h disjoint} ={(γ, h h ) | (γ, h) ∈ A, (γ, h ) ∈ B, and h, h disjoint} ∪ {(γ, h h ) | (γ, h) ∈ A , (γ, h ) ∈ B, and h, h disjoint} =(A B) ∪ (A B)
and, when A, B ⊆ L n × Heaps,

(A ∪ A ) B ={(v • v , h h ) | (v, h) ∈ A ∪ A , (v , h ) ∈ B, and h, h disjoint} ={(v • v , h h ) | (v, h) ∈ A, (v , h ) ∈ B, and h, h disjoint} ∪ {(v • v , h h ) | (v, h) ∈ A , (v , h ) ∈ B, and h, h disjoint} =(A B) ∪ (A B)
This enables the following property relative to set inclusion:

A B ⊆ A B when A ⊆ A because A B = (A B) ∪ ((A \ A) B), which is clearly a superset of A B.
Based on these properties, it is also true that

(A ∪ A ) (B ∪ B ) = (A B) ∪ (A B ) when A ⊆ A and B ⊆ B because (A ∪ A ) (B ∪ B ) = (A (B ∪ B )) ∪ (A (B ∪ B )) = (A (B ∪ B )) ∪ A B = (A B) ∪ (A B ) ∪ (A B ) = (A B) ∪ (A B )
Given now two sets F 1 and F 2 of formulae and predicate atoms, the following holds:

X ( * F 1 * * F 2 ) = X ( * F 1 ) X ( * F 2 )
and, as we did for the FOL assignments, we also define

X ( * F 1 ∨ * F 2 ) = X ( * F 1 ) ∪ X ( * F 2 )
Definition 1.3.5 (Solution of an SL inductive system). A solution of S is an assignment X ∈ Assign SL (S p ) such that F SL S (X ) X . The set of all solutions of S is

Sol SL S = {X | F SL S (X ) X }. A least solution of S is µS SL ∈ Sol SL
S such that, for any assignment X ≺ µS SL , X ∈ Sol SL S . Lemma 1.3.6. The extension of an assignment is monotonically increasing, i.e if X 1 , X 2 ∈ Assign SL (S p ) such that X 1 X 2 , then X 1 (p(x)) ⊆ X 2 (p(x)), for any p(x) ∈ Atom and p ∈ S p (1.12)

X 1 ( * R(x)) ⊆ X 2 ( * R(x)), for any p(x), R(x) ∈ S (1.13) Proof. Since X 1 X 2 , it follows that X 1 (p) ⊆ X 2 (p), ∀p ∈ S p . Thus, X 1 (p(x)) = {(ν, h) | (ν(x), h) ∈ X 1 (p)} ⊆ {(ν, h) | (ν(x), h) ∈ X 2 (p)} = X 2 (p(x)))
for any p(x) ∈ Atom with p ∈ S p . We have successfully proven (1.12).

Let R(x, y) = {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} such that p(x), R(x) ∈ S and y = x 1 • . . . • x n . By the extension of assignments, for any i ∈ [2],

X i ( * R(x)) ={(ν, h 0 n j=1 h j ) | ν, h 0 |= SL φ(x, y) and (ν, h j ) ∈ X i (q j (x j )), ∀j ∈ [n]} ={(ν, h 0 ) | ν, h 0 |= SL φ} n j=1 X i (q j (x j )) (1.14)
Since X 1 X 2 , it follows from (1.12) that X 1 (q j (x j )) ⊆ X 2 (q j (x j )), ∀j ∈ [n]. Thus, by chaining the property of relative to subsets,

n j=1 X 1 (q j (x j )) ⊆ n j=1 X 1 (q j (x j )) (1.15)
From (1.14) and (1.15) we obtain that

{(ν, h 0 ) | ν, h 0 |= SL φ(x, y)} n j=1 X 1 (q j (x j )) ⊆ {(ν, h 0 ) | ν, h 0 |= SL φ(x, y)} n j=1 X 2 (q j (x j ))
and, thus, that X 1 ( * R(x, y)) ⊆ X 2 ( * R(x, y)). It easily follows that also X 1 ( * R(x)) ⊆ X 2 ( * R(x)). As R was chosen arbitrarily, we conclude that (1.13) was successfully proven.

Theorem 1.3.7 (Monotonicity of F SL S ). The function F SL S : Assign SL (S p ) → Assign SL (S p ), induced by the SL inductive system S, is monotonically increasing, i.e F SL S (X 1 )

F SL S (X 2 ) if X 1 , X 2 ∈ Assign SL (S p ) such that X 1 X 2 .
Proof. The proof is similar to the one of Theorem 1.3.2, by using Lemma 1.3.6 to justify the monotonicity of assignment extension. Lemma 1.3.8. The extension of an assignment is continuous, i.e if (X i ) i∈N is an ascending chain in Assign SL (S p ), then

i∈N X i (p(x)) = i∈N X i (p(x)), for any p(x) ∈ Atom and p ∈ S p (1.16) i∈N X i ( * R(x)) = i∈N X i ( * R(x)
), for any p(x), R(x) ∈ S

(1.17)

Proof. By the extension of assignments and the definition of assignment union,

i∈N X i (p(x)) = {(ν, h) | (ν(x), h) ∈ i∈N X i (p)} = {(ν, h) | (ν(x), h) ∈ i∈N X i (p)} = i∈N {(ν, h) | (ν(x), h) ∈ X i (p)} = i∈N X i (p(x))
for any p(x) ∈ Atom with p ∈ S p . We have successfully proven (1.12).

Let R(x, y) = {φ(x, x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} such that p(x), R(x) ∈ S and y = x 1 • . . . • x n . By the extension of assignments,

i∈N X i ( * R(x, y)) = {(ν, h 0 n j=1 h j ) | ν, h 0 |= φ, (ν, h j ) ∈ i∈N X i (q j (x j )), ∀j ∈ [n]} = {(ν, h 0 ) | ν, h 0 |= φ(x, y)} n j=1 i∈N X i (q j (x j )) (1.18) (X i )
i∈N is an ascending chain, so it follows from (1.16) that i∈N X i (q j (x j )) = i∈N X i (q j (x j )) and we can rewrite (1.18) as

i∈N X i ( * R(x, y)) = {(ν, h 0 ) | ν, h 0 |= φ(x, y)} n j=1 i∈N X i (q j (x j )) (1.19)
Due to the properties of , and because (X i ) i∈N is an ascending chain and the extension of assignments is monotonically increasing, as per Lemma 1.3.6, then

n j=1 i∈N X i (q j (x j )) = i∈N n j=1 X i (q j (x j )). In consequence, (1.19) becomes i∈N X i ( * R(x, y)) = {(ν, h 0 ) | ν, h 0 |= φ(x, y)} i∈N n j=1 X i (q j (x j )) = i∈N {(ν, h 0 ) | ν, h 0 |= φ} n j=1 X i (q j (x j )) = i∈N X i ( * R(x, y))
It easily follows that also

i∈N X i ( * R(x)) = i∈N X i ( R(x)
) and, as R was chosen arbitrarily, we can conclude that (1.13) was successfully proven.

Theorem 1.3.9 (Continuity of F SL S ). The function F SL S : Assign SL (S p ) → Assign SL (S p ), induced by the SL inductive system S, is continuous, i.e

F SL S i∈N X i = i∈N F SL S (X i ) if (X i ) i∈N is an ascending chain in Assign SL (S p ).
Proof. The proof is similar to the one of Theorem 1.3.4, by using Lemma 1.3.8 to justify the continuity of assignment extension.

Theorem 1.3.10 (Least solution of an SL inductive system). An SL inductive system S has a unique least solution equal to the least fixed point of F SL S , i.e. µS SL = lfp(F SL S ). Moreover,

µS SL = F SL S n (X ∅ ), where n ∈ N is the smallest value for which F SL S n+1 (X ∅ ) = F SL S n (X ∅ ).
Proof. The proof is similar to the one of Theorem 1.3.5, using Theorem 1.3.7 and Theorem 1.3.9 to justify the monotonicity and continuity of F SL S , respectively.

The Entailment Problem

In order to refer to any inductive system, regardless of its underlying logic (FOL or SL), we use µS and |= S to mean either µS I and |= I S or µS SL and |= SL S , depending on the context. The main concern of this thesis is the following entailment problem, which we define in the general context of any inductive system S. Definition 1.4.1 (Entailment problem). Given an inductive system S and predicates p σ1...σm , q σ1...σm 1 , . . . , q σ1...σm n ∈ S p with the same tuple of argument sorts, does µS(p) ⊆ n i=1 µS(q i ) (denoted p |= S q 1 , . . . , q n ) hold?

We consider inductive systems for which the set of constraints S c consists of quantifier-free formulae in which no disjunction occurs positively (i.e. under an even number of ¬ applications) and no conjunction occurs negatively (i.e. under an odd number of ¬ applications). Without loss of generality, disjunctions can be eliminated from quantifier-free constraints by splitting each predicate rule p(x), {φ 1 ∨ . . . ∨ φ m , q 1 (x 1 ), . . . , q n (x n )} into m predicate rules of the form p(x), {φ i , q 1 (x 1 ), . . . , q n (x n )} , one for each i ∈ [m].

Additionally, we assume that every p ∈ S p is the goal of at least one predicate rule of S. Otherwise, the least solution is empty for that predicate, i.e. µS I (p) = ∅. Furthermore, from the way assignments (and, consequently, least solutions) are extended to predicate rule bodies, µS I will be empty for any predicate q ∈ S p for which p is a subgoal. Thus, all such predicates and all the predicate rules in which they occur can be safely eliminated from S.

Example 1.4.1 (Entailment problem in FOL). Consider the following inductive system, with FOL constraints:

p(x) ← S x ≈ f (x 1 , x 2 ), p 1 (x 1 ), p 2 (x 2 ) q(x) ← S x ≈ f (x 1 , x 2 ), q 1 (x 1 ), q 2 (x 2 ) p 1 (x) ← S x ≈ g(x 1 ), p 1 (x 1 ) | x ≈ a | x ≈ f (x 1 , x 2 ), q 2 (x 1 ), q 1 (x 2 ) p 2 (x) ← S x ≈ g(x 1 ), p 2 (x 1 ) | x ≈ b q 1 (x) ← S x ≈ g(x 1 ), q 1 (x 1 ) | x ≈ a q 2 (x) ← S x ≈ g(x 1 ), q 2 (x 1 ) | x ≈ b
Intuitively, S models two tree automata with initial states given by the predicates p and q, where p accepts trees of the form f (g n (a), g m (b)), n, m ∈ N, while q accepts both trees of the form f (g n (a), g m (b)) and f (g n (b), g m (a)), n, m ∈ N. The entailment p |= I S q expresses the language inclusion between the two states and it holds. On the other hand, q |= I S p does not hold.

Example 1.4.2 (Entailment problem in SL). Consider the following inductive system, with symbolic heap constraints:

ls + (x, y) ← S x → y | y ≈ y ∧ x → x , ls + (x , y ) ls e (x, y) ← S x ≈ y ∧ emp | y ≈ y ∧ x → x , ls o (x , y ) ls o (x, y) ← S x → y | y ≈ y ∧ x → x , ls e (x , y ) ls + (x, y) ← S y ≈ y ∧ x → x * ls e (x , y ) | y ≈ y ∧ x → x * ls o (x , y )
Intuitively, ls + (x, y) defines the set of finite list segments of at least one element between x and y, ls e and ls o are list segments of even and odd length, respectively, and ls + (x, y) is the definition of a list segment consisting of one element followed by an even or an odd list segment. Entailments that hold include: (i) ls

Entailments under the Canonical Interpretation

Let N * be the set of sequences of natural numbers, where ε ∈ N * is the empty sequence and p • q is the concatenation of two sequences p, q ∈ N * . We call p a prefix of q if and only if there exists some r ∈ N * such that p • r = q. A set X ⊆ N * is prefix-closed if p ∈ X implies that p ∈ X for every prefix p of p.

A tree over the signature Σ = (Σ s , Σ f ) is a ground term t ∈ T Σ , viewed as a finite partial function t : N * fin Σ f , where dom(t) is prefix-closed and, for all α ∈ dom(t) such that t(α) = f σ1...σnσ , we have [n] = {i ∈ N | α • i ∈ dom(t)}, i.e. t is defined at consecutive positions from α • 1 to α • n for every argument of f . The tree t is of sort σ ∈ Σ s (written as t σ ) if t(ε) = f σ1...σnσ , for some f σ1...σnσ ∈ Σ f . The set fr(t) = {α ∈ dom(t) | α • 1 ∈ dom(t)} is called the frontier of t. Given a tree t and a position α ∈ dom(t), we denote by t |α the subtree of t rooted at p, where, for each β ∈ N * , we have t |α (β) = t(α • β). The subtree order is defined by u t if and only if u = t |α , for some α ∈ dom(t). For a function symbol f σ1...σnσ ∈ Σ f and trees t σ1 1 , . . . , t σn n ∈ T Σ , we denote by τ n (f, t 1 , . . . , t n ) the tree t such that t(ε) = f and

t |i = t i , for all i ∈ [n].
The Herbrand (canonical) interpretation H is the one in which each constant symbol is interpreted as itself and each function symbol as the function that applies it, as described, for instance, in [START_REF] Van Dalen | Logic and structure[END_REF]Section 3.1]. Thus, terms become both syntactical objects and values. In other words, H maps (i) each sort σ ∈ Σ s into T Σ , (ii) each constant symbol c into the tree c H = {(ε, c)} consisting of a leaf which is also the root, and (iii) each function symbol f σ1...σnσ into the function f H such that f H (t 1 , . . . , t n ) = τ n (f, t 1 , . . . , t n ), for any t σ1 1 , . . . , t σn n ∈ T Σ . Under this interpretation,

t 1 ≈ t 2 if and only if t 1 (ε) = t 2 (ε) = f σ1...σnσ and t 1| i ≈ t 2| i , ∀i ∈ [n].
Even in this simple case, where function symbols do not have any equational properties (e.g. commutativity, associativity, etc.) entailment problems are undecidable, as stated by the following theorem. Proof. This undecidability result can be shown by reduction from the inclusion problem for context-free languages, which is a known undecidable problem [START_REF] Hopcroft | Introduction to Automata Theory, Languages, and Computation[END_REF]Theorem 9.22 (e)].

Consider a context-free grammar G = Ξ, Σ, ∆ , where Ξ is the set of nonterminals, Σ is the alphabet of terminals, and ∆ is a set of productions (X, w) ∈ Ξ × (Ξ ∪ Σ) * . For a nonterminal X ∈ Ξ, L(G, X) ⊆ Σ * is the language produced by G starting with X as axiom. The problem "Given X, Y ∈ Ξ, does L(G, X) ⊆ L(G, Y )?" is undecidable.

To reduce this inclusion problem to the entailment problem under the Herbrand interpretation, we define an inductive system S G based on a context-free grammar G = Ξ, Σ, ∆ , as follows:

(i) Each nonterminal X ∈ Ξ corresponds to a predicate X(x σ , y σ ), where σ is the only sort used in the reduction;

(ii) Each alphabet symbol a ∈ Σ corresponds to a function symbol âσσ , and a word w = a 1 . . . a n ∈ Σ * is encoded by the context (i.e. the term with a hole) ŵ = â1 (. . . ân (.));

(iii) Each grammar rule (X, u 1 X 1 . . . u n X n u n+1 ) ∈ ∆ corresponds to a predicate rule of the inductive system S G :

X(x, y), {φ(x, y, x 1 , y 1 , . . . , x n , y n ), X 1 (x 1 , y 1 ), . . . , X n (x n , y n )} where φ ≡ x ≈ û1 (x 1 ) ∧ n-1 i=1 y i ≈ ûi+1 (x i+1 ) ∧ y n ≈ ûn+1 (y). In addition, a grammar rule (X, ) ∈ ∆ is mapped into a rule X(x, y), {x ≈ y} ∈ S G .

For any nonterminals X, Y ∈ Ξ, we must show that we have L(G, X) ⊆ L(G, Y ) if and only if X |= H S G Y . This is proved using the invariant

∀w ∈ Σ * . (∀t ∈ Σ H . [x ← ŵ(t), y ← t] ∈ µS H G (X)) ⇔ w ∈ L(G, X)
where [x ← ŵ(t), y ← t] denotes the valuation mapping x to ŵ(t) and y to t. Chapter 2

Proof Systems for Entailments

In this chapter, we describe cyclic proof systems suited for entailments involving inductively defined predicates. More specifically, we give a generalized one for FOL and adapt it to SL (Section 2.3). Their design was influenced by an antichain-based method for checking language inclusion of top-down nondeterministic finite tree automata (Section 2.1). We give a general proof search semi-algorithm (Section 2.2), which can become a decision procedure when soundness and completeness are assured. In order to achieve this, additional restrictions (Section 2.4) are necessary, and we show how they indeed guarantee the soundness and completeness of our proof systems (Section 2.5).

Downwards Inclusion Check for Tree Automata

Consider top-down nondeterministic finite tree automata (NFTA) over a ranked alphabet F [START_REF] Hubert Comon | Tree automata techniques and applications[END_REF], where #f is the rank of the symbol f ∈ F. Then A = {Q A , F, I A , ∆ A } is an NFTA where Q A is a set of states, I A ⊆ Q A are the initial states of A and ∆ A is a set of transition rules q f → (q 1 , . . . , q n ), where n = #f for some f ∈ F. Note that NFTA also have an equivalent bottom-up representation, where the initial states become final states and transitions are written as (q 1 , . . . , q n ) f → q.

In the top-down sense, an NFTA A = {Q A , F, I A , ∆ A } labels an input tree with states starting at the root and moving downwards. A transition q f → (q 1 , . . . , q n ) ∈ ∆ A means that, if the input is a tree with root f labelled by state q, then the automaton can move downwards and label the children of f with the states q 1 , . . . , q n , in this order. This process, called a run, can start by using any state from I A to label the root of the input tree, and ends successfully for each leaf a of the input labelled by state r if there exists a transition rule r a → (). An input tree is accepted if there exists a successful run of A on it. Then L(A) -called the language of A -is the set of all inputs accepted by A. Also, L(A, q) -called the language of q in A -is the set of all inputs accepted starting from state q ∈ Q A . Note that L(A) = q∈I A L(A, q). An NFTA can be naturally viewed as an inductive system, where predicates represent states and predicate rules are obtained by translation from transition rules. For instance, q f → (q 1 , . . . , q n ) is equivalent to q(x), {x ≈ f (x 1 , . . . , x n ), q 1 (x 1 ), . . . , q n (x n )} . This means that x is a tree whose root is f and, if the automaton has labelled x with state q, then it can label its subtrees x 1 , . . . , x n with q 1 , . . . , q n , respectively. The variables range over ground terms and the function symbols are interpreted in the canonical (Herbrand) sense. Note that, when describing transition rules for NFTA, the direction of the arrows denotes either the top-down or the bottom-up representation. While similar, our q(x) ← S R 1 , . . . , R n notation simply means that the set of models for q is the union of the sets of models given by the predicate rules R 1 , . . . , R n , and it is not meant to indicate a certain representation. Moreover, L(A, q) is equivalent to µS H (q) for any state q and its translation into a predicate.

Given two NFTA A = {Q A , F, I A , ∆ A } and B = {Q B , F, I B , ∆ B }, a common problem is language inclusion, i.e. whether L(A) ⊆ L(B). This can be translated into a language inclusion problem for states, as it is equivalent to asking whether L(A, p) ⊆ q∈I B L(B, q) for every p ∈ I A . Considering two states p and q, and an inductive system S representing the translation of A and B, the language inclusion problem L(A, p) ⊆ L(B, q) is equivalent to the entailment problem p |= H S q, which asks whether every tree model of p (defined as an inductive predicate) is a model of q (also defined as an inductive predicate).

Example 2.1.1. The inductive system from Example 1.4.1 describes two NFTA A = {{p, p 1 , p 2 }, F, {p}, ∆ A } and B = {{q, q 1 , q 2 }, F, {q}, ∆ B }, where F = {f (, ), g(), a, b} and

∆ A = {p f → (p 1 , p 2 ), p 1 g → p 1 , p 1 a → (), p 2 g → p 2 , p 2 b → ()} ∆ B = {q f → (q 1 , q 2 ), q 1 g → q 1 , q 1 a → (), q f → (q 2 , q 1 ), q 2 g → q 2 , q 2 b → ()} Then L(A) = L(A, p) = µS H (p) and L(B) = L(B, q) = µS H (q).
The language inclusion problem L(A) ⊆ L(B) is then equivalent to L(A, p) ⊆ L(B, q), which is furthermore equivalent to the entailment problem p |= H S q.

Since language inclusion is decidable for NFTA [12, Corollary 1.7.9], we leverage an existing algorithm for this problem by Holík et al. [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF] to build a complete set of inference rules and derive a proof search technique. The downwards inclusion check proposed by Holík et al. searches for counterexamples of L(A, p) ⊆ k i=1 L(B, q i ) by building a tree containing pairs (r, {s 1 , . . . , s n }), where r is a state that can be reached from p via a series of transitions in ∆ A , and {s 1 , . . . , s n } are all the states that can be reached from q 1 , . . . , q k via a series of transitions in ∆ B with the same symbols. A counterexample is discovered when the algorithm encounters a pair (r, {s 1 , . . . , s n }) such that there exists a transition r f → (r 1 , . . . r m ) in ∆ A and there exists no transition

s i f → (s 1 , . . . s m ) in ∆ B for any i ∈ [n].
In this situation, we reach a leaf of the form ((r 1 , . . . , r m ), ∅), where m ≥ 0. On a different note, if a leaf ((), S) with () ∈ S is reached, then the check was successful on its corresponding branch. This type of leaves indicate a transition with a symbol of rank 0 that exists for both r and some state s i , with i ∈ [n], of the parent pair (r, {s 1 , . . . , s n }).

One important aspect is that, by the nature of tree automata, it is possible to have transitions such as

p f → (r 1 , . . . , r n ) and q f → (s 1 1 , . . . , s 1 n ), . . . , q f → (s k 1 , . . . , s k n ). Thus, the inclusion L(A, p) ⊆ L(B, q) holds only if L(A, (r 1 , . . . , r n )) ⊆ k i=1 L(B, (s i 1 , . . . , s i n )
) also holds. In this case, the algorithm reaches a pair ((r 1 , . .

. , r n ), {(s 1 1 , . . . , s 1 n ), . . . , (s i 1 , . . . , s i n )}). Be- cause the union k i=1 L(B, (s i 1 , . . . , s i n )) = k i=1 L(B, s i 1 ) × . . . × L(B, s i n
) cannot be simply computed component-wise, there is no easy check that can be performed on such a pair. Instead, using some properties of the Cartesian product, we can perform a split action and obtain several groups of simpler inclusions L(A, r i ) ⊆ s∈Si L(B, s), with S i ⊆ {s 1 i , . . . , s k i } and i ∈ [n], such that, if all the inclusions hold in at least one group, then

L(A, (r 1 , . . . , r n )) ⊆ k i=1 L(B, (s i 1 , . . . , s i n )
) also holds (see [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF]Theorem 1]). Then the pair ((r 1 , . . . , r n ), {(s 1 1 , . . . , s 1 n ), . . . , (s k 1 , . . . , s k n )}) can also be broken down into several groups of pairs (r i , S i ) and, if a counterexample is encountered for at least one pair in every group, then there also exists a counterexample for ((r 1 , . . . , r n ), {(s 1 1 , . . . , s 1 n ), . . . , (s k 1 , . . . , s k n )}). The algorithm also keeps a workset of previously checked pairs and stops successfully whenever it encounters a pair identical to one of its ancestors. This is justified by the fact that, if the inclusion does not hold, it is not because of the sequence of pairs obtained from the ancestor to the current one. Otherwise, by infinite descent, there would exist a counterexample that is a strictly smaller tree than the one obtained from the ancestor and, by repeating the path infinitely often, we would obtain an infinite sequence of strictly smaller counterexamples, which is impossible, as we only consider finite trees.

Example 2.1.2. Consider the NFTA A and B from Example 2.1.1. To check L(A, p) ⊆ L(B, q), we start with (p, {q}). A run of the algorithm is depicted below, where the enumerated pairs are organized as a tree. The algorithm perform two types of actions: transitions (indicated by arrows labelled with symbols) and split actions (indicated by unlabelled edges).

(p, {q})

((p1, p2), {(q1, q2), (q2, q1)}) (p1, {q1, q2}) (p1, {q1}) (p2, {q2}) (p2, {q2, q1}) ((), {()}) (p1, {q1, q2}) ((), {()}) (p1, {q1}) ((), {()}) (p2, {q2}) ((), {()}) (p2, {q2, q1}) f a g a g b g b g
Note that, for the pair ((p 1 , p 2 ), {(q 1 , q 2 ), (q 2 , q 1 )}), this run checks the group (p 1 , {q 1 , q 2 }), (p 1 , {q 1 }), (p 2 , {q 2 }) and (p 2 , {q 2 , q 1 }). By [24, Theorem 1], the other possibilities are:

-(p 1 , {q 1 , q 2 }), (p 1 , {q 1 }), (p 1 , {q 2 }) and (p 2 , {q 2 , q 1 }); -(p 1 , {q 1 , q 2 }), (p 2 , {q 1 }), (p 1 , {q 2 }) and (p 2 , {q 2 , q 1 }); -(p 1 , {q 1 , q 2 }), (p 2 , {q 1 }), (p 2 , {q 2 }) and (p 2 , {q 2 , q 1 }).
On the other hand, note how L(B, q) ⊆ L(A, p). There exists only one run of the algorithm starting with the pair (q, {p}), as depicted below.

(q, {p})

((q1, q2), {(p1, p2)}) ((q2, q1), {(p1, p2)}) (q1, {p1}) (q2, {p2}) (q2, {p1}) (q1, {p2}) ((), {()}) (q1, {p1}) ((), {()}) (q2, {q2}) ((), ∅) (q2, {p1}) ((), ∅) (q1, {p2}) f f a g b g b g a g
Because both sets in ((q 1 , q 2 ), {(p 1 , p 2 )}) and ((q 2 , q 1 ), {(p 1 , p 2 )}) contain only one tuple, the pairs can be split in only one way, component-wise. The counterexamples in this case are f (b, a), f (b, x) with x ∈ L(B, q 1 ), and f (x, a) with x ∈ L(B, q 2 ).

A Proof Search Semi-algorithm

The main idea behind the proof systems we want to build is to view a complete, counterexample-free search tree for an inclusion problem L(A, p) ⊆ k i=1 L(B, q i ) (such as the one depicted in Example 2.1.2) as a proof for the validity of the entailment p |= H S q 1 , . . . , q k , where S contains the predicate definitions corresponding to the two NFTA in which p and q 1 , . . . , q k are states. We view the pairs (r, {s 1 , . . . , s n }) explored by the downwards inclusion check as sequents r(x) s 1 (x), . . . , s n (x) in the proof and apply the principle of Infinite Descent to close those branches leading to an infinite sequence of strictly decreasing counterexamples.

We write Γ ∆ to denote a sequent. Typically, the left-hand side Γ is a set of quantifierfree formulae and predicate atoms, while the right-hand side ∆ is a set of (possibly existentially quantified) conjunctions over quantifier-free formulae and predicate atoms. In FOL, the left-hand sides are interpreted as classic conjunctions, while in SL they use the separating conjunction. In both cases, the right-hand sides are interpreted as disjunctions. When writing sequents we usually omit the braces in both Γ and ∆. A sequent of the form p(x) q 1 (x), . . . , q n (x) is called basic. Definition 2.2.1 (Proof system). A proof system R is a set of inference rule schemata:

IR Γ 1 ∆ 1 . . . Γ n ∆ n Γ ∆ side conditions . . . . C Γ p ∆ p
We call Γ i ∆ i the antecedents and Γ ∆ the consequent of the inference rule. When the list of antecedents is empty (i.e. n = 0), an inference rule may have a pivot Γ p ∆ p (which is always a sequent preceding the consequent in the transitive closure of the consequentantecedent relation or, in other words, an ancestor of the consequent) and C is a pivot constraint on the path between the pivot and the consequent.

An inference rule schema (or simply inference rule, for short) allows for infinite instances that share the same structure. We refer to these as inference rule instances or inference rule applications. For any inference rule IR we assume that there are finitely many instances of IR with pivot Γ p ∆ p and consequent Γ ∆. We denote by #(IR) the number of its antecedents and write for the antecedent list whenever #(IR) = 0. It is possible to have inference rules for which #(IR) ≥ 0 and only a particular instance can determine the exact number of antecedents. Thus, we say that #(ir ) = 0 if an instance ir of IR generates an empty list of antecedents and also write for this particular instance. Naturally, if #(IR) = 0, then also #(ir ) = 0 for any instance ir of IR. Definition 2.2.2 (Derivation). A derivation using the proof system R is a (possibly infinite) tree D = (V, v 0 , Seq, Rule, Par, Piv), where V is a set of vertices, v 0 ∈ V is the root node, Seq is a total mapping from V to sequents, Rule : V R, Par : V \ {v 0 } → V and Piv : V \ {v 0 } V such that:

(i) Each v ∈ V is labelled by a sequent Seq(v) and Rule(v), if defined, indicates the inference rule schema whose instance is applied on Seq(v);

(ii) For each v ∈ V \ {v 0 }, Par(v) ∈ V is the parent node of v and Seq(v) is an antecedent of the Rule(Par(v)) instance applied on Seq(Par(v)). If this inference rule instance generates an empty list of antecedents, then Seq(v) = ;

(iii) If the instance of Rule(v) applied on Seq(v) has a pivot, where v ∈ V \ {v 0 }, then Piv(v) ∈ V denotes a node such that Seq(Piv(v)) is the pivot of this instance.

Definition 2.2.3 (Proof). A proof is a finite derivation D = (V, v 0 , Seq, Rule, Par, Piv) such that Seq(v) = for all leaves v ∈ V -i.e. on every branch of the derivation, the last inference rule application has an empty list of antecedents.

Having formalized derivations and proofs, we now define backlinks, traces and paths. These notions are instrumental to formulating properties of derivations and proofs, while also playing an important role in establishing soundness and completeness results later on.

Definition 2.2.4 (Backlink). Given a derivation D = (V, v 0 , Seq, Rule, Par, Piv), a backlink is a pair (u, v) with u, v ∈ V such that Piv(u) = v. Definition 2.2.5 (Trace). A trace in a derivation D = (V, v 0 , Seq, Rule, Par, Piv) is a (possi- bly infinite) sequence of vertices τ = v 1 , v 2 , . . . such that, for all i > 1 either v i-1 = Par(v i ) or Piv(v i-1 ) = v i . We say that τ contains a backlink if Piv(v i-1 ) = v i for some i > 1. Definition 2.2.6 (Path). A path in a derivation D = (V, v 0 , Seq, Rule, Par, Piv) is a sequence of vertices π = v 1 , . . . , v n such that, for all i ∈ [2, n], we have v i-1 = Par(v i ). If, furthermore, Piv(v n ) = v 1 , then π is a direct path.
Note that, since the branching degree of a proof is finite, by König's Lemma every path in a proof must also be finite. Traces, however, can be infinite, in both derivations and proofs. Given a path or a finite trace π = v 1 , . . . , v k , we write Λ(π) for the sequence Rule(v 1 ), . . . , Rule(v k ) of inference rule schemata applied along π. We can also decompose π into several subsequences ρ 1 , . . . , ρ m such that their concatenation is equal to π. We denote this by π = ρ 1 • . . . • ρ m and, in this case, we also write Λ

(π) = Λ(ρ 1 ) • . . . • Λ(ρ m ).
The pivot constraint C of an inference rule schema IR is a set of finite sequences of inference rule schemata, such that, for any instance ir of IR, if π is the direct path from the pivot of ir to its consequent, then Λ(π) ∈ C. We usually specify C using regular expressions. Proposition 2.2.1. Any infinite trace in a proof contains infinitely many direct paths.

Proof. Let τ be an infinite trace in the proof D = (V, v 0 , Seq, Rule, Par, Piv). Since V is finite, τ must contain infinitely many backlinks. Moreover, V × V is also finite and there can only be a finite number of backlinks, thus there must exist a backlink (v i-1 , v i ) that repeats infinitely often in τ .

We now show that, for every finite trace ρ = v i , . . . , v i-1 , where (v i-1 , v i ) is a backlink, there exists a direct path in ρ, by induction on the number N of backlinks in ρ. If N = 0 the direct path is trivially ρ. For the induction step N > 0, we suppose that the property holds for any

N < N . Let ρ = v i , . . . , v j-1 , v j , . . . , v i-1 , where (v j-1 , v j ) is the last backlink on ρ. Then the suffix v j . . . v i-1 of ρ is a path. Since (v i-1 , v i ) is a backlink, then v i is a predecessor of v i-1 in D, thus v i , v j and v i-1
are on the same branch on D. We distinguish two cases:

1. If v j is v i or a predecessor of v i then ρ ends in a direct path from v i to v i-1 in ρ and we are done, because ρ = v i , . . . , v j-1 , v j , . . . , v i , . . . , v i-1 and there are no more backlinks between v j and v i-1 .

2. Else, if v i is a strict predecessor of v j , we show that there must exist another occurrence of v j in the prefix v i , . . . , v j-1 of ρ. Note that v i , v j and v j-1 occur on the same branch in D. Suppose, by contradiction, that v k = v j , for all k ∈ [i, j -1]. To reach v j-1 from v i there must exist a strict predecessor u ∈ V of v j and a subsequence of ρ from u to some strict successor u ∈ V of v j that goes through one or more backlinks (see the figure below). However this is not possible, since each backlink leads from a leaf of D to one of its predecessors, thus any trace starting at v i , passing through u and then following a different branch than the one on which v i , v j and v j-1 reside, can only return to this branch at u or predecessors of u, whereas u is a strict successor of u.

. . .

v i v j v j-1 u u
We have shown that there exists k

∈ [i, j -1] such that v k = v j , thus we have a subsequence ρ = v k , . . . , v j-1 of ρ, where (v j-1 , v k ) is a backlink, containing N < N backlinks.
By the induction hypothesis, ρ contains a direct path, which concludes the induction proof.

Therefore, each finite subtrace v i-1 , . . . , v i contains a direct path. Because the backlink (v i-1 , v i ) occurs infinitely often in τ , there are infinitely many such subtraces in τ , we can conclude that τ contains infinitely many direct paths.

We want our proof systems to be sound and, ideally, complete. Having introduced all the above notions, we can now define soundness and completeness. Definition 2.2.7 (Soundness and completeness). Given an inductive system S and an interpretation I, a proof system R is sound if, for every sequent p(x) q 1 (x), . . . , q n (x) that is the root of a proof constructed with R, the entailment p |= I S q 1 , . . . , q n holds. Moreover, R is complete if for every valid entailment p |= I S q 1 , . . . , q n there exists a proof starting with p(x) q 1 (x), . . . , q n (x) that can be constructed with R.

Trying to build a proof with no guidance on what inference rule schema to apply at any point can become quite a gruelling task. To this end, we introduce the notion of a strategy, which can be used to guide a proof-search algorithm. Definition 2.2.8 (Strategy). A strategy is a set S of inference rule schema sequences. A derivation (or proof) D is an S-derivation (or S-proof) if the sequences of inference rule applications along every maximal path in D belong to S. Definition 2.2.9 (Valid prefix). Given a strategy S, a sequence s of inference rule schemata is a valid prefix for S if there exists another, possibly empty, sequence s such that their concatenation s • s belongs to S. pivot, children) which takes four arguments of the same types as its fields and initializes them. The proof-search semi-algorithm we propose uses this data structure, and also the notion of applicable inference rule schema, for which we provide the following definition.

Algorithm 1: Proof search semi-algorithm.

Input : An inductive system S, a basic sequent p(x) q 1 (x), . . . , q n (x), a proof system R and a strategy S Output: A proof starting with p(x) q 1 (x), . . . , q n (x) Mark N as closed Definition 2.2.10 (Applicable inference rule schema). Given an inference rule IR, a sequent Γ ∆ and path π starting at the root of a derivation and ending at v, where Seq(v) = Γ ∆, we say that IR is applicable on Γ ∆ and π if there exists an instance ir of IR such that:

1 Root ← Node(p(x) q 1 (x), . . . , q n (x), null , null , null , []) 2 WorkQueue ← {Root} 3 while WorkQueue = [] do
(i) Γ ∆ matches the consequent of ir such that the side conditions are satisfied;

(ii) There exists v p = v along π, where Seq(v p ) matches the pivot of ir such that the side conditions are satisfied, and

, if π = ρ • v p • η • v, then Λ(v p • η) ∈ C, where C is the pivot constraint of ir .
Given an input sequent p(x) q 1 (x), . . . , q n (x), a set R of inference rule schemata and a strategy S, the proof search semi-algorithm 1 iterates over a work queue of nodes to build a derivation. The root node is initialized with the input sequent, an empty list of children and nil for the parent pointer and the inference rule schema. The work queue initially contains only the root. When a node is removed from the work queue, the path between the root sequent and the current sequent is extracted using the parent pointers. The semi-algorithm then computes the sets R N (of inference rule schemata applicable on the current sequent and derivation path) and R 0 N (the subset of R N containing only those inference rule schemata with a guaranteed empty list of antecedents). Inference rule schemata in R 0 N matching the strategy are applied eagerly and the node is marked as closed, indicating a successfully proved path. Otherwise, the semi-algorithm chooses nondeterministically an application of an inference rule schema in R N that matches the strategy. Then, for every antecedent, a new child node is created, which is then added to the work queue. If the inference rule application generated an empty list of antecedents, the current node is marked as closed.

Note that, if a proof of p(x) q 1 (x), . . . , q n (x) exists, then there also exists a finite execution of the semi-algorithm 1 on this sequent. Moreover, if the strategy S is chosen in a way that forbids infinite derivations, this turns 1 into an algorithm, which can furthermore become a decision procedure for the entailment problem if the input set of inference rules is complete for the input inductive system.

