Professor, Tudor Jebelean

Professor, Olga Kouchnarenko

Stephan Merz

Keywords: Variable zero: T. Variable succ: T → T. Inductive P: T → Prop := p1: P zero | p2: Noetherian induction reasoning, first-order formal reasoning, proof certification, SPIKE, Coq

Example 1 (Coq specification and proofs of the P&Q example) This example has been adapted from [Wirth, 2004]. By using the specification language of Coq, let us define two mutually defined inductive predicates P and Q, as well as N intended to define natural numbers. Let us also provide the main steps of the Coq proof script of the lemma p is true, stating that P holds for any natural, to be used later to prove our main theorem stating that (Q x y) holds for every natural x and y:

Variable T: Set.

General Introduction 1 Motivation

(Mathematical) induction is a most successful proof technique to reason on data structures of unbounded size like naturals and lists. Already known by the ancient greeks and rediscovered by Pascal and Fermat at the second half of the seventeenth century, it became a precious formal tool for mathematicians to such an extent that Poincaré considered it, at the beginning of the twentieth century, as the mathematical reasoning par excellence [Poincaré, 1902]. This is also the case for computer science. The fundamental notion of computable function can be defined in many equivalent models of computation, among which the Turing machines [START_REF] Turing | On computable numbers, with an application to the Entscheidungsproblem[END_REF] and the (µ-)recursive functions [Kleene, 1936]. There is a strong link between recursion and induction; for example, the correctness of primitive recursive functions is proved by induction on naturals.

After the inception of computers, McCarthy saw an interest for its mechanization and coded into Lisp the recursion induction [McCarthy, 1963], a method for proving the equivalence between two recursively defined functions. Later on, Burstall [Burstall, 1969] showed the importance of structural schematabased induction to verify properties about recursively defined data structures. Since then, a lot of 'proof by induction' methods have been proposed and contributed to many successful stories about the validation and verification of (critical) programs. A closer look on the applications of induction-based theorem provers as ACL2 [Kaufmann and Moore, 1999] 1 may identify the following (non-exhaustive list of) application domains:

• data structures (fully ordered sets, finite sets, powerlists),

• processor modelling and hardware verification (assynchronous circuits, self-timed circuits, x86 instruction set architecture, flash memories, AMD processors, pipelined machines),

• programming languages and software verification (Java-like bytecode, cryptographic language compilers, verification condition generation, program verification strategies),

• floating point and real arithmetic (register-transfer logic, continuity and differentiability, floating point operations: addition, division, square root),

• concurrency (cache coherence, interactive consistency),

• model checking (predicate abstraction, reduction of invariant proofs, compositional and µ-calculus model checking), and

• logic and metamathematics (quadratic unification, Higman's lemma, Dickson's lemma, synthesized SAT-provers, decision procedures for propositional logic, rewriting, computer algebra).

Some repositories2 contain benchmarks and challenge problems for induction-based theorem provers. An example of non-trivial property that can be proved by induction is rev(rev(l)) = l, for every list l, where rev is the function that computes the reverse of a list.

We are interested in the use of induction to reason on programs specified in a first-order language.

2 Some induction principles for first-order reasoning

Peano induction is one of the classical examples of induction principles: to prove a formula P (x), for any natural x, it is enough to prove both P (0) and P (S(x )), where x is a fresh natural variable, by allowing to use P (x ) in the proof of P (S(x )). The power of induction reasoning stands in the use of 'not-yet proved' facts, as P (x ).

Other induction principles, adapted for first-order reasoning, are issued from the Knuth-Bendix saturation-based completion procedure [START_REF] Knuth | [END_REF]. It opened the way to rewritebased automated reasoning methods like the inductionless induction [Musser, 1980, Goguen, 1980, Huet and Hullot, 1980, Lankford, 1980] and other reductive induction methods as implicit induction [Kounalis andRusinowitch, 1990a, Reddy, 1990]. A more recent induction reasoning technique for first-order logic with inductive definitions (FOL ID ) is cyclic induction [Brotherston and Simpson, 2011].

Not all induction reasoning techniques are equivalent when proving properties. In the frame of FOL ID , it has been shown in [START_REF] Berardi | [END_REF] that Peano-like induction reasoning is not as powerful as cyclic induction reasoning, by using arguments based on the 2-Hydra problem.

The 2-Hydra problem is a particular case showing the termination of the battle between Hercules and Hydra [START_REF] Dershowitz | The Hydra battle revisited. Rewriting, Computation and Proof[END_REF] when Hydra has at most two heads that hang on the top of necks of different lengths. Hercules prevails if either Hydra has i) no heads at all, or ii) the length of the first neck is 1 unit and it has lost the second head (i.e., the length of the neck is 0), or iii) the length of the second neck is 1 unit, as in Figure 1. Hercules can cut the Hydra's necks according to the following rules. If both necks have strictly positive lengths, then Hercules can cut them such that the first neck is shorter by 1 unit and the second by 2 units (see the case iv in Figure 2). If Hydra has already lost one of the heads and the neck of the other head has a length l of at least 2 units, the first head will have a neck of length l -1 units and the second head a neck of length l -2 units (see the cases v and vi in Figure 2).

In FOL ID , the six cases can be formalised as the axioms of a binary inductive predicate p:

i) p(zero, zero),

ii) p(succ(zero), zero),

iii) ∀x, p(x, succ(zero)), viii 2. Some induction principles for first-order reasoning where zero and succ (the 'successor' function) are intended to represent the usual constructors of natural numbers. In this setting, Hercules always wins over Hydra if ∀ x y, p(x, y) holds whenever x and y are natural numbers, where the property of being a natural number is captured by another inductive predicate. In [START_REF] Berardi | [END_REF], it has been shown that this property cannot be proved by induction principles similar to Peano induction.

The Noetherian induction principle. Peano induction is a particular case of a more general induction principle called Noetherian induction or well-founded induction. It allows to prove the validity of a property φ for any element from a potentially infinite poset (E, <), provided that < is a well-founded ordering which excludes the occurrence of any infinite strictly decreasing sequence of elements. The Noetherian induction principle can be formally stated as follows:

Noetherian induction. (∀m ∈ E, (∀k ∈ E, k < m ⇒ φ(k)) ⇒ φ(m)) ⇒ ∀p ∈ E, φ(p).

Thanks to the well-founded property of the ordering, the assumptions φ(k), called induction hypotheses (IHs), can be soundly applied in the proof of the induction conclusion φ(m). The soundness proof will be shown for the contrapositive version of the Noetherian induction, called the 'Descente Infinie' (or Infinite Descent) induction, but a similar proof can be built also for the soundness of the Noetherian induction principle.

'Descente Infinie' induction.

(∀m ∈ E, ¬φ(m) ⇒ (∃k ∈ E, k < m ∧ ¬φ(k))) ⇒ ∀p ∈ E, φ(p).
The soundness proof is by contradiction. If there exists an element m 0 ∈ E such that ¬φ(m 0 ), according to the induction principle, there is a smaller element m 1 such that ¬φ(m 1 ), for which there is an even smaller element m 2 such that ¬φ(m 2 ), and so on. In this way, an infinite strictly descending sequence of elements of E is built. This contradicts the well-foundedness property of the ordering.

In a first-order setting, two useful classes of Noetherian/'Descente Infinie' induction instances are distinguished, for which the elements of E are i) (vectors of) terms, and ii) (first-order) formulas. For the latter case, φ can be the second-order identity predicate in order to keep up with the first-order setting.

Term-based Noetherian induction reasoning and its limitations

Term-based instances of the Noetherian induction principle include the conventional induction methods, based on induction schemas that explicitly define the IHs to be used in the proof of each induction conclusion. The information justifying the soundness property is locally embedded inside the induction schemas, hence their natural integration into deductive, sequent-based inference systems in terms of induction rules. During a proof, it may happen to define useless IHs or to ask for crucial IHs that are not yet defined. The case of mutual induction, for which instances of a formula are used as IHs in the proof of other formulas, and viceversa, is hardly manageable with non-mutual recursion and leads to more technical and complex proofs.

The term-based Noetherian induction methods build explicit induction schemas attaching eagerly IHs to induction conclusions. In this approach, the proof of an induction conclusion is further developed, expecting that the IHs be applied at some proof step. Defining the right induction schemas may need several proof attempts, especially when some knowledge about the way the proof will be performed is lacking. In practice, it may happen that IHs be defined but not used or that IHs be required but not defined. The latter case is challenging especially when defining induction schemas for the management of mutual induction reasoning where a property can help proving another property, and conversely. Today, it is hardly imaginable a modern theorem prover not integrating 'proof by induction' features. Explicit induction schemas can be automatically generated from the analysis of inductive predicate, recursive function or datatype definitions, a feature that is implemented by many formal reasoning tools like the Coq proof assistant [The Coq development team, 2020]. The following example outlines, by the means of Coq, the main problems that may arise when using Peano-like induction principles, and explicit induction reasoning in general, for proving properties about mutually defined functions.

Inductive N: T → Prop := n1: N zero | n2: ∀ x, N x → N (succ x).
Theorem p is true : ∀ u, N u → P u. Proof.

[ The type T is generic and the variables 'zero' and 'succ' are meant again to be the constructors of naturals. Each inductive definition is built from labelled axioms that represent either atoms or implication formulas.

The Coq proof scripts are not meant to be read but executed using Coq proof environments as CoqIDE. 3 The advantage of using proof environments is due to a better undertanding of each proof step by displaying the current proof state. In the following, we will explain to the readers of p is true's proof script4 the main induction proof steps. The induction principle, denoted by N ind, is called using the induction command. The proof scripts of the resulting induction cases are indented and prefixed by a symbol, e.g., '-' or '+', followed by some comment, e.g., Case "zero", related the current case. Coq builds automatically N ind from the recursive definition of N:

forall P : T -> Prop, P zero -> (forall x : T, N x -> P x -> P (succ x)) -> forall t : T, N t -> P t which has the same induction cases as the Peano induction principle.

The induction cases are built depending on the argument given to induction which is a label of a premise formula of the form (N v), where v is the induction variable to be instantiated by the induction schema. If P is a property defined over the terms t satisfying (N t), N ind states that (P t) holds for all terms t of type T if both induction cases (P zero) and (P (succ x)) hold, where x is a fresh variable. It also states that (P x) can be soundly used in the proof of (P (succ x)) as IH. It can be noticed that the proof requires two induction steps, one embedded into the other. The first step uses u as induction variable, while the second step uses as induction variable the generalization of the term (succ x). The notation [...] means that some non-relevant Coq script is missing or some IH was applied at (S)Case "succ".

The lemma can be used in the proof of our main theorem. The proof requires only one induction step that applies one more time the N ind induction principle:

Theorem q is true : ∀ u v, N u → N v → Q u v.
Proof.

[...]. induction H0. (* v is the induction variable *) -Case "zero". apply q1.

-Case "succ". apply q2.

[...]. apply p is true. [...]. Qed.

It is hard to find a global proof for the main theorem from Example 1 where the N ind induction principle is applied only once. This is because the proof of ∀u, (P u) needs an instance of ∀x y, (Q x y), and vice versa. In another proof attempt, one can take advantage of the fact that the main theorem is a consequence of the conjunction ∀x y, (P x) ∧ (Q x y). However, the proof of the conjunction lemma is as difficult as the global proof, requiring also three induction steps. It can be noticed that the proof attempts for other conjunction lemmas, as ∀x y, (P y) ∧ (Q x y) for which the shared variable is y, and ∀u x y, (P u) ∧ (Q x y), where no variable is shared, will fail. 5From the previous proof attempts, we conclude that one of the main difficulties encountered when using the term-based approach is to devise successful induction schemas.

4 Formula-based Noetherian induction reasoning and its advantages

Simpler proof derivations, based only on variable instantiations and unrolls of the definitions of P and Q, can be built using formula-based instances of the Noetherian induction principle. This approach uses lazy and mutual induction reasoning to stop the proof development of formulas if they are instances of previously generated formulas. The result of such a terminating proof development is referred to as a pre-proof.

Example 2 (a Coq pre-proof of the P&Q example)

Theorem cyclic: ∀ x y, N x → N y → Q x y.

Proof. (* the proof of (P x') requires induction reasoning *) Focus 2.

(* the proof of (Q x' (succ x')) requires induction reasoning *) Admitted.

The inversion tactic is a different way to instantiate variables from an inductive atom P (a) given as a premise, also derived from the definition of the inductive predicate P . 'Focus 2' is used to process the next branch in the tree structure of the Coq pre-proof. The command 'Admitted' informs Coq to abandon the proof. As it is, Coq is not able to validate the above proof script.

Checking the soundness of pre-proofs. Not every pre-proof is sound. In our context, the soundness property boils down to validate the usage of IHs by the application of some induction principle. A formulabased induction proof is a pre-proof that satisfies the ordering constraints required by the application of formula-based Noetherian induction principles. The validation of IHs may be tricky because one have to find the orderings that satisfy the ordering constraints. To show how the ordering constraints are built, we will represent the pre-proofs as directed graphs (digraphs).

Example 3 (a formula-based induction proof of the P&Q example) Figure 3 is a digraph representation of the Coq pre-proof from Example 2, where the nodes represent atoms of the form (P t) and (Q t 1 t 2 ) found in the conclusion of the main steps of the pre-proof. Each downward arrow link a node with the new nodes issued after the process of the node.

The pre-proof starts by instantiating y by zero and (succ y) from the root node labelled by (Q x y). (Q x zero) is true, by q1. The instantiating substitutions label the corresponding downward arrows. The instance (Q x (succ y )) is also true if (P y ) and (Q x y ) are true, by q2. No further transformation is supported by (Q x y ) which is an instance of the root node using the substitution {x → y }. The instantiation relation is graphically represented by an upward dashed arrow labelled by the instantiating substitution written in boldface style. The variable x of (P x) is further instantiated by zero and (succ x ). (P zero) is true, by p1, while (P (succ x )) is true if both (Q x (succ x )) and (P x ) are true, by p2. (P x ) is an instance of (P x ) using the substitution {x → x }, while (Q x (succ x )) is an instance of the root node using the substitution {x → x ; y → (succ x )}.

Sections 6.2 and 6.3 will show different ways to apply the formula-based Noetherian induction principle in order to validate the IHs. We will follow the approach detailed in Section 6.3. Let the set E, used in the definition of the formula-based Noetherian induction, consist of the two formulas ∀t, (P t) and ∀ t 1 t 2 , (Q t 1 t 2 ). This approach requires that the nodes labelled by (P x) and (Q x y) be root nodes. This is already the case for the node labelled by (Q x y) but not for (P x). The node labelled by (P x) can be The new digraph is normalized such that all the IHs label terminal nodes that point to root nodes. We say that an IH labelling a terminal node n is validated if it is smaller than some instance of the root formula of the tree to which n belongs. This instance uses the cumulative substitution resulting from the composition of the substitutions that label the downward arrows encountered along the path leading the root to n. Since the IHs are all instances of root formulas, the ordering constraints will compare only instances of root formulas. If P σ is the instance of a formula P with the substitution σ, the ordering constraints for the four IHs of our example are:

• IH (Q x y ): (Q x y){x → x; y → y } < p (Q x y){x → x; y → (succ y )},

• IH (P x ): (P x){x → x } < p (P x){x → (succ x )},

• IH (Q x (succ x )): (Q x y){x → x ; y → (succ x )} < p (P x){x → (succ x )}, and

• IH (P x): (P x){x → x} < p (Q x y){x → x; y → (succ y )}.

The ordering < p has to be defined such that the ordering constraints, resulting after the application of the substitutions to the root formulas, are satisfied: (Q x y ) < p (Q x (succ y )), (P x ) < p (P (succ x )), (Q x (succ x )) < p (P (succ x )) and (P x) < p (Q x (succ y )). If the measure value of a formula (P t) (resp., (Q t 1 t 2 )) is the multiset {t, t} (resp., {t 1 , t 1 , t 2 }), the ordering constraints are boiled down to the following comparisons between multisets of terms: {x, x, y } < p {x, x, (succ y )}, {x , x } < p {(succ x ), (succ x )}, {x , x , (succ x )} < p {(succ x ), (succ x )}, and {x, x} < p {x, x, (succ y )}. It can be shown that the constraints are satisfied if < p is the multiset extension of a multiset path ordering (mpo) [Baader and Nipkow, 1998] based on the precedence over the function symbols stating that 'zero' is smaller than 'succ'.

Several formula-based instances of the Noetherian induction principles can be applied for checking whether a pre-proof is a proof. Validating the IHs can be done after building the pre-proofs or during their development. Also, the ordering constraints may be implicitly satisfied if reductive proof procedures are used. The attribute 'reductive' relates to the fact that every inference step transforms formula instances into strictly smaller ones or, sometimes, smaller or equal ones. An example of reductive induction technique is the rewrite-based implicit induction, suggested in [Kounalis and Rusinowitch, 1990b] and defined later in [START_REF] Bronsard | [END_REF]. In this case, there is only one application of the formula-based induction principle by using a unique induction ordering defined over all the formulas encountered during the proof derivation. The reductive induction reasoning can be easily automatised and multiple induction steps can be performed during a proof session, as it is witnessed by the proofs generated with SPIKE, an implicit induction prover [The SPIKE development team, 2020].