Cyclic Proof Systems for Inductive Entailments

The Inference Rule Set R Ind for FOL Entailments

We introduce the proof system R Ind = {LU, RU, RD, ∧R, SP, AX, ID}, suited for FOL entailments. Its inference rule schemata are depicted in Figures 2.2, 2.3, 2.4 and 2.5, where long side conditions are written underneath each respective inference rule schema instead of to the right. The inference rules of type LU and RU (Figure 2.2) unfold a predicate atom p(x) which occurs on either the left-or right-hand side of a sequent Γ ∆, respectively. By unfolding p(x), the atom is replaced with the set of predicate rules p(x)

LU R i (x, y i ), Γ \ p(x) ∆ n i=1 Γ ∆ p(x) ∈ Γ, y 1 , . . . , y n fresh p(x) ← S R 1 (x) | . . . | Rn(x) RU Γ {∃y i . R i (x, y i )} n i=1 , ∆ \ p(x) Γ ∆ p(x) ∈ ∆, y 1 , . . . , y n fresh p(x) ← S R 1 (x) | . . . | Rn(x)
← S R 1 (x) | . . . | R n (x)
, in which we use fresh subgoal variables. The left unfolding yields a set of sequents that must be all proved, one for each R i , thus creating several new branches in the derivation that need to be all valid in order to obtain a proof. In contrast, the right unfolding simply replaces p(x) on the right-hand side of the sequent with a set of formulae obtained by applying conjunction over each R i , i ∈ [n] and existentially quantifying the fresh subgoal variables in them.

Example 2.3.1. Consider the inductive system from Example 1.4.1. In order to prove the entailment p |= H S q, we start a derivation from the sequent p(x) q(x). By applying LU on this sequent to unfold p(x), we obtain:

p(x) q(x) x ≈ f (x1, x2), p1(x1), p2(x2) q(x) lu
We can further apply RU on the resulting sequent and unfold q(x):

x ≈ f (x1, x2), p1(x1), p2(x2) q(x) x ≈ f (x1, x2), p1(x1), p2(x2) ∃y1, y2 . x ≈ f (y1, y2) ∧ q1(y1) ∧ q2(y2), ∃y1, y2 . x ≈ f (y1, y2) ∧ q2(y1) ∧ q1(y2)
ru Note that, by unfolding, we have introduced the new subgoal variables x 1 , x 2 on the left-hand side and the new, existentially quantified subgoal variables y 1 , y 2 for each conjunction on the right-hand side. The inference rules of type RD (Figure 2.3) simplify sequents by eliminating the constraints from both the left-and right-hand sides. This is done by checking the entailments φ |= I ∃y j . ψ j , j ∈ [k] between the left constraint and each of the constraints on the right. If the entailment does not hold, the corresponding conjunction ∃y j . ψ j (x, y j ) ∧ Q j (y j ) from the right-hand side is ignored. If the entailment holds, however, it is witnessed by a finite set of substitutions S j ⊆ VIS(φ, ψ) for the existentially quantified subgoal variables y j , where VIS(φ, ψ) = {θ :

RD p 1 (x 1 ), . . . , p n (x n ) {Q j (y j θ) | θ ∈ S j } i j=1 φ(x, x 1 , . . . , x n ), p 1 (x 1 ), . . . , p n (x n ) {∃y j . ψ j (x, y j ) ∧ Q j (y j )} k j=1 where φ |= I i j=1 ∃y j . ψ j , φ |= I k j=i+1 ∃y j . ψ j , S j ⊆ VIS(φ, ψ j ), j ∈ [i] ∧R Γ p(x) ∧ Q, ∆ Γ q(x) ∧ Q, ∆ Γ p(x) ∧ q(x) ∧ Q, ∆
m j=1 set(y j ) → T Σ (set(x) ∪ n i=1 set(x i )) | φ |= I ψθ}.
For each valid entailment, we eliminate the constraint ψ j (x, y j ) together with the existential quantification, and add every conjunction of predicates Q j (y j θ) with θ ∈ S j on the right-hand side of the antecedent. Finally, the left-hand side of the antecedent is obtained from the left-hand side of the consequent by simply eliminating the constraint.

Note that the application of RD, which substitutes the subgoal variables on the right-hand side, may generate conjunctions of predicates sharing the same tuple of arguments (if there originally were more subgoals on the right-hand side before the application of RD). These cases are eagerly eliminated using an inference rule of type ∧R (Figure 2.3). We assume that every application of RD is followed by a cleanup of the right-hand side of its antecedent using sufficiently many applications of ∧R to eliminate all conjunctions of predicates with the same arguments from the right-hand side.

Example 2.3.2. Continuing the derivation from Example 2.3.1, we apply RD on the antecedent of RU:

x ≈ f (x1, x2), p1(x1), p2(x2) ∃y1, y2 . x ≈ f (y1, y2) ∧ q1(y1) ∧ q2(y2), ∃y1, y2 . x ≈ f (y1, y2) ∧ q2(y1) ∧ q1(y2) p1(x1), p2(x2) q1(x1) ∧ q2(x2), q2(x1) ∧ q1(x2) rd This application of RD checks the entailment x ≈ f (x 1 , x 2 ) |= I ∃y 1 , y 2 . x ≈ f (y 1 , y 2 )
for both parts of the right-hand side (since they happen to have the same constraint). The entailment holds and is witnessed by the substitution θ = {(y 1 , x 1 ), (y 2 , x 2 )}. The constraints x ≈ f (x 1 , x 2 ) and x ≈ f (y 1 , y 2 ) together with the quantification ∃y 1 , y 2 are removed and θ is applied on both conjunctions from the right-hand side. The transition actions performed by the algorithm for tree automata inclusion checking detailed in Section 2.1 are equivalent to applying the LU, RU and RD inference rules all at once. This is a natural consequence of how the function symbol labelling the root of the current input controls the transition rules for tree automata. Function symbols can only be compared via equality, thus the constraints of the predicate rules corresponding to a tree automata match unambiguously. For instance, x ≈ f (x 1 , x 2 ) |= H ∃y 1 ∃y 2 . x ≈ g(y 1 , y 2 ) if and only if f and g are the same function symbol, in which case the only substitution witnessing the validity of the entailment is θ(

SP p īj (x īj ) {q īj (x īj ) | ∈ [k], f j (Q ) = īj } n k j=1 p 1 (x 1 ), . . . , p n (x n ) {Q j (x 1 , . . . , x n )} k j=1 where set(x i ) ∩ set(x j ) = ∅, ∀i, j ∈ [n], Q j = n i=1 q j i (x i ), Q j = q j 1 , . . . , q j n , ∀j ∈ [k] F (Q 1 , . . . , Q k ) = {f 1 , . . . , f n k }, ī ∈ [n] n k
x i ) = y i , for i ∈ [2].
However, when considering general constraints, matching requires the discovery of nontrivial substitutions that prove an entailment between existentially quantified formulae. Moreover, the matching step implemented by the RD rule is crucial for the completeness of the proof system. We generalize from the simple case of tree automata constraints and identify general properties for the set of constraints that allow matching to be complete. Such properties are detailed in Section 2.4.

The inference rules of type SP (Figure 2.4) split a sequent without constraints, of the from

p 1 (x 1 ), . . . , p n (x n ) {Q j (x 1 , . . . , x n )} k j=1 , where Q j (x 1 , . . . , x n ) = n i=1 q j i (x i )
, into basic sequents, with left-hand sides p 1 (x 1 ), . . . , p n (x n ). This inference rule corresponds to the split action performed by the inclusion check from Section 2.1. Given a set of predicate tuples

{Q 1 , . . . , Q k } ⊆ Pred n , for some n ≥ 1, a choice function f maps each tuple Q j , j ∈ [n] into an index f (Q j ) ∈ [n] corresponding to a given position in the tuple. Let F(Q 1 , . . . , Q k ) = {f 1 , . . . , f n k } be
the set of all such choice functions. This set has cardinality n k , for any set of n-tuples of predicates. Consider now a tuple of length n k containing index choices from 1 to n, each corresponding to a choice function f 1 , . . . , f n k . The set of all such choices is [n] n k . Given a choice ī ∈ [n] n k , let īj = pos j (ī). Then, for each ī there exists an application of SP, generating n k antecedents with left hand-side p īj (x īj ), j ∈ [n k ] and right hand-side consisting of all predicate atoms q īj (x īj ), ∈ [k] obtained from predicates at position īj in the tuples Q which are mapped to īj by the choice function f j . In order to obtain a proof, there must exist some application of SP -and, therefore, some ī ∈ [n] n k -for which all the generated antecedents can be proven. It is important to note, however, that these tuples are meant to encode the transformation of a formula from CNF to DNF and, as such, not all possibilities are relevant. More precisely, as shown in [24, Section 3], any ī for which there exists j ∈ [n k ] such that īj ∈ img(f j ) can be discarded.

To apply SP, it is necessary that all the conjunctions on the right-hand side of the consequent contain the same number of predicate atoms as the left-hand side. This might not always be the case after applying RD and as many instances of ∧R as possible. Note that the substitutions from RD which map the subgoal variables y j to the subgoal variables x 1 , . . . , x n ensure that there cannot be fewer predicate atoms on the left-hand side than on the right-hand side. Otherwise at least two predicate atoms on the right-hand side would share the same tuple of subgoals x i for some i ∈ [n] and ∧R would be enabled, which contradicts the assumption that we applied ∧R as many times as possible.

In order to enable the application of SP on sequents that have, on the right-hand side, conjunctions of fewer predicate atoms than the left-hand side, we introduce a set of universal predicate rules S u = { p k u (x 1 , . . . , x k ), { } | k ≥ 0} and assume that any system S contains it by default. If there are conjunctions of predicates Q on the right-hand side such that there exist tuples of subgoal variables x i for which ∃p ∈ S p . p(x i ) ∈ Γ, but ∀q ∈ S p . q(x i ) does not occur in Q, then we add p ||xi|| u (x i ) to Q. This change does not alter the semantics of the entailment and is done implicitly when applying SP.

R 1 × R 2 ⊆ S 1 × S 2 ∪ T 1 × T 2 corresponding to this sequent can be rewritten as (R 1 ⊆ S 1 ∪ T 1 ) ∧ (R 1 ⊆ S 1 ∨ R 2 ⊆ T 2 ) ∧ (R 1 ⊆ T 1 ∨ R 2 ⊆ S 2 ) ∧ (R 2 ⊆ S 2 ∪ T 2 )
and, by translating this formula into DNF, we would obtain

(R 1 ⊆ S 1 ∪ T 1 ) ∧ (R 1 ⊆ S 1 ) ∧ (R 1 ⊆ T 1 ) ∧ (R 2 ⊆ S 2 ∪ T 2 ) ∨ (R 1 ⊆ S 1 ∪ T 1 ) ∧ (R 1 ⊆ S 1 ) ∧ (R 2 ⊆ S 2 ) ∧ (R 2 ⊆ S 2 ∪ T 2 ) ∨ (R 1 ⊆ S 1 ∪ T 1 ) ∧ (R 2 ⊆ T 2 ) ∧ (R 1 ⊆ T 1 ) ∧ (R 2 ⊆ S 2 ∪ T 2 ) ∨ (R 1 ⊆ S 1 ∪ T 1 ) ∧ (R 2 ⊆ T 2 ) ∧ (R 2 ⊆ S 2 ) ∧ (R 2 ⊆ S 2 ∪ T 2 )
SP encodes this transformation for µS H (p 1 ) × µS H (p 2 ) ⊆ µS H (q 1 ) × µS H (q 2 ) ∪ µS H (q 2 ) × µS H (q 1 ) as follows. Let Q 1 = (q 1 , q 2 ) and Q 2 = (q 2 , q 1 ) be the tuples of predicates corresponding to the right-hand side. The set of choice functions is

F(Q 1 , Q 2 ) = {f 1 , f 2 , f 3 , f 4 }: f 1 f 2 f 3 f 4 Q 1 1 1 2 2 Q 2 1 2 1 2
The set {c 1 , . . . , c 16 } of all possible index choice tuples for

F(Q 1 , Q 2 ) is: c 1 c 2 c 3 c 4 c 5 c 6 c 7 c 8 c 9 c 10 c 11 c 12 c 13 c 14 c 15 c 16 f 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 f 2 1 1 1 1 2 2 2 2 1 1 1 1 2 2 2 2 f 3 1 1 2 2 1 1 2 2 1 1 2 2 1 1 2 2 f 4 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2
The antecedent of RD corresponds to a valid entailment if there exists some i ∈ [START_REF] Echenim | On the expressive completeness of Bernays-Schönfinkel-Ramsey separation logic[END_REF] such that, if we choose ī = c i , the application of SP with ī leads to a proof. For this example, the relevant tuples (the ones in which īj ∈ img(f j ) for every j ∈ [START_REF] Barrett | The SMT-LIB Standard: Version 2[END_REF]) are c 2 , c 4 , c 6 and c 8 . We choose ī = c 4 = (1, 1, 2, 2), generating the following application of SP:

p1(x1), p2(x2) q1(x1) ∧ q2(x2), q2(x1) ∧ q1(x2) p1(x1) q1(x1), q2(x1) p1(x1) q1(x1) p2(x2) q2(x2) p2(x2) q2(x2), q1 (x2)
sp At this point, in order to prove the entailment, it is necessary to continue the derivation and obtain a proof from each branch created by this application of SP. The inference rule schema AX (Figure 2.5) closes the current branch of the proof, if the sequent from its consequent can be proved using a decision procedure for the underlying constraint logic, while treating all predicate symbols as uninterpreted function symbols of boolean sort.

AX Γ ∆ Γ |= I ∆ ID Γθ ∆ θ θ is a flat, injective substitution ∆ ⊆ ∆ . . . . (R Ind ) * • LU • (R Ind ) * Γ ∆
Example 2.3.4. Consider the sequent p 1 (x 1 ) q 1 (x 1 ), q 2 (x 1 ) obtained from the application of SP in Example 2.3.3. We continue the derivation by applying LU to unfold p 1 (x 1 ) and RU to unfold q 1 (x 1 ). In order to arrive at an application of AX, we only look at the branch generated by LU for the rule p 1 (x 1 ), {x 1 ≈ a} . We obtain the following derivation:

p1(x1) q1(x1), q2(x1) x1 ≈ a q1(x1), q2(x1) x1 ≈ a x1 ≈ a, ∃y1 . x1 ≈ g(y1) ∧ q1(y1), q2(x1) LU RU
Note how x ≈ a appears both on the left-and right-hand sides. Any decision procedure for FOL that treats q 1 and q 2 as uninterpreted functions will indicate that x ≈ a |= H x ≈ a ∨ (∃y 1 . x ≈ g(y 1 ) ∧ q 1 (y 1 )) ∨ q 2 (x) holds. Therefore, it is possible to apply AX:

x1 ≈ a x1 ≈ a, ∃y1 . x1 ≈ g(y1) ∧ q1(y1), q2(x1)
AX Thus, this particular branch of our derivation is closed and, moreover, it represents a valid branch for the proof we are seeking.

The inference rules ID (Figure 2.5), short for Infinite Descent, work as follows. A sequent Γθ ∆ θ denotes a valid entailment whenever the pivot Γ ∆, encountered earlier in the proof, is a similar sequent up to the renaming of variables by a flat, injective substitution θ. The pivot condition (R Ind ) * • LU • (R Ind ) * asks that a rule of type LU is applied somewhere on the path between the pivot Γ ∆ and the consequent Γθ ∆ θ in the proof. Rules of type ID are sound if the inductive system is ranked (Definition 2.4.3), by an application of Fermat's Infinite Descent principle [START_REF] Bussey | Fermat's method of infinite descent[END_REF]. The soundness of ID is based on the following argument, proven in more detail in Section 2.5.1.

Consider, by contradiction, that Γ ∆ does not denote a valid entailment. From the soundness of R Ind \ {ID}, we show how there exists a counterexample ν ∈ µS I ( Γ) \ µS I ( ∆), which can be propagated along the path from the pivot to the consequent of ID, such that we obtain ν ∈ µS I ( Γθ)\µS I ( ∆ θ) and ν is strictly smaller than ν in a chosen well-founded ordering. This is due to the requirement that LU must be applied along this direct path, which, in turn, requires RD to also be applied, guaranteeing a strict decrease in the multiset image of the counterexample. Since θ is flat, injective and also surjective by construction, its inverse exists and we obtain a counterexample ν θ -1 for Γ ∆, which is strictly smaller than ν. Then, for any infinite trace along which we can propagate a counterexample, because such a trace contains infinitely many direct paths (see Proposition 2.2.1) causing a strict decrease in the counterexample, we obtain an infinite strictly decreasing sequence of multisets, contradicting the well-foundedness of the chosen order. Thus Γ |= I S ∆ must hold and the proof branch can be closed.

Example 2.3.5. Similar to how we proceeded in Example 2.3.4, we consider the sequent p 1 (x 1 ) q 1 (x 1 ), q 2 (x 1 ) and apply LU to unfold p(x) and RU twice to unfold both q 1 (x) and q 2 (x). This time, however, we only look at the branch generated by LU for the predicate rule p 1 (x 1 ), {x 1 ≈ g(x 11 ), p 1 (x 11 )} .

We then apply RD, which checks the following entailments:

x 1 ≈ g(x 11 ) |= I x 1 ≈ a (2.1)
x 1 ≈ g(x 11 ) |= I x 1 ≈ b (2.2) x 1 ≈ g(x 11 ) |= I ∃y 11 . x 1 ≈ g(y 11 ) (2.3)
Entailments (2.1) and (2.2) two do not hold and their respective conjunctions from the right-hand side are ignored. Entailment (2.3) holds and is witnessed by the substitution θ = {(y 11 , x 11 )}. This entailment corresponds to two conjunctions from the right-hand side, from which we remove the constraint and the existential quantification, we apply θ, and add the results to the right-hand side of the next sequent.

p1(x11) q1(x11), q2(x11) x1 ≈ g(x11), p1(x11) q1(x1), q2(x1) x1 ≈ g(x11), p1(x11) x1 ≈ a, ∃y11 . x1 ≈ g(y) ∧ q1(y11), q2(x1) x ≈ g(x11), p1(x11) x1 ≈ a, ∃y11 . x1 ≈ g(y11) ∧ q1(y11), x1 ≈ b, ∃y11 . x ≈ g(y11) ∧ q2(y11) p1(x11) q1(x11), q2 (x11)
LU RU RU RD ID Thus, we obtain p 1 (x 11 ) q 1 (x 11 ), q 2 (x 11 ) and we can apply ID using the pivot p 1 (x 1 ) q 1 (x 1 ), q 2 (x 1 ) to close this valid branch of our derivation. Note that, by combining Examples 2.3.4 and 2.3.3, we obtain a proof for the sequent p 1 (x 1 ) q 1 (x 1 ), q 2 (x 1 ). The other three sequents obtained from SP in Example 2.3.3 can be proved in a similar manner.

2.3.2

The Inference Rule Set R SL Ind for SL Entailments

In order to prove SL entailments, we modify the R Ind proof system from Section 2.3.1 such that the sets on the left-hand sides of sequents are interpreted as separating conjunctions, and those on the right-hand sides are interpreted as disjunctions over separating conjunctions. Thus, we obtain the proof system R SL Ind = {LU, RU SL , RD SL , ∧R, SP SL , AX SL , ID}, where the inference rule schemata RU SL , RD SL , SP SL and AX SL have been modified from their counterparts in R Ind and are depicted in Figures 2.6, 2.7, 2.8 and 2.9. Applying RU SL (Figure 2.6) to a sequent is similar to applying its RU counterpart. When

RU SL Γ {∃y i . * R i (x, y i )} n i=1 , ∆ \ p(x) Γ ∆ p(x) ∈ ∆, y 1 , . . . , y n fresh, p(x) ← S R 1 (x) | . . . | Rn(x)
p(x) ← S R 1 (x) | . . . | R n (x)
, the singleton predicate atom p(x) on the right-hand side of a sequent is replaced with a set of formulae obtained by applying the separating conjunction over each R i , i ∈ [n], and existentially quantifying the fresh subgoal variables in them.

Example 2.3.6. Consider the inductive system from Example 1.4.2. In order to prove the entailment ls + |= SL ls + , we start a derivation from the sequent ls + (x, y) ls + (x, y). We apply LU on this sequent to unfold ls + (x, y) and consider only the branch corresponding to the predicate rule ls + (x, y), {y ≈ z 2 ∧ x → z 1 , ls + (z 1 , z 2 )} . We obtain:

ls + (x, y) ls + (x, y) y ≈ z2 ∧ x → z1, ls + (z1, z2) ls + (x, y)

LU

We can further apply RU SL on the resulting sequent and unfold ls + (x, y):

y ≈ z2 ∧ x → z1, ls + (z1, z2) ls + (x, y) y ≈ z2 ∧ x → z1, ls + (z1, z2) ∃u1, u2 . y ≈ u2 ∧ x → u1 * ls e (u1, u2), ∃u1, u2 . y ≈ u2 ∧ x → u1 * ls o (u1, u2) RU SL
Note that, by unfolding, we have introduced the new subgoal variables z 1 , z 2 on the lefthand side and the new, existentially quantified subgoal variables u 1 , u 2 for each separating conjunction on the right-hand side. The inference rules of type RD SL (Figure 2.7) operate similarly to their RD counterparts, but check the entailments φ |= SL ∃y j . ψ j , j ∈ [k] between the left constraint and each of the right constraints. Here, VIS(φ, ψ) = {θ :

RD SL p 1 (x 1 ), . . . , p n (x n ) {Q j (y j θ) | θ ∈ S j } i j=1 φ(x, x 1 , . . . , x n ), p 1 (x 1 ), . . . , p n (x n ) {∃y j . ψ j (x, y j ) * Q j (y j )} k j=1 where φ |= SL i j=1 ∃y j . ψ j , φ |= SL k j=i+1 ∃y j . ψ j , S j ⊆ VIS(φ, ψ j ), j ∈ [i]
m j=1 set(y j ) → set(x) ∪ n i=1 set(x i ) | φ |= SL ψθ}.
Furthermore, the form of the right-hand sides is changed to accommodate the new interpretation of the sequents and each Q j , j ∈ [n], is a separating conjunction of predicate atoms.

Example 2.3.7. Continuing the derivation from Example 2.3.6, we apply RD SL on the antecedent of RU SL :

y ≈ z2 ∧ x → z1, ls + (z1, z2) ∃u1, u2 . y ≈ u2 ∧ x → u1 * ls e (u1, u2), ∃u1, u2 . y ≈ u2 ∧ x → u1 * ls o (u1, u2) ls + (z1, z2) ls e (z1, z2), ls o (z1, z2) RD SL
This application of RD SL checks the entailment y ≈ z 2 ∧x → z 1 |= SL ∃u 1 ∃u 2 . y ≈ u 2 ∧x → u 1 for both parts of the right-hand side (since they happen to have the same constraint). The entailment holds and is witnessed by the substitution θ = (u 1 , z 1 ), (u 2 , z 2 ). The constraints are removed and θ is applied on both separating conjunctions from the right-hand side. The inference rules of type SP SL (Figure 2.8) and AX SL (Figure 2.9) differ from their R Ind counterparts in the form and interpretation of sequents. The right-hand side for the consequent of SP SL contains separating conjunctions of predicate atoms, while the side condition of AX SL contains a separating conjunction over the the left-hand side of its consequent. Example 2.3.8. Continuing the derivation from Example 2.3.7, note that an application of SP SL is not needed. We apply LU to unfold ls + (z 1 , z 2 ) and we separately analyse the two branches that result for each predicate rule in the definition of ls + .

SP SL p īj (x īj ) {q īj (x īj ) | ∈ [k], f j (Q ) = īj } n k j=1 p 1 (x 1 ), . . . , p n (x n ) {Q j (x 1 , . . . , x n )} k j=1 where set(x i ) ∩ set(x j ) = ∅, ∀i, j ∈ [n], Q j = * n i=1 q j i (x j ), Q j = q j 1 , . . . , q j n , ∀j ∈ [k] F (Q 1 , . . . , Q k ) = {f 1 , . . . , f n k }, ī ∈ [n] n k
AX SL Γ ∆ * Γ |= SL ∆
On the branch obtained by left unfolding ls + (z 1 , z 2 ) with the predicate rule ls + (z 1 , z 2 ), {z 1 → z 2 } , we can apply RU SL to unfold ls o (z 1 , z 2 ) on the right-hand side. Then we can close the branch by applying AX SL , because any decision procedure for SL that treats ls e as an uninterpreted function will indicate that

z 1 → z 2 |= SL ls e (z 1 , z 2 ) ∨ z 1 → z 2 ∨ ∃u 1 , u 2 . z 2 ≈ u 2 ∧ z 1 → u 1 * ls e (u 1 , u 2 ) holds. ls + (z1, z2) ls e (z1, z2), ls o (z1, z2) z1 → z2 ls e (z1, z2), ls o (z1, z2) z1 → z2 ls e (z1, z2), z1 → z2, ∃u1, u2 . z2 ≈ u2 ∧ z1 → u1 * ls e (u1, u2) LU RU SL AX SL
On the branch obtained by left unfolding ls + (z 1 , z 2 ) with the predicate rule ls + (z 1 , z 2 ), {y ≈ u 2 ∧ z 1 → u 1 , ls + (u 1 , u 2 )} , we apply RU SL twice to unfold both predicate atoms on the righthand side, we eliminate the constraints by RD SL and then we can close the branch by ID.

ls + (z1, z2) ls e (z1, z2), ls o (z1, z2) z2 ≈ u2 ∧ z1 → u1, ls + (u1, u2) ls e (z1, z2), ls o (z1, z2) z2 ≈ u2 ∧ z1 → u1, ls + (u1, u2) z1 ≈ z2 ∧ emp, ∃v1, v2 . z2 ≈ v2 ∧ z1 → v1 * ls o (v1, v2), ls o (z1, z2) z2 ≈ u2 ∧ z1 → u1, ls + (u1, u2) z1 ≈ z2 ∧ emp, ∃v1, v2 . z2 ≈ v2 ∧ z1 → v1 * ls o (v1, v2), z1 → z2, ∃v1, v2 . z2 ≈ v2 ∧ z1 → v1 * ls e (v1, v2) ls + (u1, u2) ls o (u1, u2), ls e (u1, u2) LU RU SL RU SL RD SL ID 2.

Restricting the Set of Constraints

The undecidability results of Theorems 1.4.1 and 1.4.2 indicate that a number of restrictions on the constraints of an inductive system are required to ensure the soundness and completeness of our proof systems. Checking whether a given inductive system respects the restrictions that we propose is subject to the existence of a decision procedure of the ∃ * ∀ * -quantified fragment of the underlying logic, in which the constraints in every predicate rule are expressed. For first-order logic with the canonical interpretation, this problem is known as disunification and has been shown decidable in [START_REF] Comon | Equational problems and disunification[END_REF], with tighter complexity bounds in [START_REF] Pichler | On the complexity of equational problems in CNF[END_REF]. For separation logic, we provide our own decision procedures in Chapter 3. We only consider SL inductive systems whose constraints are -- * -free, since the presence of the separating implication leads to the undecidability of the satisfiability problem for the ∃ * ∀ * -quantified fragment (see Section 3.3.1).

Well-quasi-orderings

We introduce the notion of quasi-ordering as it is defined in [START_REF] Kruskal | The theory of well-quasi-ordering: A frequently discovered concept[END_REF]. It is useful in defining ranked inductive systems in Section 2.4.3 and necessary for proving certain results related to derivation and proof trees in Section 2.5. Given a set D, a quasi-ordering or qo is a relation

≤ D ⊆ D × D that is reflexive (i.e. ∀d ∈ D . d ≤ D d) and transitive (i.e. ∀d 1 , d 2 , d 3 ∈ D . d 1 ≤ D d 2 and d 2 ≤ D d 3 ⇒ d 1 ≤ D d 3 ). An infinite sequence d 1 , d 2 , . . . from D is saturating if it contains an increasing pair d i ≤ D d j for some i < j.
A quasi-ordering ≤ D on D is a well-quasi-ordering or wqo if every infinite sequence in D is saturating. A quasi-ordering ≤ D on D is well-founded or a wfqo if and only if there are no infinite decreasing sequences

d 1 > D d 2 > D . . . in D, where d 1 > D d 2 ⇔ d 2 ≤ D d 1 and d 1 = d 2 .
Every wqo is a wfqo, but not vice versa.

Example 2.4.1. A simple example of wqo is (N, ≤), the set of natural numbers together with the standard number ordering. Note that its integer counterpart, (Z, ≤), is not a wqo because it is not well-founded. On the other hand, (N, |), the set of natural numbers ordered by the divisibility relation, is a wfqo, but not a wqo, because the prime numbers form an infinite, non-saturating sequence.

A wfqo that is relevant for our work is (T Σ , ), as defined by the Herbrand interpretation in Section 1.4.1. Since T Σ consists only of finite trees, it is impossible to build an infinite strictly decreasing sequence of subtrees, thus making it well-founded. On the other hand, infinite non-saturating sequences do exist. Consider, for instance, Σ s = {σ} and Σ f = {a σ , f σσ , g σσ }. Then the sequence f (a), f (g(a)), . . . , f (g n (a)), . . . , n ∈ N is infinite and nonsaturating. Therefore (T Σ , ) is not a wqo.

A → B, we define the multiset f [[A]] : f (A) → N, where f [[A]](y) = ||{x | x ∈ A, f (x) = y}|| for every y ∈ f (A).
The set of finite multisets over D is M(D). Given two multisets M 1 , M 2 ∈ M(D), we define the membership and inclusion relations, as well as the union, intersection and difference operations:

d ∈ M 1 ⇔ ∃d ∈ D . M 1 (d) > 0 M 1 ⊆ M 2 ⇔ ∀d ∈ D . M 1 (d) ≤ M 2 (d) (M 1 ∪ M 2 )(d) = max(M 1 (d), M 2 (d)), ∀d ∈ D (M 1 ∩ M 2 )(d) = min(M 1 (d), M 2 (d)), ∀d ∈ D (M 1 \ M 2 )(d) = max(0, M 1 (d) -M 2 (d)), ∀d ∈ D
The multiset order induced by ≤ D is defined as follows: M ≤ † D N if and only if either M = N , or there exists a non-empty finite multiset X ⊆ N and a (possibly empty) multiset Y , such that ∀y ∈ Y ∃x ∈ X . y < D x and M = (N \ X) ∪ Y . In other words, M is obtained by replacing a non-empty subset of N with a possibly empty multiset of smaller elements. An equivalent definition is given by Huet and Oppen in [START_REF] Huet | Equations and rewrite rules: A survey[END_REF]: M < † D N if and only if M = N and, for all x ∈ D, M (x) > N (x) ⇒ ∃y ∈ D . x < D y and M (y) < N (y). The following theorem was proved by Dershowittz and Manna in [START_REF] Dershowitz | Proving termination with multiset orderings[END_REF].

Non-filtering

The non-filtering condition for an inductive system requires that, given any models for the subgoals of a predicate rule, it be possible to find an all-encompassing model that also satisfies the constraint of the rule. This property is important because inductive systems that are filtering lead, in general, to the undecidability of the entailment problem. Such is the case, for instance, of tree automata with equality and disequality constraints [12, Theorem 4.2.10].

The Non-filtering Property in FOL Definition 2.4.1 (Non-filtering in FOL). Given an interpretation I and an FOL inductive system S, a predicate rule p(x), {φ, q 1 (x 1 ), . . . , q n (x n )} ∈ S is non-filtering if and only if, for all i ∈ [n] and v i ∈ µS I (q i ), there exists a valuation ν such that ν(x i ) = v i and I, ν |= φ.

(x) ← S x ≈ f (x 1 , x 2 ) ∧ x 1 ≈ x 2 , p 1 (x 1 ), p 2 (x 2 )
then S would become filtering, as all the subgoals models for which the values of x 1 and x 2 differ would be rejected by the new predicate rule.

Checking whether a given inductive system in FOL is non-filtering is undecidable, as shown by the following lemma.

Lemma 2.4.3. The problem "Given an inductive system S with FOL constraints, is S non-filtering?" is undecidable in the Herbrand interpretation.

Proof. We show the undecidability of the non-filtering problem in FOL by reduction from the disjointness problem for context-free languages, which is a known undecidable problem [START_REF] Hopcroft | Introduction to Automata Theory, Languages, and Computation[END_REF]Theorem 9.22 (a)].

As in the proof of Theorem 1.4.1, consider a context-free grammar G = Ξ, Σ, ∆ , where Ξ is the set of nonterminals, Σ is the alphabet of terminals, ∆ is a set of productions (X, w) ∈ Ξ × (Ξ ∪ Σ) * , and L(G, X) ⊆ Σ * denotes the language produced by G starting with the nonterminal X as axiom. The problem "Given two nonterminals X, Y ∈ Ξ, is it the case that L(G, X) ∩ L(G, Y ) = ∅?" is undecidable.

We can encode G as an inductive system S G , in the same way as done in the proof of Theorem 1.4.1, each nonterminal Z ∈ Ξ corresponding to a predicate Z(x, y). Then we add the following predicate rule:

P (), {x 1 ≈ x 2 ∧ y 1 ≈ y 2 , X(x 1 , y 1 ), Y (x 2 , y 2 )} Then S G is non-filtering if and only if L(G, X) ∩ L(G, Y ) = ∅.
This negative result prompts us to adopt a stronger sufficient condition requiring that ∀x 1 . . . ∀x n ∃x . φ(x, x 1 , . . . , x n ) holds for each constraint φ ∈ S c . Checking this condition becomes decidable in the canonical Herbrand interpretation, because each constraint φ is a conjunction of equalities s ≈ t and disequalities ¬(s ≈ t) between terms s, t ∈ T Σ (set(x) ∪ n i=1 set(x i )). Establishing the validity of ∀x 1 . . . ∀x n ∃x . φ(x, x 1 , . . . , x n ) is equivalent to checking the unsatisfiability of the equational problem ∃x 1 . . . ∃x n ∀x . ¬φ(x, x 1 , . . . , x n ).

Because the constraints in S c do not contain disjunctions, ¬φ is a disjunction of equalities and disequalities, thus it is trivially in conjunctive normal form. By [39, Theorem 5.2], the satisfiability of formulae ∃y∀x . φ(x, y) in conjunctive normal form is NP-complete. Thus, our validity problem (and, consequently, the problem of checking the non-filtering property using this sufficient condition) is in co-NP.

The Non-filtering Property in SL Definition 2.4.2 (Non-filtering in SL). Given an SL inductive system S, a predicate rule p(x), {φ, q 1 (x 1 ), . . . , q n (x n )} ∈ S is non-filtering if and only if, for all i ∈ [n] and ( i , h i ) ∈ µS SL (q i ), where all h i are pairwise disjoint, there exists a valuation ν and a heap h, disjoint from n i=1 h i , such that ν(x i ) = i and ν, h |= SL φ, for all i ∈ [n]. The inductive system S is non-filtering if and only if each rule in S is non-filtering.

Example 2.4.3. The inductive system from Example 1.4.2 is non-filtering because there exists a model ν, h |= SL y ≈ y ∧x → x , such that ν(x ) = 1 , ν(y ) = 2 and dom(h)∩dom(h ) = ∅, for each given pair ( 1 , 2 , h ) in µS SL (ls + ), µS SL (ls e ), or µS SL (ls o ). Since the set L is infinite, it is always possible to find a value ν(x) ∈ dom(h ).

The non-filtering property is decidable for inductive systems with SL constraints, unlike the case with FOL constraints under the Herbrand interpretation (Lemma 2.4.3). This is because it is possible to build an over-approximation of the least solution, that is both necessary and sufficient to characterize the satisfiability of a quantifier-free SL formula using predicate atoms [START_REF] Brotherston | A decision procedure for satisfiability in separation logic with inductive predicates[END_REF]. The lemma below establishes the upper bound for the complexity of deciding whether a given inductive system is non-filtering. Lemma 2.4.4. The problem "Given an inductive system S with -- * -free SL constraints, is S non-filtering?" is in EXPSPACE.

Proof. The abstraction we need is defined as the least fixed point µS of an operator F S . We introduce an abstract assignment Y that maps a predicate p σ1...σn into a set of pairs (A, E), where A ∈ P([n]) is a set of positions corresponding to allocated arguments and E ⊆ [n] × [n] is a set of equality constraints. For each model ( 1 , . . . , n , h) ∈ µS SL (p) there exists a corresponding pair (A, E) ∈ µS (p) in which

A = {i ∈ [n] | i ∈ dom(h)} and E = {(i, j) ∈ [n] × [n] | i = j }.
Given a quantifier-free SL formula ϕ, we define the following sets:

alloc + (ϕ) = {x ∈ FV(ϕ) | ϕ ∧ ∃z 1 . . . ∃z k . x → (z 1 , . . . , z k ) * is satisfiable} alloc -(ϕ) = x ∈ FV(ϕ) | ϕ |= SL ∃z 1 . . . ∃z k . x → (z 1 , . . . , z k ) * eq(ϕ) = (x, y) ∈ FV(ϕ) × FV(ϕ) | ϕ |= SL x ≈ y
Intuitively, alloc + (ϕ) is the set of all variable that may represent allocated locations, alloc -(ϕ) is the set of all variables that must represent allocated locations and eq(ϕ) is the equality relation induced by ϕ. Computing these sets can be done in polynomial space for general, -- * -free SL formulae, using the decision procedures for quantifier-free and Bernays-Schoenfinkel-Ramsey SL formulae given in Chapter 3. For symbolic heaps, it can be done in polynomial time.

Dually, for any set U ⊆ Var and relation V ⊆ Var×Var, we consider the following formulae that build the corresponding heap and equality constraints:

A(U ) = * x∈U ∃z 1 . . . ∃z k . x → (z 1 , . . . , z k ) E(V ) = (x,y)∈V x ≈ y ∧ (x,y) ∈V ¬(x ≈ y)
For the remainder of this proof, consider a predicate rule R of S, where R = p(x), {φ(x, y 1 , . . . , y m ), q 1 (y 1 ), . . . , q m (y m )} , x = x 1 , . . . , x n and y i = y i 1 , . . . , y i ni , ∀i ∈ [m]. For any relation Rel ⊆ FV(φ) × FV(φ) and tuple P = (A 1 , E 1 ), . . . , (A m , E m ) ∈ µS (q 1 ) × . . . × µS (q m ), we define:

ω R (P, Rel) ≡ * i∈[m] A({x j | j ∈ A i }) ∧ E({(y i r , y i s ) | (r, s) ∈ E i , i ∈ [m]}) ∧ E(Rel)
η R (P, Rel) ≡ ∃y 1 . . . ∃y m . φ(x, y 1 , . . . , y m ) * ω R (P, Rel)

We extend the abstract assignment Y to predicate rules and define Y(R) as the set of pairs (A, E) for which there exists a tuple P ∈ µS (q 1 ) × . . . × µS (q m ) and a relation Rel ⊆ FV(φ) × FV(φ) such that: Considering again the arbitrary predicate rule R ∈ S described above, let P = (A 1 , E 1 ), . . . , (A m , E m ) ∈ µS (q 1 ) × . . . × µS (q m ) be a tuple of pairs and Rel ⊆ FV(φ) × FV(φ) a relation on variables, such that ω R (P, Rel) is satisfiable. We claim that, if the formula φ * ω R (P, Rel) is satisfiable, then for each tuple of models ( 1 , h 1 ), . . . , ( m , h m ) ∈ µS SL (q 1 ) × . . . × µS SL (q m ), there exist a valuation ν and a heap h such that ν, h |= SL φ and ν, m i=1 h i |= SL ω R (P, Rel), where ν(y i ) = i , ∀i ∈ [m], and dom(h) ∩ (

A = {i ∈ [n] | x i ∈ All, alloc -(η R (P, Rel)) ⊆ All ⊆ alloc + (η R (P, Rel))} E = {(i, j) ∈ [n] × [n] | (x i , x j ) ∈ eq(η R (P, Rel))} If η R (P, Rel) is unsatisfiable, then alloc -(η R (P, Rel)) = set(x), alloc + (η R (P, Rel)) = ∅
m i=1 dom(h i )) = ∅.
The proof idea for this claim is that, because ω R (P, Rel) specifies exactly those variables which are allocated, as well as those which are not, and the pairs of variables which are equal, along with the ones which are not, the truth value of φ * ω R (P, Rel) is invariant under the renaming of the values of set(x) ∪ m i=1 set(y i ), as long as the allocations and equalities are preserved. Moreover, each tuple of models ( 1 , h 1 ), . . . , ( m , h m ) ∈ µS SL (q 1 )×. . .×µS SL (q m ) is a model of ω R (P, Rel), for some P = (A 1 , E 1 ), . . . , (A m , E m ) ∈ µS (q 1 ) × . . . × µS (q m ) and Rel ⊆ FV(φ) × FV(φ). Then, for each predicate rule R ∈ S we need to check the satisfiability of φ * ω R (P, Rel), for each P and Rel for which ω R (P, Rel) is satisfiable.

Since there are finitely many variables in S, for a predicate p σ1...σn ∈ S p the set of pairs (A, E) is finite, of cardinality at most 2 n+n 2 . Then µS (p) can be computed in an exponential number of steps1 , each step requiring polynomial space. These pairs can be stored in a table that requires 2 O(n 2 ) space, indexed by O(n 2 ) bits, where each pair occupies O(n) bits. Checking the satisfiability of a formula φ * ω R (P, Rel) is possible in polynomial space.

In conclusion, we can check if a predicate rule in S is non-filtering, by checking the satisfiability of an exponential number of SL formulae, where each satisfiability check can be done in polynomial space. Thus, the overall complexity of checking if an SL inductive system is non-filtering is EXPSPACE.

Ranked

The ranked condition requires that, in any predicate rule of an inductive system, each value assigned to a subgoal variable is strictly smaller (with respect to a chosen wfqo) than the value of some goal variable. This property ensures that the principle of Infinite Descent [START_REF] Bussey | Fermat's method of infinite descent[END_REF] can be applied to close a branch of the proof tree.

The Ranked Property in FOL

We fix an interpretation I and assume that (σ I , ≤ I,σ ) is a wfqo, for each σ ∈ Σ s . Given a valuation ν and a set of variables x ⊆ Var, we write

< ‡ I such that [[x]] ν ≤ ‡ I [[y]] γ and, respectively, [[x]] ν < ‡ I [[y]
] γ , if and only if for each x σ ∈ x there exists y σ ∈ y, of the same sort σ, such that ν(x) ≤ I,σ γ(y) and, respectively,

ν(x) < I,σ γ(y). Given a chain [[x 1 ]] ν1 ∼ [[x 2 ]] ν2 ∼ . . . ∼ [[x k ]] ν k , where ∼ is either ≥ ‡ I or > ‡ I , it easily follows that we have [[x 1 ]] ν1 > ‡ I [[x k ]] ν k if and only if [[x i ]] νi > ‡ I [[x i+1 ]] νi+1 for at least some i ∈ [k -1].
Proposition 2.4.5. Given a signature Σ and an interpretation I, (M(Val), < ‡ I ) is a wfqo provided that, for each σ ∈ Σ s , (σ I , ≤ I,σ ) is a wfqo.

Proof. Consider two valuations ν and γ and two multisets [[x]] ν and [[y

]] γ . Then [[x]] ν < ‡ I [[y]] γ trivially gives us [[x]] ν = ([[y]] γ \ [[y]] γ ) ∪ [[x]] ν ,
n i=1 set(x i )]] ν < ‡ I [[set(x)]] ν . Example 2.4.4.
The inductive system from Example 1.4.1 is ranked. The only constraints involving subgoal variables are (i) x ≈ f (x 1 , x 2 ) and (ii) x ≈ g(x 1 ). For each valuation ν we have ν(x 1 ) ν(x) and ν(x 2 ) ν(x), if ν satisfies the constraint (i), and ν(x 1 ) ν(x), if ν satisfies the constraint (ii). Lemma 2.4.6. The problem "Given an inductive system S with FOL constraints, is S ranked in the subtree order (T Σ , )?" is in co-NP.

Proof. For each constraint φ(x, x 1 , . . . , x n ) with goal variables x and subgoal variables x 1 ∪ . . . ∪ x n , we need to check if the formula

φ ∧ ¬ y∈x1∪...∪xn x∈x y x = φ ∧ y∈x1∪...∪xn x∈x (y ≈ x ∨ ¬(y x)) (2.4)
is unsatisfiable. The satisfiability of the quantifier-free fragment of FOL with a subterm relation is an NP-complete problem [START_REF] Venkataraman | Decidability of the purely existential fragment of the theory of term algebras[END_REF]. Since the size of the formula (2.4) is polynomially bounded by the number of variables occurring in φ, if follows that the problem of checking if a given inductive system is ranked is in co-NP.

The Ranked Property in SL

Since there are no relations other than equality defined on the set of locations L, there does not exist a natural wfqo on L. Therefore, we consider the following wfqo on heaps. For any h 1 , h 2 ∈ Heaps, we have h 1 h 2 if and only if there exists h ∈ Heaps such that h 2 = h 1 h. If, moreover, h = ∅, then we write h 1 h 2 .

Definition 2.4.4 (Ranked in SL). Given an SL inductive system S, let p(x), {φ, q 1 (x 1 ), . . . , q n (x n )} be any predicate rule in S. Then S is ranked if, for any pairs

( i , h i ) ∈ µS(q i ), i ∈ [n],
where h 1 , . . . , h n are disjoint, there exists ( , h) ∈ µS(p) such that n i=1 h i h.

Note that this property targets only the predicate rules in S that have at least one subgoal and requires that their constraints do not admit an empty heap model. The constraints of predicate rules without subgoals, however, are allowed to admit models with empty heaps.

Example 2.4.5. The inductive system from Example 1.4.2 is ranked because each predicate rule with at least one subgoal has a constraint y ≈ y ∧ x → x , which does not admit an empty heap model. Lemma 2.4.7. The problem "Given an inductive system S with SL constraints, is S ranked in the subheap order (Heaps, )?" is in PSPACE. When considering symbolic heap constraints, the problem is in P.

Proof. Since all SL constraints in an inductive system S are quantifier-free SL formulae, we can determine if S is ranked by checking the validity of φ |= SL ¬emp, which is equivalent to checking the satisfiability of φ ∧ emp for each constraint φ belonging to predicate rules with subgoals. We know that the latter is in PSPACE [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF].

The PSPACE bound drops to P for inductive systems with symbolic heap constraints because a symbolic heap Π ∧ Θ admits an empty heap model if and only if Θ does not contain any atoms of the form x → (y 1 , . . . , y k ). This check can be performed in polynomial time, proportional to the number of atoms (or the number of * occurrences) in Θ.

Finite Variable Instantiation

The finite variable instantiation condition requires that, for any two constraints φ and ψ from an inductive system, having the same goal variables, there exist a finite number of substitutions θ mapping each group of subgoal variables in ψ to a group of subgoal variables in φ such that φ entails ψθ. This property guarantees that all constraints can be eliminated from a proof sequent by instantiating the subgoal variables on the right-hand side using finitely many substitutions that map them to the subgoal variables from the left-hand side.

The Finite Variable Instantiation Property in FOL

When the constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) occur in a sequent φ, p 1 (x 1 ), . . . , p n (x n ) ∃y 1 . . . ∃y m . ψ ∧ q 1 (y 1 ) ∧ . . . ∧ q m (y m ) and the entailment φ |= I ∃y 1 . . . ∃y m . ψ is valid, we want to continue the derivation with the sequent

p 1 (x 1 ), . . . , p n (x n ) {q 1 (y 1 θ) ∧ . . . ∧ q m (y m θ) | θ ∈ S}
where S is a finite set of substitutions witnessing the entailment, i.e. φ |= I ψθ, for each θ ∈ S. This elimination of constraints from sequents is generally sound but incomplete. For instance, the entailment A complete proof rule based on this replacement has to consider every possible interpretation of these Skolem witnesses. However, in general, this is impossible, because the definitions of these functions are not bound to any particular form. In order to achieve completeness, we require that these functions are always flat substitutions defined on the quantified variables m j=1 set(y j ) and ranging over the free variables of the entailment set(x) ∪ n i=1 set(x i ). This condition ensures, moreover, that there are finitely many possible interpretations of these Skolem witnesses. Definition 2.4.5 (Finite variable instantiation in FOL). An FOL inductive system S has the finite instantiation (fi) property if and only if for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) from S, with goal variables set(x) and subgoal variables n i=1 x i and m j=1 set(y j ), respectively, the set VIS(φ, ψ) = {θ :

φ(x,
m j=1 set(y j ) → T Σ (set(x)∪ n i=1 set(x i )) | φ |= I ψθ} is finite. Moreover, S has the finite variable instantiation (fvi) property if, given any θ ∈ VIS(φ, ψ), for all j ∈ [m] there exists i ∈ [n] such that set(y j )θ = set(x i ).
Note that, whenever an FOL inductive system S has the fvi property, a constraint φ(x) with no subgoal variables cannot entail a constraint ψ(x, y 1 , . . . , y m ), where m j=1 set(y j ) = ∅. If this were the case, φ(x) |= I ∃y 1 . . . ∃y m . ψ(x, y 1 , . . . , y m ) would imply that VIS(φ, ψ) = ∅. But then each flat substitution θ ∈ VIS(φ, ψ) would have an empty range, which is not possible.

Example 2.4.6. Consider the inductive system in Example 1.4.1. It can easily be shown that it has the fvi property. Take, for instance, the constraints φ ≡ x ≈ f (x 1 , x 2 ) and ψ ≡ x ≈ f (y 1 , y 2 ). The entailment φ |= H ∃y 1 ∃y 2 . ψ is witnessed by a single substitution θ with θ(x 1 ) = y 1 and θ(x 2 ) = y 2 , which means that VIS(φ, ψ) = {θ}.

The following lemma gives an upper bound for the complexity of checking whether whether a given FOL inductive system has the fvi property under the canonical Herbrand interpretation. It is unclear, for now, whether the bound can be tightened, because the exact complexity of the satisfiability of equational problems is still unknown, in general.

Lemma 2.4.8. The problem "Given an FOL inductive system S, does S have the fvi property?" is in NEXPTIME under the Herbrand interpretation. If there exists a constant K > 0, independent of the input, such that for each constraint φ(x, x 1 , . . . , x n ) in S, with goal variables x and subgoal variables n i=1 set(x i ), respectively, we have ||x i || ≤ K, then the problem is in NP.

Proof. An FOL inductive system S has the fvi property if, for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) in S c , with goal variables set(x) and subgoal variables n i=1 set(x i ) and m j=1 set(y j ), respectively, the following entailment is not valid: x i ∼ = y j which, in turn, can be rewritten as

φ(x, x 1 , . . . , x n ) |= H ∃y 1 . . .
∃x ∃x 1 . . . ∃x n ∀y 1 . . . ∀y m . φ(x, x 1 , . . . , x n ) ∧ m j=1 ¬ψ(x, y 1 , . . . , y m ) ∨ n i=1 x i ∼ = y j
This formula is not in conjunctive normal form (CNF) and expanding x i ∼ = y j to obtain the CNF causes an exponential blowup. Since checking the satisfiability of an equational problem in CNF is NP-complete, the above check can be performed in NEXPTIME. If the size of each set of subgoal variables is bound to a constant K, independent of the input, the size of each clause in the CNF expansion of the above formula is bound by a constant. Since there are at most polynomially many such constants, we can apply [ Lemma 2.4.9. The problem "Given an SL inductive system S, does S have the fvi property?" is in PSPACE if S has quantifier-free and -- * -free SL constraints, and in Σ P 2 if S has symbolic heap constraints.

Proof. Similarly to the proof for Lemma 2.4.8, an SL inductive system S has the fvi property if, for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) in S c , with goal variables set(x) and subgoal variables n i=1 set(x i ) and m j=1 set(y j ), respectively, the following entailment is not valid:

φ(x, x 1 , . . . , x n ) |= SL ∃y 1 . . . ∃y m . ψ(x, y 1 , . . . , y m ) ∧ m j=1 n i=1 ¬(x i ∼ = y j ) where x i ∼ = y j is shorthand for y∈set(y j ) x∈set(xi) x ≈ y ∧ x∈set(xi)
y∈set(y j ) x ≈ y . Just as in the proof for Lemma 2.4.8, this entailment is valid only if the following formula is unsatisfiable:

∃x ∃x 1 . . . ∃x n ∀y 1 . . . ∀y m . φ(x, x 1 , . . . , x n ) ∧ m j=1 ¬ψ(x, y 1 , . . . , y m ) ∨ n i=1 x i ∼ = y j
We know that checking the satisfiability for the above formula is in PSPACE when φ and ψ are quantifier-free and -- * -free SL formulae (see Section 3.3.1) and, thus, the fvi problem is in PSPACE. If, however, φ and ψ are symbolic heaps, the initial entailment problem is in Π P 2 [1, Theorem 6], thus the fvi problem is in Σ P 2 .

Non-overlapping

The non-overlapping condition requires that, if any two constraints from an inductive system overlap (i.e. have at least one model in common), then one must entail the other. This property is required for completeness and is also related to the elimination of constraints from sequents.

The Non-overlapping Property in FOL Note that, for a non-overlapping system, if φ(x, x 1 , . . . , x n ) ∧ ψ(x, y 1 , . . . , y m ) is a satisfiable conjunction of constraints, then the formulae ∃x 1 . . . ∃x n . φ and ∃y 1 . . . y m . ψ are equivalent.

Example 2.4.8. The FOL inductive system from Example 1.4.1 is non-overlapping. Take, for instance, the constraints x ≈ f (x 1 , x 2 ) and x ≈ f (y 1 , y 2 ). Then

x ≈ f (x 1 , x 2 )∧x ≈ f (y 1 , y 2 ) is satisfiable and x ≈ f (x 1 , x 2 ) |=
H ∃y 1 ∃y 2 . x ≈ f (y 1 , y 2 ) holds. However, if we take the constraints x ≈ f (x 1 , x 2 ) and x ≈ g(y 1 ), then x ≈ f (x 1 , x 2 ) ∧ x ≈ g(y 1 ) is unsatisfiable.

Lemma 2.4.10. The problem "Given an FOL inductive system S, does S have the nonoverlapping property?" is in NP under the Herbrand interpretation.

Proof. Given an FOL inductive system S, in order to determine if S has the non-overlappig property, we need to perform two checks for any pairs of constraints φ, ψ ∈ S c with goal variables x and subgoal variables n i=1 x i and m j=1 y j , respectively: (i) whether φ ∧ ψ is satisfiable and (ii) whether φ |= I ∃y 1 . . . ∃y m . ψ is valid. Checking the validity of the entailment in (ii) can be reduced to checking whether the formula ∃x ∃x 1 . . . ∃x n ∀y 1 . . . ∀y m . φ ∧ ¬ψ is unsatisfiable.

Under the Herbrand interpretation, since φ and ψ are both conjunctions of literals, φ ∧ ψ and φ ∧ ¬ψ are in conjunctive normal form. Then both problems (i) and (ii) are in NP [START_REF] Pichler | On the complexity of equational problems in CNF[END_REF], and thus the non-overlapping problem under the Herbrand interpretation is in NP.

if and only if there exists a tuple ī ∈

[n] n k , such that ∀j ∈ [n k ] . µS I (p īj ) ⊆ {µS I (q īj ) | ∈ [k], f j (Q ) = īj } where F(Q 1 , . . . , Q k ) = {f 1 , . . . , f n k } are the choice functions over (Q 1 , . . . , Q k ).
Proof. From [24, Theorem 1], it follows that

µS I (p 1 ) × . . . × µS I (p n ) ⊆ k j=1 µS I (q j 1 ) × . . . × µS I (q j n ) ⇔ n k j=1 n i=1 µS I (p i ) ⊆ {µS I (q i ) | ∈ [k], f j (Q ) = i} ⇔ ī∈[n] n k n k j=1 µS I (p īj ) ⊆ {µS I (q īj ) | ∈ [k], f j (Q ) = īj }
The last step describes the translation of the formula from conjunctive normal form to disjunctive normal form.

The local soundness of R Ind \{ID} means that, if the consequent Γ ∆ denotes an invalid entailment, then at least one of its antecedents also denotes an invalid entailment. Moreover, their respective counterexamples can be related by a wfqo. Lemma 2.5.2. Given an FOL inductive system S that is ranked in the interpretation I, for each instance of an inference rule schema in R Ind \ {ID}, having the consequent Γ ∆ and antecedents Γ i ∆ i with i ∈ [n], and each valuation ν ∈ µS I ( Γ) \ µS I ( ∆), there exists

ν i ∈ µS I ( Γ i ) \ µS I ( ∆ i ) for some i ∈ [n] such that [[FV(Γ i )]] νi ≤ ‡ I [[FV(Γ)]] ν .
Proof. For AX, soundness follows from the side condition and its consequent admits no counterexamples, thus the lemma is trivially true in this case. We analyse LU, RU, RD, ∧R and SP individually, as follows.

(LU) Let p(x) ∈ Γ be a predicate atom, where p(x)

← S R 1 (x) | . . . | R n (x). The an- tecedents of Γ ∆ are Γ i ∆ i ≡ R i (x, y i ), Γ \ p(x) ∆, where i ∈ [n]
and each y i is a tuple of fresh variables. In this case, the least solution of Γ is

µS I Γ = µS I p(x) ∧ (Γ \ {p(x)}) = µS I (p(x)) ∩ µS I (Γ \ {p(x)}) = n i=1 µS I R i (x) ∩ µS I (Γ \ {p(x)}) = n i=1 µS I R i (x) ∩ µS I (Γ \ {p(x)}) = n i=1 µS I R i (x) ∧ (Γ \ {p(x)}) If there exists ν ∈ µS I ( Γ) \ µS I ( ∆), then ν ∈ µS I ( R i (x) ∧ (Γ \ {p(x)})) \ µS I ( ∆)
for some i ∈ [n] and there also exists

ν i ∈ µS I ( R i (x, y i ) ∧ (Γ \ {p(x)})) \ µS I ( ∆) such that for every x ∈ FV(Γ) we have ν i (x) = ν(x). Furthermore, because S is ranked, [[set(x i )]] νi < ‡ I [[set(x)]] ν . Since FV(Γ i ) = FV(Γ) ∪ set(x i ) and set(x) ⊆ FV(Γ), it follows that [[FV(Γ i )]] νi ≤ ‡ I [[FV(Γ)]] ν .
(RU) Let p(x) ∈ ∆ be a predicate atom, where p(x)

← S R 1 (x) | . . . | R n (x). Then Γ ∆ has only one antecedent Γ 1 ∆ 1 ≡ Γ ∃y 1 . R 1 (x, y 1 ), . . . , ∃y n . R n (x, y n ), ∆ \ p(x)
, where each y i with i ∈ [n] is a tuple of fresh variables. Note that FV(Γ 1 ) = FV(Γ). In this case, the least solution of ∆ is

µS I ∆ = µS I p(x) ∨ (∆ \ {p(x)}) = µS I (p(x)) ∪ µS I (∆ \ {p(x)}) = n i=1 µS I R i (x) ∪ µS I (∆ \ {p(x)}) = n i=1 µS I ∃y i . R i (x, y i ) ∪ µS I (∆ \ {p(x)}) = µS I n i=1 ∃y i . R i (x, y i ) ∪ µS I (∆ \ {p(x)}) = µS I n i=1 ∃y i . R i (x, y i ) ∨ (∆ \ {p(x)}) = µS I ∆ 1
If there exists a valuation ν ∈ µS I ( Γ) \ µS I ( ∆), then it is also the case that ν ∈ µS I ( Γ 1 ) \ µS I ( ∆ 1 ). Therefore, the counterexample for the antecedent is

ν 1 = ν and [[FV(Γ 1 )]] ν1 ≤ ‡ I [[FV(Γ)]] ν holds trivially.
(RD) Then the sequent Γ ∆ ≡ φ(x, x 1 , . . . , x n ), p 1 (x 1 ), . . . , p n (x n ) {∃y j .ψ j (x, y j ) ∧ Q j (y j )} k j=1 has only one antecedent Γ 1 ∆ 1 ≡ p 1 (x 1 ), . . . , p n (x n ) {Q j θ | θ ∈ S j } i j=1 . By the side condition of RD, φ |= I i j=1 ∃y j .ψ j . Also, by Definition 2.4.5, we have µS I (φ) ⊆ µS I (ψ j θ) for each θ ∈ VIS(φ, ψ j ) and j ∈ [i]. In this case, the least solution of ∆ is

µS I ∆ = µS I   k j=1 ∃y j .ψ j ∧ Q j   = k j=1 µS I ∃y j .ψ j ∧ Q j ⊇ i j=1 µS I ∃y j .ψ j ∧ Q j ⊇ i j=1 θ∈VIS(φ,ψj ) µS I ((ψ j ∧ Q j )θ) = i j=1 θ∈VIS(φ,ψj ) µS I (ψ j θ ∧ Q j θ) = i j=1 θ∈VIS(φ,ψj ) µS I (ψ j θ) ∩ µS I (Q j θ) = i j=1 θ∈VIS(φ,ψj ) µS I (ψ j θ) ∩ i j=1 θ∈VIS(φ,ψj ) µS I (Q j θ)
Note that also µS

I ( Γ) = µS I (φ) ∩ µS I (p 1 (x 1 ) ∧ . . . ∧ p n (x n )). If there exists a valuation ν ∈ µS I ( Γ) \ µS I ( ∆), then ν ∈ µS I Γ \   i j=1 θ∈VIS(φ,ψj ) µS I (ψ j θ) ∩ i j=1 θ∈VIS(φ,ψj ) µS I (Q j θ)   = µS I Γ \   i j=1 θ∈VIS(φ,ψj ) µS I (ψ j θ)   ∪ µS I ( Γ) \   i j=1 θ∈VIS(φ,ψj ) µS I (Q j θ)   = ∅ ∪ µS I Γ \   i j=1 θ∈VIS(φ,ψj ) µS I (Q j θ)   ⊆ µS I (p 1 (x 1 ) ∧ . . . ∧ p n (x n )) \   i j=1 θ∈VIS(φ,ψj ) µS I (Q j θ)   ⊆ µS I (p 1 (x 1 ) ∧ . . . ∧ p n (x n )) \   i j=1 θ∈Sj µS I (Q j θ)   = µS I Γ 1 \ µS I ∆ 1
Therefore, the counterexample for the antecedent is ν 1 = ν. Because φ is introduced to the left-hand side by left unfolding and S is ranked, we have

[[set(x 1 )∪. . .∪set(x n )]] ν < ‡ I [[set(x)]] ν . Then [[FV(Γ 1 )]] ν1 < ‡ I [[FV(Γ)]] ν .
(∧R) Let ∆ = {p(x) ∧ q(x) ∧ Q} ∪ ∆ . Then the antecedents of Γ ∆ are Γ 1 ∆ 1 ≡ Γ p(x) ∧ Q, ∆ and Γ 2 ∆ 2 ≡ Γ q(x) ∧ Q, ∆ . In this case, the least solution of ∆ is

µS I ( ∆) = µS I p(x) ∧ q(x) ∧ Q ∨ ∆ = µS I p(x) ∧ Q ∧ q(x) ∧ Q ∨ ∆ = µS I (p(x) ∧ Q) ∩ µS I (q(x) ∧ Q) ∪ µS I ∆ = µS I (p(x) ∧ Q) ∪ µS I ∆ ∩ µS I (q(x) ∧ Q) ∪ µS I ∆ = µS I p(x) ∧ Q ∨ ∆ ∩ µS I q(x) ∧ Q ∨ ∆ = µS I ∆ 1 ∩ µS I ∆ 2
If there exists a valuation ν ∈ µS I ( Γ)\µS I ( ∆), then also ν ∈ µS I ( Γ)\(µS

I ( ∆ 1 )∩ µS I ( ∆ 2 )) = (µS I ( Γ)\µS I ( ∆ 1 ))∪(µS I ( Γ)\µS I ( ∆ 2 )). Therefore, ν ∈ µS I ( Γ i )\ µS I ( ∆ i ) for some i ∈ [2] and the counterexample for Γ i ∆ i is ν i = ν. Because Γ = Γ 1 = Γ 2 , we have [[FV(Γ i )]] νi ≤ ‡ I [[FV(Γ)]] ν . (SP) Then Γ ∆ ≡ p 1 (x 1 ), . . . , p n (x n ) { n i=1 q j i (x i )} k j=1 . For each ī ∈ [n] n k , the antecedents of Γ ∆ are Γ ī j ∆ ī j ≡ p īj (x īj ) {q īj (x īj ) | ∈ [k], f j (Q ) = īj }, j ∈ [n k ].
If there exists a valuation ν ∈ µS I ( n i=1 p i (x i )) \ µS I k j=1 n i=1 q j i (x i ) , then by the proof of Lemma 2.5.1, there exist j ∈ [n k ] and counterexamples ν 1 , . . . , ν n such that

ν i ∈ µS I (p i (x i )) \ {µS I (q i ) | ∈ [k], f j (Q (x i ))) = i} and ν(x i ) = ν i (x i ) for all i ∈ [n].
In other words, for all tuples ī ∈ [n] n k we have ν īj ∈ µS I (p īj (x īj )) \ {µS

I (q īj (x īj )) | ∈ [k], f j (Q ) = īj } = µS I ( Γ ī j ) \ µS I ( ∆ ī j ).
Therefore, given such j ∈ [n k ], the counterexample for each antecedent Γ ī j ∆ ī j is ν īj . Since FV(Γ ī j ) = set(x īj ) ⊆ FV(Γ) and

ν(x īj ) = ν i (x īj ), we have [[FV(Γ ī j )]] νi ≤ ‡ I [[FV(Γ)]] ν , for each ī ∈ [n] n k .
This result allows us to define a reachability relation between counterexamples and write ν ν when, given any instance of an inference rule in R Ind \ ID, ν is a counterexample of the consequent and ν is a counterexample of one of its antecedents obtained from ν, as shown in the proof of Lemma 2.5.2.

Definition 2.5.1 (Counterexample path in FOL

). A path π = v 1 , v 2 , . . . , v k in a proof D = (V, v 0 , Seq, Rule, Par, Piv) built with R Ind is a counterexample path if there exists a sequence of valuations ν 1 , ν 2 , . . . , ν k such that, for all i ∈ [k]: (i) ν i ∈ µS I ( Γ i )\µS I ( ∆ i ), where Seq(v i ) = Γ i ∆ i , and (ii) ν i ν i+1 if i < k.
The following lemma shows that, if the given FOL inductive system is ranked, any direct counterexample path in a proof causes a strict decrease in the multiset images of the counterexamples for the pivot and consequent delimiting the path.

Lemma 2.5.3. Given an FOL inductive system S that is ranked in the interpretation I, let D = (V, v 0 , Seq, Rule, Par, Piv) be a proof built with R Ind and π = v 1 , . . . , v k be a direct counterexample path in D for a backlink (v k , v 1 ), with valuations ν

1 . . . ν k . Then [[FV(Γ 1 )]] ν1 > ‡ I [[FV(Γ k )]] ν k , where Seq(v i ) = Γ i ∆ i , for all i ∈ [k].
Proof. Since π is a direct path, it follows that ID does not occur in Λ(v 1 , . . . , v k-1 ). As shown in the proof of Lemma 2.5.2, which ensures the local soundness of R Ind \ {ID}, we obtain a sequence of valuations ν

1 . . . ν k such that [[FV(Γ 1 )]] ν1 ≥ ‡ I . . . ≥ ‡ I [[FV(Γ k )]] ν k . We know that Seq(v 1 ) = Γ 1 ∆ 1 , Seq(v k ) = Γ k ∆ k = Γ 1 θ ∆ 1 θ with ∆ 1 ⊆ ∆ 1 and
LU occurs in Λ(π), as required by the side condition of the ID instance applied at v k . We show that RD is also required to occur in Λ(π) by the following analysis on the form of Γ 1 :

(i) If Γ 1 = {p(x)}, then LU is the only inference rule applicable on Γ 1 ∆ 1 that changes Γ 1 . This required application introduces a constraint on the left-hand side. In order to reach any sequent that has a constraint-free left-hand side, an application of RD is also required. To specifically reach Γ 1 θ ∆ 1 θ with Γ 1 θ = {p(xθ)}, Λ(π) may contain additional occurrences of LU and RD, but at least one RD is required;

(ii) If Γ 1 = {p 1 (x 1 ), . . . , p n (x n )} with n > 1, then LU is immediately applicable, but it would introduce a constraint that cannot be reduced (this requires all arguments of predicate atoms to be subgoals in the constraint) thus making it impossible to reach any sequent with only predicate atoms on the left-hand side. Therefore, SP should be applied before the required LU and, later on, RD is needed to remove the constraint introduced by LU. In order to specifically reach Γ 1 θ ∆ 1 θ with Γ 1 θ = {p 1 (x 1 θ), . . . , p n (x n θ)}, Λ(π) may contain additional occurrences of SP, LU and RD, but at least one RD is required;

(iii) If Γ 1 = {φ, p 1 (x 1 ), . . . , p n (x n )} with n ≥ 1, then, just as in case (ii), applying LU before another inference rule that modifies the left-hand side introduces a second constraint impossible to reduce (this requires a single constraint on the left-hand side), thus preventing the reaching of any sequent with only one constraint on the left-hand side. Therefore, RD is necessary to remove φ before applying LU. In order to specifically reach Γ 1 θ ∆ 1 θ with Γ 1 θ = {φθ, p 1 (x 1 θ), . . . , p n (x n θ)}, Λ(π) may contain additional occurrences of RD, SP and LU, but at least one RD is required;

(iv) If Γ 1 = {φ 1 , . . . , φ m } with m ≥ 1, then LU is not applicable on any path starting with Γ 1 ∆ 1 because we cannot create a derivation with R Ind that introduces predicate atoms on the left-hand side;

(v) If Γ 1 = {φ 1 , . . . , φ m , p 1 (x 1 ), . . . , p n (x n )} with m, n > 1, then LU is the only inference rule applicable on Γ 1 ∆ 1 , and on all of the sequents derived from it, that modifies the left-hand side. Therefore, it is impossible to reach any sequent having m constraints on the left-hand side, which includes Γ 1 θ ∆ 1 θ with Γ 1 θ = {φ 1 θ, . . . , φ m θ, p 1 (x 1 θ), . . . , p n (x n θ)}, because LU would introduce extra constraints in any derived sequent that cannot be removed because RD is not applicable. It follows from cases (i), (ii), (iii), i.e. the ones allowing the existence of the path π with the necessary LU occurrence in Λ(π), that RD is required to occur in Λ(π). Then [[FV(Γ

i )]] νi > ‡ I [[FV(Γ i+1 )]] νi+1 for some i ∈ [k -1], which leads to [[FV(Γ 1 )]] ν1 > ‡ I [[FV(Γ k )]] ν k .
Through the next lemma, we extend the reachability relation to backlinks and show that any infinite trace in a proof leads to an infinite strictly decreasing sequence of multisets associated with counterexamples, contradicting the well-foundedness of the wfqo which makes the inductive system be ranked (Defintion 2.4.3). Then there cannot exist a counterexample for any sequent labelling the root of a proof built with R Ind and the associated entailment must hold. Theorem 2.5.4. Given an FOL inductive system S that is ranked in the interpretation I, if a sequent Γ ∆ has a proof D = (V, v 0 , Seq, Rule, Par, Piv) built with R Ind and Seq(v 0 ) ≡ Γ ∆, then the entailment Γ |= I S ∆ holds.

Proof. Suppose, by contradiction, that Γ |= I S ∆ does not hold, i.e. there exists a valuation ν 0 ∈ µS I ( Γ) \ µS I ( ∆). Since v 0 is the root of the proof, it is also the consequent of an instance of Rule(v 0 ) and, by Lemma 2.5.2, an antecedent of this inference rule has a counterexample ν 1 , such that ν 0 ν 1 . Applying this argument iteratively, we build a path from v 0 to a leaf v k ∈ V and a sequence of valuations ν 0 ν 1 . . . ν k .

Since AX inference rules, by their side condition, cannot be applied on sequents that accept counterexamples, it must be the case that Rule(

v k ) = AX. Since v k is a leaf, then Rule(v k ) = ID and let v k+1 = Piv(v k ). Then Seq(v k ) = Γ k ∆ k and Seq(v k+1 ) = Γ k+1 ∆ k+1 such that Γ k = Γ k+1 θ, ∆ k = ∆ k+1 θ and ∆ k+1 ⊆ ∆ k+1 , for some injective substitution θ : FV(Γ k+1 ∪ ∆ k+1 ) → FV(Γ k ∪ ∆ k ). We can assume w.l.o.g. that θ is surjective, by defining θ(x) = x for each x ∈ FV(Γ k ∪ ∆ k ) \ θ(FV(Γ k+1 ∪ ∆ k+1 ))
. Since θ is also injective, by the side condition of ID, its inverse exists and ν k θ -1 is a counterexample for Γ k+1 ∆ k+1 . Therefore, we can extend the relation with the pair (ν k , ν k θ -1 ). This argument can be continued ad infinitum and we obtain an infinite trace τ = v 0 , v 1 , . . . in D together with an infinite sequence of valuations ν 0 ν

1 . . .. If Seq(v i ) = Γ i ∆ i , for each i ≥ 0, by Lemma 2.5.2, we have [[FV(Γ i )]] νi ≥ ‡ I [[FV(Γ i+1 )]] νi+1
, for all i ≥ 0. By Proposition 2.2.1, τ contains infinitely many direct paths π j = v kj , . . . , v j , where {k j } j≥0 and { j } j≥0 are infinite strictly increasing sequences of integers such that k j < j ≤ k j+1 < j+1 , for all j ≥ 0. By Lemma 2.5.3, we obtain that [[FV(Γ

kj )]] ν k j > ‡ I [[FV(Γ j )]] ν j , for all j ≥ 0. Since [[FV(Γ j )]] ν j ≥ ‡ I [[FV(Γ kj+1 )]] ν k j+1
, for all j ≥ 0, we obtain a strictly decreasing sequence

[[FV(Γ k0 )]] ν k 0 > ‡ I [[FV(Γ k1 )]] ν k 1 > ‡ I .
. ., which contradicts that > ‡ I is a wfqo, by Proposition 2.4.5. We can conclude that our assumption was false, thus the entailment Γ |= I S ∆ holds.

Completeness

We will show that R Ind is complete for entailments between predicates defined by FOL inductive systems that are ranked, non-filtering, non-overlapping and have the fvi property. To facilitate this proof, we first show some properties of the derivations built using the inference rules in R Ind .

We introduce maximal, irreducible and structured derivations, and use D(Γ ∆) for the set of all derivations built with R Ind whose roots are labelled with Γ ∆ and that are, at the same time, maximal, irreducible and structured. Definition 2.5.2 (Maximal derivation). A derivation using the R Ind proof system is maximal if it cannot be extended by an application of any inference rule from R Ind . Definition 2.5.3 (Irreducible derivation). A derivation D using the R Ind proof system is irreducible if there exists no path in D on which ID is applicable. Otherwise, D is reducible.

Note that the proof-search semi-algorithm 1 from Section 2.2 only produces irreducible derivations, as it will eagerly try to apply AX and ID before the other inference rules. Definition 2.5.4 (Structured derivation). A derivation D is structured if, on every path of D, there exists an application of RD between any two consecutive applications of LU. Otherwise, D is unstructured.

We are interested in structured derivations because, intuitively, unstructured derivations constitute poor candidates for proofs. It will always be possible, for instance, to create a derivation by repeatedly applying LU and no other inference rule. However, this kind of derivation will only grow the left-hand side without making significant progress towards or a counterexample. Note how any subtree of a structured derivation is also structured. Lemma 2.5.5. If the FOL inductive system S has the fvi property, then the following properties of derivations built with R Ind hold:

(1) Any irreducible and structured derivation is finite;

(2) For any sequent Γ ∆, the set D(Γ ∆) is finite.

Proof. Given an FOL inductive system S, we introduce the following constants relative to S:

r # = ||S|| is the number of predicate rules in S; -p # = ||S p || is the number of predicates in the inductive system S; -s # is the maximum number of subgoals occurring in each predicate rule of S.

Since p # is finite for any inductive system S, there is also a finite number b # of basic sequents that can be constructed using the predicates in S p . As there are p # predicates that can occur on the left-hand side and 2 p # -1 possible non-empty subsets of predicates that can occur on the right-hand side, it follows that b # = p # * (2 p # -1).