The non-trivial induction reasoning requires the usage of IHs. Intrinsically, it is cyclic in the sense that it includes cases where the proof of a formula φ depends on (an instance of) φ given as IH. In some cases, the validity of IHs can also be checked without employing Noetherian induction reasoning and ordering constraints. An example is the CLKID ω inference system [Brotherston and Simpson, 2011] that can reason on FOL ID . Its implementation in the Cyclist prover [Brotherston et al., 2012] uses a proof strategy guided by building cycles of formulas that satisfy some global trace condition and automata-based methods for checking its validity.

The manual check of the validity of IHs may be tedious, error-prone and costly. For example, the automatically generated implicit induction proofs may contain thousands of proof steps that make hard to explicitly state and verify the ordering constraints. For these reasons, their mechanical certification becomes a necessity. Some certifying proof environments based on type theory, such as Coq and Isabelle [START_REF] Nipkow | [END_REF], have a higher-order specification language that allow the definition and the direct application of instances of the Noetherian induction principle. In Coq, Noetherian induction principles can also be derived from recursion-based specifications. They can be formalised in two ways, by the means of: i) the functional programming style, based on pattern matching constructions, and ii) the logic programming style, based on inductive predicates. Both styles allow to encode recursion but each of them has limitations. Any function should be total and terminating, the built-in termination criterion being supported by a structural recursion analysis checking that one of the function arguments decreases according to a well-founded ordering. On the other hand, any inductive predicate is defined by the means of a set of formulas written in a 'Horn-clause' implication form, but no termination proof is needed.

5 Goals and structure of the content Goals. Our main objectives are: i) to understand the relations between term-and formula-based induction principles in order to bridge the gap between the underlying proof methods, ii) to free the inductive reasoning from computation, and iii) implement it more effectively and trustworthily.

Structure of the content and contributions. The rest of the document is structured in three parts. The first part is more theoretical and has three chapters. Chapters 1 and 2 are based on the work published in [Stratulat, 2012]. Chapter 1 gives an overview of the term-and formula-based instances of the Noetherian induction principle. Chapter 2 introduces a cyclic and non-reductive formula-based induction proof method and its relation with reductive methods as those based on implicit induction. The xiv last chapter, based on [Stratulat, 2016[START_REF] Dramnesc | Mechanical synthesis of sorting algorithms for binary trees by logic and combinatorial techniques[END_REF], studies the relations between term-and formula-based proofs. Firstly, we show how to implement cyclic reasoning in Coq and identify conjectures that are, on the one hand, easy to be proved by cyclic induction but are, on the other hand, hard to be proved by using explicit induction. The last part of Chapter 3 shows how cyclic reasoning was converted to explicit induction reasoning and mechanized during a concrete application: the synthesis of sorting algorithms for binary trees.

The second part also has three chapters but is more practical. Chapter 4 introduces the SPIKE prover, based on [Stratulat, 2020]. Chapter 5, synthesizing results from [START_REF] Barthe | [END_REF], presents an industrial-size application of the implicit induction and SPIKE: the validation of the JavaCard platform. Chapter 6, based on [Stratulat, 2010, Stratulat and Demange, 2011, Henaien and Stratulat, 2013, Stratulat, 2017b], gives a methodology for the Coq certification of implicit and cyclic induction reasoning for recursive-based specifications using the functional and logic programming styles.

The last part, consisting of two chapters, reveals bridges of the Noetherian induction reasoning with other reasoning techniques. Chapter 7, based on [Stratulat, 2017a, Stratulat, 2018], introduces a different method to validate cyclic FOL ID proofs, via ordering constraints. This approach allows to represent cyclic FOL ID induction reasoning as Noetherian induction reasoning that can be validated by Coq. The second chapter presents a connection between saturation-based and Noetherian induction reasoning, published in [Stratulat, 2005, Stratulat, 2007].

The document ends with proposals for future projects.

List of main contributions

We briefly highlight the main contributions related to the use of the Noetherian induction principle in first-order reasoning.

Taxonomy for the first-order instances of the Noetherian induction principle. In Chapter 1, we proposed a classification of the first-order instances of the Noetherian induction principle into termand formula-based instances. This allowed us to classify different induction reasoning techniques and induction principles for first-order reasoning. We showed that every term-based proof can be directly converted to a formula-based one. In the other direction, the direct conversion is possible only for a class of formula-based proofs. Section 3.1 gave several examples of formula-based proofs that are hard or impossible to be proved using term-based induction principles that may be issued from the formula-based proofs, e.g., using the same variable instantiation schemas. On the other hand, Section 3.2 presented a class of formula-based proofs that can be translated into term-based ones. The question whether every formula-based proof can be converted to a term-based one remains open. Our effort to better understand the relations between formula-and term-based instances is continued in the detailed project from Section C.1.

Formula-based induction proof technique. In Chapter 2, we proposed a cyclic and non-reductive formula-based reasoning technique and applied it to prove conjectures about conditional specifications.

The paper [Stratulat, 2012] presenting it received a best paper award at the Alan Turing Centenary Conference in 2012.

Certification of formula-based induction reasoning. Our experiments conducted on the JavaCard application, described in Chapter 5, with the SPIKE prover, presented in Chapter 4, have automatically generated some proof scripts consisting of thousands of steps that are time-consuming or very hard to be checked by humans. This motivated our research on the mechanical certification of the implicit induction proofs produced by SPIKE and, more general, of the formula-based induction reasoning using the Coq certification environment, as described in Chapter 6. This work was done in collaboration with Vincent Demange and Amira Henaien during their PhD period.

Connections between formula-based Noetherian induction reasoning and other kinds of firstorder reasoning. In Chapter 7, we showed that the soundness conditions for a class of FOL ID cyclic pre-proofs can be deduced from a set of ordering and derivability constraints issued from the analysis of the pre-proofs. The similarity between these ordering constraints and those occurring in formula-based proofs allowed us to extend the certification methodology for formula-based reasoning to certify FOL ID cyclic proofs. In other direction, in Chapter 8 we identified similarities between reductive induction-based inference systems, as the implicit induction inference systems, and saturation-based inference systems, as the paramodulation-and resolution-based systems. For example, we showed that the derivations produced by these inference systems do not eliminate the minimal counterexamples. A methodology for building sound reductive induction-based systems has been adapted for saturation-based systems and used to improve some of the existing ones.

Case studies, computer experiments and software developments.

Part I

First-Order Noetherian Induction Proving Induction reasoning is helpful when establishing properties about programs and specifications built from recursively defined domains and data structures. The properties of interest are inductive, i.e., they are valid only in distinguished models, e.g., term-generated, standard or non-standard models as the Henkin models. However, it is hardly imaginable to perform induction reasoning exclusively with reasoning techniques working only for inductive models. Indeed, the current inductive theorem provers mix them with deductive techniques that can validate properties in all models.

This chapter, based on [Stratulat, 2012], gives an overview of the use of the Noetherian induction principle to build first-order proofs valid in term-generated models.

Structure of the chapter. The chapter has five sections. After the introduction of basic notions in Section 1.1, Section 1.2 defines the term-and formula-based instances of the Noetherian induction principle, adapted when reasoning on first-order logic. Sections 1.3 and 1.4 overview the term-and formula-based induction proof methods. The features of each of these methods are analysed by the means of different proofs of a very simple running example. The last section concludes.

Basic notions

Let F (resp. P) be a ranked alphabet of function (resp. predicate) symbols and V a countable set of variables. T (F, V) denotes the set of terms over F and V, and T (F) its subset of ground terms. The expression P (t 1 , . . . , t n ) is an atom, where P ∈ P is an n-ary predicate and t 1 , . . . , t n are terms. The set A(P, F, V) (resp. A(P, F)) denotes the set of atoms over P, F and V (resp. P and F). Let L represent a decidable set of first-order formulas over A. We denote by Ax the axioms that build a specification, consisting of formulas from L. New terms and formulas can be obtained by substitution operations, representing finite mappings between variables and terms, of the form {x 1 → t 1 , . . . , x n → t n }, where x i (i ∈ [1..n]) are distinct. A renaming substitution has all substituting terms as variables. In addition, if every substituting variable is the same as the substituted variable, the substitution is an identity substitution. Given a substitution σ and a term t (resp. formula φ), tσ (resp. φσ), sometimes written (t, σ) or t[σ] (resp. (φ, σ) or φ[σ]), denotes the instance of t (resp. φ) by the substitution σ. Given two substitutions σ 1 and σ 2 , by ψ(σ 1 σ 2 ) we denote (ψσ 1 )σ 2 , for any term or formula ψ; σ 1 σ 2 means that σ 1 is composed with σ 2 . We are referring to ground substitutions if the mapping terms are ground.

Semantically, given a first-order structure S with domain D, we write f S to denote the interpretation of the symbol f ∈ F in S. The variables are interpreted by a valuation (total) function from variables of V to D. It can be extended to non-variable terms as follows: if t(s 1 , . . . , s n ) is a term such that t S : D n → D is the interpretation of t, its interpretation is obtained by replacing each of its i) function symbol f by f S , and ii) variable by its valuation. Every n-ary predicate symbol from P is interpreted as an n-ary relation on D. We write S |= ζ φ for a formula φ that is true in S using the valuation function ζ. Any interpretation < S, ζ > satisfying Ax is a model of Ax. A formula φ is a deductive consequence of a set of formulas Φ, denoted by Φ |= φ, if φ holds in all models of Ax whenever ψ holds in all models of Ax, for any ψ ∈ Φ. A formula is deductively valid w.r.t. Ax iff it is a deductive consequence of Ax.

Deductive relation. Let P(L) denote recursive sets over L. The recursively enumerable deductive relation ⊆ P(L) × L satisfies the properties:

• if φ ∈ Ax, then Ax φ,
• if Ax φ and Ax ⊆ Ax , then Ax φ,

• if Ax φ and Ax ∪ {φ} φ , then Ax φ , and • if Ax φ, then Ax φσ, for any substitution σ.

In practice, the first-order (deductive) systems that implement the deductive relation are normally sound , i.e., Ax φ implies Ax |= φ, and complete, i.e., Ax |= φ implies Ax φ, for any formula φ.

Inductive relations. We are interested in the case when Ax has term-based (Herbrand) models, i.e., whose valuation functions transform variables into ground terms. A formula φ is an inductive consequence of the axioms if φ holds in all Herbrand models of Ax. The inductive theory of Ax consists of all inductive consequences of Ax. In general, it is neither decidable, nor semi-decidable. For various reasons which depend not only on the nature and form of the axioms but also on the user's intuition, monotonicity behavior and operational feasibility criteria [START_REF] Wirth | [END_REF], only a non-empty subset of the Herbrand models of Ax is considered. For example, when Ax is a set of universally quantified Horn clauses with equality, it is convenient to reason on the unique initial (minimal) model of Ax. The choice of the model subset influences the way the variables are instantiated during the induction proofs.

In this chapter, we consider that such subset, denoted by M, exists and it is already fixed before performing any induction reasoning. To simplify the presentation, we assume that all variables are universally quantified. A formula φ is a M -consequence (or just consequence) of a set of formulas Φ, denoted by

Φ |= M φ, if S |= ζ φ whenever S |= ζ ψ, for any ψ ∈ Φ and model < S, ζ > from M. A formula φ is M-valid (or just valid), denoted by |= M φ iff it is a consequence of Ax.
The two notions of consequence relation may coincide for particular cases; for example, a positive clause φ is an inductive consequence of a set of universally quantified Horn clauses with equality iff φ is valid in their initial model [Gramlich, 2005].

A formula φ is false, denoted by |= M φ, if it is not valid. Any false formula has (or contains) at least one false ground instance, called counterexample. It can be easily shown that, for any formula φ and set of formulas

Ψ, if Ψ |= M φ and |= M φ then it exists a formula ψ ∈ Ψ such that |= M ψ.
Sufficient completeness. The axioms define very often functions based on constructors that are sufficiently complete. In this case, the set F is split into defined function (DF) and constructor (C) symbols. In addition, the models from M are constructor models, i.e., whose valuation functions transform variables into ground constructor terms from T (C).

A function symbol f ∈ DF is sufficiently complete if any ground term of the form f (t) is deductively equivalent to a constructor ground term from T (C), where t is a term vector of the form (t 1 , . . . , t n ) with

t i ∈ T (C), ∀i ∈ [1..n].

The term-and formula-based instances

Induction orderings. The induction orderings are assumed to satisfy essential properties related to wellfoundedness and stability under substitutions, as defined below. Well-foundedness implies the existence of minimal elements.

Lemma 1 Let (E, <) be a well-founded poset. For any non-empty subset of E, there is a minimal element.

Proof By contradiction, assume that E has a non-empty subset E without minimal elements, i.e., for each element of E there is a smaller element in E . Let x 1 be an arbitrary element of E . Since it is not minimal, it exists an element x 2 of E smaller than x 1 . The same reasoning is performed on x 2 , and so on, to finally build an infinite strictly decreasing sequence of elements of E . Contradiction because the ordering is well-founded.

A binary relation R is stable under substitutions if whenever s R t then (sσ) R (tσ), for any substitution σ and terms or formulas s and t. R is stable under contexts if, for any two terms s and t such that s R t and any term l s , then l R r, where r can be any term built by replacing in l occurrences of s by t. A quasi-ordering is stable under substitutions if its strict and equivalent parts are stable under substitutions. A reduction ordering is a transitive and irreflexive relation that is well-founded and stable under substitutions and contexts. Given a set of formulas Ψ, by Ψ ≤ψ (resp., Ψ <ψ ) are denoted the instances of formulas from Ψ that are smaller or equal (resp., strictly smaller) than ψ w.r.t. ≤ (resp., <). An quasi-ordering is total if any two distinct elements are comparable.

In a first-order setting, the set E may contain an infinite number of elements that can be either ground terms or ground formulas. An effective reasoning can be pursued only on finite descriptions of them by the means of terms and/or formulas with variables. Hopefully, this reasoning can be projected and reused to the ground level when needed if the ordering is stable under substitutions.

An example of syntactic reduction ordering over terms is the recursive path ordering (rpo) [Dershowitz, 1982b, Kamin and Lévy, 1980, Lescanne, 1983]. Let us assume the status function τ for F that returns τ (f ) ∈ {Lex, Mul}, foreach f ∈ F, where Lex (resp., Mul) stands for lexicographic (resp., multiset) status. Given a precedence over F, denoted by the well-founded quasi-ordering ≤ F , the rpo ≺ rpo is recursively defined, as follows: for all terms s, t ∈ T (F, V), t ≺ rpo s if s ≡ f (s 1 , . . . , s m ) and i) either s i ≡ t or t ≺ rpo s i for some s i , 1 ≤ i ≤ m, or ii) t ≡ g(t 1 , . . . , t n ), t i ≺ rpo s for all i, 1 ≤ i ≤ n and either a) g < F f , or b) f ∼ F g, f and g have the same arity and status, and

(t 1 , . . . , t n ) ≺ τ (f ) rpo (s 1 , . . . , s n ). ≺ Lex rpo is the lexicographic extension of ≺ rpo : (a 1 , . . . , a n ) ≺ Lex rpo (b 1 , . . . , b n ) if either i) a 1 ≺ rpo b 1 or ii) a 1 ∼ rpo b 1 and (a 2 , . . . , a n ) ≺ Lex rpo (b 2 , . . . , b n )
, where ∼ rpo is recursively defined as: t ∼ rpo t, for any term t, and f (a 1 , . . . , a n ) ∼ rpo g(b 1 , . . . , b n ) if f ∼ F g and, for each i ∈ [1..n], a i ∼ rpo b i . We refer to multiset path ordering (mpo) instead of rpo when the status of all function symbols is Mul. Two terms s and t are equivalent if s ∼ rpo t. ≺ Mul rpo , also denoted by ≺ ≺ rpo , is the multiset extension of ≺ rpo : (A ≡ )(a 1 , . . . , a n ) ≺≺ rpo (b 1 , . . . , b n )( ≡ B) if there are two finite multisets X and Y such that B = (A -X) Y , X = ∅ and ∀y ∈ Y , ∃x ∈ X, y < x holds, where (resp., -) is the union (resp., difference) on multisets. In practice, X (resp., Y ) is A (resp., B) after having deleted pairwisely the common elements. Two multisets of terms are equivalent if they are reduced to empty sets after deleting pairwisely their equivalent terms. The multiset extension of any well-founded ordering is also well-founded [Baader and Nipkow, 1998].

The term-and formula-based instances

As a running example, let us prove the conjecture x + 0 = x, for all natural x, using the axioms 0 + x = x, for any natural x, and S(x) + y = S(x + y), for any naturals x and y, that define the addition symbol '+' over the naturals based on the constructor symbols 0 and S. '=' is the only predicate symbol and the deductive system is based on equational logic [Baader and Nipkow, 1998]. '+' is sufficiently complete and the unique model from M is the initial model of the axioms since it fits well to reason over naturals.