Let D be a structured derivation starting from the basic sequent p(x) q 1 (x), . . . , q n (x) and π be a path in D from the root to another basic sequent r(y) s 1 (y), . . . , s m (y), without containing any other basic sequents. Only LU, RU, ∧R, RD and SP can be applied along π, otherwise AX and ID would not allow us to reach the second basic sequent. The left-hand side of the sequents along π allows for -at most one application of LU, on p(x); -at most one application of RD, after LU, on the predicate rule that replaces p(x); -at most one application of SP, after RD and ∧R, if we are left with multiple predicate atoms on the left-hand side.

The right-hand side of the sequents along π allows for -n applications of RU, where n is at most p # ; -r # * (s # -1) applications of ∧R, because there can be at most s # -1 for every sequent resulting from RU and reduced by RD, and there can be at most r # predicate rules that can be used to apply RU.

Thus, any path between two consecutive basic sequents is of length at most b # π = 3 + p # + r # * (s # -1), which is a constant determined by the inductive system S.

Case (1) Let D be an irreducible and structured derivation. Suppose, by contradiction, that D is not finite. By König's Lemma, D must have an infinite path. Let π be an arbitrary infinite path in D. Let ρ be any subsequence of π on which no LU rule has been applied. The maximum possible length of ρ is reached when the sequence starts with an antedecedent of LU applied on a basic sequent and it extends until the consequent of the next possible application of LU, while encountering the next basic sequent and covering the applications of all possible inference rules before the second LU. The only inference rule applicable on a basic sequent before LU is RU and it can occur a maximum of p # times. Thus, ρ has a maximum length of b # π -1 + p # and is finite. Then, for π to be infinite, LU must be applied infinitely often along π. Since D is structured, RD must also be applied infinitely often. The antecedent of each application of RD contains no constraints and each corresponding consequent is of the form φ(x, x 1 , . . . , x n ), p 1 (x 1 ), . . . , p n (x n ) ∆, where the left hand side of such sequents must have been produced by an application of LU on a sequent of the form p(x) ∆. Such sequents can only be the antecedents of RD, ∧R or SP, the first two having a single predicate atom on the left-hand side of their consequent. If p(x) ∆ is the antecedent of RD or ∧R, then ∆ consists of singleton predicate atoms and the sequent is basic, because S has the fvi property and ∧R is used eagerly after an application of RD to rule out conjunctions of predicate atoms with the same argument list. This is also the case for SP due to the form of its antecedents and, moreover, the consequent of SP must have been obtained from an application of RD, optionally followed by ∧R.

Therefore, between every two consecutive applications of RD there exists a basic sequent and, for π to be infinite, basic sequents must occur infinitely often along it. Since the number of basic sequents is bounded by b # , some basic sequent must occur at least twice along π, which makes ID applicable and contradicts the assumption that D is irreducible. Hence, π must be finite, and, since it was chosen arbitrarily, D cannot have an infinite path and is a finite derivation.

Case (2) Suppose, by contradiction, that D(Γ ∆) is infinite. We know from (1) that each derivation in D(Γ ∆) is finite. Let D 1 , D 2 , . . . be an infinite sequence of distinct, maximal derivations from D(Γ ∆) obtained by applying more than one inference rule. Such a sequence exists because there is only a finite number of derivations obtained by applying only one inference rule. Since there can be at most b # distinct basic sequents and any path between two consecutive basic sequents is of finite length at most b # π , then there must exist a derivation D i in the infinite sequence chosen above that contains a path in which the same basic sequent appears at least twice. But then this means that D i is reducible and, thus, that D i ∈ D(Γ ∆), which contradicts our assumption. Definition 2.5.5 (Tree-shaped set). A set F = {φ 1 , . . . , φ m , p 1 (x 1 ), . . . , p n (x n )}, where φ 1 , . . . , φ m are constraints and p 1 (x 1 ), . . . p n (x n ) are predicate atoms, is tree-shaped if there exist trees t 1 , . . . , t k such that:

1. Each node labelled with a constraint φ i (y, y 1 , . . . , y h ) in some tree t , ∈ [k] has exactly h children and, for all j ∈ [h], the j-th child is labelled either with (i) a constraint whose goal variables are y j , or (ii) a predicate atom q(y j ), q ∈ {p 1 , . . . , p n }.

2. A predicate atom p i (x i ), i ∈ [n] may occur only on the frontier of a tree t j , j ∈ [k].

If k = 1, then F is called singly-tree shaped.

Because tree-shaped sets can be uniquely represented as trees labelled with formulae, we use sets of trees and sets of formulae interchangeably. We write Γ ∆ Γ ∆ whenever Γ ∆ labels a node in a derivation from D(Γ ∆). The following lemma shows an invariant on the shape of the sequents in any derivation that starts with a basic sequent. Lemma 2.5.6. Given an FOL inductive system S and predicates p, q 1 , . . . , q n ∈ S p , in every sequent Γ ∆ such that p(x) q 1 (x), . . . , q n (x) Γ ∆, Γ is a tree-shaped set and ∆ consists of finite conjunctions over tree-shaped sets, with all subgoal variables existentially quantified.

Proof. We prove this lemma by induction on the length of the path p(x) q 1 (x), . . . , q n (x) = Γ 1 ∆ 1 , . . . , Γ N ∆ N = Γ ∆ from the derivation in which Γ ∆ occurs. Let T (N ) mean "Γ N is a tree-shaped set and ∆ N consists of finite conjunctions over tree-shaped sets, with all subgoal variables existentially quantified".

Base case. We consider the case where N = 1. Then Γ 1 = {p(x)} is trivially tree-shaped and ∆ 1 = {q 1 (x), . . . , q n (x)} trivially consists of singleton conjunctions over the tree-shaped sets {q 1 (x)}, . . . , {q n (x)}, therefore T (1) holds.

Inductive case. Assuming that T (N -1) holds, we prove that T (N ) also holds by doing a case split on the type of the last inference rule applied on the path.

-(LU) In this case, ∆ N = ∆ N -1 . Based the induction hypothesis, Γ N -1 is treeshaped and there exists a tree t associated with Γ N -1 such that t(α) = r(y), for some frontier position α ∈ fr(t) and predicate atom r(y). Then there exists a predicate rule r(y), R(y) ∈ S such that Γ N = R(y, y ) ∪ Γ N -1 \ {r(y)}, where R(y, y ) = φ(y, y 1 , . . . , y m ), s 1 (y 1 ), . . . , s m (y m ), and t [α] • τ m (R(y, y )) replaces t in the set of trees that represents Γ N . Therefore, T (N ) holds.

-(RU)

In this case, Γ N = Γ N -1 . Based the induction hypothesis, there exists r(y) ∈ ∆ N -1 and a tree consisting of a single node labelled with r(y). This tree is replaced in ∆ N by trees t 1 , . . . , t m corresponding to conjunctions over the treeshaped sets R 1 (y, z 1 ), . . . , R m (y, z m ) with existentially quantified subgoal variables, where r(y) ← S R 1 (y) | . . . | R m (y). Thus, T (N ) holds.

-(RD) Any antecedent of an RD application is of the form

Γ N ∆ N ≡ r 1 (y 1 ), . . . , r m (y m ) {s j 1 (z j 1 ) ∧ . . . ∧ s j j (z j j )} k j=1
Therefore, T (N ) trivially holds.

-(∧R) In this case, Γ N = Γ N -1 . Based on the inductive hypothesis, ∆ N contains all the elements of ∆ N -1 , except for one whose corresponding tree has lost a leaf consisting of a predicate atom. Therefore, T (N ) holds.

-(SP) Any antecedent of an SP application is of the form Γ N ∆ N ≡ r(y) s 1 (y), . . . , s m (y) Therefore, T (N ) trivially holds.

Since T (1) holds and T (N -1) implies T (N ) for any N > 1, we can conclude that T (N ) holds for any N ≥ 1.

The following lemma is crucial for establishing the completeness of R Ind . It provides an invariant on the set of derivations for a sequent that denotes an invalid entailment and proves that they indicate the existence of a counterexample. Lemma 2.5.7. Given an interpretation I, a non-filtering and non-overlapping FOL inductive system S with the fvi property, the predicates p, q 1 , . . . , q n ∈ S p , and a sequent Γ ∆ such that p(x) q 1 (x), . . . , q n (x) Γ ∆, if every derivation D ∈ D(Γ ∆) contains a leaf Γ ∅ then there exists a valuation ν ∈ µS I ( Γ) \ µS I ( ∆).

Proof. Let D * (Γ ∆) = {d | d ∈ D(Γ ∆) or ∃d ∈ D * (Γ ∆) . d d }.
Because, by Lemma 2.5.5, any derivation in D(Γ ∆) is finite and D(Γ ∆) itself is finite, then D * (Γ ∆) is also finite. Since (D * (Γ ∆), ) is a wqo, by Lemma 2.4.1 (P fin (D * (Γ ∆)), ∀∃ ) is also a wqo and we can prove this lemma by induction on it.

Let D(Γ ∆) = IR∈R Ind D IR (Γ ∆), where D IR (Γ ∆) denotes the subset of D(Γ ∆) consisting of derivations starting with an instance of the inference rule IR. We do not consider the cases IR ∈ {AX, ID} because these inference rules do not lead to a leaf of the required form. Given D ∈ D IR (Γ ∆) with IR ∈ R Ind \{AX, ID}, we assume that, for each antecedent Γ ∆ of Γ ∆, the lemma holds for any D ∈ IR ∈R Ind D IR (Γ ∆ ) and show that it extends to D.

(LU) Let r(y) ∈ Γ be the predicate atom chosen for replacement and r(y) ← S R 1 (y) | . . . | R m (y). Then R 1 (y, y 1 ), Γ \ r(y) ∆, . . . , R m (y, y m ), Γ \ r(y) ∆ are the antecedents for the application of IR = LU on Γ ∆, for some fresh tuples of variables y 1 , . . . , y m .

The right-hand side of any antecedent is ∅ only if ∆ was already ∅. Because p(x) q 1 (x), . . . , q n (x) Γ ∆, S is non-filtering, every constraint in S c is satisfiable, and there are no predicates with empty least solutions, it follows that µS I ( Γ) is not empty. Therefore, there exists a counterexample ν ∈ µS I ( Γ) \ µS I ( ∆) = µS I ( Γ).

If ∆ = ∅, suppose that, for each i ∈ [m], there exists D i ∈ D(R i (y, y i ), Γ \ r(y) ∆) not containing any leaf Γ ∅. Then we can choose these derivations and create one for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, for some i ∈ [m] every derivation in D(R i (y, y i ), Γ \ r(y) ∆) must contain a leaf Γ ∅.

By the induction hypothesis, there exists ν ∈ µS I ( (R i (y, y i ) ∪ Γ \ {r(y)})) \ µS I ( ∆). Then it is also the case that ν ∈ µS I ( Γ) \ µS I ( ∆), because

µS I (R i (y, y i ) ∪ Γ \ {r(y)}) = µS I R i (y, y i ) ∩ µS I (Γ \ {r(y)}) ⊆ µS I (r(y) ∩ µS I (Γ \ {r(y)}) ⊆ µS I (r(y) ∧ (Γ \ {r(y)}) ⊆ µS I (r(y) ∪ Γ \ {r(y)}) = µS I Γ
(RU) Let r(y) ∈ ∆ be the predicate atom chosen for replacement and r(y

) ← S R 1 (y) | . . . | R m (y). Then Γ ∃z 1 . R 1 (y, z 1 ), . . . , ∃z m . R m (y, z m ), ∆ \ r(y)
is the antecedent for the application of IR = RU on Γ ∆. Note that, because RU is applicable, ∆ = ∅. Also, the right-hand side of the antecedent cannot be ∅ because all predicates in S p must be goals for at least one predicate rule of S.

Suppose that there exists D ∈ D(Γ ∃z 1 . R 1 (y, z 1 ), . . . , ∃z m . R m (y, z m ), ∆ \ r(y)) not containing any leaf Γ ∅. Then we can choose D and create a derivation for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, it must be the case that every derivation in D(Γ ∃z 1 . R 1 (y, z 1 ), . . . , ∃z m . R m (y, z m ), ∆ \ r(y)) contains a leaf Γ ∅.

By the induction hypothesis, there exists ν ∈ µS I ( Γ) \ µS I ( m i=1 ∃z i . R i ∨ (∆ \ {r(y)})). Then it is also the case that ν ∈ µS I ( Γ) \ µS I ( ∆), because µS I ( ∆) = µS I ( m i=1 ∃z i . R i (y, z i ) ∨ (∆ \ {r(y)})), as previously shown in the (RU) case of the proof for Theorem 2.5.2.

(RD) Let Γ = {φ(y, y 1 , . . . , y m ), r 1 (y 1 ), . . . , r m (y m )} and ∆ = {∃z 1 .ψ 1 (y, z 1 )∧Q 1 (z 1 ), . . . , ∃z k .ψ k (y, z k ) ∧ Q k (z k )}, where Q 1 , . . . , Q k are conjunctions of predicate atoms. Also, let S j = VIS(φ, ψ j ), for all j ∈ [k]. Each S j is finite because S has the fvi property.

If m = 0, then Γ contains no predicate atoms. Since p(x) q 1 (x), . . . , q n (x) Γ ∆, then, by Lemma 2.5.6, Γ is tree-shaped, meaning that Γ = {φ(y)} and φ has no subgoal variables. We distinguish the following cases:

-If k = 0, then ∆ = ∅. Since φ ∈ S c , it must be satisfiable. Thus any valuation ν such that I, ν |= φ contradicts the entailment φ(y) |= I ⊥. Such a valuation exists because all constraints in S c are satisfiable.

-If k > 0, then φ(y) |= I ∃z j .ψ j (y, z j ) for each j ∈ [k], because S has the fvi property.

As in the previous case, any model of φ contradicts the entailment and such a model exists because φ is satisfiable.

If m > 0, then r 1 (y 1 ), . . . , r m (y m ) {Q j θ | θ ∈ S j } i j=1 is the antecedent for the application of IR = RD on Γ ∆, where, by the side condition, φ |= I i j=1 ∃z j .ψ j and φ |= I k j=i+1 ∃z j .ψ j (with a possible reordering of ∆). If k = 0, because S is non-filtering, y 1 , . . . , y m are distinct and there are no predicates in S p with empty least solutions, it follows that µS I ( Γ) is not empty. Therefore there exists a counterexample ν ∈ µS I ( Γ) \ µS I ( ∆) = µS I ( Γ). Similarly, if i = 0, we have that µS I (r 1 (y 1 ) ∧ . . . ∧ r m (y m )) is not empty and it contains counterexamples for the antecedent. Given ν ∈ µS I (r 1 (y 1 ) ∧ . . . ∧ r m (y m )), because the system is non-filtering, there exists v ∈ Val ||y|| such that I, ν |= φ and ν = ν[y ← v]. Because, by the side condition of RD and the fact that S is non-overlapping, we have that I, ν |= ∃z j .ψ j for any j ∈ [k], we obtain

ν ∈ µS I (∃z j .ψ j ∧ Q j (z j )), ∀j ∈ [k], thus ν ∈ µS I ( Γ) \ µS I ( ∆).
If both k > 0 and i > 0, suppose that there exists D ∈ D(r 1 (y 1 ), . . . , r m (y m ) {Q j θ | θ ∈ S j } i j=1 ) not containing any leaf Γ ∅. Then we can choose D and create a derivation for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, it must be the case that every derivation in D(r 1 (y 1 ), . . . , r m (y m )

{Q j θ | θ ∈ S j } i j=1 contains a leaf Γ ∅.
By the induction hypothesis, there exists a valuation ν ∈ µS I (r

1 (y 1 ) ∧ . . . ∧ r m (y m )) \ µS I i j=1 {Q j θ | θ ∈ S j }
, and also ν ∈ µS I (r 1 (y 1 ) ∧ . . . ∧ r m (y m )) \ µS I (Q j θ) for every j ∈ [i] and θ ∈ S j . Because S is non-filtering, there exists v ∈ Val ||y|| such that I, ν |= φ and ν = ν[y ← v]. This means that ν ∈ µS I ( Γ). Note that the only free variables occurring in the antecedent are m j=1 y j . Then it is also true that ν ∈ µS I (r 1 (y 1 ) ∧ . . . ∧ r m (y m )) \ µS I (Q j θ), for every j ∈ [i] and θ ∈ S j . Furthermore, because S is non-overlapping and φ |= I ∃z j .ψ j for all j ∈ [i + 1, k], it follows that φ ∧ ∃z j .ψ j is unsatisfiable, hence ν is also a counterexample for each entailment φ |= I ∃z j .ψ j with j ∈ [i + 1, k], and thus for the entailment φ |= I k j=i+1 ∃z j .ψ j . Suppose that ν is a model of ∃z j .ψ j (y, z j ) ∧ Q j (z j ) for some j ∈ [k]. Then we get I, ν |= ∃z j .ψ j (y, z j ) and, because S is non-overlapping, we have that φ |= I ∃z j .ψ j . It follows that i ∈ [i + 1, k], otherwise it would contradict the side condition φ |= I ∃z i+1 .ψ i+1 ∨ . . . ∨ ∃z k .ψ k . Therefore, j ∈ [i] and, since S has the fvi property, I, ν |= ψ j θ for all θ ∈ S j . Moreover, there is no other Skolem function that witnesses this, besides the ones in S j . Then also ν ∈ µS I (Q j θ) for all θ ∈ S j and only for these substitutions. Because the range of each θ ∈ S j is y 1 ∪ . . . ∪ y m , it must be the case that ν ∈ µS I (Q j θ) for all θ ∈ S j , which contradicts the fact that ν is a counterexample of the antecedent. It follows that ν cannot be a model of ∃z j .ψ j (y, z j ) ∧ Q j (z j ) for any j ∈ [k] and ν ∈ µS I ( Γ) \ µS I ( ∆), as required.

(∧R) Let ∆ = r(y) ∧ s(y) ∧ Q, ∆ . Then Γ r(y) ∧ Q, ∆ and Γ s(y) ∧ Q, ∆ are the antecedents for the application of IR = ∧R on Γ ∆. Note that, because ∧R is applicable, ∆ = ∅. Also, the right-hand side of the antecedents cannot be ∅ either.

Suppose that there exist D 1 ∈ D(Γ r(y) ∧ Q, ∆ ) and D 2 ∈ D(Γ s(y) ∧ Q, ∆ ) not containing any leaf Γ ∅. Then we can choose D 1 and D 2 and create a derivation for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, it must be the case that every derivation in

D(Γ r(y) ∧ Q, ∆ ) or D(Γ s(y) ∧ Q, ∆ ) contains a leaf Γ ∅. µS I r(y) ∧ Q ∨ ∆ = µS I (r(y)) ∩ µS I Q ∨ ∆ ⊇ µS I (r(y)) ∩ µS I (s(y)) ∩ µS I Q ∨ ∆ = µS I r(y) ∧ s(y) ∧ Q ∨ ∆ = µS I ( ∆)
If every derivation in D(Γ r(y) ∧ Q, ∆ ) contains a leaf Γ ∅, by the induction hypothesis there exists ν 1 ∈ µS I ( Γ) \ µS I (r(y) ∧ Q ∨ ∆ ). Then it is also the case that ν 1 ∈ µS I ( Γ) \ µS I ( ∆), because of the inclusion above.

Similarly, if every derivation in D(Γ s(y) ∧ Q, ∆ ) contains a leaf Γ ∅, by the induction hypothesis there exists ν 2 ∈ µS I ( Γ) \ µS I (s(y) ∧ Q ∨ ∆ ) and also ν 2 ∈ µS I ( Γ) \ µS I ( ∆).

(SP) Let Γ = {r 1 (y 1 ), . . . , r m (y m )} and ∆ = { m i=1 s j i (y i )} k j=1 . Then, for a given ī ∈ [m] m k , the antecedents for the application of IR = SP are r īj (y īj )

{s īj (y īj ) | ∈ [k], f j (Q ) = īj }, for every j ∈ [m k ].
The right-hand side of any antecedent is ∅ only if ∆ was already ∅, meaning k = 0. Because y 1 , . . . , y m are distinct and there are no predicates in S p with empty least solutions, it follows that µS I ( Γ) is not empty. Therefore, there exists a counterexample ν ∈ µS I ( Γ) \ µS I ( ∆) = µS I ( Γ).

If ∆ = ∅, suppose that there exists ī ∈ [m] m k and D j ∈ D(r īj (y īj ) {s īj (y īj ) | ∈ [k], f j (Q ) = īj }) not containing any leaf Γ ∅, for every j ∈ [m k ].
Then we can choose these derivations and create one for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, it must be the case that, for any ī

∈ [m] m k there exists j ∈ [m k ] such that every derivation in D(r īj (y īj ) {s īj (y īj ) | ∈ [k], f j (Q ) = īj }) contains a leaf Γ ∅.
By the induction hypothesis, for any ī ∈ [n] n k there exist j ∈ [n k ] and a valuation

ν j ∈ µS I (r īj (y īj )) \ µS I {s īj (y īj ) | ∈ [k], f j (Q ) = īj } . Because this is equivalent to µS I (r īj ) ⊆ µS I {s īj | ∈ [k], f j (Q ) = īj } , it
follows by Lemma 2.5.1 that µS I (r 1 ) × . . . × µS I (r m ) ⊆ k j=1 µS I (q j 1 ) × . . . × µS I (q j m ). This is equivalent to µS I (r 1 (y 1 ) ∧ . . . ∧ r m (y m )) ⊆ µS I ( k j=1 n i=1 q j i (y i )), as previously shown in the (SP) case of the proof for Theorem 2.5.4. Then, there must exist ν ∈ µS I ( Γ) \ µS I ( ∆).

The following theorem establishes the completeness of the inference rule set R Ind , while also providing a proof search strategy S. Theorem 2.5.8. Given an non-filtering, non-overlapping FOL inductive system S with the fvi property, which is also ranked in the interpretation I, let p, q 1 , . . . , q n ∈ S p . Then the entailment p |= I S q 1 , . . . , q n holds only if the sequent p(x) q 1 (x), . . . , q n (x) has an Sproof with the inference rule schemata R Ind , where S is defined by the regular expression

(LU • RU * • RD • ∧R * • SP?) * • LU? • RU * • (AX | ID).
Proof. Since p |= I S q 1 , . . . , q n and S is non-filtering, non-overlapping, and has the fvi property, it follows by Lemma 2.5.7 that there exists a finite maximal, structured and irreducible derivation D ∈ D(p(x) q 1 (x), . . . , q n (x)) which does not contain any leaf of the form Γ ∅. Furthermore, no other node in D is of the form Γ ∅, because all descendants of such a node (including leaves of the derivation) would have empty right-hand sides as well.

Step 1. We first show that this derivation is actually a proof (i.e. all its leaves are ). Suppose, by contradiction, that there exists a leaf which is not . Then this leaf must be a sequent Γ ∆, where ∆ = ∅. Let π be the path in D from the root to Γ ∆. Since D is a maximal derivation, π cannot be extended any further by the application of an inference rule. Let IR be the last inference rule schema applied on π and let Γ ∆ be its consequent. Since p(x) q 1 (x), . . . , q n (x) Γ ∆ , it follows by Lemma 2.5.6 that Γ is a tree-shaped set and ∆ consists of existentially quantified finite conjunctions of tree-shaped sets. Also, IR cannot be AX or ID, otherwise the leaf would be . We do a case split on IR.

(LU) Then Γ = R(y, y )∪Γ \{r(y)} and ∆ = ∆ , where r(y), R(y) ∈ S. If ∆ contains at least one singleton predicate atom, we can still apply RU, which contradicts the fact that D is maximal. Otherwise, because ∆ = ∅ consists of existentially quantified finite conjunctions of tree-shaped sets and it does not contain any singleton predicate atoms, then ∆ contains only existentially quantified conjunctions over predicate rules from S, obtained from previous applications of RU, or predicate atom conjunctions that are not singleton, obtained from previous applications of RD. We distinguish the following cases:

-Γ \ {r(y)} = ∅. Then we can apply RD to the sequent Γ ∆ and extend D, which leads to a contradiction.

-Γ \{r(y)} = ∅. In this case, IR cannot be the first occurrence of LU along π, otherwise we would have Γ \ {r(y)} = ∅. Then there must have been a previous application of LU on π, and, because D is structured, RD must have been applied between them. Therefore, since Γ is tree-shaped, Γ \{r(y)} can only contain predicate atoms, because the constraints introduced by LU are always eliminated by RD. Then we can apply LU and extend D, which leads to a contradiction.

(RU) Then Γ = Γ and ∆ = {∃z i . R i (y, z i )} m i=1 ∪ ∆ \ {r(y)}, where r(y) ← S R 1 (y) | . . . | R m (y). If ∆ \ {p(x)
} contains at least one singleton predicate atom, we can continue to apply RU and extend D, which leads to a contradiction. Otherwise, because ∆ = ∅ consists of existentially quantified finite conjunctions of tree-shaped sets and it does not contain any singleton predicate atoms, then it must be the case that ∆ contains only existentially quantified conjunctions over predicate rules from S, obtained from previous applications of RU, or conjunctions of predicate atoms that are not singleton, obtained from previous applications of RD. We distinguish the following cases for Γ:

-Γ contains a predicate atom. Then we can apply LU and extend D, which leads to a contradiction.

-Γ does not contain predicate atoms. Then it can only contain a constraint with no subgoal variables, because Γ is tree-shaped and D is structured. Therefore, we can apply RD and extend D, which leads to a contradiction.

(RD) Then Γ = {r 1 (y 1 ), . . . , r m (y m )} and ∆ = {Q 1 , . . . , Q i }, where each Q j , j ∈ [i] is a conjunction of predicate atoms. It is possible to apply LU -or even ∧R, RU or SP if their side conditions are satisfied. This means that π can still be extended, which leads to a contradiction.

(∧R) Then Γ = Γ and ∆ = {r(y) ∧ Q} ∪ ∆ , where Q is a conjunction of predicate atoms and ∆ only contains conjunctions of predicate atoms. Since we only apply (∧R) as cleanup after RD, Γ only contains predicate atoms. If r(y) ∧ Q or any member of ∆ contains some conjunction s 1 (z) ∧ s 2 (z) we can again apply ∧R. Otherwise, we can apply LU -or even RU or SP if their side conditions are satisfied. This means that π can still be extended, which leads to a contradiction.

(SP) Then Γ = r(y) and ∆ = {s 1 (y), . . . , s m (y)}. We can apply LU or RU to Γ ∆, which means that π can still be extended and leads to a contradiction.

Step 2. We now show that the sequences of inference rules applied along each branch in D are captured by the strategy S. Let π be an arbitrary branch in D, starting at the root. Since D is maximal, π cannot be extended by the application of any inference rule. We assume that the first instance of LU along π does not immediately follow an application of RU -otherwise, the same sequent can be obtained by changing the order of the inference rules such that LU is applied first. We do a proof by induction on the number N ≥ 1 of basic sequents that occur on π.

(N = 1) The only basic sequent is the root p(x) q 1 (x), . . . , q n (x) and it occurs on the first position of π. In this case, SP is never applied along π, otherwise we would obtain more than one basic sequent. Note that the rules applicable on a basic sequent are AX, LU and RU. We distinguish the following cases:

-If LU is not applied on π, then the only possibility to obtain a maximal π is to directly apply AX on the root. Since we exclude LU, the only other applicable inference rule would be RU, but, since it preserves the left-hand side, π would not be maximal after all possible applications of RU. Therefore, Λ(π) = AX ∈ S.

-If LU is applied on π, then there are multiple possibilities for Λ(π), which we obtain from analysing the sequents created by each potential choice of inference rules.

-Since AX would close the path and we assumed that RU does not immediately precede LU, it follows that LU must be the first inference rule in Λ(π). Let p(x), R(x) ∈ S be the predicate rule chosen for applying LU on the root;

-We obtain R(x, x ) q 1 (x), . . . , q n (x) as the second sequent in π. We can continue by LU (if R contains at least one predicate atom) or RU. However, LU is not allowed at this point because the derivation is structured, so the only choice is to apply RU for one of the predicate atoms on the right-hand side.

-If the next sequent satisfies the side condition of AX, then we can close π. Otherwise we can continue with at most n -1 instances of RU. If, at any point during the right unfolding, AX becomes applicable, then π can be closed. We obtain

Λ(π) = LU • RU * • AX ∈ S.
-After n -1 more right unfoldings, we reach a sequent R(x, x ) ∃y 1 . R 1 (x, y 1 ), . . . , ∃y m . R m (x, y m ), where the right-hand side is obtained from all the predicate rules for q 1 , . . . , q n in S. If AX is not applicable, we can only continue by RD and, immediately, as many ∧R applications as necessary.

-We reach a sequent

r 1 (x 1 ), . . . , r h (x h ) Q 1 , . . . , Q k , where each Q i with i ∈ [k]
is a conjunction of predicate atoms over the tuples {x 1 , . . . , x h }, such that no two predicate atoms in the same Q i have the same arguments. Then h = 1, otherwise this sequent would be basic, contradicting the assumption that N = 1. Also, h = 0, otherwise it would lead to k = 0 after RD, which, by Lemma 2.5.7, indicates the existence of a counterexample and contradicts the fact that D is a proof. Since SP cannot occur along π, the only possibilities for continuation are AX, ID, LU and RU. However, LU is applicable at most once, because RD is required between two consecutive left unfoldings and RD is only applicable on sequents with a singly tree-shaped left-hand side, which is impossible here due to h > 1. Also, RU can only be applied a finite number of times, equal to the number of singleton predicate atoms on the right hand side. In both cases, π is not maximal, because LU is enabled by h > 1. Then the only possibility is to end π by AX or ID, obtaining Λ(π)

∈ LU • RU * • RD • ∧R * • LU? • RU * • (AX | ID) ⊆ S.
(N > 1) Let π = τ •ρ, where ρ starts with the second occurrence of a basic sequent in π. As before, the first occurrence is the initial sequent p(x) q 1 (x), . . . , q n (x). Then the head of ρ is obtained after a sequence RD • ∧R * • SP?, where SP is only required if the left-hand side for the consequent of RD contains more than one predicate atom. The left-hand side of this RD consequent is a predicate rule in S with goal p(x), introduced by a previous application of LU. It follows that only RU can be applied between LU and RD and, also, RU is the only other rule applicable before LU. However, the order of the LU and RU applications is not important and we consider that the left unfolding is always performed first. Assuming that Λ(ρ) ∈ S, we obtain that Λ(π) ∈ (LU

• RU * • RD • ∧R * • SP?) • S ⊆ S.
As previously discussed, the proof-search semi-algorithm 1 only produces irreducible derivations. If it is executed with S, then these derivations will also be structured. This guarantees termination because, by point (1) of Lemma 2.5.5, each irreducible and structured derivation is finite. If the input inductive system S is ranked, non-filtering, non-overlapping and has the fvi property, then R Ind is complete, thus algorithm 1 becomes a decision procedure for this class of entailment problems.

The Soundness and Completeness of R SL

Ind

Soundness

We develop our argument for the soundness of R SL Ind in a similar fashion as the one for R Ind . The following lemma is the counterpart of Lemma 2.5.1 and its proof adapts the result of [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF]Theorem 1] to support the local soundness of SP SL . Lemma 2.5.9. Consider an SL inductive system S, the predicates p 1 , . . . , p n ∈ S p , and the tuples of predicates

Q j = q j 1 , . . . , q j n ∈ (S p ) n , j ∈ [k]. Then µS SL (p 1 (x 1 ) * . . . * p n (x n )) ⊆ k j=1 µS SL (q j 1 (x 1 ) * . . . * q j n (x n ))
only if there exists a tuple ī ∈ [n] n k , such that:

µS SL (p īj ) ⊆ {µS SL (q īj ) | ∈ [k], f j (Q ) = īj } for all j ∈ [n k ], where F(Q 1 , . . . , Q k ) = {f 1 , . . . , f n k }. Proof. Let U k = L k × Heaps.
Then, given some predicates r 1 , . . . , r n ∈ S p , the following property holds:

n i=1 µS SL (r i ) ⊆ n i=1   i-1 j=1 U ||xj || µS SL (r i ) n j=i+1 U ||xj ||   (2.5)
This proof closely follows the outline of the proof for Theorem 1 in [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF]. Using property (2.5), the inclusion we need to prove can be rewritten as

µS SL (p 1 (x 1 ) * . . . * p n (x n )) ⊆ k j=1 µS SL (q j 1 (x 1 ) * . . . * q j n (x n )) ⇔ n i=1 µS SL (p i ) ⊆ k j=1 n i=1 µS SL (q j i ) ⇔ n i=1 µS SL (p i ) ⊆ k j=1 n i=1 i-1 =1 U ||x || µS SL (q j i ) n =i+1 U ||x || (2.6)
As in the proof of [24, Theorem 1], because the power set lattice (2 V , ⊆) of any set V is a completely distributive lattice, for any doubly indexed family

{S j,k ∈ 2 V | j ∈ J, k ∈ K j } it holds that j∈J k∈Kj S j,k = f ∈F j∈J S j,f (j)
where F is the set of choice functions f choosing for each index j ∈ J some index f (j) ∈ K j . In our case, let F = F(Q 1 , . . . , Q k ). Then, we can rewrite (2.6) as

n i=1 µS SL (p i ) ⊆ k j=1 n i=1 i-1 =1 U ||x || µS SL (q j i ) n =i+1 U ||x || ⇔ n i=1 µS SL (p i ) ⊆ f ∈F k j=1   f (Q j )-1 =1 U ||x || µS SL (q j f (Q j ) ) n =f (Q j )+1 U ||x ||   ⇔ ∀f ∈ F. n i=1 µS SL (p i ) ⊆ k j=1   f (Q j )-1 =1 U ||x || µS SL (q i f (Q j ) ) n =f (Q j )+1 U ||x ||   (2.7)
For a fixed f , we can rewrite the right hand-side of (2.7) as

k j=1   f (Q j )-1 =1 U ||x || µS SL (q j f (Q j ) ) n =f (Q j )+1 U ||x ||   = n i=1 j∈[k],f (Q j )=i i-1 =1 U ||x || µS SL (q j i ) n =i+1 U ||x || = n i=1   i-1 =1 U ||x ||   j∈[k],f (Q j )=i µS SL (q j i )   n =i+1 U ||x ||   (2.8)
Using (2.8), the inclusion query (2.7) becomes

∀f ∈ F. n i=1 µS SL (p i ) ⊆ n i=1   i-1 =1 U ||x ||   j∈[k],f (Q j )=i µS SL (q j i )   n =i+1 U ||x ||   ⇔ ∀f ∈ F ∃i ∈ [n] . µS SL (p i ) ⊆ j∈[k],f (Q j )=i µS SL (q j i ) ⇔ n k j=1 n i=1 µS SL (p i ) ⊆ {µS SL (q i ) | ∈ [k], f j (Q ) = i} ⇔ ī∈[n] n k n k j=1 µS SL (p īj ) ⊆ {µS SL (q īj ) | ∈ [k], f j (Q ) = īj } (2.9)
Inclusion (2.9) is true only when there exists a tuple ī

∈ [n] n k , for all j ∈ [n k ], such that µS SL (p īj ) ⊆ {µS SL (q īj ) | ∈ [k], f j (Q ) = īj }.
The local soundness of R SL Ind \{ID} means that, if the consequent Γ ∆ denotes an invalid entailment, then at least one of its antecedents also denotes an invalid entailment. Moreover, their respective counterexamples can be related by .

Lemma 2.5.10. Given a ranked SL inductive system S, for each instance of an inference rule schema in R SL Ind \ {ID}, having the consequent Γ ∆ and antecedents Γ i ∆ i with i ∈ [n], and each (ν, h) ∈ µS SL ( Γ) \ µS SL ( ∆), there exists

(ν i , h i ) ∈ µS SL ( Γ i ) \ µS SL ( ∆ i ) for some i ∈ [n] such that h i h.
Proof. For AX SL , soundness follows from the side condition and its consequent admits no counterexamples, thus the lemma is trivially true in this case. We analyse LU, RU SL , RD SL , ∧R and SP SL individually, in a similar fashion as we did for the local soundness of R Ind (Lemma 2.5.2).

(LU) Let p(x) ∈ Γ be a predicate atom, where p(x)

← S R 1 (x) | . . . | R n (x). The an- tecedents of Γ ∆ are Γ i ∆ i ≡ R i (x, y i ), Γ \ p(x) ∆, where i ∈ [n]
and each y i is a tuple of fresh variables. In this case, the least solution of Γ is

µS SL ( * Γ) = µS SL (p(x) * * (Γ \ {p(x)})) = µS SL (p(x)) µS SL ( * (Γ \ {p(x)})) = n i=1 µS SL ( * R i (x)) µS SL ( * (Γ \ {p(x)})) = n i=1 (µS SL ( * R i (x)) µS SL ( * (Γ \ {p(x)}))) = n i=1 µS SL ( * R i (x) * * (Γ \ {p(x)})) If there exists (ν, h) ∈ µS SL ( * Γ) \ µS SL ( ∆), then (ν, h) ∈ µS SL ( * R i (x) ∧ * (Γ \ {p(x)})) \ µS SL ( ∆) for some i ∈ [n].
In consequence, there also exists (ν i , h i ) ∈ µS SL ( * R i (x, y i ) * * (Γ \ {p(x)})) \ µS SL ( ∆) such that h i = h and for every x ∈ FV(Γ) we have ν i (x) = ν(x).

Then h i h holds trivially.

(RU SL ) Let p(x) ∈ ∆ be a predicate atom, where p(x)

← S R 1 (x) | . . . | R n (x). Then Γ ∆ has only one antecedent Γ 1 ∆ 1 ≡ Γ ∃y 1 . * R 1 (x, y 1 ), . . . , ∃y n . * R n (x, y n ), ∆ \ p(x),
where each y i with i ∈ [n] is a tuple of fresh variables. In this case, the least solution of ∆ is

µS SL ∆ = µS SL p(x) ∨ (∆ \ {p(x)}) = µS SL (p(x)) ∪ µS SL (∆ \ {p(x)}) = n i=1 µS SL ( * R i (x)) ∪ µS SL (∆ \ {p(x)}) = n i=1 µS SL (∃y i . * R i (x, y i )) ∪ µS SL (∆ \ {p(x)}) = µS SL n i=1 ∃y i . * R i (x, y i ) ∪ µS SL (∆ \ {p(x)}) = µS SL n i=1 ∃y i . * R i (x, y i ) ∨ (∆ \ {p(x)}) = µS I ( ∆ 1 )
If there exists (ν, h) ∈ µS SL ( * Γ)\µS SL ( ∆), then it is also the case that (ν, h) ∈ µS SL ( * Γ 1 )\ µS SL ( ∆ 1 ). Therefore, the counterexample for the antecedent is (ν 1 , h 1 ) = (ν, h) and h 1 h holds trivially.