Let n be an arbitrary natural, hence it is either 0 or a successor of another natural n . In the first case, 0 + 0 = 0 is deductively valid as an instance of the first axiom. The second case, S(n

) + 0 = S(n ),
is deductively equivalent to S(n + 0) = S(n ) using the second axiom. The IH n + 0 = n can help to replace S(n + 0) by S(n ) in order to obtain an identity and finish the proof.

The sound use of n + 0 = n can be argued by two different instances of the Noetherian induction principle, recalled below

Noetherian induction. (∀m ∈ E, (∀k ∈ E, k < m ⇒ φ(k)) ⇒ φ(m)) ⇒ ∀p ∈ E, φ(p),
according to the cases when the set E consists of ground terms or ground formulas. The underlying induction orderings over (vector of) terms and formulas are generically denoted by < t and < f , respectively.

Term-based Noetherian induction. Let φ be a first-order formula defining a property to be checked for a non-empty set of term vectors E.

If k∈E,k<tm {φ(k)} |= M φ(m), for any term vector m ∈ E, then ∀p ∈ E, |= M φ(p).
Proof (soundness) By contradiction, if φ(m) is assumed to be false for some m ∈ E, we define the non-empty subset E ⊆ E representing all term vectors for which φ is false. By Lemma 1, E has minimal term vectors, and let m be such a term vector. The term-based Noetherian induction rule can be applied to prove the existence of a term vector from E smaller than m , so contradiction.

A well-known term-based Noetherian induction principle is the Peano induction principle.

Example 4 (Peano induction proof of x + 0 = x) The IH P (x ) can be soundly used in the proof of P (S(x )) because x < S(x ), where < is the 'smaller' relation over the naturals. In our example, P (x) stands for x + 0 = x, so n + 0 = n is the IH for proving S(n ) + 0 = S(n ).

On the other hand, the IH n + 0 = n can also be legitimated by formula-based Noetherian induction principles.

Formula-based Noetherian induction. Let E be a non-empty set of first-order formulas. If for any formula δ ∈ E, γ∈E,γ< f δ {γ} |= M δ then ∀ρ ∈ E, |= M ρ.

Proof (soundness)

The Noetherian induction principle presented in the introductory part is instantiated such that E consists of first-order formulas and the predicate φ is the identity relation, i.e., φ(x) = x, for any formula x ∈ E. Formulated into a 'Descente Infinie' setting, this principle states that a potentially infinite set of firstorder formulas are true if for any false formula there is another formula which is also false but smaller w.r.t. the well-founded ordering. The proof of this statement is by contradiction: we assume a false formula in E. We consider the non-empty subset set E of E consisting of all the false formulas from E. By Lemma 1, there exists a minimal false formula in E for which there is no smaller false formula, so contradiction.

Example 5 The formula-based Noetherian induction principle can be applied if the proof of x + 0 = x has been generated using some reductive system such that, for any natural x , x + 0 = x is smaller than S(x + 0) = S(x ) which is in turn smaller than S(x ) + 0 = S(x ). 6 The set E consists of all formulas encountered in the proof script of x + 0 = x, i.e., {x + 0 = x, 0 + 0 = 0, S(x ) + 0 = S(x ), S(x + 0) = S(x ), S(x ) = S(x )}. The soundness proof uses a reductio ad absurdum reasoning at the ground level. By contradiction, we assume that E has a counterexample. Since the ordering is well-founded, there is a minimal counterexample of it. It can only be an instance of x + 0 = x because the deductively valid formulas and the formulas deductively equivalent with but greater than x + 0 = x cannot have minimal counterexamples. Let it be n + 0 = n , for some natural n . n should be of the form S(n ) since 0 + 0 = 0 is deductively true. In the proof script, S(x) + 0 = S(x) is transformed into the smaller equality 1.3. Term-based Noetherian induction principles S(x + 0) = S(x), for any natural x, so S(n + 0) = S(n ) is a smaller counterexample thanks to the 'stability under substitutions' property of the ordering. In the next step of the proof script, S(x+0) = S(x) is transformed into an identity using x + 0 = x, for any x. Instantiating x with n , we conclude that n + 0 = n should be false. We get a contradiction since n + 0 = n is a counterexample of x + 0 = x, smaller than n + 0 = n .

Term-based Noetherian induction principles

Most of the term-based Noetherian induction principles promote eager induction, an approach that defines the IHs (sometimes long) before their use by means of (explicit) induction schemas [Aubin, 1979] usually resulted from the recursion analysis of recursively defined functions. Given a formula, an induction schema firstly identifies a subset of its variables to be instantiated, called induction variables, then defines the IHs as well as the induction conclusions as instances of the formula. The IHs associated to an induction conclusion are explicitly added to its conditions and are expected to participate in further developments of the proof. Some variables from the terms instantiating the induction variables are shared between the induction conclusions and their associated IHs. A well-known example of 'induction schema'-based induction principle that fits well for constructorbased sorted specifications is the structural induction [McCarthy and Painter, 1967], which generalizes the Peano and mathematical inductions.

Theorem 1 (soundness of structural induction) Let φ be a formula to be checked for the elements of a sort S.

If ∀f : S 1 , . . . , S n → S ∈ C, ∀x 1 , . . . , ∀x n , {φ(x i1 ) ∪ . . . ∪ φ(x i k )} |= M φ(f (x 1 , . . . , x n )) then ∀p ∈ S, |= M φ(p)
, where the variables x i1 , . . . , x i k are those variables among x 1 , . . . , x n that have the sort S.

Proof The structural induction principle exploits the fact that x is structurally smaller than f (. . . , x, . . .). The term-based induction principle is applied further.

In turn, it is generalized by the cover set induction [START_REF] Zhang | [END_REF] which is inspired from the idea of [Boyer and Moore, 1979] according to which the induction schemas are built from the recursive definitions of the functions appearing in the conjecture to be proved. The cover set induction principle assumes that a sort is characterized, or covered, by a finite set of terms called (term) cover set. The cover set notion can be generalized to a set of term vectors that cover a product of sorts S 1 × S 2 × . . .. Formally, {t 1 , . . . , t n } is a cover set of the product of sorts E if, for any formula φ, whenever |= M φ(u), for some term vector u ∈ E, it exists j ∈ [1..m] and a substitution σ such that t j σ ≡ u, where ≡ is the (syntactical) identity relation.

Theorem 2 (soundness of cover set induction) Let Ψ be a non-empty cover set {t 1 , . . . , t m } of the product of sorts E and φ a formula to be checked for the elements of E.

If k∈E,k<tt {φ(k)} |= M φ(t), for any term vector t ∈ Ψ, then ∀p ∈ E, |= M φ(p). Proof By contradiction, assume that ∃p ∈ E such that |= M φ(p ) is false. We consider E ⊆ E defined as {p | p ∈ E, |= M φ(p) is false}. E is not empty since p ∈ E .
By the well-foundedness property of < t and Lemma 1, there is a minimal term vector u ∈ E such that |= M φ(u). By the definition of the term cover set, it exists j ∈ [1..m] and a substitution σ such that t j σ ≡ u. On the other hand, k∈E,k<ttj {φ(k)} |= M φ(t j ). By the 'stability under substitutions' property of < t , we have k∈E,kσ<ttj σ {φ(kσ)} |= M φ(t j σ). Since |= M φ(t j σ), it exists k ∈ E such that k < t u and |= M φ(k ). Therefore, k ∈ E . Contradiction with the minimality of u.

The main shortcomings of the schemata-based approaches are related to the management of the IHs, when: i) the generated IHs do not contribute to the proof, and ii) the IHs that are required at some point of the proof are not yet generated or impossible to be defined with the 'recursion analysis' method. Its main advantage is the local scope of the induction ordering, at the level of the induction schema. This allows for flexibility in the ordering management during a proof; the ordering constraints are checked only when defining the induction schemas and, on the other hand, a different induction ordering may be used for each induction schema. Moreover, the schemata-based induction can be easily integrated into sequent-based deductive systems in terms of sound inference rules.

Another shortcoming is the treatment of mutual induction which cannot be directly performed because the induction conclusion and its attached IHs are instances of the same formula. However, several partial solutions have been proposed. Boyer and Moore [Boyer and Moore, 1988a] build the induction schema from a new function that calls the mutually defined functions according to the value of an extra argument. Sometimes, the conjecture should be strengthened or auxiliary lemmas about the mutually defined functions should be provided by the users. A more automatic solution has been provided by [START_REF] Kapur | [END_REF] to deal with a class of mutually recursive functions that can transform the mutual recursion into simple recursion by unrolling the cover sets and expanding the function definitions. The multi-predicate induction schemas proposed by Boulton and Slind [Boulton and Slind, 2000] have one predicate for each of the mutually recursive functions and avoid the need for expanding the functions into a single function. However, if the conjecture embeds different recursive function symbols the induction schemas have to be combined [Boyer and Moore, 1979].

Formula-based Noetherian induction principles

Inductionless induction, also known as proof by consistency, is the first proof method integrating formula-based Noetherian induction. Proposed by Musser in [Musser, 1980], it uses the saturationbased Knuth-Bendix's completion algorithm [START_REF] Knuth | [END_REF] to prove inductive properties. The method can prove a set of equalities as consequences of a consistent set of equality axioms by i) adding them to the axioms, ii) orienting the new set of equalities into rewrite rules, and ii) showing their consistency if the completion algorithm saturates, i.e., until no new7 equality is generated. As time went by, the method has been improved [Huet and Hullot, 1980, Dershowitz, 1982a[START_REF] Fribourg | A strong restriction of the inductive completion procedure[END_REF], Jouannaud and Kounalis, 1986, Kapur et al., 1986, Bachmair, 1988, Küchlin, 1989]. For an overview of inductionless induction, the reader may consult [Comon, 2001, Comon and[START_REF] Comon | [END_REF].

By clearly separating the axioms from the formulas to be proved, the implicit induction inference systems are reductive procedures, many of them being rewrite-based and saturation-free. Initially, Reddy [Reddy, 1990] proposed a proof method called term-rewriting induction, implemented by an inference system which computes formula cover sets. They are issued from the instantiation of some variables of a formula with a term cover set associated to the product of their sorts defined in terms of cover substitutions. Each formula instance is reduced afterwards with rewrite rules from the axioms; in this way, whenever the formulas from the formula cover set are valid, the covered formula is also valid. Bachmair [Bachmair, 1988] showed that formula cover sets are fundamental for the proofs by consistency. This is also true for the proofs by implicit induction. In the following, we refine formula cover sets as (general) cover sets and strict cover sets. Formally, Σ = {σ 1 , . . . , σ n } is a set of cover substitutions of a formula φ(x) if the set of mapping term vectors built for each substitution from Σ is a term cover set of the (product) sort of x. A set of formulas {φ 1 , . . . , φ n } is a formula cover set (resp. strict formula cover set) of a formula φ built on the set of cover substitution {σ 1 , . . . ,

σ n } if φ i |= M φσ i and φ i ≤ f φσ i (resp. φ i < f φσ i ), for any i ∈ [1..n].
The term-rewriting method does not need to be refutationally complete, as required by [Bachmair, 1988], and the specifications may not be ground confluent in order to prove inductive properties. 8 Kounalis and Rusinowitch [Kounalis and Rusinowitch, 1990b] went even further and proposed a completion-free induction technique based on test sets [START_REF] Kapur | [END_REF].

To simplify the rest of the presentation, we will denote the ordering over formulas < f by < and refer to (strict) formula cover sets as (strict) cover sets, if otherwise stated.

Theorem 3 (soundness of term-rewriting induction) Let {φσ 1 , . . . , φσ n } be a set of instances of the formula ∀x ∈ E, φ(x) built from the cover-substitutions σ 1 , . . . , σ n , respectively.

If ∀i ∈ [1..n], φθ<φσi φθ |= M φσ i then ∀x ∈ E, |= M φ(x).
Proof By absurd, assume that ∀i ∈ [1..n], φθ<φσi φθ |= M φσ i but it exists u ∈ E such that |= M φ(u).

We consider E defined as {φθ | |= M φθ}. E is not empty since φ(u) ∈ E . Since < is well-founded, there is a minimal instance φτ in E , by Lemma 1. Also, σ 1 , . . . , σ n are cover-substitutions for φ, so there exist j ∈ [1.

.n] and a substitution such that φτ ≡ φσ j and |= M φσ j . Since φθ<φσi φθ |= M φσ i for all i ∈ [1..n], this is also true for j, so φθ<φσj φθ |= M φσ j . By the 'stability under substitutions' of <, we have φθ <φσj φθ |= M φσ j . On the other hand, |= M φσ j , so there is a substitution θ such that |= M φθ and φθ < φσ j (≡ φτ ). Contradiction with the minimality of φτ .

The term-rewriting induction principle cannot directly perform mutual induction reasoning because all the involved formulas are instances of only one formula. It has been superseded by the implicit induction principle, as suggested in [Kounalis and Rusinowitch, 1990b] and formally presented in [START_REF] Bronsard | [END_REF].

Theorem 4 (soundness of implicit induction) Let E be a set of formulas and assume that for any formula δ ∈ E, γ∈E,γ<δ {γ} |= M δ. Also, let φ be a formula to be checked for a non-empty set S of term vectors. If ∀p ∈ S, φ(p) ∈ E then ∀p ∈ S, |= M φ(p).

Proof By the formula-based Noetherian induction principle, any formula δ from E holds. Since ∀p ∈ S, φ(p) ∈ E, then ∀p ∈ S, |= M φ(p).

In practice, the implicit induction technique is applied on the set E of all instances of the formulas encountered in a proof derivation. The formula φ(p) is one of its initial conjectures and the ordering constraints from the relation ∀δ ∈ E, γ∈E,γ<δ {γ} |= M δ are guaranteed by reductive inference systems. They consist of inference rules representing transitions between states consisting of pairs of sets of formulas of the form (E, H), where E are conjectures and H are premises. By applying an inference rule, one of the conjectures, called current conjecture, is firstly transformed into a (potentially empty) set of new conjectures, then it may be added to the set of premises in order to participate to further transformations. A derivation is a successive application of inference rules. A proof of a set of formulas E 0 produced with the inference system J is a finite n+1-state derivation of the form (E 0 , ∅) J (E 1 , H 1 ) J . . . J (∅, H n ).

An inference system is sound if the minimal counterexamples are persistent in any derivation, i.e., whenever the current conjecture has a minimal counterexample, an equivalent one exists in the set of conjectures from a future state.

Theorem 5 Let I be a sound inference system. For any proof (E 0 , ∅) I . . .

I (∅, H n ), we have |= M E 0 .
Proof By contradiction, assume that E 0 has a false formula, hence a counterexample. By Lemma 1, in the set E there exists a minimal counterexample φ. Since I is sound, this counterexample is persistent and should be among the ground instances of the conjectures from the last state of the proof. Contradiction, since the proof finishes with an empty set of conjectures.

A simple sound inference system is I:

Generate: (E ∪ {φ}, H) I (E ∪ Ψ, H ∪ {φ}),
where Ψ is a strict cover set of φ. Simplify:

(E ∪ {φ}, H) I (E ∪ Φ, H), if (E ∪ Φ ∪ H) ≤φ |= M φ.
By Ψ ≤ψ (resp. Ψ <ψ ) are denoted the instances of formulas from Ψ that are smaller than or equal to (resp. strictly smaller than) ψ. The Generate rule replaces the current conjecture with a strict cover set of it, then adds it to the set of premises. Simplify replaces φ from the state

(E ∪ {φ}, H) with Φ if φ is a consequence of the set of IHs (E ∪ Φ ∪ H) ≤φ .
Lemma 2 The premises from any I-derivation starting with an empty set of premises do not have minimal counterexamples.

Proof Let us notice that the premises from any derivation that starts with an empty set of premises are added exclusively by Generate. By contradiction, assume that Generate applies on a current conjecture φ that has a minimal counterexample φτ . By definition, the strict cover set Ψ for φ has a formula γ that covers φτ , i.e., there is a cover substitution σ and another substitution such that φσ ≡ φτ and γ<φσ {γ} |= M φσ. Thanks to the 'stability under substitutions' property of <, we have I is an inference system that abstracts the computation, hence it cannot be used in practice. Its main role is to capture the induction reasoning by defining the formulas that can be used as IHs during a proof. Its concrete implementations show how the current conjecture is transformed, by the means of adequate reasoning techniques that may use the IHs defined by the implemented (abstract) inference rules. In addition, any such concrete implementation of I is sound since I has been shown sound by Theorem 6. The equality x + 0 = x from the running example can be proved with the inference system I i that allows to reason on equalities containing natural variables:

GenNat (G): (E ∪ {φ}, H) Ii (E ∪ {φ 1 , φ 2 }, H ∪ {φ}),
where φ has a natural variable that is instantiated by 0 and S(x ) and x is a fresh variable; φ 1 , φ 2 are the result of rewriting the instances of φ with axioms. SimpEq (S ):

(E ∪ {φ}, H) Ii (E ∪ Φ, H),
if either i) φ is a tautology; in this case Φ is empty; or, ii) φ is rewritten to ψ with rewrite rules from Ax ∪ (E ∪ Φ ∪ H) ≤φ ; in this case, Φ is {ψ}.