(RD SL ) Then the sequent Γ ∆ ≡ φ(x, x 1 , . . . , x n ), p 1 (x 1 ), . . . , p n (x n ) {∃y j .ψ j (x, y j ) * Q j (y j )} k j=1 has only one antecedent Γ 1 ∆ 1 ≡ p 1 (x 1 ), . . . , p n (x n ) {Q j θ | θ ∈ S j } i j=1 .
By the side condition of RD, φ |= SL * i j=1 ∃y j .ψ j . Also, by Definition 2.4.6, we have µS SL (φ) ⊆ µS SL (ψ j θ) for each θ ∈ VIS(φ, ψ j ) and j ∈ [i]. In this case, the least solution of ∆ is

µS SL ∆ = µS SL   k j=1 ∃y j .ψ j * Q j   = k j=1 µS SL ∃y j .ψ j * Q j ⊇ i j=1 µS SL ∃y j .ψ j * Q j ⊇ i j=1 θ∈VIS(φ,ψj ) µS SL ((ψ j * Q j )θ) = i j=1 θ∈VIS(φ,ψj ) µS SL (ψ j θ * Q j θ) = i j=1 θ∈VIS(φ,ψj ) (µS SL (ψ j θ) µS SL (Q j θ)) = i j=1 θ∈VIS(φ,ψj ) µS SL (ψ j θ) i j=1 θ∈VIS(φ,ψj ) µS SL (Q j θ) Note that also µS SL ( * Γ) = µS SL (φ) µS SL (p 1 (x 1 ) * . . . * p n (x n )). If there exists (ν, h) ∈ µS SL ( * Γ)\µS SL ( ∆), then h = h h such that (ν, h ) ∈ µS SL (φ) and (ν, h ) ∈ µS SL (p 1 (x 1 ) * . . . * p n (x n )). It follows that we have (ν, h h ) ∈ (µS SL (φ) µS SL (p 1 (x 1 ) * . . . * p n (x n ))) \ i j=1 θ∈VIS(φ,ψj ) µS SL (ψ j θ) i j=1 θ∈VIS(φ,ψj ) µS SL (Q j θ) and, since as previously stated µS SL (φ) ⊆ i j=1 θ∈VIS(φ,ψj ) µS SL (ψ j θ), we obtain (ν, h ) ∈ µS SL (p 1 (x 1 ) * . . . * p n (x n )) \ i j=1 θ∈VIS(φ,ψj ) µS SL (Q j θ) = µS SL ( * Γ 1 ) \ µS SL ( ∆ 1 )
. Therefore, the counterexample for the antecedent is (ν 1 , h 1 ) = (ν, h ). Because φ is introduced to the left-hand side by left unfolding and S is ranked, we have that h = ∅ and, thus, h 1 h.

(∧R) As in the ∧R case from the proof of Theorem 2.5.4, we have that, for any counterexample (ν, h) ∈ µS SL ( * Γ) \ µS SL ( ∆), it is also the case that (ν, h) ∈ (µS SL ( * Γ 1 ) \ µS SL ( ∆ 1 )) ∪ (µS SL ( * Γ 2 ) \ µS SL ( ∆ 2 )). Therefore, ν ∈ µS SL ( * Γ i ) \ µS SL ( ∆ i ) for some i ∈ [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF] and the counterexample for Γ i ∆ i is (ν i , h i ) = (ν, h). Then h i h holds trivially.

(SP SL ) Then Γ ∆ ≡ p 1 (x 1 ), . . . , p n (x n ) { * n i=1 q j i (x i )} k j=1 . For each ī ∈ [n] n k , the antecedents of Γ ∆ are Γ ī j ∆ ī j ≡ p īj (x īj ) {q īj (x īj ) | ∈ [k], f j (Q ) = īj }, j ∈ [n k ]. If there exists (ν, h) ∈ µS SL ( * n i=1 p i (x i )) \ µS SL k j=1 * n i=1 q j i (x i ) ,
then by the proof of Lemma 2.5.9, there exists j ∈ [n k ] and pairs (ν 1 , h 1 ), . . . ,

(ν n , h n ) such that (ν i , h i ) ∈ µS SL (p i (x i )) \ {µS SL (q i ) | ∈ [k], f j (Q (x i ))) = i} for all i ∈ [n], where h = h 1 . . . h n and ν(x i ) = ν i (x i ) for each i ∈ [n]. In other words, for all tuples ī ∈ [n] n k we have (ν īj , h īj ) ∈ µS SL (p īj (x īj ))\ {µS SL (q īj (x īj )) | ∈ [k], f j (Q ) = īj } = µS SL ( * Γ ī j )\µS SL ( ∆ ī j ).
Therefore, given such j ∈ [n k ], the counterexample for each antecedent Γ ī j ∆ ī j is (ν īj , h īj ).

Since h = h 1 . . . h n , we have h īj h, for each ī ∈ [n] n k .
Based on this result, we again consider a reachability relation between counterexamples and write (ν, h) (ν , h ) when, given any instance of an inference rule in R SL Ind \ ID, (ν, h) is a counterexample of the consequent and (ν , h ) is a counterexample of one of its antecedents obtained from (ν, h), as shown in the proof of Lemma 2.5.10. With this in mind, we revisit the definition of a counterexample path and adapt it to SL.

Definition 2.5.6 (Counterexample path in SL). A path π = v 1 , v 2 , . . . , v k in a proof D = (V, v 0 , Seq, Rule, Par, Piv) built with R SL
Ind is a counterexample path if there exists a sequence of pairs (ν 1 , h 1 ), (ν 2 , h 2 ), . . . , (ν k , h k ) such that, for all i ∈ [k] we have:

(i) (ν i , h i ) ∈ µS SL ( * Γ i )\ µS SL ( ∆ i ), where Seq(v i ) = Γ i ∆ i , and (ii) (ν i , h i ) (ν i+1 , h i+1 ) if i < k.
The following lemma is the counterpart of Lemma 2.5.3 and shows that, if the given SL inductive system is ranked, any direct counterexample path in a proof causes a strict heap decrease in the counterexamples for the pivot and consequent delimiting the path. Lemma 2.5.11. Given a ranked SL inductive system S, let D = (V, v 0 , Seq, Rule, Par, Piv) be a proof built with R SL Ind and π = v 1 , . . . , v k be a direct counterexample path in D for a backlink (v k , v 1 ), with counterexamples (ν 1 , h 1 ) . . . (ν k , h k ). Then h 1 h k .

Proof. Through a similar reasoning as the one in the proof of Lemma 2.5.3 and using Lemma 2.5.10 to support the fact that h 1 . . . h k , we obtain that RD SL is required to occur in Λ(π), leading to

h i h i+1 for some i ∈ [k -1]. Then h 1 h k .
Finally, the following theorem extends the reachability relation to backlinks and shows that any infinite trace in a proof leads to an infinite strictly decreasing sequence of heaps, contradicting the well-foundedness of the wfqo which makes the inductive system be ranked (Definition 2.4.4). Then there cannot exist a counterexample for any sequent labelling the root of a proof built with R SL Ind and the associated entailment must hold.

Theorem 2.5.12. Given a ranked SL inductive system S, if a sequent Γ ∆ has a proof D = (V, v 0 , Seq, Rule, Par, Piv) built with R SL Ind and Seq(v 0 ) ≡ Γ ∆, then the entailment * Γ |= SL S ∆ holds.

Proof. This proof by contradiction closely follows the one of Theorem 2.5.4. We suppose that * Γ |= SL S ∆ does not hold and, by Lemma 2.5.10, obtain a path from v 0 to a leaf v k ∈ V and an associated sequence of counterexamples (ν 1 , h 1 ) . . .

(ν k , h k ). Clearly, Rule(v k ) = ID. Let v k+1 = Piv(v k ), Seq(v k ) = Γ k ∆ k and Seq(v k+1 ) = Γ k+1 ∆ k+1 such that Γ k = Γ k+1 θ, ∆ k = ∆ k+1 θ and ∆ k+1 ⊆ ∆ k+1 , for some injective substitution θ : FV(Γ k+1 ∪ ∆ k+1 ) → FV(Γ k ∪ ∆ k ). Again, we can assume w.l.o.g. that θ is surjective, by defining θ(x) = x for each x ∈ FV(Γ k ∪ ∆ k ) \ θ(FV(Γ k+1 ∪ ∆ k+1 )).
Since θ is also injective, by the side condition of ID, its inverse exists and (ν k θ -1 , h k ) is a counterexample for Γ k+1 ∆ k+1 . Therefore, we can extend the relation with the pair

((ν k , h k ), (ν k θ -1 , h k )).
We obtain an infinite trace τ = v 0 , v 1 , . . . in D together with an infinite sequence (ν 0 , h 0 ) (ν 1 , h 1 ) . . .. By Lemma 2.5.10, we have h i h i+1 , for all i ≥ 0. By Proposition 2.2.1, τ contains infinitely many direct paths π j = v kj , . . . , v j , where {k j } j≥0 and { j } j≥0 are infinite strictly increasing sequences of integers such that k j < j ≤ k j+1 < j+1 , for all j ≥ 0. By Lemma 2.5.11, we obtain that h kj h j , for all j ≥ 0. Since h j h kj+1 for all j ≥ 0, this leads to a strictly decreasing sequence h k0 h k1 . . ., contradicting the fact that is a wfqo. We can conclude that our initial assumption was false, thus the entailment * Γ |= SL S ∆ holds.

Completeness

The R SL Ind proof system is not complete for SL entailments, even if the predicates involved in the entailment are defined by inductive systems that satisfy all the restrictions introduced in Section 2.4. Instead, we will show completeness for a more restricted class of entailment problems. Whether a complete set of inference rules for the general entailment problem in SL exists is, to our knowledge, still an open question.

The restricted semantics that we consider for SL entailments take into consideration the way a predicate definition unfolds a heap. The same heap can be built in different ways, but R SL Ind is complete only for entailments that involve predicates whose definitions unfold the heap in a similar manner. Definition 2.5.7 (Coverage trees). A coverage tree for a heap h ∈ Heaps is a tree t : N * fin Heaps such that dom(t(α 1 )) ∩ dom(t(α 2 )) = ∅ for all α 1 , α 2 ∈ dom(t) with α 1 = α 2 and also h = α∈dom(t) t(α). In other words, the labels of the coverage tree form a partition of the heap. We write Cover to mean the set of all coverage trees. We restrict the class of SL entailments by defining a new type of assignments that map a predicate of arity n into a subset of L n × Heaps × Cover. Given an SL inductive system S, we refer to the set of all assignments on the predicates of S as Assign U (S p ). We extend any assignment X ∈ Assign U (S p ) to a singly tree-shaped set represented as a tree T and define X ( * T ) as the set of tuples (ν, h, t), where ν : α∈dom(T ) FV(T (α)) → Loc is a valuation, h is a heap and t is a coverage tree for h such that:

-For each α ∈ dom(T ) \ fr(T ) we have that ν, t(α) |= SL T (α); -For each α ∈ fr(T ) such that T (α) = p(x) there exists (ν(x), t(α), t |α ) ∈ X (p).

We can further extend the above definition to a tree-shaped set T = T 1 ∪ . . . ∪ T k , which consists of multiple singly tree-shaped sets T 1 , . . . , T k . Then

X ( * T ) = X ( * T 1 * . . . * * T k ) = {(ν, h 1 . . . h k , {t 1 , . . . , t k }) | (ν, h i , t i ) ∈ X ( * T i ), i ∈ [k]}.
As it was the case for the previous types of assignments, X ( * T ∧ * T ) = X ( * T ) ∩ X ( * T ), X ( * T ∨ * T ) = X ( * T ) ∪ X ( * T ) and X (∃x . * T ) = X ( * T ) for any two tree-shaped sets T and T . The SL inductive system S now induces a function on assignments, F U S :

Assign U (S p ) → Assign U (S p ), such that F U S (X )(p) = m i=1 {(ν(x), h, t) | (ν, h, t) ∈ X (R i )}, where p(x) ← S R 1 (x) | . . . | R m (x). It can easily be shown that F U
S is monotone and continuous, just as we previously have shown for F SL S in Theorems 1.3.7 and 1.3.9. These proofs are enabled by introducing an operator τ k with k ∈ N such that, given sets

A ∈ L n × Heaps, B 1 ∈ L n1 × Heaps × Cover, . . . , B k ∈ L n k × Heaps × Cover, we have τ k (A, B 1 , . . . , B k ) = {( • 1 • . . . • k , h h 1 . . . h k , τ k (h, t 1 , . . . , t k )) | ( , h) ∈ A, ( i , h i , t i ) ∈ B i , i ∈ [k]}. We similarly use it for sets A ∈ V × Heaps, B 1 ∈ V × Heaps × Cover, . . . , B k ∈ V × Heaps × Cover.
A solution of the SL inductive system S is now an assignment X ∈ Assign U (S p ) such that

F U S (X ) X . The set of all solutions of S is Sol U S = {X | F U S (X ) X }. A least solution of S is µS U ∈ Sol U
S such that, for any assignment X ≺ µS U , X ∈ Sol U S . Similar to Theorem 1.3.10, it can be shown that µS U is unique and

µS U = F U S n (X ∅ ), where n ∈ N is the smallest value for which F U S n+1 (X ∅ ) = F U S n (X ∅ ).
For each (ν, h, t) ∈ µS U (p), for a predicate p ∈ S p , we call t an unfolding tree of p. Given p, q 1 , . . . , q n ∈ S p , the entailment problem now becomes p(x) |= U S q 1 (x), . . . , q n (x) if and only if µS U (p) ⊆ µS U (q 1 ) ∪ . . . ∪ µS U (q n ). Note that p(x) |= U S q 1 (x), . . . , q n (x) implies p(x) |= SL S q 1 (x), . . . , q n (x), but not the other way around. Example 2.5.1. Consider the following SL inductive system S:

ls 1 (x, y) ← S x ≈ y ∧ emp | y ≈ y ∧ x → x , ls 1 (x , y ) ls 2 (x, y) ← S x ≈ y ∧ emp | y ≈ y ∧ x → x * x → z , ls 2 (z , y )
The predicates ls 1 (x, y) and ls 2 (x, y) both define list segments, but the latter only covers list segments of even length and unfolds them two elements at a time. The entailment ls 2 |= SL S ls 1 holds. Given ( , h) = ( 1, 5 , {(1, 2), (2, 3), [START_REF] Barrett | CVC4[END_REF][START_REF] Barrett | The SMT-LIB Standard: Version 2[END_REF], (4, 5)}), clearly ( , h) ∈ µS SL (ls 1 ) and ( , h) ∈ µS SL (ls 2 ). However, the two definitions generate different coverage trees t 1 and t 2 for h, such that ( , h, t 1 ) ∈ µS U (ls 1 ) and ( , h, t 2 ) ∈ µS U (ls 2 ):

t 1 = {(1, 2)} {(2, 3)} {(3, 4)} {(4, 5)} ∅ t 2 = {(1, 2), (2, 3)} {(3, 4), (4, 5)} ∅ It follows that µS U (ls 2 ) ⊆ µS U (ls 1
) and the entailment ls 2 |= U S ls 1 does not hold. On a different vein, consider the SL inductive system S :

dlls(hd, p, tl, n) ← S hd ≈ tl ∧ hd → (p, n) | p ≈ hd ∧ tl ≈ tl ∧ n ≈ n ∧ hd → (p, hd ), dlls(hd , p , tl , n ) dlls r (hd, p, tl, n) ← S hd ≈ tl ∧ hd → (p, n) | hd ≈ hd ∧ p ≈ p ∧ n ≈ tl ∧ tl → (n, tl ), dlls r (hd , p , tl , n )
Both predicates define doubly-linked list segments, but dlls unfolds them starting at the head, while dlls r unfolds starting at the tail. The entailments dlls |= SL S dlls r and dlls r |= SL S dlls hold.

Let ( , h ) = ( 0, 1, 4, 5 , {(1, 0, 2 ), (

}). It is easy to see that ( , h ) ∈ µS SL (dlls) and ( , h ) ∈ µS SL (dlls r ). Again, the two definitions generate different coverage trees t 1 and t 2 for h , such that ( , h , t 1 ) ∈ µS U (dlls) and ( , h , t 2 ) ∈ µS U (dlls r ):

t 1 = {(1, 0, 2 )} {(2, 1, 3 )} {(3, 2, 4 )} {(4, 3, 5 )} t 2 = {(4, 3, 5 )} {(3, 2, 4 )} {(2, 1, 3 )} {(1, 0, 2 )}
It follows that µS U (dlls) ⊆ µS U (dlls r ) and µS U (dlls r ) ⊆ µS U (dlls). The corresponding entailments dlls |= U S dlls r and dlls r |= U S dlls do not hold.

The definitions for maximal and irreducible derivations using R SL Ind are the same as their R Ind counterparts in Section 2.5.1. Similarly, a derivation built with R SL Ind is structured if and only if RD SL occurs between any two consecutive applications of LU. We use D SL (Γ ∆) for the set of irreducible, maximal and structured having Γ ∆ as a root and using R SL Ind . We also write Γ ∆ SL Γ ∆ if Γ ∆ occurs as a node in a derivation from D SL (Γ ∆).

The following lemmas are the SL counterparts of the ones in Section 2.5.1. Since R SL Ind is structurally the same as R Ind , we need not redo the proofs, as they closely resemble the ones for Lemma 2.5.5 and Lemma 2.5.6. Lemma 2.5.13. If the SL inductive system S has the fvi property, then the following properties of derivations built with R SL Ind hold:

(1) Any irreducible and structured derivation is finite;

(2) For any sequent Γ ∆, the set D SL (Γ ∆) is finite.

Lemma 2.5.14. Given an SL inductive system S and predicates p, q 1 , . . . , q n ∈ S p , in every sequent Γ ∆ such that p(x) q 1 (x), . . . , q n (x) SL Γ ∆, Γ is a tree-shaped set and ∆ consists of finite separating conjunctions over tree-shaped sets, with all subgoal variables existentially quantified.

The following lemma is the counterpart of Lemma 2.5.7, providing a similar invariant on the set of derivations for a sequent that denotes an invalid entailment. As in the FOL case, this result is important for showing the completeness of R SL Ind under the new interpretation of entailments, based on unfolding trees. Lemma 2.5.15. Given a non-filtering and non-overlapping SL inductive system with the fvi property, the predicates p, q 1 , . . . , q n ∈ S p , and a sequent Γ ∆ such that p(x) q 1 (x), . . . , q n (x) SL Γ ∆, if every derivation D ∈ D SL (Γ ∆) contains a leaf Γ ∅ then there exists a valuation ν, a heap h and a set of unfolding trees U such that (ν, h, U ) ∈

µS U ( * Γ) \ µS U ( ∆). Proof. Let (D SL ) * (Γ ∆) = {d | d ∈ D SL (Γ ∆) or ∃d ∈ (D SL ) * (Γ ∆) . d d }.
Because, by Lemma 2.5.13, any derivation in D SL (Γ ∆) is finite and

D SL (Γ ∆) itself is finite, then (D SL ) * (Γ ∆) is also finite. Since ((D SL ) * (Γ ∆),
) is a wqo, by Lemma 2.4.1 (P fin ((D SL ) * (Γ ∆)), ∀∃ ) is also a wqo and we can prove this lemma by induction on it.

Let D SL (Γ ∆) = IR∈R SL Ind D SL IR (Γ ∆)
, where D SL IR (Γ ∆) denotes the subset of D SL (Γ ∆) consisting of derivations starting with an instance of the inference rule IR. We do not consider the cases IR ∈ {AX SL , ID} because these inference rules do not lead to a leaf of the required form. Given D ∈ D SL IR (Γ ∆) with IR ∈ R SL Ind \ {AX SL , ID}, we assume that, for each antecedent Γ ∆ of Γ ∆, the lemma holds for any D ∈ IR ∈R Ind D SL IR (Γ ∆ ) and show that it extends to D.

(LU) Let r(y) ∈ Γ be the predicate atom chosen for replacement and r(y) ← S R 1 (y) | . . . | R m (y). Then R 1 (y, y 1 ), Γ \ r(y) ∆, . . . , R m (y, y m ), Γ \ r(y) ∆ are the antecedents for the application of IR = LU on Γ ∆. If ∆ = ∅, then, similarly to the LU case in Lemma 2.5.7, there exists a counterexample ν

∈ µS U ( * Γ) \ µS U ( ∆) = µS U ( * Γ). If ∆ = ∅, suppose that, for each i ∈ [m], there exists D i ∈ D SL (R i (y, y i ), Γ \ r(y) ∆) not containing any leaf Γ ∅.
Then we can choose these derivations and create one for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, there must exist i ∈ [m] such that every derivation in D SL (R i (y, y i ), Γ \ r(y) ∆) contains a leaf Γ ∅.

Because p(x) q 1 (x), . . . , q n (x) SL Γ ∆, Γ is a tree-shaped set and let T 1 , . . . , T k be the singly-tree shaped sets, represented as trees labelled with formulae, such that Γ = k i=1 T i . Then there exists a tree T j , j ∈ [k] and a frontier position α r ∈ fr(T j ) such that T j (α r ) = r(y). Then the tree-shaped set R i (y, y i ), Γ \ r(y) is represented by the singly-tree shaped sets T 1 , . . . , T k , where

T = T for all ∈ [k] \ {j} and T j = T j [αr] • R i (y, y i ).
By the induction hypothesis, there exists a counterexample (ν, h 1 . . . h k , {t 1 , . . . , t k }) ∈ µS U ( * (R i (y, y i ) ∪ Γ \ {r(y)})) \ µS U ( ∆), where (ν, h , t ) ∈ µS U ( * T ), for all ∈ [k]. Because T = T for all ∈ [k] \ {j}, we only need to show that (ν, h j , t j ) ∈ µS U ( * T j ). Since (ν, h j , t j ) ∈ µS U ( * (T j [αr] • R i (y, y i ))), there exist some disjoint heaps h j and h j , a context t j [αr] and a cover t j such that: (i) h j = h j h j and t j = t j [αr] • t j , (ii) t j [αr] covers h j and (ν, t j , h j ) ∈ µS U ( * R i (y, y i )). Since r(y), R i (y) ∈ S is a predicate rule, we have µS U ( * R i (y, y i )) ⊆ µS U (r(y)). This leads to (ν, t j , h j ) ∈ µS U (r(y)) and (ν,

h j , t j ) ∈ µS U ( * (T j [αr] • R i (y, y i ))) ⊆ µS U ( * (T j [αr] • r(y))) = µS U ( * T j ). Therefore, (ν, h , t ) ∈ µS U ( * T ) for all ∈ [k] and (ν, h 1 . . . h k , {t 1 , . . . , t k }) ∈ µS U ( * Γ) \ µS U ( ∆).
(RU SL ) Let r(y) ∈ ∆ be the predicate atom chosen for replacement and r(y

) ← S R 1 (y) | . . . | R m (y). Then Γ ∃z 1 . * R 1 (y, z 1 ), . . . , ∃z m . * R m (y, z m ), ∆ \ r(y)
is the antecedent for the application of IR = RU SL on Γ ∆. Since RU is applicable, ∆ = ∅. Also, the right-hand side of the antecedent cannot be ∅ because all predicates in S p must be goals for at least one predicate rule of S.

Suppose that there exists

D ∈ D SL (Γ ∃z 1 . * R 1 (y, z 1 ), . . . , ∃z m . * R m (y, z m ), ∆ \ r(y))
not containing any leaf Γ ∅. Then we can choose D and create a derivation for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Therefore, it must be the case that every derivation in D SL (Γ ∃z 1 . * R 1 (y, z 1 ), . . . , ∃z m . * R m (y, z m ), ∆ \ r(y)) contains a leaf Γ ∅.

By the induction hypothesis, there exists (

ν, h, U ) ∈ µS U ( * Γ)\µS U ( m i=1 ∃z i . * R i (y, z i )∨ (∆ \ {r(y)})). Then it is also the case that (ν, h, U ) ∈ µS U ( * Γ) \ µS U ( ∆), because µS U ( ∆) = µS U ( m i=1 ∃z i . * R i (y, z i ) ∨ (∆ \ {r(y)})
) by a similar argument as in the (RU SL ) case of the proof for Theorem 2.5.10.

(RD SL ) Let Γ = {φ(y, y 1 , . . . , y n ), r 1 (y 1 ), . . . , r m (y m )} and ∆ = {∃z 1 .ψ 1 (y, z 1 ) * Q 1 (z 1 ), . . . , ∃z k .ψ k (y, z k ) * Q k (y k )}, where Q 1 , . . . , Q k are separating conjunctions of predicate atoms. Also, let S j = VIS(φ, ψ j ), for all j ∈ [k]. Each S j is finite because S has the fvi property.

If m = 0, the proof is similar to the one in the (RD) case of Lemma 2.5.7.

If m > 0, then r 1 (y 1 ), . . . , r m (y m ) {Q j θ | θ ∈ S j } i j=1 is the antecedent for the application of IR = RD SL on Γ ∆, where, by the side condition, φ |= U i j=1 ∃y j .ψ j and φ |= U k j=i+1 ∃y j .ψ j (with a possible reordering of ∆). If k = 0, because S is non-filtering, y 1 , . . . , y m are distinct and there are no predicates in S p with empty least solutions, it follows that µS U ( * Γ) is not empty. Therefore there exists a counterexample (ν, h, t) ∈ µS U ( * Γ)\µS U ( ∆) = µS U ( * Γ). Similarly, if i = 0, we have that µS U (r 1 (y 1 ) * . . . * r m (y m ))

is not empty and it contains counterexamples for the antecedent. Given (ν, h, {t 1 , . . . , t m }) ∈ µS U (r 1 (y 1 ) * . . . * r m (y m )), because the system is non-filtering, there exist a pair ( , h 0 ) ∈ L ||y|| × Heaps such that h 0 is disjoint from h and ν[y ← ], h 0 |= SL φ. By the side condition of RD and the fact that S is non-overlapping, we have that ν

[y ← ], h |= SL ∃z j .ψ j (z j ), ∀j ∈ [k]. We obtain (ν[y ← ], h 0 h, τ m (h 0 , t 1 , . . . , t m )) ∈ µS U (∃z j .ψ j (y, z j ) * Q j (z j )), ∀j ∈ [k], thus (ν[y ← ], h 0 h, τ m (h 0 , t 1 , . . . , t m )) ∈ µS U ( * Γ) \ µS U ( ∆).
If both k > 0 and i > 0, suppose that there exists D ∈ D SL (r 1 (y 1 ), . . . , r m (y m ) {Q j θ | θ ∈ S j } i j=1 ) not containing any leaf Γ ∅. Then we can choose D and create a derivation for Γ ∆ with the same property, which contradicts the hypothesis of the lemma. Thus, it must be the case that every derivation in

D SL (p 1 (x 1 ), . . . , p n (x n ) {Q j θ | θ ∈ S j } i j=1 contains a leaf Γ ∅.
By the induction hypothesis, there exists (ν, h,

{t 1 , . . . , t m }) ∈ µS U (r 1 (y 1 ) * . . . * r m (y m ))\ µS U i j=1 {Q j θ | θ ∈ S j } ,
and also, for every j ∈ [i] and θ ∈ S j , (ν, h, {t 1 , . . . , t m }) ∈ µS U (r 1 (y 1 ) * . . . * r m (y m )) \ µS U (Q j θ). Then h = m j=1 h j , where (ν(y j ), h j , t j ) ∈ µS U (r j ), for all j ∈ [m]. Because S is non-filtering, there exists a pair ( , h 0 ) ∈ L ||y|| × Heaps such that h 0 is disjoint from h and ν[y ← ], h 0 |= SL φ. Because p(x) q 1 (x), . . . , q n (x) SL Γ ∆, by Lemma 2.5.6 the set Γ = {φ(y, y 1 , . . . , y m ), r 1 (y 1 ), . . . , r m (y m )} is tree-shaped, and because the number of predicate atoms equals the number of tuples of subgoal variables, it must be a singly-tree shaped set. Then (ν

[y ← ], h 0 h, τ n (h 0 , t 1 , . . . , t n )) ∈ µS U ( * Γ). Suppose that (ν[x ← ], h 0 h, τ n (h 0 , t 1 , . . . , t m )) is a model of ∃z j .ψ j (x, z j ) * Q j (z j ) for some j ∈ [k]. Then ν[x ← ], h 0 |= SL ∃z j .ψ j (x, z j )
and, because S is non-overlapping, we have that φ |= SL ∃z j .ψ j . It follows that j ∈ [i + 1, k], otherwise it would contradict the side condition φ |= SL ∃z i+1 .ψ i+1 ∨. . .∨∃z k .ψ k . Therefore, j ∈ [i] and, because S has the fvi property, ν[x ← ], h 0 |= SL ψ j θ, for all θ ∈ VIS(φ, ψ j ). Moreover, there is no other Skolem function that witnesses this entailment, besides the ones in S j . Then also (ν[x ← ], h, {t 1 , . . . , t n }) ∈ µS U (Q j θ), for all θ ∈ S j and only for these substitutions. Because the range of each θ ∈ S j is y 1 ∪ . . . ∪ y m , it must be the case that (ν, h, {t 1 , . . . , t m }) ∈ µS U (Q j θ) for all θ ∈ S j , which contradicts our assumption that this is a counterexample of the antecedent. It follows that

(ν[x ← ], h 0 h, τ n (h 0 , t 1 , . . . , t m )) cannot be a model of ∃z j .ψ j (x, z j ) ∧ Q j (z j ) for any j ∈ [k] and (ν[x ← ], h 0 h, τ n (h 0 , t 1 , . . . , t n )) ∈ µS U ( * Γ) \ µS U ( ∆), as required.
(∧R) Similar to the (∧R) case in the proof of Lemma 2.5.7.

(SP SL ) Similar to the (SP) case in the proof of Lemma 2.5.7, using a variation of Lemma 2.5.9 in which It has been proved by Calcagno et al. [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] that the satisfiability problem is PSPACEcomplete for the SL(T ) fragment in which Data = Loc × Loc. We try to generalize this result and consider any first-order theory T whose quantifier-free fragment has a satisfiability problem in PSPACE. In general, this is the case for most theories supported by SMT solvers, which are typically in NP (e.g. linear arithmetic of integers or reals, possibly with sets and uninterpreted functions).

U k = L k × Heaps × Cover and n i=1 µS U (p i ) def = {( 1 • . . . • n , h 1 . . . h n , {t 1 , . . . , t n }) | ( i , h i , t i ) ∈ µS U (p i ), i ∈ [n]},

The Quantifier-Free Fragment of SL(T )

We show that the satisfiability problem for the quantifier-free fragment of SL(T ) is PSPACEcomplete if the satisfiability problem of the base theory T is in PSPACE. A semanticspreserving translation is used to transform SL(T )-formulae into second-order T -formulae with quantifiers that range over a domain of sets and uninterpreted functions, where the cardinality of these sets is polynomially bound by the size of the input formula. We then introduce a method for lazy, counterexample-driven quantifier instantiation, tailored specifically for this fragment of T -formulae translated from SL(T ), and show that it is sound, complete and terminating.

Reducing SL(T ) to Multisorted Second-Order Logic

Due to the behaviour of the * and -- * connectives, separation logic cannot be formalized as a classical (unsorted) first-order theory. The separating conjunction does not comply with the standard rules of contraction and weakening, meaning that φ ⇒ φ * φ and φ * ψ ⇒ φ do not hold because * requires its operands to hold on disjoint heaps. Similarly, φ -- * ψ holds on a heap that, when extended by a disjoint heap satisfying φ, must satisfy ψ. We capitalize on the expressiveness of multi-sorted first-order theories by translating SL(T )formulae into quantified T -formulae, under the assumption that T subsumes a theory of sets and uninterpreted functions.

To integrate separation logic within the DPLL(T ) framework [START_REF] Ganzinger | DPLL(T): Fast decision procedures[END_REF], it is necessary to present the input logic as a multi-sorted one. We assume, without loss of generality, the existence of a fixed theory T = (Σ, M) that subsumes a theory for sets of sort Set(σ) [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF], for any sort σ ∈ Σ s of set elements. The functions for the set theory are the union ∪ Set(σ) Set(σ) Set(σ) , intersection ∩ Set(σ) Set(σ) Set(σ) , singleton set {.} σ Set(σ) and empty set ∅ Set(σ) . The interpretation of these functions is the classical one. We introduce the shorthands s ⊆ s for s ∪ s ≈ s and t ∈ s for {t} ⊆ s, given any terms s and s of sort Set(σ) and t of sort σ. Moreover, Loc, Data ∈ Σ s , nil ∈ Σ f and we assume that Σ f contains infinitely many function symbols pt Loc Data . Additionally, we consider an if-then-else operator ite(b, t, u), of sort Bool × σ × σ → σ, for each sort σ ∈ Σ s , that evaluates to t if b is true, and to u, otherwise.

The aim is to express separation logic connectives in multi-sorted second-order logic through a labelling transformation which introduces (i) constraints over variables of sort Set(Loc) and (ii) terms over uninterpreted points-to functions of sort Loc → Data. Given a SL(T )-formula φ, we denote its translation as φ [ , pt], where = 1 , . . . , n is a tuple of variables of sort Set(Loc) and pt = pt 1 , . . . , pt n is a tuple of universally quantified uninterpreted function symbols. To ease the notation, we write and pt for the singleton tuples and pt , for

(φ * ψ) [ , pt] ¬∀ 1 ∀ 2 . ¬( 1 ∩ 2 ≈ ∅ ∧ 1 ∪ 2 ≈ ∧ φ [ 1 ∩ , pt] ∧ ψ [ 2 ∩ , pt]) (φ -- * ψ) [ , pt] ∀ ∀pt . ( ∩ ( ) ≈ ∅ ∧ φ [ , pt ]) ⇒ ψ [ • , pt • pt] t → u [ , pt] ≈ {t} ∧ ite(t ∈ , pt(t) ≈ u) ∧ ¬(t ≈ nil) (φ ∧ ψ) [ , pt] φ [ , pt] ∧ ψ [ , pt] (¬φ) [ , pt] ¬(φ [ , pt]) emp [ , pt] ≈ ∅ φ [ , pt] φ φ is a T -formula
1 ∪ . . . ∪ n , ∩ for ∩ 1 , . . . , ∩ n , • for , 1 , . . . , n , and ite(t ∈ , pt(t) ≈ u) for ite(t ∈ 1 , pt 1 (t) ≈ u, ite(t ∈ 2 , pt 2 (t) ≈ u, . . . ite(t ∈ n , pt n (t) ≈ u, ) . . .)).
Intuitively, a labelled formula φ [ , pt] indicates that it is possible to build, from any of its models (I, ν), a heap h such that I, ν, h |= SL φ, where dom(h

) = ν( 1 ) ∪ . . . ∪ ν( n ) and h = pt I 1 ↓ ν( 1) ∪ . . . ∪ pt I n ↓ ν( n ) . For any i ∈ [n],
i defines a slice of the domain of the heap, while the restriction of pt i to the valuation of i describes the heap relation on that slice. Note how each interpretation I of pt and valuation ν ∈ V I of such that ν( i ) ∩ ν( j ) = ∅, for all i, j ∈ [k] with i = j, define a unique heap.

The rewriting rules in Figure 3.1 translate an input SL(T ) formula φ into a labelled second-order formula, with quantifiers over sets and uninterpreted functions. A labelling step φ[ψ] =⇒ φ[ψ /ψ] can be applied to φ if ψ and ψ match the antecedent and consequent of a rewriting rule, respectively. We write φ =⇒ * φ to indicate that φ was obtained from φ after one or more labelling steps. Our rewriting system is confluent, and we use φ⇓ for the normal form of φ with respect to the application of labelling steps.

Example 3.2.1. Consider the SL(T ) formula emp ∧ (x → a -- * y → b). The reduction to second-order logic is given below:

(emp ∧ (x → a -- * y → b)) [ , pt] ∧ =⇒ emp [ , pt] ∧ (x → a -- * y → b) [ , pt] emp =⇒ ≈ ∅ ∧ (x → a -- * y → b) [ , pt] -- * =⇒ ≈ ∅ ∧ (∀ ∀pt . ∩ ≈ ∅ ∧ x → a [ , pt ] ⇒ y → b [ , , pt , pt ]) → =⇒ ≈ ∅ ∧ (∀ ∀pt . ∩ ≈ ∅ ∧ ≈ {x} ∧ ite(x ∈ , pt (x) ≈ a, ) ∧ ¬(x ≈ nil) ⇒ ∪ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ b, ite(y ∈ , pt(y) ≈ b, )) ∧ ¬(y ≈ nil))
The following lemma reduces the SL(T )-satisfiability problem to the satisfiability of a second-order fragment of the multi-sorted theory T , with quantifiers over sets and uninter-preted functions. Given the tuple of heaps h = h 1 , . . . , h n , we write dom(h) to denote the tuple dom(h 1 ), . . . , dom(h n ) . Lemma 3.2.1. Given an SL(T )-formula φ and the tuples = 1 , . . . , n , pt = pt 1 , . . . , pt n with n > 0, then, for any interpretation I, valuation ν ∈ V I and heap h ∈ Heaps I , we have that I, ν, h |= SL φ if and only if the entailment

I[pt ← h ], ν[ ← dom(h)] |= T φ [ , pt] ⇓ holds:
(1) for all heaps h = h 1 , . . . , h n such that h = h 1 . . . h n , and (2) for all heaps h = h 1 , . . . , h n such that h 1 ⊆ h 1 , . . . , h n ⊆ h n .

Proof. We prove this lemma by induction on the structure of φ.

-If φ is a T -formula, then the lemma holds trivially, as φ [ , pt]⇓≡ φ and the symbols from and pt do not occur in φ.

-If φ ≡ emp, then I, h, ν |= SL emp if and only if dom(h) = ∅.