GenNat builds a strict cover set of an equality integrating a natural variable by firstly replacing the variable by 0 and the successor of a fresh natural variable, then rewriting the two instances by the rewrite rules resulted from orienting the axioms from left to right whenever the lhs is greater than the rhs. The rewriting results are stored as new conjectures and the equality as a new premise. Therefore, it implements Generate. On the other hand, SimpEq implements Simplify. It either deletes the tautologies or performs rewrite operations based on the same ordering over equalities mentioned in the footnote 6, and on the IHs defined by Simplify.

Example 6 (I i -proof of x + 0 = x) Let 0 + x → x and S(x) + y → S(x + y) be the two rewrite rules resulting from orienting from left to right the axioms defining '+'. The equality x+0 = x can be proved with I i , as follows:

({x + 0 = x}, ∅) G Ii ({0 = 0, S(x +0) = S(x )}, {x+0 = x}) S Ii ({S(x + 0) = S(x )}, {x+ 0 = x}) S Ii ({S(x ) = S(x )}, {x + 0 = x}) S Ii (∅, {x + 0 = x}).
In the derivation, the current conjectures from every state are underlined. The induction reasoning is performed during the second last SimpEq application: the instance x + 0 = x of the premise x + 0 = x is applied as IH in order to reduce S(x + 0) = S(x ) to the identity S(x ) = S(x ). Since I i is an instance of I, it is sound, so x + 0 = x is valid, by Theorem 5.

We present a more effective inference system, denoted by I s , that instantiates I. It integrates the narrowing-based inference rule ConjSup:

1.4. Formula-based Noetherian induction principles

ConjSup (Cs): (E ∪ {φ}, H) Is (E ∪ ∪ n i {φ i }, H ∪ {φ}), where φ i = φ[r i ] p σ i for any rewrite rule l i → r i from Ax such that σ i = mgu(φ|p, l i ) and φ|p, with i ∈ [1..n]
The narrowing operation is based on unification. mgu(s, t) denotes the most general unifier between s and t, for any terms s and t, i.e. the most general substitution σ such that sσ ≡ tσ.

ConjSup is adapted from [START_REF] Comon | [END_REF] to perform conjecture superposition on a set of axioms that is saturated under superposition and equality reasoning.9 It firstly chooses from an equality φ one of the non-variable subterms φ|p at a position p, then unifies it with the left hand sides of all rewrite rules from the axioms. Any time the unification process is successful, the subterm is replaced by the corresponding unification instance of the right-hand side of the rewrite rule and the resulted equality becomes a new conjecture. If the set of new conjectures is not empty, the current conjecture is saved as premise. φ[r i ] p indicates that φ has the subterm r i at position p. In [Stratulat, 2005, Stratulat, 2007], it has been shown that ∪ n i {φ i } from similar narrowing-based inference rules is a strict cover set of φ, as it is the case for ConjSup.

Example 7 (I s -proof of x + 0 = x) The proof starts by applying the rule ConjSup on the subterm x + 0 of x + 0 = x. Since x + 0 unifies with the left-hand sides of the two axioms defining '+', the new conjectures are 0 = 0 and S(x + 0) = S(x ), where x is a fresh variable. x + 0 = x is added to the premises, to finally obtain a result similar to that of GenNat in the precedent I i -proof. The rest of the proof can be successfully done as for the I s -proof if I s integrates a rule like SimpEq.

In practice, ConjSup may generate less new conjectures than GenNat. For example, if S(u) + 0 = S(u) is the current conjecture, ConjSup will generate the singleton {S(u+0) = S(u)}, which is equivalent to a rewrite step, while GenNat yields the set of conjectures {S(0 + 0) = S(0), S(S(u + 0)) = S(S(u))}.

Different sound abstract reductive systems exist in the literature. I is very similar to the Implicit Induction procedure from [START_REF] Bronsard | [END_REF], which is a generalization of the hierarchical induction procedure from [Reddy, 1990] and of the inductive procedures for conditional equalities from [Kounalis and Rusinowitch, 1990b, Bronsard and Reddy, 1991, Bouhoula et al., 1995]. A very general inference system was proposed in [Stratulat, 2001], based on the notion of contextual cover set, that generalizes those of cover set and strict cover set. It is conducted by a methodology to build sound implicit induction procedures using the compositional properties of contextual cover sets. The methodology also allowed to represent saturation-based inference systems as instances of the general inference system [Stratulat, 2005, Stratulat, 2007]. It witnesses that the implicit induction and saturationbased procedures share the same logic. This is not surprising since Bachmair [Bachmair, 1988] and Reddy [Reddy, 1990] already shown that the set of critical pairs generated by completion can build (strict) cover sets.

When dealing with equality reasoning, the reductive constraints between the current and new conjectures can be implicitly satisfied by the reductive inference rules if the equational specifications are represented in terms of rewrite systems and the IHs are orientable, as for the inductionless induction methods. Various solutions have been proposed to partially weaken the constraints related to IHs. In [Stratulat, 2008], the proposed method allows for relaxed rewriting [Bouhoula et al., 1995] to deal with unorientable IHs by integrating explicit induction schemas when building cover sets. It covers the term [Reddy, 1990], ordered [START_REF] Dershowitz | [END_REF], enhanced and incremental [Aoto, 2006] rewriting induction procedures.

Mutual recursion represents a form of recursion for which data types or functions are mutually defined. It is ubiquitous in computer science. Crucial data structures like graphs, forests of trees and some programming language constructions, as the set of syntax rules using the BNF notation, can be naturally represented as mutually recursive data types. On the other hand, the mutually recursive functions, very common in functional programming, can code effectively algorithms based on (mutually) recursive data structures. Mutual induction is the most natural induction technique to reason on datatypes and functions defined using mutual recursion.

The formula-based Noetherian induction reasoning can involve instances of different formulas, which makes easy the management of mutual induction [Stratulat, 2010]. As shown below, any term-based Noetherian induction principle can be represented as formula-based one but the instantiation constraints are so strong that the ability to perform mutual induction is lost. This instantiation result argues a certain resemblance between (parts of) implicit and conventional induction proofs, firstly advocated in Musser's paper [Musser, 1980]. For example, the I-proof of the running example is very similar to the term-based version; as for an explicit induction schema, Generate instantiates variables and adds the current conjecture in the set of premises, but the resemblance stops here. [Sprenger and Dam, 2003] and [Brotherston and Simpson, 2011] include similar instantiation results. Also, the formula-based Noetherian induction procedures can perform lazy induction such that the IHs are provided by request. For example, during any of the proofs of x + 0 = x with formula-based Noetherian induction methods, the smaller instances of previous conjectures to be applied as IH are needed to be known only at the moment of their application.

In some cases, the implicit induction proofs are more automatic than those based on conventional induction [START_REF] Bouhoula | [END_REF], in other cases the contrary happens [START_REF] Kapur | [END_REF].

Further analyses and comparisons have been conducted in [Garland and Guttag, 1988, Jouannaud and Kounalis, 1989, Kapur and Zhang, 1994, Naidich, 1996, Comon, 2001, Wirth, 2005].

The following theorem is important from both theoretical and practical points of view. In practice, the term-based Noetherian induction reasoning can therefore be directly integrated by formula-based Noetherian induction inference systems. Unfortunately, the opposite holds only for particular cases.

Theorem 8 The formula-based Noetherian induction principle can be represented as a term-based Noetherian induction principle if E consists only of instances of a same formula.

Proof The formula-based Noetherian induction principle that proves the validity of a non-empty set of instances of some formula φ is formalized as following: if for any formula φ(m) ∈ E,

φ(k)∈E,φ(k)< f φ(m) {φ(k)} |= M φ(m) then we have |= M φ(p), ∀φ(p) ∈ E. Let E be the set {p | φ(p) ∈ E}.
The equivalent term-based Noetherian induction principle can be stated as: if for any term vector m ∈ E , φ(k)∈E ,k<tm {φ(k)} |= M φ(m) then we have |= M φ(p), ∀p ∈ E , where k < t m is defined as φ(k) < f φ(m).

Conclusions

We have given an overview of the Noetherian induction proof methods for first-order logic and termgenerated models. We compared different instances of the Noetherian induction principle and inference systems based on them. A crucial step was to abstract the computation in order to distile the induction reasoning from the implementation details. Some examples of concrete implementations instantiating the abstract inference systems are presented, but most of the problems and challenges that face current implementations are not discussed here (see, e.g., [Gramlich, 2005] for an overview).

2

A Cyclic and Non-reductive Formula-based Noetherian Induction Proof Method This chapter presents a formula-based Noetherian induction proof method that is cyclic and nonreductive, published in [Stratulat, 2012].

Structure of the chapter. The chapter has six sections. Sections 2.1 and 2.2 present an inference system and proof strategy, respectively, for building cyclic and non-reductive formula-based proofs. The definition of a cycle, the soundness proof of the inference system and the connections between reductive and non-reductive proofs are given in Section 2.3. A full example of proof using this method and requiring mutual induction reasoning is presented in Section 2.4. Section 2.5 compares implicit proofs and proofs built with an implementation of the method and the DRaCuLa strategy in the SPIKE theorem prover [Bouhoula et al., 1992, Stratulat, 2001, Barthe and Stratulat, 2003] for the validation of a non-trivial application. Section 2.6 concludes.

The inference system

The features of formula-and term-based Noetherian induction proof techniques mutually complement each other. In the following, we propose a new induction proof method which preserves the advantages of conventional and implicit induction techniques. The heart of the method is the DRaCuLa strategy, designed for performing:

• formula-based 'Descente Infinie' / Noetherian induction,

• Rarefied ordering constraints by reductive-free induction,

• Customized term-based Noetherian induction, and • Lazy and mutual induction.

A DRaCuLa-based inference system consists of a set of inference rules representing transitions between sets of conjectures. We introduce the inference system D made of three non-reductive abstract inference rules:

Deduction (D): E ∪ {φ} D E ∪ Φ, if Φ |= φ. Split (S ): E ∪ {φ} D E ∪ Φ,
if Φ is a cover set of φ with at least two elements.

Induction (I ): E ∪ {φ} D E ∪ Φ, if Φ ∪ Ψ |= M φ and Ψ is a non-empty set of checked IHs.
Deduction (resp. Split) replaces the current conjecture by new formulas for which it is a deductive consequence (resp. by one of its cover sets). In addition, Split is intended to deal with variable instantiations during a proof derivation, hence the requirement for the cover set to have at least two elements. Induction treats the case when IHs are needed to build the new conjectures, but it can be applied only when the IHs are checked according to the DRaCuLa strategy.

It is assumed that each conjecture φ has attached a history consisting of a list of conjecture instances represented as pairs (φ i , σ i ) and involved in producing φ. Formally, it is denoted by --------------→ ...(φ i ,σ i )(φ i+1 ,σ i+1 )... φ, where the history is shown under the horizontal arrow pointing to φ. The time flows from left to right, for example φ i was created before φ i+1 . The conjectures from the history of φ are its ancestors. Each instantiating substitution from the history is an identity substitution, excepting when Split is applied. For this case, the cover substitution involved in producing φ is considered instead. The offsprings of a formula φ are all formulas from a derivation having φ in the history. In addition, φ has attached a set of IHs to be checked before Induction can be applied.

The DRaCuLa proof strategy

When a proof starts, the history and the set of attached IHs for each conjecture from the set of initial conjectures E 0 are empty. The DRaCuLa strategy mingles proof development, as implemented by the procedure 'Develop' (see Algorithm 1), with IH checking performed by the function 'Check' (see Algorithm 2). Algorithm 1 applies D-inference rules one by one starting from E 0 . The application of any Induction rule E ∪ {φ} I D E ∪ Φ attaches the set Ψ of IHs to φ and is delayed until all IHs from Ψ are checked. In this case, φ is in stand-by and no other rule rule can be applied to it as long as the set of attached IHs is not completely checked. Any IH is an instance (φ 1 , δ), where φ 1 is a previous conjecture encountered in the derivation. Two cases may arise for successfully checking (φ 1 , δ): i) if φ 1 was already proved, i.e., φ 1 has no offsprings in E, and ii) if (φ 1 , δ) is part of a cycle built from φ and other conjectures in stand-by. Otherwise, the proof keeps developing other conjectures, hoping that the newly added conjectures build cycles that successfully check (φ 1 , δ). The proof process successfully finishes when the set of conjectures becomes empty. Also, the proof development may be blocked if all conjectures from the current state are in stand-by. In practice, the deadlock can be avoided since other rules like Split and Deduction can be applied on the stand-by conjectures if the set of attached IHs is reinitialized. Finally, a proof may run infinitely if a crucial IH cannot be checked.

Definition 1 (n-cycle) Let us consider n conjectures φ 1 , . . . , φ n such that, for each i ∈ [1..n], φ i is explicitly represented with its history chunk involved in the cycle as

θi=σ 1 i ...σ m i i -------------→ (φ 1 i ,σ 1 i )...(φ m i i ,σ m i i )
φ i and has attached the IH (φ

from E, --------------→ ...(φ 1 i ,σ 1 i )...(φ m 1 i ,σ m 1 i ) φ i , i ∈ [1..n]
if (φ 1 1 , δ 1 ) ∈ IHS and is attached to φ n and φ 1 1 δ 1 is smaller than φ 1 n θ n , where θ n is the cumulative substitution σ

1 n . . . σ mn n then if n == 1 then { 1-cycle is found ! } ok IHs := ok IHs ∪ {(φ 1 1 , δ 1 )} IHS := IHS \ {(φ 1 1 , δ 1 )} else if for each i ∈ [1..n -1]: (φ 1 i+1 , δ i+1
) ∈ IHS and is attached to φ i , and φ 1 i+1 δ i+1 is smaller than

φ 1 i θ i , where θ i is the cumulative substitution σ 1 i . . . σ mi i then {n-cycle (n > 1) is found ! } ok IHs := ok IHs ∪ ∪ n i=1 {(φ 1 i , δ i )} IHS := IHS \ ∪ n i=1 {(φ 1 i , δ i )} end if end if end if until no cycle is found return ok IHs Figure 2.1 illustrates a n-cycle.
The relation between the conjecture attaching an IH and the IH is graphically represented with a non-horizontal arrow. The cumulative substitution θ i written above the horizontal arrow pointing to a conjecture φ i allows to produce it from φ 1 i θ i using a Split-free derivation, for any i ∈ [1..n]. The main strength of the method is the fact that the induction reasoning involves only ordering constraints between instances of the conjectures starting the history chunks.

Implementation in SPIKE. The DRaCuLa strategy has been implemented in the SPIKE implicit induction prover. More details about its usage are given in Chapter 4.

. . . ∪ { θ1=σ 1 1 ...σ m 1 1 -------------→ (φ 1 1 ,σ 1 1 )...(φ m 1 1 ,σ m 1 1 ) φ 1 } I D . . . ∪ Φ 1 s.t. (φ 1 2 , δ 2 ) ∈ Ψ 1 δ2 w w . . . ∪ { θ2=σ 1 2 ...σ m 1 2 -------------→ (φ 1 2 ,σ 1 2 )...(φ m 2 2 ,σ m 2 2 ) φ 2 } I D . . . ∪ Φ 2 s.t. (φ 1 3 , δ 3 ) ∈ Ψ 1 δn ... w w . . . ∪ { θn=σ 1 n ...σ m 1 n -------------→ (φ 1 n ,σ 1 n )...(φ m 1 n ,σ m 1 n ) φ n } I D . . . ∪ Φ n s.t. (φ 1 1 , δ 1 ) ∈ Ψ n δ1 s s

Building cycles

The cycle identification process may be costly if there are considered all the permutations built from subsets of the stand-by conjectures from the current state. Since each permutation represents a potential cycle, all the ancestors of the conjectures from the permutation may be tested to satisfy the ordering constraints. A more efficient alternative that avoids this combinatorial explosion problem is to build cycles incrementally and by need, as follows. Anytime a new IH (φ, δ) attached to a conjecture φ 0 is about to be checked and φ is not yet proved, the strategy for choosing the current conjecture privileges the offsprings of φ from the current state that already participate in the cycle. If the corresponding ordering constraints are satisfied, the cycle is built. Otherwise, the ordering constraint related to the conjecture initiating the history chunk of φ 0 will be verified. If it is satisfied, a new history chunk starting with φ is added to the cycle. In this case, the proof of the offspring of φ continues to be developed until either it is proved, or a new IH required during the proof development is to be checked as previously. If the ordering constraint is not satisfied, Induction cannot be applied on φ and the proof of φ continues to be developed either by checking other IHs or by applying a rule other than Induction.

Definition 2 (D-proof ) Any D-derivation built by Develop(E 0 ) and finishing with an empty set of conjectures is a D-proof of E 0 , for any set of conjectures E 0 .

Theorem 9 (soundness of D) For any set of conjectures E 0 , if there is a D-proof of E 0 then |= M E 0 .