"⇒" For any tuples h satisfying condition (1) we have dom

(h i ) = ∅ for all i ∈ [n], thus I[pt ← h ], ν[ ← dom(h)] |= T = ∅ for all h satisfying condition (2).
"⇐" Let h and h be tuples of heaps satisfying conditions ( 1) and ( 2), such that

I[pt ← h ], ν[ ← dom(h)] |= T emp [ , pt]⇓, then dom(h) = ∅ and I, h, ν |= SL emp. -If φ ≡ t → u, then I, h, ν |= SL t → u if and only if h = {(t I ν , u I ν )
} and t I ν = nil I . "⇒" Let h and h be tuples of heaps satisfying the conditions (1) and [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF]. Then there exists i ∈

[n] such that dom(h i ) = {t I ν }, h i (t I ν ) = u I ν and dom(h j ) = ∅ for all j ∈ [n] \ {i}. In consequence, we obtain that I[pt ← h ], ν[ ← dom(h)] |= T = {t} ∧ ite(t ∈ , pt(t) ≈ u) ∧ ¬(t ≈ nil). "⇐" If I[pt ← h ], ν[ ← dom(h)] |= T t → u [ ,
pt]⇓ for each h and h satisfying conditions (1) and (2), we easily obtain that {t I ν } = dom(h i ) ⊆ dom(h i ) and h i (t I ν ) = u I ν for some i ∈ [n], leading to h = {(t I ν , u I ν )}. Moreover, ¬(t I ν ≈ nil) holds, thus we obtain I, h, ν |= SL t → u.

-If φ ≡ ψ 1 * ψ 2 , then I, h, ν |= SL ψ 1 * ψ 2 if and only if there exist heaps g 1 , g 2 with h = g 1 g 2 such that I, g 1 , ν |= SL ψ 1 and I, g 2 , ν |= SL ψ 2 .

"⇒" Let h and h be tuples of heaps satisfying conditions (1) and [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF]. By the induction hypothesis we obtain

I[pt ← h ], ν[ 1 ← dom(g 1 )][ ← dom(h)] |= T ψ 1 [ 1 ∩ , pt]⇓ I[pt ← h ], ν[ 2 ← dom(g 2 )][ ← dom(h)] |= T ψ 2 [ 2 ∩ , pt]⇓ because g j ∩ h i ⊆ h i for each j ∈ [2] and i ∈ [n]. Moreover, dom(g 1 ) ∩ dom(g 2 ) = ∅ and dom(g 1 ) ∪ dom(g 2 ) = n i=1 dom(h i ), thus we obtain I[pt ← h ], ν[ ← dom(h)] |= T ψ 1 * ψ 2 [ , pt]⇓. "⇐" If I[pt ← h ], ν[ ← dom(h)] |= T ψ 1 * ψ 2 [ , pt]⇓, there exist sets L 1 , L 2 ⊆ Loc such that L 1 ∩ L 2 = ∅ and dom(h) = L 1 ∪ L 2 .
Let g 1 = h↓ L1 and g 2 = h↓ L2 . We have that h = g 1 g 2 and

I[pt ← h ], ν[ 1 ← dom(g 1 )][ ← dom(h)] |= T ψ 1 [ 1 ∩ , pt]⇓ I[pt ← h ], ν[ 2 ← dom(g 2 )][ ← dom(h)] |= T ψ 2 [ 2 ∩ , pt]⇓
Moreover, g j = n i=1 g j ∩ h i and g j ∩ h i ⊆ h i , for j ∈ [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF] and i ∈ [n], thus we can apply the induction hypothesis to obtain I, g 1 , ν |= SL ψ 1 and I, g 2 , ν |= SL ψ 2 , which together give us I, h, ν |= SL ψ 1 * ψ 2 .

We omit the cases φ ≡ ψ 1 ∧ψ 2 and φ ≡ ¬ψ, since they are straightforward and can be proved by simple applications of the inductive hypothesis.

Although satisfiability is undecidable in the presence of quantifiers and uninterpreted functions, the following section strengthens the reduction by adapting the rewriting rules for * and -- * (Figure 3.1) to use bounded quantification over finite set domains.

Reducing SL(T ) to Quantifiers over Bounded Sets

Through the translation introduced in the previous section, we have reduced any instance of the SL(T )-satisfiability problem to an instance of the T -satisfiability problem in the secondorder multi-sorted extension of the theory T , which subsumes a theory for sets and uninterpreted function symbols. A key aspect of this translation is that the quantifiers occurring in second order T -formulae range over variables of sort Set(Loc) and function symbols of sort Loc → Data. Building upon a small model property for SL over the data domain Data = Loc × Loc [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF], we can show that it is sufficient to consider quantified variables that range over a bounded domain of sets. This enables the replacement of universal quantifiers with finite conjunctions and leads to a decidability result that only relies on the decidability of the quantifier-free theory T , with sets and uninterpreted functions. We then develop an efficient procedure for lazy quantifier instantiation, based on counterexample-driven refinement, in Section 3.2.3.

With this purpose in mind, we quote Proposition 96 from [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF], emphasizing the fact that its proof does not rely on the assumption that Data = Loc × Loc. Given an SL(T )-formula φ, we introduce the following measure:

|φ * ψ| h = |φ| h + |ψ| h |φ -- * ψ| h = |ψ| h |φ ∧ ψ| h = max(|φ| h , |ψ| h ) |¬φ| h = |φ| h |t → u| h = 1 |emp| h = 1 |φ| h = 0 if φ is pure
Intuitively, |φ| h is the the maximum number of invisible locations in the domain of a heap h that are distinguished by φ but are not in the range of any valuation ν ∈ V I such that I, ν, h |= SL φ. For instance, if I, ν, h |= SL ¬emp * ¬emp and dom(h) ≥ 2, then it is possible to restrict dom(h) to |¬emp * ¬emp| h = 2 locations only, to satisfy this formula.

Let Pt(φ) denote the set of terms (of sort Loc ∪ Data) that occur on the left-or righthand side of a → operator in φ. We define Pt(t → u) = {t, u}, Pt(φ * ψ) = Pt(φ -- * ψ) = Pt(φ) ∪ Pt(ψ), Pt(¬φ) = Pt(φ), and Pt(emp) = Pt(φ) = ∅ for a pure formula φ. The small model property is given by the following lemma. The decidability of separation logic when Data = Loc × Loc is justified by the fact that that, when an interpretation I of the free variables is fixed, it is enough to look within a finite set of heaps h , satisfying the above conditions, in order to find a heap model h for a separation logic formula. This gives a PSPACE upper bound for the satisfiability problem in this fragment.

Since the proof of Lemma 3.2.2 [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF] does not involve reasoning about data values, other than equality checking, we can refine our reduction from the previous section by bounding the quantifiers to finite sets of constants of known size. We assume the existence of a total order on the (countable) set of constants in Σ f of sort Loc, disjoint from any terms that occur in a given formula φ, and define Bnd(φ, C) = {c m+1 , . . . , c m+|φ| h }, where m = max{i | c i ∈ C}, and m = 0 if C = ∅. Clearly, we have Pt(φ) ∩ Bnd(φ, C) = ∅ and also C ∩ Bnd(φ, C) = ∅, for any C and any φ. The result of the labelling process is a formula in which all quantifiers are of the form

φ * ψ [ , pt, C] ¬∀ 1 ∀ 2 . 1 ∪ 2 ⊆ C ∪ Pt(φ * ψ) ⇒ ¬( 1 ∩ 2 ≈ ∅ ∧ 1 ∪ 2 ≈ ∧ φ [ 1 ∩ , pt, C] ∧ ψ [ 2 ∩ , pt, C]) φ -- * ψ [ , pt, C] ∀ ∀pt . ⊆ C ∪ Pt(φ -- * ψ) ∧ pt ⊆ (C ∪ Pt(φ -- * ψ)) × (Pt(φ -- * ψ) ∪ {d}) ⇒ (( ∩ ( ) ≈ ∅ ∧ φ [ , pt , C ]) ⇒ ψ [ • , pt • pt, C]) C = Bnd(φ ∧ ψ, C) d ∈ Pt(φ -- * ψ)
∀ 1 . . . ∀ n ∀pt 1 . . . ∀pt n . n i=1 i ⊆ L i ∧ n i=1 pt i ⊆ L i × D i ⇒ ψ( , pt)
, where L i and D i are finite sets of terms, none of which involve quantified variables, and ψ is a formula in the theory T with sets and uninterpreted functions. Moreover, the labelling rule for φ -- * ψ [ , pt, C] uses a fresh constant d that does not occur in φ or ψ.

Example 3.2.2. We revisit below the labelling of from Example 3.2.1.

(emp ∧ (x → a -- * y → b)) [ , pt, {c 1 }] =⇒ * ≈ ∅ ∧ (x → a -- * y → b) [ , pt, {c 1 }] -- * =⇒ ≈ ∅ ∧ (∀ ∀pt . ⊆ {x, y, a, b, c 2 } ∧ pt ⊆ {x, y, a, b, c 2 } × {x, y, a, b, d} ⇒ (( ∩ ≈ ∅ ∧ x → a [ , pt , {c 2 }]) ⇒ y → b [ , , pt , pt , {c 1 }])) → =⇒ ≈ ∅ ∧ (∀ ∀pt . ⊆ {x, y, a, b, c 2 } ∧ pt ⊆ {x, y, a, b, c 2 } × {x, y, a, b, d} ⇒ ( ∩ ≈ ∅ ∧ ≈ {x} ∧ ite(x ∈ , pt (x) ≈ a, ) ∧ ¬(x ≈ nil) ⇒ ∪ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ b, ite(y ∈ , pt(y) ≈ b, )) ∧ ¬(y ≈ nil)))
We start the labelling using a set C = {c We now establish the soundness of the translation of SL(T ) formulae in a fragment of T that contains only bounded quantifiers, using the rules in Figure 3.2. This relies on the following technical property of the magic wand. Lemma 3.2.4. Given a formula φ in the language SL(T ), for any interpretation I of T and valuation ν under I, let L ⊆ Loc I \ Pt(φ) I ν be a set of locations such that ||L|| = |φ| h and v ∈ Data I \ Pt(φ) I be a data value. Then there exists a heap h such that I, ν, h |= SL φ if and only if there exist heaps h = h 1 , . . . , h n and h = h 1 , . . . , h n such that: (1) for all i, j ∈ [n] with i < j, we have h i #h j , (2) for all i ∈ [n], we have h i ⊆ h i and (3)

I[pt ← h ][C ← L][d ← v], ν[ ← dom(h )] |= T φ [ , pt, C]⇓ .
Proof. By Lemma 3.2.2, there exists h such that I, h, ν |= SL φ if and only if there exists h such that dom(h ) ⊆ L ∪ Pt(φ) I ν and for all ∈ dom(h ), h ( ) ∈ Pt(φ) I ∪ {v}, for a value v ∈ Data I \ Pt(φ) I . It is thus sufficient to prove the statement for these heaps only and assume that h satisfies the conditions of Lemma 3.2.2.

We show the following stronger statement. For any heap h, where dom(h) ⊆ L ∪ Pt(φ) I ν and img(h) ∈ Pt(φ) I ν ∪ {v}, we have I, h, ν |= SL φ if and only if

I[pt ← h ][C ← L][d ← v], ν[ ← dom(h)] |= T φ [ , pt, C]⇓ for all tuples h = h 1 , . . . , h n and h = h 1 , . . . , h n such that h = h 1 . . . h n and h 1 ⊆ h 1 , . . . , h n ⊆ h n .
This can be proven by induction on the structure of φ, similarly to the proof of Lemma 3.2.1. It can be easily verified that the quantified sets variables and uninterpreted functions belong to the domains required by the rules of Figure 3.2 -for magic wand, in particular, this is ensured by Proposition 3.2.3.

A Decision Procedure for Quantifier-Free SL(T ) in SMT

This section presents our decision procedure for the SL(T )-satisfiability of quantifier-free SL(T ) formulae φ, which uses an underlying efficient decision procedure for the T -satisfiability of φ [ , pt, C] ⇓, obtained from the transformation described in Section 3.2.2. The main challenge presented by this problem is treating the universal quantification occurring in φ [ , pt, C]⇓, which may involve arbitrary levels of quantifier alternation. As previously mentioned, the key factor for decidability is that all universally quantified symbols range over bounded sets.

More concretely, all universally quantified subformulae of φ [ , pt, C]⇓ are of the form ∀x . ( x ⊆ s) ⇒ ψ, where x is a tuple of ground terms and s is a tuple of sets (or products of sets) containing ground terms. For brevity, we refer to such formulae using the shorthand ∀x ⊆ s . ψ to denote a quantified formula of this form. While we can clearly reduce any such formulae to a quantifier-free conjunction of instances, constructing these instances is, in practice, very expensive. Following recent approaches for handling universal quantification [START_REF] Ge | Complete instantiation for quantified formulas in satisfiability modulo theories[END_REF][START_REF] Reynolds | Counterexample-guided quantifier instantiation for synthesis in SMT[END_REF][START_REF] Bjørner | Playing with quantified satisfaction[END_REF][START_REF] Reynolds | An instantiation-based approach for solving quantified linear arithmetic[END_REF], we use a counterexample-guided method for choosing the instances of quantified formulae that are relevant to the satisfiability of our input. This method relies on an iterative procedure that maintains an evolving, equisatisfiable set Γ of quantifier-free formulae, which is initially obtained from φ by a purification step.

To this end, we extend some notions related to T -satisfiability (Definition 1.1.11) and T -entailment (Definition 1.1.12) to sets of formulae. Let F , F 1 and F 1 be sets of T -formulae. We write

[[F ]] T for [[ F ]] T and say that F is T -satisfiable whenever [[F ]] T = ∅. Also, F 1 |= T F 2 if and only if [[F 1 ]] T ⊆ [[F 2 ]] T . We call F 1 and F 2 equisatisfiable whenever [[F 1 ]] T = ∅ implies [[F 2 ]] T = ∅.
In the case of our procedure, the sets Γ and {φ} are equisatisfiable, where φ is the input formula. For a closed quantified (i.e. not occurring under any other quantifiers) formula ∀x ⊆ s . φ, the purification step involves associating it to a boolean variable A, called the guard of the formula and a unique tuple of Skolem symbols k of the same length and sorts as x. We write (A, k) ∀x ⊆ s . φ to show that A and k are associated with the formula.

Given a set of T -formulae Γ, we use Q(Γ) for the set of quantified formulae whose guard occurs within a formula in Γ. Replacing all closed quantified subformulae in φ with their corresponding guards is called purifying φ and we refer to the result as φ . Conversely, replacing all guards in Γ by the quantified formulae they are associated with is called unpurifying and we denote the result by Γ .

We use φ * for the the smallest set of formulae obtained by purifying an input formula φ and continuing to apply the purification step to its subformulae such that:

φ ∈ φ * (¬A ⇒ ¬ψ[k/x] ) ∈ φ * if ∀x ⊆ s . ψ ∈ Q( φ * ) where (A, k) ∀x ⊆ s . ψ
In other words, φ * contains clauses that witness the negation of each universally quantified formula occurring in φ. If φ is a T -formula possibly containing quantifiers, then φ * is a set of quantifier-free T -formulae. Moreover, if all quantified formulae in φ are of the form ∀x ⊆ s . ψ mentioned above, then all quantified formulae in Q( φ * ) are also of this form. 3. Let t be a vector of terms, such that t ⊆ s, and t

J γ = k J γ .
Return solve T ( Γ ∪ A ⇒ ψ[t/x] * ). More concretely, Step 1 of the procedure determines the T -satisfiability of Γ using a combination of a satisfiability solver and a decision procedure for T . Non-constant Skolem symbols k introduced by the procedure may be treated as uninterpreted functions. Constraints of the form k ⊆ S 1 × S 2 are translated to c∈S1 k(c) ∈ S 2 , while the domain of k may be restricted to the set {c I | c ∈ S 1 } in models (I, ν) found in steps 1 and 2 of the procedure. By the construction of φ [ , pt, C]⇓, k is only applied to the terms in S 1 , thus these restrictions do not cause a loss of generality. Because Γ is T -entailed by Γ , if it is established that Γ is T -unsatisfiable, then the procedure may terminate with "unsat". Otherwise, there exists a T -model I for Γ.

For each guard A that is mapped to true by ν, Step 2 of the procedure solve T checks whether Γ ∪ {A} T -entails ψ[k/x] for the fresh free constants k. This can be accomplished by determining whether Γ∪{A, ¬ ψ[k/x] } is T -unsatisfiable. A successful check for a quantified formula ∀x . ψ means that Γ |= T {∀x . ψ}. If this check succeeds for all such quantified formulae, then Γ is equivalent to Γ and the procedure may terminate with "sat". Otherwise, let Q + (I,ν) (Γ) be the subset of Q(Γ) for which this check did not succeed and which we call active quantified formulae for Γ and (I, ν). We consider an active quantified formula that is minimal with respect to the relation ≺ Γ,(I,ν) over Q(Γ), where:

ψ ≺ Γ,(I,ν) φ if and only if ψ ∈ Q( φ * ) ∩ Q + (I,ν) (Γ)
Through this ordering, we consider the innermost active quantified formulae first. Let ∀x . ψ be minimal with respect to ≺ Γ,(I,ν) , where (A, k) ∀x . ψ. Since Γ ∪ A does not T -entail ψ[k/x] , there must exist a model (J , γ) for Γ ∪ { ¬ψ[k/x] } where A J = .

Step 3 of the procedure chooses a tuple of terms t = t 1 , . . . , t n based on the model (J , γ) and adds to Γ the set of formulae obtained by purifying A ⇒ ψ[t/x], where A is the guard of ∀x ⊆ s . ψ. Let s = s 1 , . . . , s n , where each s i is a finite union of ground T -terms. Each tuple t is chosen such that t i is a subset of s i , for all i ∈ [n], with t J γ = k J γ . These two criteria are essential to the termination of our algorithm: the former ensures that only a finite number of possible instances can ever be added to Γ, and the latter ensures that the same instance is never added more than once.

We now show the correctness of our procedure, which requires some intermediate lemmas. To show (2), notice that φ * is a set that can be constructed from an initial value {φ}, and updated by adding formulae of the form (¬∀x.ψ ⇒ ¬ψ[k/x]) for fresh constants k. For each step of this construction, the set of models are the same when restricted to the interpretation of all variables apart from k. Thus, by induction, φ and φ * are Tequivalent up to their shared variables. Lemma 3.2.6. For every recursive call to solve T (Γ), if Γ ∪ A |= T ψ[k/x] , where (A, k) ∀x.ψ, then Γ |= T ∀x.ψ.

will consider only a finite number of quantified formulae, and for each only a finite number of instances will be added in this way. Thus, it suffices to show that the algorithm adds to Γ only sets A ⇒ ψ[t/x] * that are not a subset of Γ. Assume this is not the case for some A ⇒ ψ[t/x] * , where ∀x.ψ ∈ Q(Γ n ), ∀x.ψ is ≺ Γ,(I,ν) -minimal, and (A, k) ∀x.ψ. The terms t meet the criteria in the procedure. In particular, for some model (J , γ) of Γ ∪ {¬ ψ[k/x] } where γ(A) = I , we have t Theorem 3.2.9. Given any SL(T )-formula φ, solve SL(T ) (φ):

(1) Answers "unsat" only if φ is SL(T )-unsatisfiable.

(2) Answers "sat" only if φ is SL(T )-satisfiable.

(3) Terminates.

Proof. To show (1), by Lemma 3.2.8 (1), it must be the case that (φ [ , pt, C]) ⇓ is Tunsatisfiable. Thus, there cannot be heaps meeting the requirements of h and h in Lemma 3.2.1, and by that lemma we get that φ is SL(T )-unsatisfiable.

To show [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF], by Lemma 3.2.8 (2), it must be the case that (φ [ , pt, C])⇓ has a T -model (J , γ). Let h be the heap with domain γ( ) such that h (u) = pt J (u) for all u ∈ γ( ), and let h = pt J . Since Loc J has infinite cardinality, and due to the structure of (φ [ , pt, C])⇓, we may assume that C J ⊆ Loc J \ Pt(φ) J γ and call this set

L. Let v = d J . Consider (I, ν) such that (J , γ) = (I[pt ← h ][C ← L][d ← v], ν[ ← dom(h )]
). Since we assumed J , γ |= T (φ [ , pt, C])⇓, then, by Lemma 3.2.4, there exists a heap h such that I, ν, h |= SL φ, and thus φ is SL(T )-satisfiable.

Lastly, (3) is an immediate consequence of Lemma 3.2.8 (3). Theorem 3.2.9 establishes that solve SL(T ) is a decision procedure for the SL(T )-satisfiability of quantifier-free SL(T )-formulae. A tight complexity bound for this problem is given by the following corollary. Corollary 3.2.10. The SL(T )-satisfiability problem is PSPACE-complete for any theory T whose satisfiability problem for the quantifier-free fragment is in PSPACE.

Proof. PSPACE-hardness can be obtained by reduction from QSAT, which generalizes [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF]Definition 7] to our case. Let φ ≡ ∀x 1 ∃y 1 . . . ∀x n ∃y n .ψ be an instance of QSAT, where ψ is a boolean combination of the variables x i and y i of sort Bool. We encode φ in SL(T ) using the translation function Tr(.), defined recursively on the structure of φ as follows:

Tr(x i ) ≡ (t i → d) * Tr(y i ) ≡ (u i → d) * Tr(¬ψ) ≡ ¬Tr(ψ) Tr(ψ 1 • ψ 2 ) ≡ Tr(ψ 1 ) • Tr(ψ 2 ) Tr(∃y i . ψ) ≡ ((u i → d) ∨ emp) * Tr(ψ) Tr(∀x i . ψ) ≡ ¬(((t i → d) ∨ emp) * ¬Tr(ψ))
where d is constant of sort Data and • ∈ {∧, ∨}. It is not hard to check that φ is satisfiable if and only if there exists a T -model (I, ν) and a heap h such that I, ν, h |= SL Tr(φ). To prove that SL(T )-satisfiability is in PSPACE, we analyse the space complexity of the solve SL(T ) algorithm. First, for any SL(T )-formula φ, let Size(φ) be the size of the syntax tree of φ. Clearly || φ * || ≤ Size(φ), and moreover, Size(ψ) ≤ Size(φ) for each ψ ∈ φ * . Then a representation of the set φ * by simply enumerating its elements will take space at most Size(φ) 2 . For a set of formulae Γ, let Size(Γ) = φ∈Γ Size(φ) denote the size of its enumerative representation. Secondly, it is not difficult to see that |φ| h ≤ Size(φ) and ||Pt(φ)|| ≤ Size(φ), for any SL(T )formula φ. Then, for each subformula ∀x ⊆ s . ψ of φ [ , pt, C]⇓, we have ||s|| ≤ Size(φ) 2in fact ||s|| ≤ Size(φ) if x is of sort Set(Loc) and ||s|| ≤ Size(φ) 2 if x is of sort Loc → Data.

Then there are at most Size(φ) 2 recursive calls on line 3 of the solve T procedure, that corresponds to an instance of the subformula ∀x ⊆ s . ψ of φ [ , pt, C] ⇓. Since there are at most Size(φ) such subformulae, there are at most Size(φ) 3 recursive calls to solve T with arguments Γ 0 , . . . , Γ n , respectively. Moreover, we have Γ 0 = {φ [ , pt, C]⇓}, thus Size(Γ 0 ) = O(Size(φ)) and Size(Γ i+1 ) ≤ Size(Γ i ) + Size(φ) 2 for each i ∈ [n -1], because a set of formulae A ⇒ ψ[t/x] * of size at most Size(φ) 2 is added to Γ i . Because T -satisfiability is in PSPACE, by the hypothesis, the checks at lines 1 and 2 can be done within space bounded by a polynomial in Size(φ), thus the space needed by solve SL(T ) (φ) is also bounded by a polynomial in Size(φ). Hence the SL(T )-satisfiability problem is in PSPACE.

In practice, the procedure solve SL(T ) terminates in much less time that the theoretical worst-case complexity given by the above corollary. Our evaluation of the prototype implementation, described in Section 3.2.5, corroborates this fact. Moreover, the following example also illustrates this aspect. We can choose t 1 , t 2 such that t

J 1 = k J 1 = {y} and t J 2 = k J 2 .
It is required that t 2 ⊆ {y, 0, 1, c 2 } × {y, 0, 1, d} and t 2 (y) J = 0 J . Then Step 3 recursively invokes solve T on the set

Γ 1 = Γ 0 ∪ A ⇒ ψ[ t 1 , t 2 / , pt ] * ≡ Γ 0 ∪ {A ⇒ (¬(y ≈ nil) ⇒ ({y} ≈{y} ∧ ite(y ∈ {y}, 0 ≈ 1, pt(y) ≈ 1) ∧ ¬(y ≈ nil)))} ≡ Γ 0 ∪ {A ⇒ (¬(y ≈ nil) ⇒ ⊥)}
The new formula added to Γ 1 contradicts ≈ ∅ ∧ A ∧ ¬(y ≈ nil), thus the next call to solve T will determine that the input set is T -unsatisfiable. Therefore, the input formula φ is also SL(T )-unsatisfiable.

Partial Support for Quantifiers

In many practical cases it is useful to check the validity of entailments between existentially quantified SL(T )-formulae such as ∃x . φ(x) and ∃y . ψ(y). Typically, this problem translates into a satisfiability query for an SL(T )-formula ∃x∀y . φ(x) ∧ ¬ψ(y), with one quantifier alternation. A partial solution to this problem is to first check the satisfiability of φ. If φ is not satisfiable, the entailment holds trivially, so let us assume that φ has a model. We then check the satisfiability of φ ∧ ψ. If unsatisfiable, then the entailment cannot hold, because there exists a model of φ which is not a model of ψ. Else, if φ ∧ ψ has a model, we add an equality x ≈ y for each pair of variables (x, y) ∈ x × y that are mapped to the same term in this model, the result being a conjunction E(x, y) of equalities. Finally, we check the satisfiability of the formula E ∧φ∧¬ψ. If this formula is unsatisfiable, the entailment is valid, otherwise, the test is inconclusive. This method was applied manually for all entailments in our evaluation set, described in Section 3.2.5. A general procedure for quantifier instantiation in the context of the ∃ * ∀ * -quantified fragment of SL(T ) is introduced in Section 3.3.

ls 1 (x, y, a) ← x ≈ y ∧ emp | b ≈ a + 10 ∧ x → (a, z), ls 1 (z, y, b) ls 2 (x, y, a) ← x ≈ y ∧ emp | a ≤ b ∧ x → (a, z), ls 2 (z, y, b) tree 1 (x, a) ← x ≈ nil ∧ emp | b ≈ a -10 ∧ c ≈ a + 10 ∧ x → (a, y, z), tree 1 (y, b), tree 1 (z, c) tree 2 (x, a) ← x ≈ nil ∧ emp | b ≤ a ∧ a ≤ c ∧ x → (a, y, z), tree 2 (y, b), tree 2 (z, c) pos 1 (x, a) ← x → a | x → a, pos 1 (y, b) pos 2 (x, y) ← x → y | x → y, pos 2 (y, z) neg 1 (x, a) ← ¬(x → a) | x → a, neg 1 (y, b) neg 2 (x, a) ← x → a | ¬(x → a), neg 2 (y, b) neg 3 (x, a) ← x → a | x → a, ¬neg 3 (y, b) neg 4 (x, a) ← x → a | ¬(x → a), ¬neg 4 (y, b) neg 5 (x, y) ← ¬(x → y) | x → y, neg 5 (y, z) neg 6 (x, y) ← x → y | ¬(x → y), neg 6 (y, z)

Experimental Evaluation

We tested our implementation of the SL(T )-satisfiability procedure in CVC4 version 1.51 . on two kinds of benchmarks. All experiments were run on a 2.80GHz Intel R Core TM i7-4600U CPU machine with 8MB of cache.

The first part of our experiments focuses on finite unfoldings of the inductive predicates shown in Figure 3.4, mostly inspired by existing benchmarks, such as SL-COMP'14 [START_REF] Sighireanu | Report on SL-COMP 2014[END_REF]. For instance, unfolding ls 1 once results in the formula

x ≈ y ∧ emp ∨ ∃z∃b . (b = a + 10 ∧ x → (a, z)) * (z ≈ y ∧ emp)
while unfolding it twice gives the formula

x ≈ y ∧ emp ∨ ∃z∃b . (b ≈ a + 10 ∧ x → (a, z)) * (z ≈ y ∧ emp ∨ (c = b + 10 ∧ z → (b, w)) * (w ≈ y ∧ emp))
Since our decision procedure targets the quantifier-free fragment of SL(T ), for each entailment we unfold both predicates using the same variables. We checked the validity of the entailment between LHS and RHS, where both predicates are unfolded n = 1, n = 2, n = 3, n = 4 and n = 8 times, by applying the manual instantiation method described in Section 3.2.4. The entailment in which LHS is ls 1 (x, y, a), RHS is ls 2 (x, y, a) and n = 1 is, actually,

∃z∃b . x ≈ y ∧ emp ∨ (b ≈ a + 10 ∧ x → (a, z)) * (z ≈ y ∧ emp) |= SL ∃z ∃b . x ≈ y ∧ emp ∨ (a ≤ b ∧ x → (a, z )) * (z ≈ y ∧ emp)
and the final formula being checked by the decision procedure is

z ≈ z ∧ b ≈ b ∧ (x ≈ y ∧ emp ∨ (b ≈ a + 10 ∧ x → (a, z)) * (z ≈ y ∧ emp)) ∧ ¬(x ≈ y ∧ emp ∨ (a ≤ b ∧ x → (a, z )) * (z ≈ y ∧ emp))
The second part of our experiments uses verification conditions automatically generated by applying the weakest precondition calculus of [START_REF] Samin | BI as an assertion language for mutable data structures[END_REF] several times to the program loops depicted in Figure 3.5. These verification conditions are of the forms φ |= SL wp(l, φ) and φ |= SL wp n (l, φ), where wp(l, φ) denotes the weakest precondition of the SL formula φ with respect to the sequence of statements l, and wp n (l, φ) = wp(l, . . . wp(l, wp(l, φ)) . . .) denotes the iterative application of the weakest precondition calculus n times in a row. For each loop l we also consider the variant zl as well, which, through the assertions on line 2 of each loop, tests that the data values contained within the memory cells are 0. The postconditions are specified using lists of specific lengths, defined by the predicates list n and zlist n with n ≥ 0. The manual instantiation method described in Section 3.2.4 was again used to eliminate the quantified variables in these verification conditions. Then the final formula checked by our decision procedure is

w 1 ≈ v ∧ w 2 ≈ v ∧ w 3 ≈ u ∧ w 4 ≈ u ∧ (w → u * u → v * (v ≈ nil ∧ emp)) ∧ ¬((((w 2 ≈ nil ∧ emp) * w 4 → w 1 ) ∧ (w 4 → w 2 * )) * w → w 3 ) ∧ (w → w 4 * )
For a majority of benchmarks, the runtime of CVC4 is quite low, with the exception of the n = 4 and n = 8 cases of the entailments between tree 1 and tree 2 formulae, which resulted in a timeout after 300 seconds due to the exponential blow-up in the size of the formulae and the number of variables used. For such cases in which CVC4 times out, the performance bottleneck resides in its ground decision procedure for finite sets, indicating efficient support for this theory is important for our approach to separation logic.

LHS RHS n = 1 n = 2 n = 3 n = 4 n = 8
Unfoldings of inductive predicates We explicitly refer to the sorts for memory locations and data by writing SL(T ) Loc,Data , and we denote the Bernays-Schönfinkel-Ramsey fragment by ∃ * ∀ * SL(T ) Loc,Data . For programs using pointer arithmetic, as it is the case of C or C++, it is useful to consider LIA (Liniar Integer Arithmetic) for the theory of memory addresses. Otherwise, if the program only performs equality checks on the values of the pointers, as in Java, we can use E (Equality with Uninterpreted Functions) for this purpose.

ls 1 (x,

Decidability and complexity results

We consider the satisfiability of the ∃ * ∀ * SL(T ) Loc,Data fragment in the following cases:

1. Loc is interpreted as the sort U of E and Data as U k , for some k ≥ 1. In general, the satisfiability problem for ∃ * ∀ * SL(E) The results for cases 2 and 3 rely on an undecidability argument for a fragment of Presburger arithmetic with one monadic predicate symbol, interpreted over finite sets. We denote by (∃ * ∀ * ∩ ∀ * ∃ * )-LIA the set of conjunctions between two linear arithmetic formulae, one ∃ * ∀ * -quantified, and the other ∀ * ∃ * -quantified. Theorem 3.3.1. The satisfiability problem is undecidable for the fragment (∃ * ∀ * ∩ ∀ * ∃ * ) -LIA, with one monadic predicate symbol, interpreted over finite sets of integers.

Proof. We reduce from the following variant of Hilbert's 10th Problem: given a multivariate Diophantine polynomial R(x 1 , . . . , x n ), the problem "does R(x 1 , . . . , x n ) = 0 have a solution in N n ?" is undecidable [START_REF] Matiyasevich | Enumerable sets are diophantine[END_REF].

By introducing sufficiently many free variables, we encode R(x 1 , . . . , x n ) = 0 as an equisatisfiable Diophantine system of degree at most two, containing only equations of the form x = yz (resp. x = y 2 ) and linear equations k i=1 a i x i = b, where a 1 , . . . , a k , b ∈ Z. Next, we replace each equation of the form x = yz, with y and z distinct variables, with the quadratic system 2x + t y + t z = t y+z ∧ t y = y 2 ∧ t z = z 2 ∧ t y+z = (y + z) 2 , where t y , t z and t y+z are fresh (free) variables. In this way, we replace all multiplications between distinct variables by occurrences of the squaring function. Let Ψ R(x1,...,xn)=0 be the conjunction of the above equations. It is manifest that R(x 1 , . . . , x n ) = 0 has a solution in N n iff Ψ R(x1,...,xn)=0 is satisfiable, with all free variables ranging over N. Now we introduce a monadic predicate symbol P , which is intended to denote a (possibly finite) set of consecutive perfect squares, starting with 0. To capture this definition, we require the following:

P (0) ∧ P (1) ∧ ∀x∀y∀z . P (x) ∧ P (y) ∧ P (z) ∧ x < y < z ∧ (∀u . x < u < y ∨ y < u < z ⇒ ¬P (u)) ⇒ z -y = y -x + 2 (sqr)
Observe that this formula is a weakening of the definition of the infinite set of perfect squares given by Halpern [START_REF] Joseph | Presburger arithmetic with unary predicates is Π 1 1 complete[END_REF], from which the conjunct ∀x∃y . y > x ∧ P (y), requiring that P is an infinite set of natural numbers, has been dropped. Moreover, notice that sqr has quantifier prefix ∀ 3 ∃, due to the fact that ∀u occurs implicitly under negation, on the left-hand side of an implication. If P is interpreted as a finite set P I = {p 0 , p 1 , . . . , p N } such that (w.l.o.g.) p 0 < p 1 < . . . < p N , it is easy to show, by induction on N > 0, that p i = i 2 , for all i = 0, 1, . . . , N .

The next step is encoding the squaring function using the monadic predicate P . This is done by replacing each atomic proposition x = y 2 in Ψ R(x1,...,xn)=0 by the formula θ x=y 2 ≡ P (x) ∧ P (x + 2y + 1) ∧ ∀z . x < z < x + 2y + 1 ⇒ ¬P (z). Proof of Fact 1. For the direct implication, if I, ν |= x = y 2 then we have (ν(y) + 1) 2 = ν(x) + 2ν(y) + 1. Let P I be the set {0, 1, . . . , (ν(y) + 1) 2 }. Clearly ν(x), ν(x) + 2ν(y) + 1 ∈ P I and, since they are consecutive perfect squares, every number in between ν(x) and ν(x) + 2ν(y) + 1 does not belong to P I . Thus I, ν |= θ x=y 2 . Considering the reverse implication, if I, ν |= θ x=y 2 and P I is a set of consecutive perfect squares, it follows that ν(x) and ν(x)+2ν(y)+1 are consecutive perfect squares, i.e. ν(x) = n 2 and ν(x)+2ν(y)+1 = (n+1) 2 for some n ∈ N. Consider now the satisfiability problem for the fragment ∃ * ∀ * SL(LIA) Int,Int where both Loc and Data are the Int sort, equipped with addition and total order. In this case, the heap consists of a set of lists with possible aliases and circularities. Without loss of generality, we consider that Int is the set of positive integers -extending the interpretation of Loc to include negative integers does not make any difference for the undecidability result.

The above theorem cannot be directly used for the undecidability of ∃ * ∀ * SL(LIA) Int,Int , by interpreting the (unique) monadic predicate as the (finite) domain of the heap. This is due to the sqr formula, which defines the interpretation of the monadic predicate as a set of consecutive perfect squares 0, 1, . . . , n 2 , and whose quantifier prefix belongs to the ∀ * ∃ * fragment. We overcome this problem by replacing the sqr formula above with a definition of such sets in ∃ * ∀ * SL(LIA) Int,Int . Consider first the following SL properties: [START_REF] Brochenin | On the almighty wand[END_REF]:

x ≥ 1 ≡ ∃u . u → x * x ≤ 1 ≡ ∀u∀t . ¬(u → x * t → x * )
Intuitively, x ≥ 1 states that x has at least one predecessor in the heap and x ≤ 1 states that x has at most one predecessor. We use x = 0 and x = 1 as shorthands for ¬( x ≥ 1) and x ≥ 1∧ x ≤ 1, respectively. The formula below states that the heap can be decomposed into a list segment, starting with x and ending in y, and several disjoint cyclic lists:

x -→ + y ≡ x = 0 ∧ alloc(x) ∧ y = 1 ∧ ¬alloc(y) ∧ ∀z . ¬(z ≈ y) ⇒ ( z = 1 ⇒ alloc(z)) ∧ ∀z . z ≤ 1
We forbid the existence of circular lists by adding the following arithmetic constraint:

∀u∀t . u → t * ⇒ u < t (nocyc)
We also ask that the elements of the list segment starting in x are consecutive perfect squares:

consqr(x) ≡ x = 0 ∧ x → 1 * ∧ ∀z∀u∀t . z → u * u → t * ⇒ t -u = u -z + 2 (consqr)
The formula ∃x∃y . Finally, we consider a variation on the previous undecidability result, where locations are the (uninterpreted) sort U of E and the data consists of tuples of sort U × Int. This fragment of SL can be useful when reasoning about lists with integer data. Its undecidability can be proved in a manner similar with Theorem 3.3.2. Theorem 3.3.3. The satisfiability problem for ∃ * ∀ * SL(ELIA) U,U ×Int is undecidable.