Proof By contradiction, assume that there is φ 0 ∈ E 0 such that |= M φ 0 . Since Develop(E 0 ) builds a derivation that finishes with an empty set of conjectures, there is a last step in the derivation when a false conjecture, denoted by φ , was processed. The applied rule is neither Deduction, nor Split because another false conjecture would be in the next step. So Induction has to be applied on φ . The derivation should include at least one cycle checking IHs attached to false conjectures such that the new conjectures resulted from the application of the Induction rules from the cycle are true. Otherwise, the derivation does not perform inductive reasoning. More exactly, it can be transformed into a hierarchy of deductive proofs of conjectures from the proof of E 0 , where the IHs are lemmas resulted from previously (deductively) proved conjectures, as follows. All the proofs that did not use IHs are at the bottom of the hierarchy, so they are true. The next upper level in the hierarchy consists of all proofs using as lemmas the conjectures proved at the bottom level, so they are true, too. And so on, by stepping up in the hierarchy level by level, the current level proofs use as lemmas only conjectures proved at a lower level.

The hierarchy is bounded since the proof of E 0 has a finite number of conjectures. It results that all conjectures from the proof of E 0 , including φ 0 , are true. Contradiction, since φ 0 is false. A classical induction reasoning will be performed on the number of cycles checking IHs attached to false conjectures in the proof of E 0 .

The base case: We assume that there is only one n-cycle checking IHs attached on false conjectures such that for each i ∈ [1..n], φ i is explicitly represented in the cycle as

θi=σ 1 i ...σ m i i -------------→ (φ 1 i ,σ 1 i )...(φ m i i ,σ m i i )
φ i and has

attached the IH (φ 1 (i+1) mod n , δ (i+1) mod n ). Moreover, φ 1 (i+1) mod n δ (i+1) mod n is smaller than φ 1 i θ i , for any i ∈ [1..n].
Any false instance of φ 0 should lead to one of the conjectures from the n-cycle, otherwise an extra cycle including false conjectures should exist in the proof. More exactly, for any counterexample φ 0 τ 0 , there is a conjecture φ from the n-cycle whose history is of the form -----------------→ (φ 0 ,σ 0 )(φ 1 ,σ 1 )......(φ p ,σ p ) φ and φ 0 τ 0 is an instance of φ 0 σ 0 . Moreover, any conjecture instance φ i θ i is false, where θ i is the cumulative substitution between φ i and φ, for all i ∈ [1..p]. Otherwise, an extra cycle including false conjectures should exist in the proof, which leads to a contradiction. W.l.o.g, we assume that φ is represented in the n-cycle by φ n and the Induction rule applied on φ n is E n ∪ {φ n } I D E n ∪ Φ n using the non-empty set Ψ n of IHs such that Φ n ∪ Ψ n |= M φ n and |= M φ n . Φ n is valid, otherwise there is an extra cycle including false conjectures which is applied in the proof of Φ n . Since Φ n is valid and Φ n ∪ Ψ n |= M φ n , there is a false IH in Ψ n . We can show that the IHs from Ψ n , different from (φ 1 1 , δ 1 ), are true. More exactly, if (ψ, δ) is such an IH, it cannot be proved only with deductive reasoning, so there should exist a new cycle checking ψ. This cycle cannot have false conjectures, so it includes neither φ n nor any false offsprings of ψ. Therefore, ψ is true, which also holds for ψδ. We conclude that (φ 1 1 , δ 1 ) is the only false IH attached to φ n .

The history chunk of φ n is represented in the n-cycle as

θn=σ 1 n ...σ mn n --------------→ (φ 1 n ,σ 1 n )...(φ mn n ,σ mn n ) φ n . Since φ 1 n θ n is false, let φ 1
n θ n τ be a minimal counterexample of it. Moreover, φ n τ is a counterexample because no cycle including false conjectures can be built on the path leading from φ 1 n σ 1 n to φ n . Thanks to the 'stability under substitutions' property of the induction ordering, we deduce that φ 1 1 δ 1 τ is false and smaller than φ 1 n θ n τ . For similar reasons, it cannot be proved outside the n-cycle, so it is an instance of φ 1 1 θ 1 . Let this false instance be φ 1 1 θ 1 τ 1 such that φ 1 1 θ 1 τ 1 ≡ φ 1 1 δ 1 τ . A similar reasoning is performed on φ 1 1 θ 1 τ 1 as for φ 1 n θ n τ to show that there is a false instance φ 1 2 θ 2 τ 2 ≡ φ 1 2 δ 2 τ 1 which is smaller than φ 1 1 θ 1 τ 1 . And so on, there is a false instance

φ 1 n θ n τ n ≡ φ 1 n δ n τ n-1 which is smaller than φ 1 n-1 θ n-1 τ n-1
. By the transitivity of the ordering, we have that φ 1 n θ n τ n is smaller than φ 1 n θ n τ . Moreover, it is false, so contradiction with the minimality assumption of φ 1 n θ n τ . The step case: We assume that Develop(E 0 ) has produced a proof having m (> 1) cycles including false conjectures. By induction hypothesis, any proof using a smaller number of cycles with false conjectures is sound.

We follow a reasoning similar to that employed for the base case. We will focus on the last generated cycle from the proof of E 0 having false conjectures. Assuming that it is built from n (> 1) conjectures, each φ i with i ∈ [1..n] is explicitly represented as

θi=σ 1 i ...σ m i i -------------→ (φ 1 i ,σ 1 i )...(φ m i i ,σ m i i )
φ i and has attached the IH

(φ 1 (i+1) mod n , δ (i+1) mod n ). Moreover, φ 1 (i+1) mod n δ (i+1) mod n is smaller than φ 1 i θ i , for any i ∈ [1..n].
It can be noticed that any false instance of φ 0 should lead to one of the conjectures from the n-cycle, otherwise the proof of such a false instance should have 'less than m' cycles having false conjectures since the last cycle is not included in the proof. By the induction hypothesis, the proof is sound, so contradiction with the assumption that the instance of φ 0 is false. Therefore, for any counterexample φ 0 τ 0 that is instance of φ 0 σ 0 , there is a conjecture φ from the n-cycle whose history is of the form -----------------→ (φ 0 ,σ 0 )(φ 1 ,σ 1 )......(φ p ,σ p ) φ. In addition, any conjecture instance φ i θ i is false, where θ i is the cumulative substitution between φ i and φ, for all i ∈ [1..p]. Otherwise, φ 0 τ 0 can be proved with 'less than m' cycles having false conjectures, so contradiction.

Again, we assume that φ is represented in the n-cycle by φ n and the Induction rule applied on φ n is E n ∪ {φ n } I D E n ∪ Φ n using the non-empty set Ψ n of IHs such that Φ n ∪ Ψ n |= M φ n and |= M φ n . Φ n is valid, otherwise there is an extra cycle including false conjectures which is applied in the proof of Φ n which contradicts the assumption that the n-cycle is the last generated one in the proof of E 0 . Since Φ n is valid and Φ n ∪ Ψ n |= M φ n , there is a false IH in Ψ n . The IHs from Ψ n , excepting (φ 1 1 , δ 1 ), are true. More exactly, if (ψ, δ) is such an IH, it has to be proved with 'less than m' cycles having false conjectures since the n-cycle cannot be included in the proof, i.e., either (ψ, δ) is checked by a cycle including φ n and generated before the n-cycle, or ψ was proved before generating the n-cycle. For the last case, ψ is true by induction hypothesis, which also holds for ψδ. We conclude that (φ 1 1 , δ 1 ) is the only false IH attached to φ n .

As for the base case, we represent the history chunk of φ n from the n-cycle as

θn=σ 1 n ...σ mn n --------------→ (φ 1 n ,σ 1 n )...(φ mn n ,σ mn n ) of φ 1 n θ n τ .
The DRaCuLa-based n-cycles from the D-proofs, for short D-cycles when n is not relevant, need less ordering constraints than the reductive cycles encountered in reductive induction derivations, for example the implicit induction and 'cyclic' proofs. More exactly, a reductive cycle requires that, for any history chunk ----------------→

(φ 0 ,σ 0 )(φ 1 ,σ 1 )...(φ m ,σ m )
φ with m > 0, φ i σ i to be greater than or (sometimes) equal to φ i+1 , for all i ∈ [0..m -1]. Moreover, φ m σ m should be greater than (or equal to) φ. As for the D-cycles, the IHs are instances of previous conjectures starting a history chunk, but they are required to be smaller than or equal to the conjecture they are applied to.

Lemma 3 Any reductive n-cycle with an average of m conjectures per history chunk should satisfy (m + 1) × n ordering constraints.

Proof There are n × m ordering constraints concerning the conjectures from the history chunks, and n ordering constraints related to the IHs.

For example, there is only one reductive cycle in the

I i i -proof of x + 0 = x from Example 6: θ={x →S(x )} -------------→ (x+0=x,{x →S(x )}) S(x + 0) = S(x ) δ={x →x } d d
The two associated ordering constraints are: S(x ) + 0 = S(x ) greater than S(x + 0) = S(x ) which should be greater than x + 0 = x .

Lemma 4 Any DRaCuLa-based n-cycle should satisfy n ordering constraints.

Proof By the construction of D-cycles.

One possible D-proof of x + 0 = x can be built with the concrete inference system D c :

DedNat (D c ): E ∪ {φ} Dc E ∪ Φ, if either i) φ is a tautology; in this case Φ is empty, or ii) φ is rewritten by rewrite rules from Ax to ψ; in this case Φ is {ψ}. SplitNat (S c ): E ∪ {φ[x]} Dc E ∪ {φ[0], φ[S(x )]},
where x is a fresh natural variable.

IndNat (I c ): E ∪ {φ} Dc E ∪ Φ, if φ is rewritten with an IH that is checked by a D-cycle. Example 8 (D c -proof of x + 0 = x) The generated proof is: {x + 0 = x} Sc Dc {0 + 0 = 0, S(x ) + 0 = S(x )} Dc(2) Dc {S(x ) + 0 = S(x )} Dc Dc {S(x + 0) = S(x )} Ic Dc {S(x ) = S(x )} Dc Dc ∅.
Dc( 2) Dc means that DedNat firstly rewrites with the axioms defining '+ , then deletes the resulted tautology. The IH from the IndNat step is checked by the D-cycle:

θ={x →S(x )} ------------------------------→ (x+0=x,{x →S(x )});(S(x )+0=S(x ),{x →x }) S(x + 0) = S(x ) δ={x →x } i i
Even if the history chunk has more conjectures, there is only one ordering constraint to be satisfied, i.e., x + 0 = x should be smaller than S(x ) + 0 = S(x ).

DedNat (resp. SplitNat, resp. IndNat) implements Deduction (resp. Split, resp. Induction). Therefore D c is sound since D is sound, by Theorem 9.

Lemma 5 Any reductive n-cycle is a DRaCuLa-based n-cycle.

Proof Assume that a reductive n-cycle exists, represented as a non-empty list of n conjectures φ 1 , . . . , φ n of the form

θi=σ 1 i ...σ m 1 i --------------→ ...(φ 1 i ,σ 1 i )...(φ m 1 i ,σ m 1 i ) φ i , i ∈ [1..n]. By construction, for each i ∈ [1.
.n], the reductive constraints require that φ k i σ k i be greater than (and sometimes equal to)

φ k+1 i (k ∈ [1..m 1 -1]) and φ m1 i σ m1 i be greater than (or equal to) φ i . By instantiating each φ k i σ k i by σ k+1 i . . . σ m1 i
and due to the 'stability under substitution' of the ordering, it results the decreasing sequence

φ 1 i θ 1 i , φ 2 i θ 2 i , . . . , φ m1 i θ m1 i , φ i , where θ j i is the cumulative substitution σ j i . . . σ m1 i .
By the transitivity of the ordering relation, φ 1 i θ 1 i is greater than φ i . Moreover, by construction, φ i should be greater than or equal to the IH φ 1 (i+1) mod n δ (i+1) mod n . Applying again the transitivity property of the ordering relation,

φ 1 i θ 1 i is greater than φ 1 (i+1) mod n δ (i+1) mod n . Therefore, the reductive n-cycle is a DRaCuLa-based n-cycle since φ 1 i θ 1 i is greater than φ 1 (i+1) mod n δ (i+1) mod n , forall i ∈ [1..n].
Theorem 10 (generalisation of reductive induction) Any reductive induction proof is a D-proof.

Proof Given a reductive induction proof, its reductive cycles can be represented as D-cycles, by Lemma 5. Moreover, the DRaCuLa strategy requires no ordering constraints for the proof parts outside the reductive cycles.

The DRaCuLa-based proofs are more flexible in terms of induction orderings because the ordering constraints inside the D-cycles can be formulated with different induction orderings. This is not the case for the reductive proofs which are governed by only one global induction ordering that should satisfy all the reductive constraints. As a side-effect, the axioms and IHs involved in a proof may satisfy additional constraints. For example, the term ordering used by rewrite-based specifications to orient the axioms into rewrite rules should be compatible with the induction ordering, i.e., the union of the two ordering relations should be an induction ordering. The specifications fitting for DRaCuLa-based reasoning no longer need them, those adapted for term-based Noetherian induction reasoning [Walther, 1994] being good candidates.

Theorem 11 (generalisation of term-based Noetherian induction) Any term-based Noetherian induction proof can be customized to a '1-cycle'-based D-proof.

Proof According to the term-based Noetherian induction principle, one can use φ 1 (k) as IH in the proof of φ 1 (m), as long as k < t m. On the other hand, according to Theorem 7, the ordering constraint can be reformulated using a formula-based Noetherian induction principle as: φ 1 (k) should be smaller than φ 1 (m), by considering the measure value of v as being that for φ 1 (v), for any term vector v. Assuming that φ 1 (k) is an IH attached to the offspring φ f of φ 1 (m), the induction principle can be schematized by the 1-cycle

θ=σ...σ ---------→ (φ 1 σ)...(φ ,σ ) φ f , δ j j where φ 1 (m) is (φ 1 , θ) and φ 1 (k) is (φ 1 , δ).
Example 9 (customisation of a Peano induction proof ) The Peano induction proof of x + 0 = x from Example 4 builds a 1-cycle similar to the D-cycle issued from the reductive I i -proof from Example 6, excepting that the induction ordering is defined over terms. Its customisation to a D-cycle is done by defining the measure value of the equality x + 0 = x as being the term x, for any natural x. Therefore, the constraint 'S(x ) + 0 = S(x ) greater than x + 0 = x ' boils down to 'S(x ) greater than x '.

Managing mutual induction

The following set of axioms mutually defines over the naturals the functions even, odd and their conditional versions even1 and odd1, respectively:

even(0) = T rue (2.1) even(S(0)) = F alse (2.2) even(S(S(x))) = even1(S(S(x)) + 0) (2.3) even1(0) = T rue (2.4) even1(S(0)) = F alse (2.5) odd(x) = F alse ⇒ even1(S(S(x))) = even(x) (2.6) odd(x) = T rue ⇒ even1(S(S(x))) = F alse (2.7) odd(0) = F alse (2.8) odd(S(0)) = T rue (2.9) odd(S(S(x))) = odd1(S(S(x)) + 0) (2.10) odd1(0) = F alse (2.11) odd1(S(0)) = T rue (2.12) even(x) = T rue ⇒ odd1(S(S(x))) = odd(x) (2.13) even(x) = F alse ⇒ odd1(S(S(x))) = T rue (2.14)
It can be noticed that all defined functions are terminating, sufficiently complete and consistent. The conjectures to be proved are: φ 1 1 : even(x + x) = T rue and φ 1 2 : odd(y + y) = F alse, using induction reasoning to be performed w.r.t. the initial model of the axioms. We assume that the previous proved conjecture x + 0 = x is available as lemma, as well as the lemma x + S(y) = S(x + y) which can be similarly proved. The ordering over conditional equalities is the multiset extension of the rpo ordering based on the precedence < F and equivalence ∼ F relations over the function symbols:

T rue < F F alse < F 0 < F S < F + < F (even ∼ F odd ∼ F even1 ∼ F odd1).
The cyclic proof can be done using the inference system D c if it is extended with the following rule:

DedCase (D c ): E ∪ {φ} Dc E ∪ Φ,
if a case analysis is performed on φ with rewrite rules from Ax; in this case, Φ is made of the rewriting results.

The rewrite rules used by DedCase are conditional, of the form d 1 = T rue ⇒ l 1 = r 1 and d 2 = F alse ⇒ l 2 = r 2 such that both d 1 and d 2 , resp. l 1 and l 2 , are equal modulo renaming using the same renaming substitution. The case analysis is done as follows: if φ is an equality of the form u = v such that u can be matched by l 1 and l 2 with the substitutions σ 1 and σ 2 , respectively, then Φ consists of the set {d

1 σ 1 = T rue ⇒ r 1 σ 1 = v, d 2 σ 2 = F alse ⇒ r 2 σ 2 = v}.
A tautology is an equality of the form t = t, or a conditional equality of the form . . . ⇒ t = t or e ⇒ e, for any term t and equality e.

The initial state of the D c -proof is {φ 1 1 , φ 1 2 }. SplitNat is applied on φ 1 1 to result φ 1 : even(0 + 0) = T rue and φ 2 1 : even(S(x ) + S(x )) = T rue. φ 1 is rewritten by the axioms to the tautology φ 1 : T rue = T rue, then deleted by DedNat. φ 2 1 is rewritten by the lemmas x + S(y) = S(x + y) and x + 0 = x to φ 3 1 : even1(S(S(x + x ))) = T rue. By case analysis with DedCase on φ 3 1 , it results φ 31 1 : odd(x + x ) = F alse ⇒ even(x + x ) = T rue and φ 32 1 : odd(x + x ) = T rue ⇒ F alse = T rue. IndNat is applied on φ 31 1 by rewriting with the IH (φ 1 1 , δ 1 ), where δ 1 = {x → x }. The IH is checked by

φ 1 1 × × φ 1 2 # # φ 1 φ 2 1 θ 1 φ 2 2 θ 2 φ 2 φ1 φ 3 1 × × # # φ 3 2 × × # # φ2 φ 31 1 δ 1 R R φ 32 1 δ 2 c c φ 31 2 δ 1 φ 32 2 δ 2 j j φ 311 1 φ 321 1 φ 311 2 φ 321 2 Figure 2.2: The skeleton of the D c -proof. the 1-cycle represented by θ1={x →S(x )} -------------------→ (φ 1 1 ,{x →S(x )})(φ 2 1 ,id)(φ 3 1 ,id) φ 31 1 since φ 1 1 δ 1 is smaller than φ 1 1 θ 1 .
The rewriting operation produces the tautology φ 311 1 : odd(x + x ) = T rue ⇒ T rue = T rue which is deleted by DedNat. Then, IndNat is expected to be applied on φ 32 1 by rewriting this time with the IH (φ 1 2 , δ 2 ), where δ 2 = {y → x }. Hence, φ 32 1 is put in stand-by and the proof of φ 1 2 starts by following similar steps as for φ 1 1 . Firstly, SplitNat is applied to result φ 2 : odd(0+0) = F alse and φ 2 2 : odd(S(y )+S(y )) = F alse. φ 2 is rewritten to the tautology φ 2 : F alse = F alse, then deleted by DedNat. φ 2 2 is successively rewritten by the lemmas to φ 3 2 : odd1(y + y ) = F alse by DedNat, then by case analysis with DedCase to φ 32 2 : even(y + y ) = T rue ⇒ odd(y + y ) = F alse and φ 31 2 : even(y + y ) = F alse ⇒ T rue = F alse. φ 32 2 is further simplified to the tautology φ 321 2 : even(y + y ) = T rue ⇒ F alse = F alse by IndNat with the IH (φ 1 2 , δ 2 ), where δ 2 = {y → y }. The IH is checked by the 1-cycle with the history chunk

θ2={y →S(y )} -------------------→ (φ 1 2 ,{y →S(y )})(φ 2 2 ,id)(φ 3 2 ,id)
φ 32 2 since φ 1 2 δ 2 is smaller than φ 1 2 θ 2 . IndNat can also be applied on φ 31 2 by rewriting with the IH (φ 1 1 , δ 1 ), where δ 1 = {x → y }. The 2-cycle consisting of the history chunks

θ1={x →S(x )} -------------------→ (φ 1 1 ,{x →S(x )})(φ 2 1 ,id)(φ 3 1 ,id)
φ 32 1 and

θ2={y →S(y )} -------------------→ (φ 1 2 ,{y →S(y )})(φ 2 2 ,id)(φ 3 2 ,id)
φ 31 2 can check the two IHs since φ 1 2 δ 2 is smaller than φ 1 1 θ 1 and φ 1 1 δ 1 is smaller than φ 1 2 θ 2 . The two IndNat operations are further applied to give the tautologies φ 321 Let us notice that the conjectures φ 1 1 and φ 1 2 cannot be proved by reductive reasoning since the axioms cannot be simultaneously oriented from left to right and transformed into rewrite rules, in particular (2.3) and (2.6), as well as (2.10), (2.14) and the axioms defining '+'. The D-proof cannot either be redone by term-based Noetherian induction reasoning because of its 2-cycle.

Due to the unorientable axioms 2.3 and 2.10, SPIKE cannot produce an implicit induction proof of the conjectures. However, SPIKE succeeds to reproduce the cyclic proof using the DRaCuLa strategy. The cyclic proof script is available at http://code.google.com/p/spike-prover/.

Representing implicit induction proofs as cyclic proofs

Implicit induction proofs can be represented, as any reductive induction proofs, as D-proofs, according to Theorem 10. Table 2.1 gives some statistics about the implicit induction proofs of a bunch of conjectures involved in the validation process [START_REF] Rusinowitch | [END_REF] protocol [START_REF] Rabadan | [END_REF] using SPIKE.10 It illustrates the name of the conjectures, the number of reductive ordering constraints, the number of IHs and the number of D-cycles. The number of reductive ordering constraints is given by the number of reductive steps in the proof. For example, the implicit induction proof of the conjecture progat insat requires 152 reductive ordering constraints but only 4 applications of IHs.

Interpreting implicit induction proofs as cyclic proofs allows to improve their certification process by Coq, as explained in Chapter 6, where every single proof step should be checked. On the one hand, the number of reductive ordering constraints, as indicated by Lemma 3, can be important. In [Stratulat, 2010], it has been shown that the validation of the ordering constraints for some proofs can last four times longer than for the validation of the deductive reasoning. On the other hand, the validation time can be dramatically reduced if the implicit induction proofs are interpreted as D-proofs because of the small number of non-reductive ordering constraints, as shown by Lemma 4. For example, by inspecting the representation of the proof script of the conjecture progat insat as a D-proof, it has been noticed that only two IHs are checked by 1-cycles, while the other two IHs do not need induction reasoning to be proved. Therefore, the validation process of the D-proof would require to check only 2 non-reductive ordering constraints. The IHs not requiring induction reasoning can be proved in priority using a different proof strategy, then considered as lemmas during the rest of the proof.

Conclusions

We have presented an induction proof technique that captures the first-order induction reasoning by the means of non-reductive cycles which can be built using different formula-based Noetherian induction orderings. It has been shown enough powerful to subsume any term-based and reductive formula-based Noetherian inductive proof methods by combining the best features of conventional and implicit induction proof techniques.

Implemented in SPIKE, the proposed technique can substantially diminish the number of ordering constraints required when certifying implicit induction proofs.

3

Building Term-based Noetherian Induction Proofs for Conjectures Proved with Formula-based Noetherian Induction Principles This chapter presents different applications of Theorem 8, defining the conditions for which formulabased Noetherian induction principles can be directly converted to term-based Noetherian induction principles. We show that this conversion result can be extended at the proof level. Indeed, we give examples where structural induction proofs can be directly built from cyclic induction proofs. On the other hand, we show that the use of the explicit induction schemas, based on the variable instantiation schemas used in cyclic induction proofs, requires user creativity embodied in the definition of new lemmas and for guiding the way the explicit induction schemas are applied.

Structure of the chapter. This chapter has three sections. Section 3.1 reproduces Coq experiments published in [Stratulat, 2016] that aim at building term-based Noetherian induction proofs for conjectures already proved using formula-based Noetherian induction. In Section 3.2, we use the generation of explicit induction principles from formula-based Noetherian induction principles that are lazily built for synthesising sorting algorithms for binary trees. The results have been partially published in [START_REF] Dramnesc | Mechanical synthesis of sorting algorithms for binary trees by logic and combinatorial techniques[END_REF], Dramnesc et al., 2016a, Dramnesc et al., 2016b, Dramnesc et al., 2015a, Dramnesc et al., 2015b, Dramnesc et al., 2015c]. The last section concludes.

Coq experiments

In this section, we firstly define a set of conjectures that can be proved by using cyclic induction, based on the variable instantiation schema of the Peano principle. All cyclic proofs follow a similar scenario. Next, we implement the cyclic induction reasoning in the Coq proof assistant [The Coq development team, 2020]. Finally, we show that the scenarios for proving these conjectures with Peano induction differ in terms of the number of induction steps and lemmas, as well as proof scenario. We identify three conjectures from this set that are hard or impossible to be proved by Peano induction.11 Related works. Previous works have tempted to convert term-to formula-based Noetherian induction proofs. Musser [Musser, 1980] was the first to compare conventional with inductionless induction methods. Since then, a lot of effort was put into clarifying the relations between explicit and implicit induction principles, [Garland and Guttag, 1988, Jouannaud and Kounalis, 1989, Kapur and Zhang, 1994, Naidich, 1996, Comon, 2001, Wirth, 2005] being among the most notable. Other studies have been conducted to reduce the gap between them. Protzen [Protzen, 1994] proposed a proof strategy to perform lazy induction on particular explicit induction proofs. Kapur and Subramaniam [START_REF] Kapur | [END_REF] devised a method that extends schemata-based induction to deal with a special class of mutually defined functions. Courant [START_REF] Courant | Proof reconstruction[END_REF] identified a class of implicit induction inference systems for which the proofs can be reconstructed into conventional induction proofs. Reddy [Reddy, 1990] designed implicit induction inference rules that look similar to schemata-based induction rules. This feature has been implemented by subsequent formula-based induction systems [START_REF] Bronsard | [END_REF], Bouhoula et al., 1992, Avenhaus et al., 2003] to generate more compact and readable proofs. Instantiation results similar to ours have been achieved more recently for particular cases of cyclic proof systems. Sprenger and Dam [Sprenger and Dam, 2003] have shown the equivalence of two Gentzen-style proof systems for first-order µ-calculus with explicit approximations; one of them integrates local term-based induction rules, while the other lacks such induction rules. In turn, the second can build finite ω-regular proof trees for which the induction reasoning is argued by an external global induction discharge condition associated to the proof structure. In the same line, Brotherston and Simpson [Brotherston and Simpson, 2011] compared two classical first-order sequent calculus proof systems; the local induction is performed using conventional induction together with a rule that deals with a class of mutual inductive definitions. In this context, they showed that any proof using local induction arguments can be represented as a proof using global induction arguments and conjectured that the other direction also holds. Later, Berardi and Tatsuta proved that the conjecture does not hold, by providing the 2-Hydra example [START_REF] Berardi | [END_REF].

Defining the set of conjectures. Let R be a set of ternary inductive predicate symbols taking natural numbers as arguments such that each symbol R ∈ R is defined by a set of axioms of the form:

R(0, u, 0) (3.1) R(x 1 , y 1 , y 2 ) ⇒ R(S(x), u, 0) (3.2) R(x 1 , y 1 , y 2 ) ⇒ R(0, u, S(v)) (3.3) R(x 1 , y 1 , y 2 ) ∧ R(x 1 , y 1 , y 2 ) ⇒ R(S(x), u, S(v)) (3.4)
where S is the 'successor' function and the variables x, u, v are universally quantified. The values of the parameters x 1 , y 1 , y 2 and x 1 , y 1 , y 2 of R occurring in the condition part of the axioms are defined in order to satisfy the following ordering constraints: i

) R(x 1 , y 1 , y 2 ) < R(S(x), u, 0), ii) R(x 1 , y 1 , y 2 ) < R(0, u, S(v)), iii) R(x 1 , y 1 , y 2 ) < R(S(x), u, S(v)), and iv) R(x 1 , y 1 , y 2 ) < R(S(x), u, S(v))
, by using a well-founded ordering <. This ordering is defined such

that R(z 1 , z 2 , z 3 ) < R(z 1 , z 2 , z 3 ) if {{z 1 , z 1 }, {z 2 , z 2 , z 3 }} < < {{z 1 , z 1 }, {z 2 , z 2 , z 3 }}, for any naturals z 1 , z 2 , z 3 , z 1 , z 2 , z 3 .
Here, < < is the multiset extension of an ordering over multisets of terms which, in turn, is the multiset extension of the mpo ordering, defined over naturals and denoted by < t , based on the precedence over the function symbols stating that 0 is smaller than S. It can be shown that this mpo ordering is well-founded and satisfies, for example, that 0 < t S(x) and x < t S(x), for any natural x. Since every multiset extension of a well-founded ordering is also well-founded, we conclude that < is well-founded. We recall that a multiset A is smaller than another multiset B w.r.t. the multiset extension of some ordering ≺ if, after pairwisely deleting the common elements from A and B we get the multisets A and B , respectively. In addition, for each element x in A , there is an element y in B such that x ≺ y. In our case, the ordering constraints 1. i) and iii) are, respectively, {{x 1 , x 1 }, {y 1 , y 1 , y 2 }} < < {{S(x), S(x)}, {u, u, 0}} and {{x 1 , x 1 }, {y 1 , y 1 , y 2 }} {{S(x), S(x)}, {u, u, S(v)}}. They are satisfied if x 1 is an element from {0, u, x} and the pair (y 1 , y 2 ) an element from {(0, 0), (0, x), (x, 0), (0, S(x)), (x, S(x)), (x, x)}. Notice that the pairs of the form (S(x), ) and the pairs including u cannot be assigned to (y 1 , y 2 ); 2. ii) and iv) are, respectively,

{{x 1 , x 1 }, {y 1 , y 1 , y 2 }} < < {{0, 0}, {u, u, S(v)}} and {{x 1 , x 1 }, {y 1 , y 1 , y 2 }} < < {{S(x), S(x)}, {u, u, S(v)}}. They are also satisfied if x 1 is an el- ement from {0, u, v} and (y 1 , y 2 ) is from {(0, 0), (0, u), (0, v), (u, v), (v, u), (u, 0), (v, 0), (v, v)}. The pair (u, u) cannot be assigned to (y 1 , y 2 ).
Therefore, the set R will have 3 × 6 × 3 × 8 = 432 inductive predicate symbols. Finally, the set of conjectures for our purpose is {∀x u v, R(x, u, v) | R ∈ R}.

Proving by cyclic induction

For any R ∈ R, the conjecture ∀x u v, R(x, u, v) can be proved by cyclic induction reasoning using only variable instantiations and unfoldings with the axioms defining R, as shown in the proof digraph from Figure 3.1.

R(x, u, v) {x →0} w w {x →S(x )} A A R(0, u, v) {v →0} z z {v →S(v )} R(S(x ), u, v) {v →0} {v →S(v )} C C R(0, u, 0) R(0, u, S(v )) R(S(x ), u, 0) u u R(S(x ), u, S(v )) s s R(x1, y1, y2) {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } i i R(x 1 , y 1 , y 2 ) {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } s s R(x1, y1, y2) {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } R(x 1 , y 1 , y 2 ) {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } {x →x 1 ;u →y 1 ;v →y 2 } d d Figure 3.1: The digraph of the cyclic proof of ∀x u v, R(x, u, v), for any R ∈ R.
The root node is labeled by R(x, u, v), the other nodes being labeled by inductive atoms that are instances of it. Each non root-node n is pointed by a solid arrow starting from some other node n . If p is the inductive atom labelling n , then the inductive atom labelling n results either i) by instantiating some variable from p by 0 and S(x), where x is a fresh variable, or ii) by unfolding p using one of the conditional axioms (3.3)-(3.4). In the first case, the instantiating substitution annotates the corresponding solid arrow. The inductive atom labeling each leaf node either instantiates (3.1) or the inductive atom labeling the root node. In the last case, a dashed arrow is firstly created by leading the leaf node to the root node, then annotated with the instantiating substitution, written in boldface.

The proof digraph from Figure 3.1 contains cycles by following the arrows in the digraph. In general, not all proof derivations, for which the root formula is instantiated by leaf formulas, are sound. In our case, the soundness is guaranteed by the ordering constraints i) -iv), as shown by the cyclic induction method from [Stratulat, 2012], also presented in Chapter 2.

Chapter 3. Building Explicit Induction Proofs for Conjectures Proved with Cyclic Induction

The Coq implementation. Let us assume that R is one of the inductive predicates symbols from R, defined by the axioms:

R(0, u, 0) (3.5) R(u, x, S(x)) ⇒ R(S(x), u, 0) (3.6) R(v, u, v) ⇒ R(0, u, S(v)) (3.7) R(u, x, S(x)) ∧ R(v, u, v) ⇒ R(S(x), u, S(v)) (3.8)
We will show how the cyclic induction reasoning for proving ∀x u v, R(x, u, v) can be certified in Coq.

R can be specified in Coq as an inductive predicate, denoted here by R:

Inductive R: nat → nat → nat → Prop := r 1: ∀ u, R 0 u 0 | r 2: ∀ x u, R u x (S x ) → R (S x ) u 0 | r 3: ∀ u v, R v u v → R 0 u (S v ) | r 4: ∀ x u v, R u x (S x ) → R v u v → R (S x ) u (S v ).
The scenario from the cyclic proof from Figure 3.1 can be reproduced if the conjecture to be proved is (temporarily) considered as an hypothesis before its usage.

Hypothesis R admitted : ∀ x u v, R x u v. Theorem R assumption: ∀ x u v, R x u v. Proof.
destruct x ; intros.

-Case "x=0". destruct v. + SCase "v=0". apply r 1. + SCase "v=S v". apply r 3. apply R admitted . -Case "x=S x". destruct v.

+ SCase "v=0". apply r 2. apply R admitted . + SCase "v=S v". apply r 4; apply R admitted .

Qed.

The tactic destruct, when applied on a natural variable v, instantiates it by 0 and (S v).

It can be easily noticed that the cycles from the proof digraph from Figure 3.1 form a unique strongly connected component, i.e., a maximal sub-graph such that, given any two different nodes in it, there is a path between them in each direction. The induction reasoning performed along these cycles can be captured by an explicit induction schema issued from the definition of a terminating and recursive boolean function, denoted by f P, taking as argument a triplet of naturals.