Proof. We redefine the following shorthands:

x ≥ 1 ≡ ∃u U ∃d Int . u → (d, x) * x ≤ 1 ≡ ∀u U ∀t U ∀d Int . ¬(u → (d, x) * t → (d, x) * ) nocyc ≡ ∀u U ∀t U ∀v U ∀d Int ∀e Int . u → (d, t) * t → (e, v) * ⇒ d < e consqr(x) ≡ ∃y U ∃z U . x → (0, y) * y → (1, z) * ∧ ∀u U ∀t U ∀v U ∀w U ∀d Int ∀e Int ∀f Int . u → (d, t) * t → (e, v) * v → (f, w) * ⇒ f -e = e -d + 2
The proof is similar to the one of Theorem 3.3.1, using the above shorthands. Return solve rec(∃x ∀y. φ(x, y), Γ ∪ {φ j (k, t)}, L). Our counterexample-guided approach for establishing the satisfiability of ∃x ∀y. φ(x, y) is described in Figure 3.6. We first introduce the tuples k and e, containing fresh constants of the same type as x and y, respectively. The basis of the procedure lies in finding a set of instantiations of ∀y. φ(k, y) that are either collectively unsatisfiable or are satisfiable and entail our input. We then construct a set L which consists of the union between the constants in k and a set L of fresh constants, whose cardinality is equal to |φ(x, y)| h plus the number n of universal variables in our input. As such, L represents a finite set of terms from which the instantiations of y in ∀y. φ(k, y) can be built.

We then invoke the recursive subprocedure solve rec on the initially empty set of formulae Γ and the set of constants L, which will incrementally add instances of ∀y. φ(k, y) to Γ. Step 1 checks whether Γ is SL(E)-unsatisfiable using the procedure from Section 3.2.3. If this is the case, then our input is also SL(E)-unsatisfiable and the procedure returns "unsat". Otherwise, Step 2 considers the miniscoped form ∃x. (∀y. φ 1 (x, y) ∧ . . . ∧ ∀y. φ p (x, y)) of our input, where the quantification over x is distributed over conjunctions. Note that we may omit quantification on conjuncts φ j that do not contain variables from y. Given this miniscoped formula, we construct a set Γ j , for each j ∈ [p], containing Γ, the negation of φ j in which y is replaced by the fresh constants in e, and a conjunction of constraints requiring each e i to be equal to at least one term in L for i = [n]. If Γ j is SL(E)-unsatisfiable for all j ∈ [p], we can conclude that our input is SL(E)-satisfiable.

Otherwise, given an interpretation I, a valuation ν ∈ V I and heap h satisfying Γ j , Step 3 constructs a tuple of terms t = t 1 , . . . , t n that is used to instantiate ∀y. φ j (k, y). For each i ∈ [n], we choose a constant t i from L, whose interpretation under I coincides with the one of e i . The existence of such a t i is guaranteed by the equality constraints from Γ j introduced in Step 2 and by the fact that I satisfies Γ j , together with ν and h. This selection helps ensure that, in each iteration, the instantiations are unique and are chosen from a finite set of possibilities. The formula φ j (k, t) is added to Γ and solve rec is invoked recursively. In practice, for both unsatisfiable and satisfiable inputs, the procedure terminates before considering all t from L n for each ∀y. φ j (x, y). Theorem 3.3.4. Let U be an uninterpreted sort belonging to the signature of E. Given any ∃ * ∀ * SL(E) U,U k formula ψ of the form ∃x ∀y. φ(x, y), solve(ψ):

(1) Answers "unsat" only if ψ is SL(E)-unsatisfiable.

(2) Terminates.

Proof. For point [START_REF] Antonopoulos | Foundations for decision problems in separation logic with general inductive predicates[END_REF], note that Γ contains only formulae φ j (k, t), which are consequences of our input. Therefore, when Γ is SL(E)-unsatisfiable, our input is SL(E)-unsatisfiable as well.

For point [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF], clearly only a finite number of possible formulae can be added to Γ as a result of the procedure, since all terms t belong to the finite set L and p is finite. Furthermore, on every iteration, for any j, I satisfies Γ and ¬φ j (k, e). Since e I i = t I i for each i = 1, . . . , n, we have that φ j (k, t) ∈ Γ, and thus a new formula is added to Γ on every call. Only a finite number of recursive calls are made to solve rec. Since the SL(E)-satisfiability of quantifier-free is decidable, all steps in the procedure are terminating, and thus solve terminates.

We discuss a few important details regarding our implementation of the procedure.

Miniscoping. In practice, the universal quantification in our input ∃x ∀y. φ(x, y) may be transformed into a formula of the form ∃x . ψ 1 ∧ . . . ∧ ψ k , where each ψ i ≡ ∀z. ϕ i (x, z) for a (possibly empty) tuple z of variables that are a subset of those in y, and ϕ i is quantifierfree. Our procedure then instantiates each of these quantified formulae independently in the manner described in Figure 3.6. In each iteration, an instance of some ∀z. ϕ i (x, z) is added to Γ. The procedure terminates with "sat" only when the set Γ ∪ {ϕ

i (k, z)[y/e] ∧ n i=1 t∈L e i ≈ t} is SL(E)-unsatisfiable for all i ∈ [k].
Matching heuristics. When constructing the terms t for instantiation, it is possible that there exists i ∈ [n] such that e I i = u I for multiple u ∈ L. In this case, the procedure will choose one such u for instantiation. To increase the likelihood of the instantiation being relevant to the satisfiability of our input, we use heuristics for selecting the best possible u among those whose interpretation is equal to e i in I. In particular, if e I i = u I 1 = u I 2 , and Γ contains atoms of the form e i → v and u 1 → v 1 for some v, v 1 where v I = v I 1 but no atom of the form u 2 → v 2 for some v 2 where v I = v I 2 , then we strictly prefer u 1 over u 2 when choosing t i for e i .

Finding minimal models. Efficient techniques for finding small models for uninterpreted sorts in CVC4 have been developed in previous work [START_REF] Reynolds | Finite model finding in SMT[END_REF]. We have found these techniques beneficial to the performance of the procedure in Figure 3.6. We use these techniques to find interpretations I in solve rec that map U to a finite set of minimal size. When combined with the matching heuristics discussed above, these techniques lead to finding useful instantiations more quickly, since more constants are constrained to be equal to e i , for i ∈ [n], under the interpretations I.

Symmetry breaking. The procedure in Figure 3.6 introduces a set of fresh constants L, which in turn introduce the possibility of discovering interpretations I that are isomorphic -i.e. identical up to the renaming of constants in L . We introduce additional constraints in Γ, which do not affect its satisfiability, but reduce the number of isomorphic models. We consider an ordering ≺ on the constants from L , and add constraints that ensure that, for all models (I, ν, h) of Γ, if I 1 ∈ dom(h) then I 2 ∈ dom(h) for all 2 such that 1 ≺ 2 . A modified version of the procedure in Figure 3.6 can be used for establishing the satisfiability of ∃ * ∀ * SL(T ) Loc,Data formulae for theories T beyond equality, and where Loc and Data are not restricted to uninterpreted sorts. In such cases, solve rec cannot restrict interpretations I to map each e i to the same value as a member of the finite set L. Therefore, solve rec requires a modification that omits the equality constraint between the elements of e and L in Step 2. This modified procedure is still sound, but is no longer terminating in general. Nevertheless, it can still be used as a heuristic for ∃ * ∀ * SL(T ) Loc,Data -satisfiability.

Experimental Evaluation

The solve procedure from Figure 3.6 was implemented within the CVC4 SMT solver and tested on similar benchmarks as the ones presented in Section 3.2.5: entailments between predicate unfoldings and verification conditions obtained from the weakest precondition calculus. In the former case, we preserved the entailments involving pos 1 , pos 2 , neg 1 , neg 2 , neg 5 and neg 6 , while also introducing some new predicates, whose definitions are shown in Figure 3.7. In the latter case, the benchmarks remained the same. All experiments were run on the same 2.80GHz Intel R Core TM i7 CPU machine with 8MB of cache.

LHS RHS n = 1 n = 2 n = 3 n = 4 n = 8
Unfoldings of inductive predicates ls3(x, y) ls4(x, y) solve < 0.01s 0.02s 0.03s 0.05s 0.21s manual < 0.01s < 0.01s < 0.01s < 0.01s < 0.01s tree3(x) tree4(x) solve < 0.01s 0.04s 1.43s 23.42s > 300s manual < 0.01s < 0.01s < 0.01s < 0.01s 0.09s ts1(x, a) ts2(x, a) solve < 0.01s 0.81s > 300s > 300s > 300s manual < 0.01s 0.03s 103.89s > 300s > 300s pos1(x, a) neg1(x, a) solve 0.34s 0.01s 0.31s 0.76s 21.19s manual 0.04s 0.05s 0.08s 0.12s 0.53s pos1(x, a) neg2(x, a) solve 0.03s 0.12s 0.23s 0.46s 3.60s manual 0.05s 0.08s 0.08s 0.12s 0.54s pos2(x, a) neg5(x, a) solve 0.04s 0.13s 0.28s 0.48s 4.20s manual 0.01s 0.03s 0.05s 0.09s 0.45s pos2(x, a) neg6(x, a) solve -0.08s 0.15s 0.26s 1.33s manual -0.03s 0.06s 0.09s 0.46s

Verification conditions

list n (w) wp(disp, list n-1 (w)) solve 0.01s 0.03s 0.08s 0.19s 1.47s manual < 0.01s 0.01s 0.02s 0.05s 0.26s list n (w)

wp n (disp, list 0 (w)) solve 0.01s 0.06s 0.17s 0.53s 7.08s manual < 0.01s 0.02s 0.08s 0.14s 2.26s zlist n (w) wp(zdisp, zlist n-1 (w)) solve 0.04s 0.05s 0.09s 0.19s 1.25s manual < 0.01s 0.01s 0.02s 0.04s 0.29s zlist n (w)

wp n (zdisp, zlist 0 (w)) solve 0.01s 0.10s 0.32s 0.87s 11.88s manual 0.01s 0.02s 0.07s 0.15s 2.20s list n (u) * list 0 (v) wp(rev, list n-1 (u) * list 1 (v)) solve 0.38s 0.06s 0.11s 0.16s 0.56s manual 0.07s 0.03s 0.07s 0.11s 0.43s list n (u) * list 0 (v)

wp n (rev, list 0 (u) * list n (v)) solve 0.38s 0.07s 0.30s 68.68s > 300s manual 0.08s 0.06s 0.11s 0.23s 1.79s zlist n (u) * zlist 0 (v) wp(zrev, zlist n-1 (u) * zlist 1 (v)) solve 0.22s 0.07s 0.15s 0.21s 0.75s manual 0.04s 0.02s 0.04s 0.06s 0.31s zlist n (u) * zlist 0 (v) wp n (zrev, zlist 0 (u) * zlist n (v)) solve 0.23s 0.09s 0.17s 0.30s 2.06s manual 0.04s 0.02s 0.05s 0.09s 0.48s Table 3.2: Experimental results of our procedure for ∃ * ∀ * -quantified SL(T ) inputs

We compared the performance of this procedure with the results of applying our previous CVC4 decision procedure for the quantifier-free SL(T ) inputs to a variant of the benchmarks obtained by manual quantifier instantiation, as described in Section 3.2.4. For each set of benchmarks, Table 3.2 lists the results of both methods. Note that the entailment between pos 2 and neg 4 when n = 1 is skipped because it is not valid -since the negated formula is satisfiable, we cannot generate the manual instantiation.

Compared to checking the manual instantiation, the fully automated solver was less than 0.5 seconds slower on 72% of the test cases, and less than 1 second slower on 79% of the test cases. The automated solver experienced 3 timeouts in cases where the manual instantiation succeeds -for the entailments between tree 3 and tree 4 with n = 8, ts 1 and ts 2 with n = 3, list n (u) * list 0 (v) and wp n (rev, list 0 (u) * list n (v)) with n = 8. These timeouts are caused by the first call to the quantifier-free SL(T ) decision procedure, which fails to produce a model in less than 300 seconds (time not accounted for in the manually produced instance of the problem).

Chapter 4

An Inductive Entailment Checker for Separation Logic

In this chapter we describe Inductor, an entailment checker tool that implements the proofsearch semi-algorithm 1 from Section 2.2, using the set R SL Ind of inference rules for inductive entailments in separation logic, introduced in Section 2.3.2. Inductor is written in C++ and uses the DPLL(T )-based SMT solver CVC4 [START_REF] Barrett | CVC4[END_REF] as a back-end that it queries in order to establish the satisfiability of SL(T )-formulae, in which the occurrences of inductive predicates are treated as uninterpreted functions. More specifically, these queries are handled by the decision procedures provided in Chapter 3 and integrated into CVC4.

Some key implementation details are provided in Section 4.1. We also analyse several case studies in Sections 4.2-4.5, which portray the behaviour of our tool for a series of interesting inputs. These case studies demonstrate how proofs and counterexamples are obtained, while also illustrating the range of problems Inductor can handle.

Implementation Details

The inputs mainly handled by Inductor are SMT-LIB scripts, abiding by the SMT-LIB Standard: Version 2.6 [START_REF] Barrett | The SMT-LIB Standard: Version 2[END_REF]. Theory and logic files are loaded automatically, based on the logic set in the input script being handled. Additionally, proof strategies are specified as nondeterministic finite word automata, in a language similar to that accepted by libVATA [START_REF] Lengál | libVATA -a C++ library for efficient manipulation with non-deterministic finite (tree) automata[END_REF]. The front-end interprets these input files using custom parsers constructed with Flex1 and Bison2 , which generate abstract syntax trees. In the case of SMT-LIB scripts, an additional well-sortedness check can be performed to ensure their correctness. The abstract syntax trees are then transformed into hierarchies specifically tailored for inductive predicate entailments in separation logic and proof strategies, respectively.

Defining SL Inductive Predicates in SMT-LIB

In order to use SL connectives in the predicate definitions expressed in SMT-LIB, we declare them as function symbols in a new theory, depicted in Listing 4.1. Specifying the :left-assoc and :right-assoc attributes for sep and wand allows them to be used for more than two arguments. The pto and nil function symbols are parametric with respect to the location and data sorts. This new theory may be combined with some already existing ones, such as Ints to obtain the SEPLOGLIA logic in Listing 4.2. Such a logic can then be set in an SMT-LIB script to indicate the theories in which its content is expressed.

(logic SEPLOGLIA :theories (SepLogic Ints) ) Listing 4.2: An SMT-LIB logic declaration for combining SepLogic with Ints Inductive predicates can be defined as recursive functions, using two available commands: define-fun-rec for a single predicate, and define-funs-rec for (possibly) multiple mutually recursive predicates. A simple definition for a singly-linked list with integer memory locations is shown in Listing 4.3. Listing 4.3: The definition of a list segment in SMT-LIB Whenever memory locations need to point to tuples of values, such as in the case of a tree definition, we declare an additional datatype with constructors and selectors for each of its fields. Two commands are at our disposal for this purpose: declare-datatype for a single algebraic datatype, and declare-datatypes for (possibly) multiple mutually recursive datatypes. A simple binary tree is defined in this manner in Listing 4.4. Listing 4.4: The definition of a binary tree in SMT-LIB

Specifying Proof Strategies as Automata

As previously mentioned, Inductor can also accept a regular expression representing a proof strategy as input -if no proof strategy is given, then S from Theorem 2.5.16 will be used as default. By Kleene's Theorem, it is known that, given a regular expression, there exists an equivalent nondeterministic finite word automaton (NFA), possibly with ε-transitions (NFA-ε). Figure 4.1 depicts a straightforward NFA-ε that is equivalent to S.

q 0 start q 1 q 2 q 3 q 4 q 5 We are more interested in such a representation because, after applying a certain inference rule, we want to easily check which inference rules that comply with the strategy could be applied next. However, given an NFA-ε, the ε-transitions are cumbersome and, thus, we prefer an equivalent NFA -which is guaranteed to exist, since the two classes of automata are known to be equivalent.

LU

As such, the proof strategies that Inductor accepts as input are given as NFA, rather than regular expressions. The definition of such an NFA is specified in a language inspired by the simplicity of the one used by libVATA and whose grammar is depicted in Listing 4.5. Listing 4.5: Grammar for files specifying proof strategies as NFA Using this language, Listing 4.6 defines an NFA that is equivalent with the NFA-ε from Figure 4.1, and consequently, is also equivalent with our default proof search strategy.

tree + 2 (x) tree + 1 (x)

x → (l0, r0), tree + 2 (l0), tree + 2 (r0) tree + 1 (x)

x → (l0, r0), tree + 2 (l0), tree + 2 (r0) x → (nil, nil), ∃l1∃r1 . x → (l1, r1) * tree + 1 (l1) * tree(r1), ∃l1∃r1 . x → (l1, r1) * tree(l1) * tree + 1 (r1) tree + 2 (l0), tree + 2 (r0) tree + 1 (l0) * tree(r0), tree(l0) * tree + 1 (r0) tree + 2 (r0) tree(r0) r0 → (l01, r01), tree + 2 (l01), tree + 2 (r01) tree(r0) r0 → (l01, r01), tree + 2 (l01), tree + 2 (r01) r0 → (nil, nil), ∃l11∃r11 . r0 → (l11, r11) * tree(l11) * tree(r11) tree + 2 (l01), tree + 2 (r01) tree(l01) * tree(r01) tree + 2 (l01) tree(l01)

ID

However, the reversed entailments do not hold and the following witnesses are provided:

-x ≈ nil ∧ emp for tree(x) tree + 1 (x) and tree(x) tree + 2 (x); -x → (l 0 , r 0 ) * tree + 1 (l 0 ) * (r 0 ≈ nil ∧ emp) for tree + 2 (x) tree + 1 (x). Note that predicate atoms can occur within counterexamples and indicate that they can be substituted by any model to obtain a more concrete one. In this case, an immediate substitution with the base case of tree + 1 (l 0 ) gives us x → (l 0 , r 0 ) * l 0 → (nil, nil) * (r 0 ≈ nil ∧ emp).

Case Study: Acyclic List Segments

Consider the following definitions for cyclic and acyclic list segments. Note that S l is ranked, non-filtering, non-overlapping and has the fvi property. Listing 4.8: Definitions of possibly cyclic and acyclic list segments in SMT-LIB Naturally, the entailment ls a |= SL S l ls holds, while ls |= SL S l ls a does not. In the latter case, the counterexample provided by Inductor for ls(x, y) ls a (x, y) is x ≈ y ∧ x → z 0 * ls(z 0 , y), The entailment lls a |= SL S ll lls holds, while its reverse lls |= SL S ll lls a does not. In the latter case, the counterexample provided by Inductor is x → (z 0 , u 0 ) * (u 0 ≈ v ∧ u 0 → u 00 * ls(u 00 , v)) * lls(z 0 , w 0 ), from which we can obtain the more concrete one x → (z 0 , u 0 ) * (u 0 ≈ v ∧ u 0 → u 00 * (u 00 ≈ y ∧ emp)) * (z ≈ nil ∧ emp). The proof for the former case is partially shown below. The subproof for ls a (u 0 , v) ls(u 0 , v) is skipped as it is identical to the one from Section 4.3 modulo a variable renaming. lls a (x, v) lls(x, v)

x → (z0, u0), ls a (u0, v), lls a (z0, w0) lls(x, v)

x → (z0, u0), ls a (u0, v), lls a (z0, w0) x ≈ nil ∧ emp, ∃z1∃u1∃w1 . x → (z1, u1) * ls(u1, v) * lls(z1, w1) ls a (u0, v), lls a (z0, w0) ls(u0, v) * lls(z0, w0) ls a (u0, v) ls(u0, v)

. . . -The total number of sequent nodes created (column Sequents);

-The total number of inference rule nodes created (column Rules);

-The maximum number of sequent nodes along a branch (column H Seq );

-The maximum number of LU applications along a branch (column H LU );

-The maximum number of SP applications along a branch (column H SP ); As shown by the Time column, the execution times are fairly low. The size of the derivations are influenced by how elaborate the inductive definitions are. For instance, tree + 1 is defined by three predicate rules, thus when encountered on the left-hand side of an entailment will generate a larger number of nodes due to left-unfolding. On the righthand side, the number of predicate rules in a definition and the number of subgoals in each predicate rule both influence the complexity of SP, which can lead to higher execution times than expected, given the size of the derivation, since all instances of SP need to be generated and then checked. In the tree + 2 |= SL St tree + 1 case, the large number of sequents generated is caused by both the complexity of the inductive definitions and the number of SP applications along a branch. Moreover, the fact that we only allow ancestral pivots for ID creates a large number of redundancies, requiring sequents that only differ by a substitution of variables to be proved multiple times, in different parts of the derivation. This case alone is enough motivation to consider non-ancestral pivot nodes as future work.

Conclusions

We propose cyclic proof systems for entailments between inductively defined predicates in (multisorted) first-order logic and separation logic, based on Fermat's principle of infinite descent, which allows inductive invariants to be produced during proof search, as opposed to classical induction, where they have to be provided. We have established the boundaries within which these proof systems remain sound and complete using semantic constraints. Soundness is ensured by requiring the models generated by unfoldings to decrease in a wellfounded domain. Completeness is determined by three additional conditions on the set of constraints used in the inductive definitions.

These restrictions are decidable, with computational complexities that depend on the logical fragment in which the constraints of the inductive system are written, and they can all be essentially reduced to determining the satisfiability of ∃ * ∀ * -quantified formulae. While there already were well-established results for first-order logic, this was not also the case for separation logic. Hence, we provide two decision procedures for the satisfiability of formulae written in separation logic and belonging either to the quantifier-free or the ∃ * ∀ * -quantified fragments. We also analyse decidability and complexity bounds for these fragments.

Ultimately, we describe an entailment checker tool called Inductor, which implements our proof system for separation logic and utilizes the aforementioned decision procedures. The tool outputs a proof whenever an entailment is found to be valid, or counterexamples when it is not. It is still possible to use Inductor outside of the boundaries that warrant soundness and completeness, and warnings are emitted whenever one or more semantic restrictions are violated. In this case, however, the proof search results may be inconclusive.

Future work

As mentioned in Section 2.5.2, our proof system for entailments involving inductive predicates written in separation logic is only complete when the predicates unfold the heap in a similar manner. In practice, however, it is often useful to prove entailments such as dlls |= SL S dlls r and dlls r |= SL S dlls from Example 2.5.1. Unfolding these predicates generates different coverage trees for the heap, but they still are related by a tree isomorphism resulting from a rotation. This type of behaviour can be captured by a CUT inference rule, as used by other cyclic proof systems [START_REF] Brotherston | A generic cyclic theorem prover[END_REF][START_REF] Brotherston | Sequent calculi for induction and infinite descent[END_REF]. In our case, if Γ * Υ is a predecessor of Γ , Γθ ∆, CUT would allow the replacement of Γθ with Υθ on the left-hand side of the latter sequent. At a semantic level, this replacement should be viewed as extracting the coverage tree corresponding to Γθ from the larger one corresponding to {Γ , Γθ}, thus creating a hole, and then rotating the latter such that the parent of Γθ becomes the new root, while the hole propagates to the node that was the old root. Then, the coverage tree corresponding to Υθ is attached at the newly obtained hole. A proof system containing such a CUT inference rule would be sound, but would cease to be complete. However, coupled with a comprehensive proof strategy, it could still prove its usefulness in practice.

On a different note, from a practical standpoint, we are often interested to separately reason about the shape of a data structure (e.g. a singly-linked list, a doubly-linked list, a tree) and the information stored by each node (e.g. a sorted list, a binary search tree). Capturing both types of information in a single constraint for an inductive predicate rule can often lead to violating the non-overlapping restriction.

Consider the following singly-linked list definitions with integer data constraints:

p 0 (x 0 , d 0 ) ← S x 0 → (x 1 , d 1 ) ∧ 0 ≤ d 1 ≤ 1, p 1 (x 1 , d 1 ) p 1 (x 0 , d 0 ) ← S x 0 → (x 1 , d 1 ) ∧ d 1 = 1 -d 0 , p 1 (x 1 , d 1 ) | x 0 ≈ nil ∧ emp q 0 (x 0 , d 0 ) ← S x 0 → (x 1 , d 1 ) ∧ d 1 ≤ 0, q 1 (x 1 , d 1 )
| x 0 → (x 1 , d 1 ) ∧ d 1 ≥ 1, q 2 (x 1 , d 1 ) q 1 (x 0 , d 0 ) ← S x 0 → (x 1 , d 1 ) ∧ d 1 = d 0 + 1, q 0 (x 1 , d 1 ) | x 0 ≈ nil ∧ emp q 2 (x 0 , d 0 ) ← S x 0 → (x 1 , d 1 ) ∧ d 1 = d 0 -1, q 0 (x 1 , d 1 ) | x 0 ≈ nil ∧ emp From a structural standpoint, both p 0 and q 0 describe the same kind of singly-linked lists and, moreover, the coverage trees obtained by unfolding them can be matched directly. However, the data constraints make S overlapping. For instance, φ ≡ x 0 → (x 1 , d 1 ) ∧ 0 ≤ d 1 ≤ 1 and ψ ≡ x 0 → (x 1 , d 1 ) ∧ d 1 ≤ 0 have common models where d 1 = 0, but neither φ |= SL ψ nor ψ |= SL φ hold. The entailment p 0 |= SL S q 0 holds, but has no proof using R SL Ind . Alternating data automata, however, are better equipped for modelling and reasoning about relations between past and current data variables. Their main advantage is the fact that complementation and intersection are possible in real time, which enables a concise encoding of trace inclusions -an inclusion problem L(A) ⊆ L(B) is reduced to the nonemptiness of the intersection L(A) ∩ L(B), where B is the complement of B. Although the emptiness problem is undecidable in general, efficient model-checking semi-algorithms, based on abstraction refinement methods, have been provided [START_REF] Iosif | The impact of alternation[END_REF]. For future work, we envision a merging of the two approaches by extracting traces from failed branches of derivations built with our inference rules, using them to construct an interpolation problem, and then using the interpolant obtained as a solution to refine the derivation such that sequents containing overlapping constraints are split into several non-overlapping ones, which together correctly capture the original entailment problem.

Example 2 .

 2 Consider the following in-place implementation of the swap(x, y) function from Example 1. swap(x, y) {x = x 0 ∧ y = y 0 } Precondition x := x + y {x = x 0 + y 0 ∧ y = y 0 } y := x -y {x = x 0 + y 0 ∧ y = x 0 + y 0 -y 0 } x := x -y {x = x 0 + y 0 -(x 0 + y 0 -y 0 ) ∧ y = x 0 + y 0 -y 0 } Strongest postcondition

  tree(x) ::= x = nil ∧ emp | ∃y, z . x → (y, z) * tree(y) * tree(z)

  A pair (I, ν) ∈ M such that I, ν |= φ is a T -model of φ. We denote the set of all T -models of φ by [[φ]] T = {(I, ν) ∈ M | I, ν |= φ}. Definition 1.1.11 (T -satisfiability and T -validity). Given a first-order theory T

Definition 1 . 1 .

 11 12 (T -entailment and T -equivalence). Given a first-order theory T = (Σ, M) and two T -formulae φ and ψ, we write φ |= T ψ and say that φ T -entails ψ if and only if [[φ]] T ⊆ [[ψ]] T . We call φ and ψ T -equivalent whenever φ |= T ψ and ψ |= T φ.

  for any v ∈ σ I A triple (I, ν, h) such that (I, ν) ∈ M and I, ν, h |= SL φ is an SL(T )-model for the SL(T )formula φ. We denote the set of all SL(T )-models of φ by [[φ]] SL(T ) = {(I, ν, h) | (I, ν) ∈ M, h ∈ Heaps I and I, ν, h |= SL φ}. Using these notations and the above semantics, we define satisfiability and entailment for SL(T )-formulae. Definition 1.2.5 (SL(T )-satisfiability and SL(T )-validity). Given a first-order theory T = (Σ, M), an SL(T )-formula φ is SL(T )-satisfiable if [[φ]] SL(T ) = ∅, and SL(T )-unsatisfiable otherwise. If φ is SL(T )-satisfiable if and only if ψ is SL(T )-satisfiable, then φ and ψ are equisatisfiable in SL(T ). If [[φ]] SL(T ) = M, then φ is SL(T )-valid and ¬φ is SL(T )-unsatisfiable. Definition 1.2.6 (SL(T )-entailment and SL(T )-equivalence). Given a first-order theory T = (Σ, M) and two SL(T )-formulae φ and ψ, we write φ |= SL T ψ and say that φ SL(T )-entails ψ if and only if [[φ]] SL(T ) ⊆ [[ψ]] SL(T ) . We call φ and ψ SL(T )-equivalent whenever φ |= SL T ψ and ψ |= SL T φ.

Theorem 1 . 3 . 5 (

 135 FOL least solution). An FOL inductive system S has a unique least solution equal to the least fixed point of F I S , i.e. µS I = lfp(F I S ). Moreover, µS I = F I S n (X ∅ ), where n ∈ N is the smallest value for which F I S n+1 (X ∅ ) = F I S n (X ∅ ).

Theorem 1 . 4 . 1 .

 141 The entailment problem is undecidable for inductive systems under the Herbrand interpretation.

Figure 2 .Figure 2 . 1 :

 221 Figure2.1 describes the data structure Node, which represents the nodes in any derivation built using the proof system R. We also consider a constructor Node(sequent, rule, parent,

4 Dequeue a node N from WorkQueue 5 9 N.rule ← IR 10 if IR has a pivot then 11 Let P be the pivot for this instance of IR 12 N.pivot ← P 13 Mark N as closed 14 if 15 N.rule ← IR 16 Let 18 N 19 Append N to N.children 20 Enqueue N in WorkQueue 21 if N.children is empty then 22

 459101112131415161819202122 Let π be the path between Root and N 6 Let R N = {IR | IR ∈ R and IR applicable on N.sequent and π} 7 Let R 0 N = {IR | IR ∈ R N and #(IR) = 0} 8 if Λ(π) • IR valid prefix of S for some IR ∈ R 0 N then N not closed and Λ(π) • IR valid prefix of S for some IR ∈ R N then ir be an application of IR on N.sequent 17 foreach antecedent Γ ∆ of ir do ← Node(Γ ∆ , null , N, null , [])

Figure 2 . 2 :

 22 Figure 2.2: Inference rule schemata for predicate unfolding.

Figure 2 . 3 :

 23 Figure 2.3: Inference rule schemata for reducing constraints and for removal of predicate conjunctions over the same arguments.

Figure 2 . 4 :

 24 Figure 2.4: Inference rule schema for splitting sequents without constraints.

Example 2 . 3 . 3 .

 233 Continuing the derivation from Example 2.3.1, we can immediately apply SP on the antecedent of RD. As shown in [24, Section 3], using properties of the Cartesian product, an inclusion of the form

Figure 2 . 5 :

 25 Figure 2.5: Inference rule schemata for closing a valid branch of the proof.

Figure 2 . 6 :

 26 Figure 2.6: Inference rule schema for right-hand side predicate unfolding in SL.

Figure 2 . 7 :

 27 Figure 2.7: Inference rule schema for reducing constraints in SL.

Figure 2 . 8 :

 28 Figure 2.8: Inference rule schema for splitting sequents without constraints in SL.

Figure 2 . 9 :

 29 Figure 2.9: Axiom inference rule schema for SL.

  We extend any qo (D, ≤ D ) to the following order on the set of finite subsets of D. For all finite sets Y, Z ∈ P fin (D), we have Y ≤ ∀∃ D Z if and only if for all d ∈ Y there exists d ∈ Z such that d ≤ D d . The following result is a consequence of Higman's lemma[START_REF] Higman | Ordering by divisibility in abstract algebras[END_REF]. Lemma 2.4.1. Given a countable set D, if (D, ≤ D ) is a wqo, then (P fin (D), ≤ ∀∃ D ) is also a wqo. Proof. Let D * be the set of finite sequences of elements from D, where u i denotes the i-th element of u ∈ D * and |u| is the length of u. The subword order ≤ sw D on D * is defined as u ≤ sw D v if and only if there exists a strictly increasing mapping f : [|u|] → [|v|] such that u i = v f (i) for all i ∈ [|u|]. The qo ≤ D on D induces the following ordering on the set D * : for all u, v ∈ D * , u ≤ * D v if there exists v ≤ sw D v such that |u| = |v | and u i ≤ D v i , for all i ∈ [|u|]. We have obtained a set of sequences D * over a well-quasi-ordered alphabet D, with the subsequence relation ≤ * D which allows the replacement of elements with smaller ones in the well-quasi-ordering ≤ D of D. Then, according to Higman's lemma [21], (D * , ≤ * D ) is a wqo. Because D is countable, there is an indexing of its elements. Then we can uniquely represent each finite set S ∈ P fin (D) as a finite word and P fin (D) as subset of D * , with the ordering ≤ ∀∃ D on P fin (D) being the equivalent of ≤ * D on D * . Consequently, (P fin (D), ≤ ∀∃ D ) is also a wqo. A multiset over D is a mapping M : D → N. The multiset M is finite if M (d) > 0 for a finite number of elements d ∈ D. Given two sets A, B and a function f :

Theorem 2 .

 2 4.2. (M(D), ≤ † D ) is a wfqo if and only if (D, ≤ D ) is a wfqo.

  and there can be no choice for the set All -thus there exists no corresponding pair (A, E) either.If p(x) ← S R 1 | . . . | R mare all the predicate rules for p in S, then the abstract assignment F S (Y) maps the predicate p to the setF S (Y)(p) = m i=1 Y(R i ). Similarly to F SL Sand µS SL in Section 1.3.3, the operator F S is monotone and continuous, with µS as its least fixed point.

  [[x]] ν for the multiset [[ν(x) | x ∈ x]]. For two valuations ν and γ and two multisets [[x]] ν and [[y]] γ , we define an order ≤ ‡ I and a strict version

  where for all a ∈ [[x]] ν there exists b ∈ [[y]] γ such that a < I,σ b and a, b ∈ σ I for some σ ∈ Σ s . Therefore, [[x]] ν < † I [[y]] γ , where < † I is the Manna-Dershowitz wfqo on multisets (see Theorem 2.4.2). Then an infinite strictly decreasing sequence in < ‡ I would imply the existence of an infinite strictly decreasing sequence in < † I , contradicting [15, Theorem 1]. Definition 2.4.3 (Ranked in FOL). Given an interpretation I and an FOL inductive system S, let φ(x, x 1 , . . . , x n ) be any constraint in S c with goal variables x and subgoal variables n i=1 x i . Then S is ranked if, given any valuation ν such that I, ν |= φ, we have [[

  ∃y m . ψ(x, y 1 , . . . , y m ) ∧ i ∼ = y j ) where x i ∼ = y j is shorthand fory∈set(y j ) x∈set(xi) x ≈ y ∧ x∈set(xi) y∈set(y j ) x ≈ y . This entailment is equivalent to the formula ∀x ∀x 1 . . . ∀x n . ¬φ(x, x 1 , . . . , x n ) ∨ ∃y 1 . . . ∃y m . ψ(x, y 1 , . . . , y m ) ∧ i ∼ = y j )and checking its validity is equivalent to checking the unsatisfiability of the formula ∃x ∃x 1 . . . ∃x n . φ(x, x 1 , . . . , x n ) ∧ ∀y 1 . . . ∀y m . ¬ψ(x, y 1 , . . . , y m ) ∨

39 ,

 39 Theorem 5.2] to obtain the NP upper bound. The Finite Variable Instantiation Property in SL Definition 2.4.6 (Finite variable instantiation in SL). An SL inductive system S has the finite instantiation (fi) and finite variable instantiation (fvi) properties under the same conditions as the ones in Definition 2.4.5, where VIS(φ, ψ) = {θ : m j=1 set(y j ) → set(x) ∪ n i=1 set(x i ) | φ |= SL ψθ} for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) from S, with goal variables set(x) and subgoal variables n i=1 set(x i ) and m j=1 set(y j ), respectively. Example 2.4.7. The system from Example 1.4.2 has the fvi property, because the entailment y ≈ y ∧ x → x |= SL ∃y ∃x . y ≈ y ∧ x → x is witnessed by a single substitution θ with θ(x ) = x and θ(y ) = y .

Definition 2 . 4 . 7 (

 247 Non-overlapping in FOL). Given an interpretation I, an FOL inductive system S is non-overlapping if, for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) in S c , with goal variables x and subgoal variables n i=1 x i and m j=1 y j , respectively, φ ∧ ψ is satisfiable only if φ |= I ∃y 1 . . . ∃y m . ψ.

  for some predicates p 1 , . . . , p n ∈ S p . Definition 3.1.1 (T -satisfiability problem). Given a theory T = (Σ, M) and a T -formula φ, is [[φ]] T = ∅ (i.e. does φ have a T -model)? Definition 3.1.2 (SL(T )-satisfiability problem). Given a theory T = (Σ, M) and an SL(T )formula φ, is [[φ]] SL(T ) = ∅ (i.e. does φ have an SL(T )-model)?

Figure 3 . 1 :

 31 Figure 3.1: Labelling Rules

Lemma 3 . 2 . 2 .

 322 [START_REF] Yang | Local Reasoning for Stateful Programs[END_REF] Proposition 96] Given an SL(T )-formula φ, for any interpretation I and any valuation ν ∈ V I , let L ⊆ Loc I \ Pt(φ) I ν be a set of locations, such that ||L|| = |φ| h and v ∈ Data I \ Pt(φ) I ν . Then for any heap h ∈ Heaps I we have I, ν, h |= SL φ if and only if I, ν, h |= SL φ for any h ∈ Heaps I such that: (1) dom(h ) ⊆ L ∪ Pt(φ) I , and (2) for all ∈ dom(h ), h ( ) ∈ Pt(φ) I ∪ {v}.

Figure 3 . 2 :

 32 Figure 3.2: Bounded Quantifier Labelling Rules for * and -- *

  1 }, since |emp ∧ (x → a -- * y → b)| h = 1. The rules for ∧ and emp have the same behaviour, but they additionally carry over the set C. We apply the bounded quantifier version of the rule for -- * . Note that Pt(x → a -- * y → b) = {x, y, a, b}. Because |x → a ∧ y → b| h = 1, the bounded quantifier labelling of the term x → a -- * y → b introduces C = {c 2 }. The rule for → is applied as usual.