Function f P (a: nat × nat × nat) {wf (fun u v : nat× nat×nat ⇒ match u,v with (u1 , x1 , y1 ), (u2 , x2 , y2 ) ⇒ mless ({{[u1 , u1 ]}} + {{[x1 , x1 , y1 ]}}) ({{[u2 , u2 ]}} + {{[x2 , x2 , y2 ]}}) end) a}: bool := match a with | (x' , y) ⇒ match x' with | (u, x ) ⇒ match u, x, y with | 0, , 0 ⇒ true | (S x ), u, 0 ⇒ f P (u, x , (S x )) | 0, u, (S v ) ⇒ f P (v , u, v ) | (S x ), u, (S v ) ⇒ andb (f P(v , u, v )) (f P(u, x , (S x ))) end end end.
The function f P firstly decomposes the triplet given as argument, then performs a case analysis on the resulting naturals to finally get a different (functional) representation of the definition of R.

As any function whose definition is accepted by Coq, f P should terminate. The Coq environment generates proof obligations requiring that its argument should decrease after each recursive call w.r.t. the well-founded ordering provided after the wf keyword, where mless is the multiset extension of the multiset extension of the 'less than' syntactic ordering over naturals, defined using the CoLoR library [Blanqui and Koprowski, 2011]. 12 Once the proof obligations are discharged, Coq automatically generates a functional (induction) schema f P ind.

An explicit induction proof can be built for the theorem RP true which is similar to R assumption when using RP, the version of R with only one (triplet) argument.

Definition RP z := R (fst (fst z )) (snd (fst z )) (snd z ).
Theorem RP true: ∀ u x y, RP (u, x , y). Proof.

intros u x y. pattern (u, x , y). pattern (f P (u, x , y)). apply f P ind; intros; unfold RP; simpl. (* apply the induction schema *) apply r 1.

(* follow the cyclic proof *) apply r 2; unfold RP in H ; simpl in H ; trivial. apply r 3. unfold RP in H ; simpl in H. trivial. apply r 4; unfold RP in H0 ; simpl in H0 ; trivial. Qed.

Finally, the R admitted hypothesis can be proved.

Theorem R admitted:

∀ x u v, R x u v.
(* the proof follows directly from RP true *)

Similarly, ∀ x u v, R (x, u, v) can be certified in Coq, for any R ∈ R, using a similar scenario for which only the termination proof is different.

Proving by structural induction

The cyclic proofs of the conjectures ∀ x u v, R (x, u, v), where R ∈ R only instantiate natural variables using 0 and the successor of new variables. The explicit induction schema that is based on this variable instantiation schema is the Peano induction, a structural induction principle issued from the analysis of the recursive definition of naturals. To recall it, in order to prove a formula P (x), where x is a natural variable to be instantiated, also called induction variable, it is enough to prove both P (0) and ∀x , P (x ) ⇒ P (S(x )), where P (x ) is an induction hypothesis and x a fresh variable. P (x ) can be soundly used in the proof of P (S(x )) because the number of 'S' symbols in x is smaller than in S(x ), for any natural x , and the 'less than' ordering over naturals is well-founded. In Coq, the Peano induction is automatically generated from the recursive definition of the nat datatype. It can be applied using the tactic induction which takes as argument the induction variable.

To distinguish each R from R, they are represented under the form of Rijkl, where

• i is the position of x 1 from the axioms (3.2) and (3.4) in the list [0, u, x],

• j is the position of (y 1 , y 2 ) from the axioms (3.2) and (3.4) in the list [(0, 0), (0, x), (x, 0), (0, S(x)), (x, S(x)), (x, x)],

• k is the position of x 1 from the axioms (3.3) and (3.4) in the list [0, u, v], and

• l is the position of (y 1 , y 2 ) from (3.3) and (3.4) in [(0, 0), (0, u), (0, v), (u, v), (v, u), (u, 0), (v, 0), (v, v)].

For example, the symbol R, defined by the axioms (3.5)-(3.8), will be referred to as R2534.

Similarly in Coq, the axioms defining Rijkl, denoted by Rijkl, are labelled as rijkl 1, rijkl 2, rijkl 3, and rijkl 4. In addition, the theorem to be proved is denoted as Rijkl true. This proof scenario is similar to that from Figure 3.1, excepting that the proof of the formulas labelling the lowest nodes in the proof digraph should be provided.

All proofs of

Different proof scenarios can be distinguished to complete the proof of Rijkl true. Table 3.1 presents some proof statistics for each case, where the second (resp., third) column gives the number of induction (resp., destruct) calls, and the fourth column the number of times 'apply rijkl 4' was called. The fifth column displays the number of intermediate lemmas and the last column the depth of the proof tree, issued by expanding the calls to the lemmas and by considering as one 'big step' each sequence of steps different from induction, destruct, split (for dealing with conjunctions) and 'apply rijkl 4'. We do not claim that our proofs have a digraph with minimal depth, our intention is only to give an idea about the degree of difficulty of each proof.

Scenario 1: no induction steps. This is the most trivial one. We consider the case R1111.

Theorem R1111 true: ∀ x u v, R1111 x u v. Proof.
destruct x ; destruct v ; intros. apply r1111 1. apply r1111 3. apply r1111 1. apply r1111 2. apply r1111 1. apply r1111 4; apply r1111 1. Qed.

Overall, 78 cases have no induction steps in their proofs. These proofs are performed mainly by instantiating variables and unfolding axioms, the maximal depth being of 7 (e.g., for R1132 true).

Scenario 2: one induction step. We consider the case R1113 where an induction step is performed in the proof of the additional lemma.

Theorem R1113 10v: ∀ v, R1113 0 0 v. Proof. induction v.
-Case "v=0" . apply r1113 1.

-Case "v=S v". apply r1113 3. apply IHv. Qed.

Theorem R1113 true: ∀ x u v, R1113 x u v. Proof.
destruct x ; destruct v ; intros. apply r1113 1. apply r1113 3. apply R1113 10v. apply r1113 2. apply r1113 1. apply r1113 4; apply R1113 10v. Qed.

Scenario 3: two induction steps. We detail the case R1115 where two induction steps are performed in the proof of the conjunction lemma:

Theorem R1115 mix: ∀ u v, R1115 0 v u ∧ R1115 0 u v. Proof.
induction u; intros.

-Case "u=0". split. apply r1115 1. destruct v. apply r1115 1. apply r1115 3. apply r1115 1.

-Case "u=S u". split. apply r1115 3. apply IHu. induction v. + SCase "v=0". apply r1115 1. Scenario 4: more than two induction steps. We chose to comment the cases R2535 and R2534. The proof of R2535 true required 3 induction steps and its digraph has the deepest depth (19). On the other hand, in spite of our efforts, the proof of R2534 true, as well as R2634 true and R2636 true, could not have been completed.

+ SCase "v = S v
Statistics for the Coq proofs.

Case IS DS CR Lemmas Depth

Case IS DS CR Lemmas Depth

R1111 0 2 1 0 3 R2411 0 3 2 1 5 R1112 0 3 1 1 4 R2412 0 4 2 2 5 R1113 1 2 1 1 4 R2413 1 3 2 2 6 R1114 1 2 1 1 4 R2414 1 3 2 2 6 R1115 2 2 1 1 6 R2415 1 5 2 2 5 R1116 0 2 1 0 3 R2416 0 3 2 1 5 R1117 0 2 1 0 3 R2417 0 3 2 1 5 R1118 1 2 1 1 4 R2418 1 3 2 2 6 R1121 0 3 1 1 4 R2421 0 4 2 2 6 R1122 1 2 2 1 5 R2422 0 4 2 2 5 R1123 1 4 2 1 6 R2423 3 6 3 2 9 R1124 1 4 2 1 6 R2424 4 5 3 2 9 R1125 2 2 3 1 7 R2425 1 4 5 2 9 R1126 0 3 1 1 4 R2426 0 4 2 2 6 R1127 0 3 1 1 4 R2427 0 4 2 2 6 R1128 1 4 2 1 6 R2428 1 5 5 3 9 R1131 0 3 1 1 4 R2431 1 3 2 2 6 R1132 0 6 2 1 7 R2432 4 8 3 2 9 R1133 1 2 2 1 5 R2433 1 3 3 2 7 R1134 1 2 2 1 5 R2434 7 5 11 2 12 R1135 1 6 3 1 8 R2435 3 6 7 2 12 R1136 0 4 1 1 5 R2436 3 5 2 2 7 R1137 0 3 1 1 4 R2437 1 6 4 2 8 Table 3.1 -Continued Case IS DS CR Lemmas Depth Case IS DS CR Lemmas Depth R1138 1 2 2 1 5 R2438 1 3 4 2 8 R1211 0 3 1 1 4 R2511 1 3 4 1 7 R1212 0 3 1 1 4 R2512 1 5 4 2 8 R1213 1 2 1 1 3 R2513 2 4 4 2 8 R1214 1 2 1 1 4 R2514 2 5 3 2 9 R1215 1 4 1 1 5 R2515 2 6 4 2 9 R1216 0 3 1 1 4 R2516 1 4 4 2 8 R1217 0 3 1 1 4 R2517 1 4 4 1 7 R1218 1 3 1 2 4 R2518 2 4 4 2 8 R1221 0 4 1 2 4 R2521 2 4 4 2 8 R1222 0 4 2 2 6 R2522 2 4 5 2 9 R1223 1 4 2 2 7 R2523 4 6 4 2 11 R1224 2 4 2 2 6 R2524 4 4 7 2 11 R1225 1 4 3 2 8 R2525 3 6 16 3 16 R1226 0 4 1 2 5 R2526 2 4 8 2 11 R1227 0 4 1 2 5 R2527 2 5 8 3 11 R1228 1 5 3 3 10 R2528 2 6 17 3 18 R1231 1 2 1 3 5 R2531 2 4 4 2 8 R1232 1 4 2 3 8 R2532 2 6 7 3 13 R1233 1 3 2 3 7 R2533 2 4 7 2 9 R1234 2 2 3 3 8 R2534 - - - - - R1235 2 5 3 3 9 R2535 3 7 18 3 19 R1236 1 3 1 3 6 R2536 2 5 9 3 13 R1237 1 2 1 3 5 R2537 2 4 11 2 12 R1238 1 2 1 3 6 R2538 2 4 14 2 13 R1311 0 2 1 0 3 R2611 1 5 3 1 8 R1312 0 3 1 1 4 R2612 1 8 3 2 8 R1313 1 2 1 1 4 R2613 2 7 3 2 9 R1314 1 2 1 1 4 R2614 2 8 4 2 11 R1315 1 4 1 1 5 R2615 2 5 4 2 10 R1316 0 3 1 1 4 R2616 1 6 3 1 8 R1317 0 2 1 0 3 R2617 1 6 3 1 8 R1318 1 2 1 1 4 R2618 2 7 3 2 9 R1321 0 3 1 1 4 R2621 2 8 3 2 10 R1322 0 3 1 1 4 R2622 2 8 5 2 12 R1323 1 4 2 1 6 R2623 6 9 5 3 14 R1324 1 4 2 1 6 R2624 10 2 7 3 13 R1325 1 3 3 1 8 R2625 3 7 17 3 18 R1326 0 3 1 1 4 R2626 2 6 5 2 14 R1327 0 3 1 1 4 R2627 2 7 6 3 15 R1328 1 4 2 1 6 R2628 2 7 8 2 16 R1331 0 3 1 1 4 R2631 2 7 3 2 12 R1332 0 7 2 1 7 R2632 4 10 5 3 13 R1333 1 2 2 1 5 R2633 2 6 4 2 13 R1334 1 2 2 1 5 R2634 - - - - - R1335 1 6 3 1 8 R2635 3 9 11 4 16 R1336 0 3 1 1 4 R2636 - - - - - R1337 0 3 1 1 4 R2637 2 7 6 2 15 R1338 1 2 2 1 5 R2638 2 7 6 2 14 Table 3.1 -Continued Case IS DS CR Lemmas Depth Case IS DS CR Lemmas Depth R1411 0 2 1 1 3 R3111 1 2 1 4 R1412 0 3 1 2 4 R3112 1 3 1 4 R1413 1 2 1 2 4 R3113 2 2 1 4 R1414 1 2 1 2 4 R3114 2 2 1 4 R1415 1 4 1 1 5 R3115 2 4 1 5 R1416 0 3 1 2 4 R3116 1 2 1 4 R1417 0 2 1 1 3 R3117 1 2 1 4 R1418 1 2 1 2 4 R3118 2 2 1 4 R1421 0 3 1 2 4 R3111 1 2 1 4 R1422 0 3 2 2 5 R3122 1 3 2 5 R1423 3 4 2 1 7 R3123 4 4 2 7 R1424 2 4 2 2 6 R3124 2 4 2 7 R1425 1 3 3 2 7 R3125 2 4 4 8 R1426 0 3 1 2 4 R3126 1 3 1 4 R1427 0 3 1 2 4 R3127 1 3 1 5 R1428 2 4 3 3 8 R3128 3 5 4 9 R1431 1 2 1 2 4 R3131 1 3 1 5 R1432 4 5 2 1 8 R3132 1 4 2 7 R1433 1 2 2 2 5 R3133 2 2 2 6 R1434 2 2 3 2 5 R3134 2 2 2 6 R1435 2 5 3 3 9 R3135 4 8 4 11 R1436 1 3 1 3 5 R3136 1 4 1 6 R1437 1 2 1 2 4 R3137 1 3 1 5 R1438 1 2 2 2 5 R3138 2 2 2 6 R1511 0 2 1 1 3 R3211 1 2 2 5 R1512 0 3 1 2 4 R3212 1 3 2 5 R1513 1 2 1 1 4 R3213 1 3 2 5 R1514 1 3 1 2 5 R3214 3 2 2 6 R1515 1 4 1 2 5 R3215 2 4 2 5 R1516 0 3 1 2 4 R3216 1 2 2 5 R1517 0 2 1 1 3 R3217 1 2 2 5 R1518 1 2 1 2 4 R3218 2 2 2 6 R1521 1 2 1 2 4 R3211 1 3 2 6 R1522 1 2 2 2 5 R3222 2 2 3 5 R1523 4 4 3 3 7 R3223 5 4 3 7 R1524 3 2 2 2 6 R3224 3 4 3 9 R1525 2 3 4 3 7 R3225 2 4 5 9 R1526 1 2 1 2 4 R3226 1 3 2 6 R1527 1 2 1 2 4 R3227 1 3 2 6 R1528 1 5 5 2 10 R3228 1 4 5 11 R1531 1 2 1 2 4 R3231 1 2 2 6 R1532 1 2 3 3 9 R3232 1 4 3 9 R1533 1 2 2 2 5 R3233 1 4 2 6 R1534 1 2 2 2 5 R3234 2 2 3 7 R1535 2 6 6 3 13 R3235 2 6 5 13 R1536 1 3 1 3 5 R3236 1 3 2 7 R1537 1 2 1 2 4 R3237 1 2 2 6 R1538 1 2 2 2 5 R3238 1 2 3 6 R1611 0 3 1 1 4 R3311 1 2 2 4 Table 3.1 -Continued Case IS DS CR Lemmas Depth Case IS DS CR Lemmas Depth R1612 0 4 1 2 5 R3312 1 3 1 4 R1613 1 3 1 2 5 R3313 2 2 1 4 R1614 1 3 1 2 5 R3314 2 2 1 4 R1615 1 4 1 2 5 R3315 2 4 1 5 R1616 0 3 1 2 4 R3316 1 2 1 4 R1617 0 3 1 2 4 R3317 1 2 1 4 R1618 1 3 1 2 5 R3318 2 2 1 4 R1621 2 2 1 2 5 R3311 1 3 1 5 R1622 1 2 3 1 6 R3322 1 3 1 5 R1623 4 5 3 2 10 R3323 3 5 2 7 R1624 8 3 3 3 11 R3324 2 4 2 7 R1625 2 4 7 2 11 R3325 2 4 4 8 R1626 1 3 1 2 5 R3326 1 3 2 5 R1627 1 3 1 2 3 R3327 1 4 2 5 R1628 2 4 4 2 8 R3328 2 6 4 10 R1631 1 2 1 1 5 R3331 1 3 1 5 R1632 3 4 3 2 10 R3332 1 7 2 8 R1633 1 2 2 1 6 R3333 2 2 2 7 R1634 1 2 2 1 6 R3334 2 2 2 6 R1635 2 6 5 2 12 R3335 2 4 3 9 R1636 1 2 1 1 5 R3336 1 3 1 5 R1637 1 2 1 1 5 R3337 1 3 1 5 R1638 1 2 2 1 6 R3338 2 2 2 6 R2111 0 3 1 1 4 R3411 1 2 2 5 R2112 0 4 1 2 4 R3412 1 3 2 5 R2113 1 3 1 2 4 R3413 2 2 2 6 R2114 1 3 1 2 4 R3414 3 2 2 6 R2115 1 5 1 2 5 R3415 2 4 2 5 R2116 0 4 1 2 4 R3416 1 3 2 5 R2117 0 4 2 2 4 R3417 1 2 2 5 R2118 1 3 1 2 4 R3418 2 2 2 6 R2121 0 3 1 1 4 R3421 1 3 2 6 R2122 0 4 2 2 4 R3422 1 3 2 6 R2123 2 5 2 2 8 R3423 4 5 3 9 R2124 1 5 2 2 6 R3424 3 4 3 9 R2125 1 6 4 2 9 R3425 2 4 4 9 R2126 0 4 1 2 4 R3426 1 3 2 6 R2127 0 4 1 2 4 R3427 1 3 2 6 R2128 1 5 2 2 5 R3428 1 4 5 10 R2131 0 3 1 1 4 R3431 1 3 2 6 R2132 0 6 2 2 6 R3432 1 7 3 9 R2133 1 3 2 2 5 R3433 1 2 4 7 R2134 1 3 2 2 5 R3434 2 2 5 9 R2135 1 7 3 2 8 R3435 2 5 4 11 R2136 0 5 1 2 5 R3436 1 3 2 7 R2137 0 4 1 2 4 R3437 1 2 2 7 R2138 1 3 2 2 5 R3438 1 2 4 7 R2211 0 7 2 1 7 R3511 1 2 2 5 R2212 0 5 2 2 7 R3512 1 3 2 5 R2213 1 4 2 2 7 R3513 2 2 2 6 Table 3.1 -Continued Case IS DS CR Lemmas Depth Case IS DS CR Lemmas Depth R2214 1 6 2 2 7 R3514 2 4 2 7 R2215 1 9 2 2 7 R3515 2 4 2 7 R2216 0 7 2 1 6 R3516 1 3 2 5 R2217 0 7 2 1 6 R3517 1 2 2 5 R2218 1 7 2 2 8 R3518 2 2 2 6 R2221 0 9 2 2 7 R3521 2 2 2 6 R2222 0 9 3 2 7 R3522 1 3 4 8 R2223 3 4 2 1 7 R3523 4 5 4 10 R2224 4 6 3 2 10 R3524 3 2 2 6 R2225 1 9 4 2 11 R3525 2 5 9 12 R2226 0 8 2 2 8 R3526 1 3 2 8 R2227 0 9 2 2 8 R3527 1 3 2 6 R2228 0 6 3 2 9 R3528 1 4 9 12 R2231 0 4 2 2 8 R3531 1 3 2 6 R2232 1 4 2 2 8 R3532 1 4 4 10 R2233 1 4 2 2 9 R3533 1 2 4 7 R2234 2 4 4 3 9 R3534 1 2 4 7 R2235 2 11 6 3 17 R3535 2 6 5 13 R2236 1 5 2 3 8 R3536 1 3 2 7 R2237 1 4 3 2 9 R3537 1 2 2 6 R2238 1 5 4 2 10 R3538 1 2 4 7 R2311 1 4 1 1 5 R3611 1 2 2 5 R2312 1 5 1 2 5 R3612 1 3 2 5 R2313 2 4 1 2 5 R3613 2 2 2 6 R2314 2 4 1 2 5 R3614 2 4 2 7 R2315 2 6 1 2 5 R3615 2 4 2 7 R2316 0 6 1 2 5 R3616 1 2 2 5 R2317 1 4 1 1 5 R3617 1 2 2 5 R2318 2 4 1 2 5 R3618 2 2 2 6 R2321 1 5 1 2 5 R3621 1 3 2 6 R2322 1 5 1 2 5 R3622 1 3 4 8 R2323 3 7 2 2 7 R3623 4 5 5 10 R2324 2 6 2 2 8 R3624 3 2 2 6 R2325 2 6 4 2 10 R3625 2 4 9 12 R2326 1 5 1 2 6 R3626 1 3 2 6 R2327 1 4 1 1 5 R3627 1 3 2 6 R2328 3 7 4 2 10 R3628 1 4 7 12 R2331 1 3 1 2 5 R3631 1 3 2 7 R2332 1 6 2 2 8 R3632 1 7 4 10 R2333 2 4 2 2 5 R3633 1 2 3 6 R2334 2 4 2 2 5 R3634 1 2 4 7 R2335 2 7 3 2 10 R3635 2 9 6 14 R2336 1 5 1 2 6 R3636 1 3 2 7 R2337 1 4 1 1 5 R3637 1 2 2 6 R2338 2 4 2 2 7 R3638 1 2 2 5