Proposition 3 . 2 . 3 .

 323 [50, Proposition 89] Given two SL(T )-formulae φ and ψ, for any interpretation I of T and any valuation ν under I, let L ⊆ Loc I \ Pt(φ -- * ψ) I ν be a set such that ||L|| = max(|φ| h , |ψ| h ) and v ∈ Data I \ Pt(φ -- * ψ) I ν be a data value. Then for any heap h ∈ Heaps I we have I, h, ν |= SL φ -- * ψ if and only if I, h h , ν |= SL ψ for any h ∈ Heaps I , where h #h and I, h , ν |= SL φ, such that: (1) dom(h ) ⊆ L ∪ Pt(φ -- * ψ) I ν , and (2) h ( ) ∈ Pt(φ -- * ψ) I ν ∪ {v}, for all ∈ dom(h ).

Example 3 . 2 . 3 .

 323 Consider the SL(T ) formula φ ≡ emp ∧ (y → 0 -- * y → 1) ∧ ¬(y ≈ nil). Through a translation process similar to the one in Example 3.2.2, we obtain:(φ [ , pt, {c 1 }])⇓ ≡ ≈ ∅ ∧ (∀ ∀pt . ⊆ {y, 0, 1, c 2 } ∧ pt ⊆ {y, 0, 1, c 2 } × {y, 0, 1, d} ⇒ ( ∩ ≈ ∅ ∧ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ 0, ) ∧ ¬(y ≈ nil) ⇒ ∪ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ 1, ite(y ∈ , pt(y) ≈ 1, )) ∧ ¬(y ≈ nil))) ∧ ¬(y ≈ nil) Let (φ [ , pt, {c 1 }])⇓= ≈ ∅ ∧ (∀ ∀pt . ψ) ∧ ¬(y ≈ nil).Purifying the result of the translation yields the following set, where (A, k 1 , k 2 ) ∀ ∀pt . ψ:(φ [ , pt, {c 1 }])⇓ * = { ≈ ∅ ∧ A ∧ ¬(y ≈ nil), ¬A ⇒ ¬ψ[ k 1 , k 2 / , pt ]}This set is obtained by first adding ≈ ∅∧A∧¬(y ≈ nil)≡ (φ [ , pt, {c 1 }])⇓ . Then, because ∀ ∀pt . ψ ∈ Q( (φ [ , pt, {c 1 }])⇓ * ),we also need to add ¬A ⇒ ¬ψ[ k 1 , k 2 / , pt ] . Since ψ does not contain any other quantified subformulae, we have that ¬ψ[ k 1 , k 2 / , pt ] ≡ ¬ψ[ k 1 , k 2 / , pt ] and the recursive purification stops here. solve SL(T ) (φ): Let C be a set of fresh constants of sort Loc such that ||C|| = |φ| h . Let and pt be fresh symbols of sort Set(Loc) and Loc → Data, respectively. Return solve T ( (φ [ , pt, C])⇓ * ).solve T (Γ):1. If Γ is T -unsatisfiable, return "unsat", else let (I, ν) be a T -model of Γ. 2. If Γ ∪ {A} |= T ψ[k/x] for all ∀x ⊆ s . ψ ∈ Q(Γ), (A, k) ∀x ⊆ s .ψ and A I = , return "sat", else let (J , γ) be a T -model of Γ ∪ {A, ¬ ψ[k/x] } for some ≺ Γ,(I,ν) -minimal ∀x ⊆ s . ψ, where (A, k) ∀x ⊆ s.ψ.

Figure 3 . 3 :

 33 Figure 3.3: Procedure for deciding the satisfiability of the SL(T ) formula φ.

Figure 3 .

 3 Figure 3.3 illustrates our solve SL(T ) procedure for determining the SL(T )-satisfiability of the input formula φ. It operates by first constructing the set C of fresh constant symbols based on the value of |φ| h , computed by traversing the structure of φ, and also choosing the fresh symbols and pt. By applying the rules in Figure 3.2, φ is translated to (φ [ , C])⇓, then purified to obtain (φ [ , pt, C])⇓ * . The subprocedure solve T is invoked on the set resulting from the purification.Broadly speaking, the recursive procedure solve T takes as input a quantifier-free set of T -formulae Γ that is T -unsatisfiable if and only if φ [ , pt, C] ⇓ is. The set Γ can be viewed as an under-approximation of φ [ , pt, C] ⇓, where the models for Γ are a superset of those for φ [ , pt, C] ⇓. On each call, solve T either (i) terminates with "unsat", indicating that φ [ , pt, C]⇓ is T -unsatisfiable, (ii) terminates with "sat", indicating that φ [ , pt, C] ⇓ is T -satisfiable, or (iii) adds the set resulting from the purification of the instance A ⇒ ψ[t/x] * to Γ and repeats.

Lemma 3 . 2 . 5 .

 325 Given any T -formula φ, the following hold: (1) φ is T -satisfiable only if φ * is T -satisfiable, and (2) φ and φ * are T -equivalent up to their shared variables. Proof. (Sketch) To show (1), let (I, ν) be a T -model of φ. Let γ be an extension of ν such that γ(A) = (∀x.ψ) I ν , for each ∀x.ψ ∈ Q( φ * ) where (A, k) ∀x.ψ. Then the pair (I, γ) is a T -model for φ * .

  γ(A) = I and (A ⇒ ψ[t/x] ) ∈ A ⇒ ψ[t/x] * ⊆ Γ, (J , γ) is a model for ψ[t/x] and also ¬ ψ[k/x] . By Lemma 3.2.7, since ∀x.ψ is ≺ Γ,(I,ν) -minimal, (J , γ) satisfies ψ[t/x] and ¬ψ[k/x]. Therefore, we obtain that k J γ = t J γ, which is a contradiction, thus our initial assumption is false.

Example 3 . 2 . 4 .

 324 The translation and purification shown in Example 3.2.2 cover the steps taken by our solve SL(T ) procedure before the call to solve T . We now show what happens when the procedure solve T is invoked, havingΓ 0 = { ≈ ∅ ∧ A ∧ ¬(y ≈ nil), ¬A ⇒ ¬ψ[ k 1 , k 2 / , pt ]} as input.Step 1 determines that Γ 0 is T -satisfiable with a model I such that A I = I . Since Γ 0 ∪ {A} |= T ψ[ k 1 , k 2 / , pt ] does not hold, Step 2 of solve T finds a model J for the set Γ 0 ∪ {A, ¬ψ[ k 1 , k 2 / , pt ]}. Note that ¬ψ ≡ ⊆ {y, 0, 1, c 2 } ∧ pt ⊆ {y, 0, 1, c 2 } × {y, 0, 1, d}) ∧ ∩ ≈ ∅ ∧ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ 0, ) ∧ ¬(y ≈ nil) ∧ ¬( ∪ ≈ {y} ∧ ite(y ∈ , pt (y) ≈ 1, ite(y ∈ , pt(y) ≈ 1, )) ∧ ¬(y ≈ nil))

Figure 3 . 4 :

 34 Figure 3.4: Inductive predicates whose finite unfoldings are used in the experiments

1 :Figure 3 . 5 :

 135 Figure 3.5: Program loops and the list definitions on which they operate As an example, list 2 (w) is the formula ∃u∃v . w → u * u → v * (v ≈ nil ∧ emp) and the weakest precondition calculus wp 2 (disp, emp ∧ w = nil) yields ∃w 1 ∃w 2 ∃w 3 ∃w 4 . ((((w 2 ≈ nil ∧ emp) * w 4 → w 1 ) ∧ (w 4 → w 2 * )) * w → w 3 ) ∧ (w → w 4 * )

Fact 1 .

 1 For each interpretation I and valuation ν ∈ V I mapping x and y into N, I, ν |= x = y 2 if and only if I can be extended to an interpretation of P as a finite set of consecutive perfect squares such that I, ν |= θ x=y 2 .

  Then ν(y) = n, thus I, ν |= x = y 2 . Let Φ R(x1,...,xn)=0 be the conjunction of sqr with the formula obtained by replacing each atomic proposition x = y 2 with θ x=y 2 in Ψ R(x1,...,xn)=0 . Observe that each universally quantified variable in Φ R(x1,...,xn)=0 occurs either in sqr or in some θ x=y 2 , and moreover, each θ x=y 2 belongs to the ∃ * ∀ * fragment of LIA. Φ R(x1,...,xn)=0 belongs thus to the ∃ * ∀ * ∩ ∀ * ∃ * fragment of LIA, with P being the only monadic predicate symbol. Finally, we prove that R(x 1 , . . . , x n ) = 0 has a solution in N n iff Φ R(x1,...,xn)=0 is satisfiable. "⇒" Let I be an interpretation I and ν ∈ V I be a valuation mapping x 1 , . . . , x n into N, such that I, ν |= R(x 1 , . . . , x n ) = 0. Obviously, ν can be extended to a model of Ψ R(x1,...,xn)=0 by assigning ν(t x ) = (ν(x)) 2 for all auxiliary variables t x occurring in Ψ R(x1,...,xn)=0 . We extend (I, ν) to a model of Φ R(x1,...,xn)=0 by assigning P I = {n 2 | 0 ≤ n ≤ √ m}, where m = max{(ν(x) + 1) 2 | x ∈ FV(Ψ R(x1,...,xn)=0 )}. Clearly P I meets the requirements of sqr. By Fact 1, we obtain that I, ν |= θ x=y 2 for each subformula θ x=y 2 of Φ R(x1,...,xn)=0 , thus I, ν |= Φ R(x1,...,xn)=0 . "⇐" If I, ν |= Ψ R(x1,...,xn)=0 then, by sqr, P I is a set of consecutive perfect squares, and, by Fact 1, I, ν |= x = y 2 for each subformula θ x=y 2 of Φ R(x1,...,xn)=0 . Then I, ν |= Ψ R(x1,...,xn)=0 and, consequently, I, ν |= R(x 1 , . . . , x n ) = 0.

Theorem 3 . 3 . 2 .

 332 x -→ + y ∧ nocyc ∧ consqr(x) belongs to the ∃ * ∀ * SL(LIA) Int,Int fragment. The satisfiability problem for ∃ * ∀ * SL(LIA) Int,Int is undecidable. Proof. We use the same reduction as in the proof of Theorem 3.3.1, but replace sqr by ∃x∃y . x -→ + y ∧ nocyc ∧ consqr(x), and define θ x=y 2 as alloc(x) ∧ alloc(x + 2y + 1) ∧ ∀z . x < z < x + 2y + 1 ⇒ ¬alloc(z).

Figure 3 . 6 :

 36 Figure 3.6: A counterexample-guided procedure for ∃ * ∀ * SL(E) U,U k formulae

Example 3 . 3 . 1 .

 331 Consider the entailment ¬(x ≈ y) ∧ x → z |= SL ∃u . x → u, where x, y, z, u are of sort U of E. It is valid if and only if the formula ∃x∃y∃z∀u .¬(x ≈ y) ∧ x → z ∧ ¬x → u is SL(E)-unsatisfiable. Since |¬(x ≈ y) ∧ x → z ∧ ¬x → u| h = 1,a run of the procedure in Figure3.6 on this input constructs k = k x , k y , k z , e = e u and L = {k x , k y , k z , 1 , 2 }. We then invoke solve rec where Γ is initially empty. By miniscoping, our input is equivalent to ∃x∃y∃z . ¬(x ≈ y) ∧ x → z ∧ ∀u . ¬x → u. On the first two recursive calls to solve rec, we may add ¬(k x ≈ k y ) and k x → k z to Γ by trivial instantiation of the first two conjuncts. On the third recursive call, Γ is SL(E)-satisfiable, and we check the satisfiability of:Γ = {¬(k x ≈ k y ), k x → k z , k x → e u ∧ (e u ≈ k x ∨ e u ≈ k y ∨ e u ≈ k z ∨ e u ≈ 1 ∨ e u ≈ 2 )} Since k x → k z andkx → e u are in Γ , for all interpretations I, valuations ν ∈ V I and heaps h such that I, ν, h |= SL Γ we have e I u = k I z . Since k z ∈ L, we may choose to add the instantiation ¬k x → k z to Γ. In consequence, Γ is SL(E)-unsatisfiable on the next recursive call to solve rec. Thus, our input is SL(E)-unsatisfiable and the entailment is valid.

ls 3 Figure 3 . 7 :

 337 Figure 3.7: Inductive predicates whose finite unfoldings are used in the experiments

(

  theory SepLogic :funs ( (emp Bool) (sep Bool Bool Bool :left-assoc) (wand Bool Bool Bool :right-assoc) (par (Loc Data) (pto Loc Data Bool)) (par (Loc) (nil Loc)) ) ) Listing 4.1: An SMT-LIB theory declaration for separation logic

(

  set-logic SEPLOGLIA) (define-fun-rec ls ((x Int) (y Int)) Bool (or (and (= x y) emp) (exists ((z Int)) (sep (pto x z) (ls z y))) ) )

(

  set-logic SEPLOGLIA) (declare-datatypes ((Node 0)) (((node (left Int) (right Int))))) (define-fun-rec tree ((x Int)) Bool (or (and (= x (as nil Int)) emp) (exists ((l Int) (r Int)) (sep (pto x (node l r)) (tree l) (tree r))) ) )

Figure 4 . 1 :

 41 Figure 4.1: An NFA-ε equivalent to our default proof strategy S

  ' string 'States' <state_list> 'Initial State' <state> 'Final States' <state_list> 'Transitions' <trans_list> <state_list> : <state> <state> ... <state> : string <trans_list> : <trans> <trans> ... <trans> : '(' <state> ',' <rule> ')' '->' <state>

  ls(x, y) ← S l x ≈ y ∧ emp | x → z, ls(z, y)ls a (x, y) ← S l x ≈ y ∧ emp | ¬(x ≈ y) ∧ x → z, ls a (z, y)The equivalent SMT-LIB definitions for ls and ls a are provided in Listing 4.8. (set-logic SEPLOGLIA) (define-fun-rec ls ((x Int) (y Int)) Bool (or (and (= x y) emp) (exists ((z Int)) (sep (pto x z) (ls z y))) ) ) (define-fun-rec lsa ((x Int) (y Int)) Bool (or (sep (= x y) emp) (exists ((z Int)) (sep (distinct x y) (pto x z) (lsa z y))) ) )

(

  exists ((z Int)) (sep (distinct x y) (pto x (node z (as nil Int))) (lsa z y))) ) ) (define-fun-rec lls ((x Int) (v Int)) Bool (or (and (= x (as nil Int)) emp) (exists ((z Int) (u Int) (w Int)) (sep (pto x (node z u)) (ls u v) (lls z w))) ) ) (define-fun-rec llsa ((x Int) (v Int)) Bool (or (and (= x (as nil Int)) emp) (exists ((z Int) (u Int) (w Int)) (sep (pto x (node z u)) (lsa u v) (llsa z w))) ) ) Listing 4.10: Definitions for lists of possibly cyclic and acyclic list segments in SMT-LIB

  ls a (u00, v) ls(u00, v) lls a (z0, w0) lls(u0, w0)

  + |= SL ls |= SL ls e , ls o . Some entailments that do not hold are: (i) ls o |= SL ls e , (ii) ls e |= SL ls + , (iii) ls e |= SL ls

		+	, (ii) ls o |= SL ls	+	, (iii) ls + |= SL ls e , ls o
	and (iv) ls
	+	and (iv) ls

+ + |= SL ls o .

  The inductive system S is non-filtering if and only if each rule in S is non-filtering. Example 2.4.2. Consider the inductive system in Example 1.4.1. It is easy to see that it satisfies the non-filtering property. However, if we were to change, for instance, the predicate rule for p into p

  x 1 , . . . , x n ) |= I ∃y 1 . . . ∃y m . ψ(x, y 1 , . . . , y m ) is valid if and only if φ(x, x 1 , . . . , x n ) |= I ψ (x, x 1 , . . . , x n ), where ψ is obtained from ψ by replacing each y ∈ m j=1 set(y j ) with a Skolem function symbol f y (x, x 1 , . . . , x n ) not occurring in φ or ψ 2 .

Table 3 .

 3 The Bernays-Schönfinkel-Ramsey class refers to the ∃ * ∀ * -quantified fragment of first-order logic with equality and uninterpreted predicate symbols, but without any function symbols[START_REF] Harry | Complexity results for classes of quantificational formulas[END_REF]. We use this name to analogously refer to the ∃ * ∀ * -quantified fragment of SL(T ) and consider formulae φ ≡ ∃x 1 . . . ∃x m ∀y 1 . . . ∀y n . ψ(x 1 , . . . , x m , y 1 , . . . , y n ), where ψ is any quantifier-free SL(T )-formula and the quantified variables range over the set of memory locations. Then φ is satisfiable if and only if its functional form ∀y 1 . . . ∀y n . ψ[c 1 /x 1 , . . . , c m /x m ] is satisfiable, where c 1 , . . . , c m are fresh (Skolem) constant symbols.

1: Experimental results of our procedure for quantifier-free SL(T ) inputs 3.3 The Bernays-Schönfinkel-Ramsey Fragment of SL(T )

  U,U k with k ≥ 2 is undecidable[16, Theorem 1]. The root cause of this undecidability result is the occurrence of universally quantified variables within the scope of a separating implication, which, moreover, appears under an even number of negations. We can recover decidability when U is finite or countably infinite by considering more restricted fragments in which we forbid universally quantified variables from appearing under the scope of any positive separating implication or, respectively, forbid any positive occurrence of separating implications whatsoever[START_REF] Echenim | On the expressive completeness of Bernays-Schönfinkel-Ramsey separation logic[END_REF] Theorems 2 and 3]. In this cases, the satisfiability problem for ∃ * ∀ * SL(E) U,U k becomes PSPACE-complete. In consequence, satisfiability for the -- * -free fragment of ∃ * ∀ * SL(E) U,U k when U is either finite or countably infinite is also PSPACE-complete.2. BothLoc and Data are interpreted as Int, equipped with addition and total order. Then the satisfiability problem for ∃

* ∀ * SL(LIA) Int,Int is undecidable; 3. Loc is interpreted as the sort U of E, and Data as U × Int. Then the satisfiability problem for ∃ * ∀ * SL(ELIA) U,U ×Int is undecidable.

  3.3.2 A Semi-decision Procedure for ∃ * ∀ * SL(T ) in SMTWe present a procedure for the satisfiability of ∃ * ∀ * SL(E) U,U k formulae implemented in the SMT solver CVC4 and building upon the one given in Section 3.2.3, designed for quantifierfree SL(T ) Loc,Data inputs, where T is a first-order theory who has a decidable satisfiability problem for quantifier-free T -constraints. Similar to other existing approaches for quantified formulae in SMT[START_REF] Ge | Complete instantiation for quantified formulas in satisfiability modulo theories[END_REF][START_REF] Reynolds | Counterexample-guided quantifier instantiation for synthesis in SMT[END_REF], our procedure uses incremental quantifier instantiation based on candidate models returned by a solver for quantifier-free inputs.solve(∃x ∀y. φ(x, y)) where x = x 1 , . . . , x m and y = y 1 , . . . , y n : Let k = k 1 , . . . , k m and e = e 1 , . . . , e n be tuples of fresh constants with the same sorts as x and y, respectively

Let L = L ∪ set(k) and L be a set of fresh constants with

||L || = |φ(x, y)| h + n.

Return solve rec(∃x ∀y. φ(x, y), ∅, L). solve rec(∃x ∀y. φ(x, y), Γ, L):

1. If Γ is SL(E)-unsat, return "unsat".

2. Assume ∃x ∀y. φ(x, y) is equivalent to ∃x.(∀y. φ 1 (x, y) ∧ . . . ∧ ∀y. φ p (x, y)).

If Γ j = Γ ∪ {¬φ j (k, e) ∧ n i=1 t∈L e i ≈ t} is SL(E)-unsat for all j ∈ [p], return "sat".

3. Otherwise, let I, ν, h |= SL Γ j for some j ∈ [p].

Let t = t 1 , . . . , t n be a tuple such that e I i = t I i and t i ∈ L for each i ∈ [n].

Table 4 .

 4 1 summarizes the experimental results obtained for the entailments discussed in Sections 4.2-4.5. All experiments were run on a 2.10GHz Intel R Core TM i7-4600U CPU machine with 4MB of cache. For each case, we indicate: -The result (column Result), which can be VALID or INVALID;

Table 4 .

 4 4.6. Experimental results121-The run time for the proof search algorithm (column Time); -The total number of calls made to CVC4 (column CVC4).LHS RHSResult Sequents Rules H Seq H LU H SP Time CVC4

	tree + 1	tree	VALID	34	22	7	2	1	0.096s
	tree + 2	tree	VALID	21	15	7	2	1	0.053s
	tree + 2	tree + 1	VALID	1477	889	11	3	2	5.515s	37
	tree	tree + 1	INVALID	7	5	4	1	0	0.033s
	tree	tree + 2	INVALID	7	5	4	1	0	0.028s
	tree + 1	tree + 2	INVALID	38	25	8	2	1	0.096s	14
	ls a	ls	VALID	8	6	5	1	0	0.014s
	ls	ls a	INVALID	7	5	4	1	0	0.015s
	lls a	lls	VALID	21	15	9	2	1	0.048s
	lls	lls a	INVALID	20	14	8	2	1	0.043s
	ls o	ls	+	VALID	10	8	6	1	0	0.032s
	ls +	ls	+	VALID	16	13	8	2	0	0.049s
	ls +	ls e , ls o	VALID	8	6	5	1	0	0.020s
	ls	+	ls e , ls o	VALID	9	7	5	1	0	0.028s
	ls e	ls	+	INVALID	7	5	4	1	0	0.024s
	ls e	ls o	INVALID	7	5	4	1	0	0.030s
	ls +	ls e	INVALID	13	10	6	2	0	0.075s
	ls	+	ls o	INVALID	20	16	9	3	0	0.143s	12

1: Experimental results for Inductor

Enfin, nous fournissons une implémentation de notre système de preuve pour la logique de séparation, qui utilise les procédures de décision ci-dessus. Étant donné un ensemble de definitions de prédicats inductifs et une requête d'implication, un avertissement est émis lorsqu'une ou plusieurs restrictions sémantiques sont violées. Nous obtenons une preuve si l'implication est valide. Sinon, un ou plusieurs contre-exemples sont fournis.

See[START_REF] Brotherston | A decision procedure for satisfiability in separation logic with inductive predicates[END_REF] Lemma 4.6] for an analogous construction for inductive systems with symbolic heap constraints.

We assume w.l.o.g. that these function symbols belong to the signature, i.e. fy ∈ Σ f .

Available at http://cvc4.cs.nyu.edu/web/.

Flex -The Fast Lexical Analyzer, https://github.com/westes/flex

GNU Bison -The Yacc-compatible Parser Generator, https://www.gnu.org/software/bison

Rules LU RU RD RI SP ID AX Automaton Default

States q0 q1 q2 q3 q4 q5 Initial state q0 Final states q5

Listing 4.6: The definition of the NFA corresponding to the default proof search strategy

The Non-overlapping Property in SL Definition 2.4.8 (Non-overlapping in SL). An SL inductive system S is non-overlapping under similar conditions as the ones in Definition 2.4.7, where, for any two constraints φ(x, x 1 , . . . , x n ) and ψ(x, y 1 , . . . , y m ) in S c , with goal variables x and subgoal variables n i=1 x i and m j=1 y j , respectively, φ ∧ ψ is satisfiable only if φ |= SL ∃y 1 . . . ∃y m . ψ.

Example 2.4.9. The SL inductive system in Example 1.4.2 is non-overlapping. Take, for instance, the constraints y ≈ y ∧ x → x and y ≈ y ∧ x → x . It is easy to see that (y ≈ y ∧ x → x ) ∧ (y ≈ y ∧ x → x ) is satisfiable and that the entailment y ≈ y ∧ x → x |= SL ∃x ∃y . y ≈ y ∧ x → x holds.

Lemma 2.4.11. The problem "Given an SL inductive system S, does S have the nonoverlapping property?" is in PSPACE if S has quantifier-free and -- * -free SL constraints, and in Π P 2 if S has symbolic heap constraints.

Proof. Similarly to the FOL case, as shown in the proof of Lemma 2.4.10, given an SL inductive system S, in order to determine if S has the non-overlapping property, we need to perform two checks for any pairs of constraints φ, ψ ∈ S c with goal variables x and subgoal variables n i=1 x i and m j=1 y j , respectively: (i) φ∧ψ is satisfiable and (ii) φ |= SL ∃y 1 . . . ∃y m . ψ is valid (or, conversely, that ∃x ∃x 1 . . . ∃x n ∀y 1 . . . ∀y m . φ ∧ ¬ψ is unsatisfiable).

When φ and ψ are quantifier-free and -- * -free SL formulae, then (ii) is in PSPACE (see Section 3.3.1) and, thus, the non-overlapping problem is in PSPACE. If, however, φ and ψ are symbolic heaps, then the satisfiability problem (i) for symbolic heaps is in NP [START_REF] Calcagno | Computability and complexity results for a spatial assertion language for data structures[END_REF] and the entailment (ii) between existentially quantified symbolic heaps is Π P 2 -complete [START_REF] Antonopoulos | Foundations for decision problems in separation logic with general inductive predicates[END_REF], thus the non-overlapping problem is in Π P 2 .

Soundness and Completeness

In this section we address the soundness and completeness of the inference rule sets R Ind and R SL Ind , and show that they are sound for entailments in a ranked inductive system S. Completeness is guaranteed if, moreover, S is non-filtering, non-overlapping and has the fvi property. Note that both soundness and completeness are independent of any particular interpretation and rely only on the restrictions laid out in Section 2.4.

The Soundness and Completeness of R Ind

Soundness

We develop our argument for the soundness of R Ind by first showing how every inference rule in R Ind \ {ID} is locally sound. To this end, we give the following lemma, which relies on an important result from [START_REF] Holík | Efficient inclusion checking on explicit and semi-symbolic tree automata[END_REF] and is integral to showing that SP is locally sound. Lemma 2.5.1. Consider an FOL inductive system S, the predicates p 1 , . . . , p n ∈ S p and the tuples of predicates

The following theorem establishes the completeness of R SL Ind under the unfolding trees interpretation of entailments, while also providing a proof search strategy S that is similar to its FOL counterpart.

Theorem 2.5.16. Given a ranked, non-filtering, non-overlapping SL inductive system S with the fvi property, let p, q 1 , . . . , q n ∈ S p . Then the entailment p |= U S q 1 , . . . , q n holds only if p(x) q 1 (x), . . . , q n (x) has an S-proof with the inference rule schemata R SL Ind , where S is defined by the regular expression (LU

Proof. Since the proof systems R SL Ind and R Ind are structurally the same, only replacing the classical conjunction with the separating conjunction in RU SL , RD SL , SP SL and AX SL , the completeness proof for SL inductive systems closely mirrors the proof of Theorem 2.5.8.

As in the FOL case, the fact that each S-derivation is irreducible and structured allows the proof search semi-algorithm 1 to terminate on all inputs, thus becoming a decision procedure for entailments p |= U S q 1 , . . . , q n , where p, q 1 , . . . , q n ∈ S p and the SL inductive system S is ranked, non-filtering, non-overlapping and has the fvi property.

Chapter 3

Decision procedures for Separation Logic in SMT

In this chapter, we provide decision procedures for the satisfiability problem of the quantifierfree (Section 3.2) and ∃ * ∀ * -quantified (Section 3.3) fragments of SL(T ) parametrized by a theory of heap locations and data, chosen from the wide array of theories handled by SMT solvers, such as integer or real arithmetic, strings, sets or uninterpreted functions. This is a joint work with Andrew Reynolds (University of Iowa) and Tim King (Google Inc.) [START_REF] Reynolds | A decision procedure for separation logic in SMT[END_REF][START_REF] Reynolds | Reasoning in the Bernays-Schönfinkel-Ramsey fragment of separation logic[END_REF].

Both procedures are designed as components of a DPLL(T ) architecture, widely used by modern SMT solvers, and implemented as subsolvers of CVC4 [START_REF] Barrett | CVC4[END_REF], which, as indicated by our experimental evaluation, is able to handle non-trivial examples quite effectively. Practical uses of our procedures, which guided our choice for the evaluation benchmarks, include:

-Integration with theorem provers for SL with inductively defined predicates. Most inductive provers for SL (including our R SL Ind from Section 2.3.2) use a higher level proof search strategy relying on separate decision procedures for non-inductive entailments to simplify proof obligations [START_REF] Brotherston | A generic cyclic theorem prover[END_REF]. The difficulty posed by these entailments in the general fragment of SL usually leads to only using symbolic heap formulae, for which entailments are proved by syntactic substitutions and matching. It is thus possible to extend the language of inductive SL solvers and allow our specialized procedure to tackle a more expressive range of non-inductive entailments. To justify this use case, a significant portion of our experiments focuses on entailments between finite unfoldings of inductive predicates commonly used in practice.

-Back-end component in a bounded model checker for programs with pointer and data manipulations, using a complete weakest precondition calculus involving the magic wand such as the one described in [START_REF] Samin | BI as an assertion language for mutable data structures[END_REF]. This led us to test our procedures on verification conditions automatically generated by applying the weakest precondition calculus of [START_REF] Samin | BI as an assertion language for mutable data structures[END_REF] to several program fragments that manipulate lists, with or without data fields.

The SL(T )-satisfiability problem

We tackle the SL(T )-satisfiability problem, as defined below, under the assumption that the quantifier-free theory T = (Σ, M) has a decidable satisfiability problem.

Proof. It suffices to show there exists a subset Γ of Γ such that Γ does not contain k and Γ |= T ψ[k/x] . Note that, if such a Γ exists, then, since Γ ⊆ Γ and Γ do not contain k, we have that Γ |= T ∀x.ψ. By construction, Γ may be partitioned into sets Γ and Γ , where Γ does not contain k, and Γ contains only (i) ¬A ⇒ ¬ψ[k/x] , and (ii) constraints of the form ¬A 1 ⇒ ¬ψ 1 [j/y] and

and the lemma holds.

(2) Answers "sat" only if ψ is T -satisfiable.

(3) Terminates.

where n is finite and Γ 0 = ψ * . By the definition of solve T and Lemma 3.2.5 [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF], it can be shown that Γ i and Γ i+1 are equisatisfiable in T , and thus, by induction, Γ j and Γ k are equisatisfiable in T for each j, k ∈ [n].

To show (1), assume without loss of generality, that solve T (Γ n ) answers "unsat". Then Γ n is T -unsatisfiable, and, by Lemma 3.2.5.(1), we have that Γ n is T -unsatisfiable. Thus, Γ 0 is T -unsatisfiable, and thus, by Lemma 3.2.5.(2), ψ is T -unsatisfiable.

To show (2), assume without loss of generality that solve T (Γ n ) answers "sat". Then Γ n is T -satisfiable with model (I, ν). We argue that (I, ν) is a model for Γ n , which implies that Γ 0 is T -satisfiable, and thus by Lemma 3.2.5 [START_REF] Bansal | Decision Procedures for Finite Sets with Cardinality and Local Theory Extensions[END_REF],

∀x.ψ. In the case that ν(A) = ⊥ I and (∀x.ψ) I ν = I , note that (I, ν) is not a model for (¬A ⇒ ¬φ[k/x] ) ∈ Γ n . In the case that ν(A) = I and (∀x.ψ) I ν = ⊥ I , by the definition of solve T , we have Γ n ∪ {A} |= T ψ[k/x] . By Lemma 3.2.6, we have that Γ n |= T ∀x.ψ. Since (I, ν) is a model of Γ n , it must be the case that (∀x.ψ) I ν = I , contradicting the fact that (∀x.ψ) I ν = ⊥ I . Therefore, our assumption that (I, ν) is not a model for Γ n is false. To show (3), first note that the checks for T -satisfiability and T -entailment terminate, by assumption of a decision procedure for the T -satisfiability of quantifier-free formulae. Moreover, for each quantified formula ∀x.ψ, only a finite number of instances A ⇒ ψ[t/x] exist for which the algorithm will add A ⇒ ψ[t/x] * to Γ, which implies that the algorithm

A Breadth-First Proof Search Implementation

The proof search method sketched by semi-algorithm 1 is reliant on the choice of IR made at line 14. Whenever there are more than one applicable inference rules, only one is selected and the rest are discarded. Furthermore, as is the case for SP SL , some inference rules can have multiple possible instances for the same sequent, where only one is required to succeed in obtaining a proof. Algorithm 1 again only chooses one of them. In our implementation, we wanted to explore all the potential derivations resulting from the inference rule instances available at any point. Moreover, since we use a queue for the nodes still needing to be explored, we generate derivations in a breadth-first fashion. Thus, any proof or counterexample we obtain is guaranteed to result from the shortest possible paths.

Consequently, we use a different tree-like structure to compactly store all the derivations explored at any given moment. This structure accepts two types of nodes, depicted in Figure 4.2, which represent sequents (SNode) and inference rule instances (RNode), respectively. The node types alternate in the tree, thus an SNode only has RNode children, and vice-versa. With these new data structures, we say that an inference rule IR ∈ R SL Ind is applicable on a given SNode N whenever there exists an instance ir of IR for which: (i) the consequent of ir matches N.sequent and the pivot of ir (if it exists) matches A.sequent, for some SNode ancestor A of N, such that the side conditions of ir are satisfied, and (ii) if R 1 , . . . , R n is the RNode sequence extracted from the path starting at A and ending at N, then R 1 .rule • . . . • R n .rule satisfies the pivot condition of ir (if it exists).

Both types of nodes are marked with either a Closed, Failed or Unknown status. By default, all nodes are initially Unknown. The status of an SNode can be changed to Closed whenever: (i) its sequent is , or (ii) at least one of its RNode children is Closed. An RNode becomes Closed when all of its SNode children are Closed. Conversely, an SNode is marked as Failed whenever: (i) its sequent is of the form Γ ∅, or (ii) all of its RNode children are Failed. An RNode is marked Failed when at least one of its SNode children is Failed. Changing the status of a node always prompts a status update for all of its ancestors.

Algorithm 2 provides a sketch of our proof search implementation for R SL Ind , which, given an input sequent p(x) q 1 (x), . . . , q n (x) and an NFA Strat = (Q Strat , R SL Ind , ∆ Strat , q 0 , F Strat ) describing the proof strategy, explores all possible derivations rooted at the input sequent. We construct a node Root, with which we initialise the work queue. While the work queue is not empty and the status of Root is Unknown, we dequeue an SNode N. We denote by Q IR N the set of states in Strat towards which we transition from N.states by applying IR, and build a set R N of applicable inference rule schema that are also accepted by the strategy.

If AX SL or ID are in R N and, moreover, their application leads Strat to transition to some Algorithm 2: A sketch of our exhaustive proof search implementation for R SL Ind Input : An SL inductive system S, a basic sequent p(x) q 1 (x), . . . , q n (x), a proof strategy Strat = (Q Strat , R SL Ind , ∆ Strat , q 0 , F Strat ) represented as an NFA Output: VALID and a proof starting with p(x) q 1 (x), . . . , q n (x);

INVALID and a counterexample for p(x) |= SL S q 1 (x) ∨ . . . ∨ q n (x); UNKNOWN and the proof search tree constructed by the algorithm

Add N to R.children and mark it as Closed Let k be the number of antecedents generated by ir

Add N to R.children and mark it as Closed

Add N i to R.children return UNKNOWN and Root final states, then this branch of the derivation has been successful. We add a leaf, which is marked as Closed.

Otherwise, for each inference rule IR ∈ R N we consider each instance ir of IR with antecedents Γ 1 ∆ 1 , . . . , Γ k ∆ k . If k = 0 and, by applying IR, we reach some final state in Strat, then this branch has been successful. As before, we add a leaf that we mark as Closed. Otherwise, if k > 1, we create an RNode R for ir and an SNode N i for each of its antecedents. If ∆ i = ∅ for some i ∈ [k], then N i is marked as Failed. If this is not the case for any i ∈ [k], then we add N 1 , . . . , N k to the work queue and continue.

When the status of Root changes to Closed, then a proof has been obtained. The proof is extracted from the proof search tree and offered as a certificate. Otherwise, if it changes to Failed, then at least one counterexample has been discovered. We extract the counterexamples from the proof search tree and give them as witnesses. If the work queue becomes empty, but the status of Root is still Unknown, then the proof search was inconclusive and our entire proof search tree is returned as justification.

Case Study: Binary Trees

Consider the following definitions for binary trees. The predicate tree accepts any binary tree as model, tree + 1 accepts binary trees with at least one node, and tree + 2 accepts binary trees with at least one node in which the children of any node are either both allocated or both nil. Note that S t is ranked, non-filtering, non-overlapping and has the fvi property. tree(x) ← St x ≈ nil ∧ emp | x → (l, r), tree(l), tree(r) tree + 1 (x) ← St x → (nil, nil) | x → (l, r), tree + 1 (l), tree(r) | x → (l, r), tree(l), tree + 1 (r) tree + 2 (x) ← St x → (nil, nil) | x → (l, r), tree + 2 (l), tree + 2 (r)

The equivalent SMT-LIB definitions for tree, tree + 1 and tree + 2 are provided in Listing 4.7. The entailments tree + 1 |= SL St tree, tree + 2 |= SL S tree and tree + 2 |= SL St tree + 1 hold, facts corroborated by Inductor. A branch of the proof for tree + 2 (x) tree + 1 (x) is depicted below.

from which we can obtain the more concrete one x ≈ y ∧ x → z 0 * (z 0 ≈ y ∧ emp). The proof for the former case is shown below.

ls a (x, y) ls(x, y)

x ≈ y ∧ emp ls(x, y)

x ≈ y ∧ emp x ≈ y ∧ emp, ∃z1.x → z1 * ls(z1, y)

Listing 4.9 shows the equivalent SMT-LIB definitions for ls e , ls o , ls, ls + and ls . Listing 4.9: Definitions for list segments of even and odd length in SMT-LIB

Case Study: Lists of Acyclic List Segments

We adapt the acyclic list segments definitions from the previous section to a fragment in which each memory location points to a pair of locations, and use them to define lists whose elements point at cyclic or acyclic list segments. Note that S ll is still ranked, non-filtering, non-overlapping and has the fvi property.