Lazy generation of induction schemas for algorithm synthesis

By algorithm synthesis we understand finding an algorithm which satisfies a given specification. We are working in the context of proof-based synthesis of functional algorithms, starting from their formal specifications. A formal specification is expressed as two predicates: the input condition I[X] and the output condition O[X, T ]. 13 The desired function F must satisfy the correctness condition ∀

X (I[X] ⇒ O[X, F [X]]
), which corresponds to the synthesis conjecture:

∀ X ∃ T (I[X] ⇒ O[X, T ]).
An algorithm which implements F can be extracted from the (constructive) proof of this conjecture. The algorithm is expressed as a list of clauses (conditional rewrite rules) of the form:

C[Z] =⇒ F [P [Z]] = T [Z],
where Z is a vector of variables, P [Z] is a pattern over these variables (with the property that it matches unambiguously certain elements of the domain), and T [Z] is a term over the matching variables. In [START_REF] Dramnesc | Mechanical synthesis of sorting algorithms for binary trees by logic and combinatorial techniques[END_REF], Dramnesc et al., 2016a, Dramnesc et al., 2016b, Dramnesc et al., 2015a, Dramnesc et al., 2015b, Dramnesc et al., 2015c], we focused on developing effective and efficient techniques for mechanizing the synthesis-proofs of sorting algorithms over the domain of binary trees, the synthesis-proofs of the auxiliary functions occurring in these algorithms, and the proofs of the additional properties which are necessary in the synthesis-proofs.

Our approach is experimental: we try various scenarios and techniques and refine them in order to obtain efficient proofs and various algorithms. The way the constructive proof is built is essential since the definition of the algorithm depends on it. For example, case splits may generate conditional branches and induction steps may produce recursive definitions. Hence, the use of different case reasoning techniques and induction principles may output different algorithms. The soundness of the proof rules and of the extraction procedure guarantee the correctness of the algorithm.

The focus of our work is on proof automation. In our experiments all the proofs are produced completely automatically, while the theory exploration (identification of all necessary auxiliary statements), the selection of the assumptions and of the induction principles used by the prover in each proof, and the construction of the conjectures from the failing proofs are performed manually.

The implementations of the case studies presented in this chapther have been carried out in the frame of the Theorema system [START_REF] Buchberger | [END_REF] which is itself implemented in Mathematica [Wolfram, 2003]. Theorema offers significant support for automating the algorithm synthesis; in particular, the new proof strategies and inference rules have been quickly prototyped, tested and integrated in the system thanks to its extension features. Also, the proofs are easier to understand since they are presented in a human-oriented style. Moreover the synthesized algorithms can be directly executed in the system. The implementation files and the full proofs are presented in [Dramnesc et al., 2015b].

Our main results include the novel synthesized algorithms: five sorting algorithms plus the auxiliary functions necessary for them: one algorithm for Insert (insert an element into a sorted tree), and three algorithms for Merge (merge two sorted trees into a sorted one).

More importantly, our experiments reveal a valuable arsenal of proof techniques (inference rules and proof strategies) which are both of general interest in natural-style proving, as well of particular interest in proof-based algorithm synthesis and in proving over the domain of binary trees.

The induction reasoning performed during the proof construction is lazy, meaning that the induction hypotheses are used by need, hence avoiding unnecessary backtracking steps. The lazy induction reasoning can be afterwards captured by explicit induction schemas such that the whole reasoning is reconstructed to an explicit induction proof which is successfully conducted at the end with the Theorema system. It may happen that different proof scenarios generate different induction schemas. Some of the auxiliary functions, e.g. Merge, use nested recursion. In this case is difficult to guess an induction principle which can be applied. Our novel combinatorial technique combined with lazy induction is able to find the appropriate induction principle, by guessing a suitable witness term.

By theory exploration in Theorema we produce 3 axioms, 11 definitions, and more than 200 properties. These theories are useful for the further study of properties and algorithms on binary trees. Although produced "manually", these theories can be of interest for the study of possible automation of the theory exploration process. Related Work. Algorithm synthesis and program generation is currently a challenging problem for programming and verification communities.14 Note however that our work does not address program generation, which consists in transforming the description of an algorithm given in a certain formalism, into a program expressed in a certain language.

Automation of Theory Exploration is an active area of research -see e. g. [Colton, 2012], however in our research we did not focus on the mechanization of this process. Rather, we apply the basic principles described in [Buchberger, 2000] in order to perform top-down in parallel with bottom-up exploration, by adding the notions and properties which are necessary for our proofs.

Induction Reasoning is used successfully for algorithm synthesis -see e. g. [Bundy et al., 2006, Johansson et al., 2011, McCasland and Bundy, 2006]. Powerful techniques (for instance rippling) have been developed for overcoming a basic drawback of explicit induction: it may be that the desired algorithm cannot be constructed using the apriori given induction. Our research complements this efforts by introducing a combinatorial technique for the generation of the witness terms, as well as a lazy induction method based on Noetherian ordering, which is able to discover new explicit induction schemes.

We perform Algorithm Synthesis by following the classical proof-based synthesis approach as presented in e. g. [Bundy et al., 2006]. The work of [Gulwani, 2010] is a comprehensive overview of the most common approaches used to tackle the synthesis problem. In [Basin et al., 2004] we find a comparison between three synthesis methods: constructive/deductive synthesis, schema-based synthesis and inductive synthesis. We do not focus on the theoretical aspects of algorithm synthesis, but we follow an experimental approach in which we can find efficient proof methods. Concerning the sorting of binary trees, in classical approaches -see e. g. [Knuth, 1998] the problem of sorting them directly is not investigated, and we did not find other descriptions of such algorithms.

In the following, we present the context of binary trees and the notations, introduce the synthesis problem and describe the main synthesis method: the construction of the synthesis conjecture, its proof by induction, and the extraction of the algorithm from the proof.

General Conventions. Similar to the Theorema style, we use square brackets for function and for predicate application (e.g., f[x] instead of f(x) and P[a] instead of P(a)). Moreover, the quantified variables are written under the quantifier, that is ∀ x ("for all x") and ∃ T ("exists T "). Sometimes, the place under the quantifier also contains a property of the quantified object.

Sorting of binary trees

We consider binary trees over elements from a domain with a total ordering. The two types however are not explicitly present in the formulas, but only implicit by notation and by using predicate and function symbols which are not overloaded. Lower-case letters (e.g., a, b, n) represent tree elements, and upper-case letters (e.g., X, T, Y, Z) represent trees.

From the names of variables present in the original formulas, the provers generates meta-variables (denoted usually by starred symbols -e.g., T * , T * 1 , Z * ) and Skolem constants (e.g., X 0 , X 1 , a 0 ). The ordering between tree elements is denoted by the usual ≤, and the ordering between a tree and an element is denoted by: (e.g., T z states that all the elements from the tree T are smaller or equal than the element z, z T states that z is smaller or equal than all the elements from the tree T ).

We use two constructors for binary trees, namely: ε for the empty tree, and the triplet L, a, R for non-empty trees, where L and R are trees and a is the root element.

Predicates: ≈ and IsSorted have the following interpretations, respectively: X ≈ Y states that X and Y have the same elements with the same number of occurrences (but may have different structures), i.e., X is a permutation of Y ; IsSorted[X] states that X is a sorted tree. A tree is a sorted (or search, or ordered ) tree if it is either ε or of the form L, a, R such that i) L a R, and ii) L and R are sorted trees.

Synthesis problem and method

As stated in the introduction, the specification of the target function F consists of two predicates: the input condition I[X] and the output condition O[X, T ], and the correctness property for F is ∀

X (I[X] ⇒ O[X, F [X]]).
The synthesis problem is expressed by the conjecture:

∀ X ∃ T (I[X] ⇒ O[X, T ]).
The proofbased synthesis consists in proving this conjecture in a constructive way and then extracting the algorithm for the computation of F from this proof.

In the case of sorting, the input condition specifies the type of the input, therefore it is missing since the type is implicit. The output condition O[X, T ] is X ≈ T ∧ IsSorted[T ] thus the synthesis conjecture becomes:

Conjecture 1 ∀ X ∃ T (X ≈ T ∧ IsSorted[T ])
This conjecture can be proved in several ways. Each constructive proof is different depending on the applied induction principle and the content of the knowledge base (the set of assumptions provided to the prover). Hence, different algorithms are extracted from different proofs.

Induction principles and algorithm extraction

The illustration of the induction principles and algorithm extraction in this subsection is similar to the one from [Dramnesc and Jebelean, 2011] for lists, but the induction principles are adapted for trees and the extracted algorithms are more complex.

The following induction principles are direct term-based instances of the Noetherian induction principle and can be represented using induction schemas. Consider the domain of binary trees with a well-founded ordering < t and denote by < < t the multiset extension of < t as a well-founded ordering over vectors of binary trees. An induction schema to be applied to a predicate ∀ x P [x] defined over a vector of tree variables

x is a conjunction of instances of P [x] called induction conclusions that 'cover' ∀

x P [x], i.e., for any value v from the domain of x, there is an instance of an induction conclusion P [t] that equals P [v], where t is a vector of trees. An induction schema may attach to an induction conclusion P [t], as induction hypotheses, any instance P [t ] of ∀

x P [x] as long as t < < t t. The induction conclusions without (resp., with) attached induction hypotheses are base (resp., step) cases of the induction schema.

In the current presentation we will use the multiset of elements as measure values for binary trees. Checking strict ordering E < t E between two expressions E, E representing trees reduces to check strict inclusion between the multisets of symbols (constants and variables except ε) occurring in the expressions. This is because the expressions representing trees contain only functions which preserve the number of elements i.e., the elements of the returned tree, on the one hand, and from the arguments, on the other hand, build equivalent multisets (Concat, Insert, Merge).

In our experiments, we use the following induction principles for proving P as unary predicates over binary trees.

Induction-1: P [ε] ∀ n,L,R (P [L] ∧ P [R]) =⇒ P [ L, n, R ] =⇒ ∀ X P [X]
This is the standard structural induction based on the definition of trees. The 'covering' property of the two induction conclusions P [ε] and P [ L, n, R ] is satisfied since any binary tree is either ε or of the form L, n, R . P [L] and P [R] are induction hypotheses attached to P [ L, n, R ], and it is very easy to see that their terms are smaller than the one of the induction conclusion.

In order to synthesize the sorting algorithm as a function

F [X], we consider the output condition O[X, T ] : X ≈ T ∧IsSorted[T ] . Induction-1 can be applied to prove the synthesis conjecture ∀ X ∃ T O[X, T ] by taking P [X] as ∃ T O[X, T ].
The proof is structured as follows:

Base case: We prove ∃ T O[ε, T ]. If the proof succeeds to find a ground witness 1 such that O[ε, 1 ],
then we know that F [ε] = 1 .

Lazy generation of induction schemas for algorithm synthesis

Step case: For arbitrary but fixed n, L 0 and R 0 (new constants), we prove

∃ T O[ L 0 , n, R 0 , T ]. We assume as induction hypotheses ∃ T O[L 0 , T ] and ∃ T O[R 0 , T ],
which are Skolemized by introducing two new constants T 1 and T 2 for each existential T. The existential quantified variable from the goal becomes the meta-variable T * (for which we need to find a substitution term). If the proof succeeds to find a witness

T * = 2 [n, L 0 , R 0 , T 1 , T 2 ] (term depending on n, L 0 , R 0 , T 1 and T 2 ), then we know that F [ L, n, R ] = 2 [n, L, R, F [L], F [R]]. 15
The extracted algorithm from the proof is expressed as:

∀ n,L,R F [ε] = 1 F [ L, n, R ] = 2 [n, L, R, F [L], F [R]]
This function definition expressed as two equalities can be easily transformed into a functional program by using appropriate decomposition functions which extract the root, the left branch, and the right branch from the tree.

The theoretical basis and the correctness of this proof-based synthesis scheme is well known -see for instance [Bundy et al., 2006].

For the following induction principles, the proof and the algorithm extraction are similar to Induction-1, therefore we give only the structure of the extracted algorithm for each induction principle.

Induction-2:

P [ε] ∀ n,L P [L] =⇒ P [ L, n, ε ] ∀ n,L,R (P [ L, n, ε ] ∧ P [R]) =⇒ P [ L, n, R ] =⇒ ∀ X P [X]
This induction principle was suggested by the experiments, according to the induction schema discovery explained in Subsection 3.2.4, and illustrated at the end of that subsection.

The extracted algorithm is:

∀ n,L,R   F [ε] = 1 F [ L, n, ε] = 3 [n, L, F [L]] F [ L, n, R ] = 5 [n, L, R, F [ L, n, ε ], F [R]]   Induction-3: P [ε] ∀ n (P [ ε, n, ε ]) ∀ n,L (P [L] =⇒ P [ L, n, ε ]) ∀ n,R (P [R] =⇒ P [ ε, n, R ]) ∀ n,L,R ((P [L] ∧ P [R]) =⇒ P [ L, n, R ]) =⇒ ∀ X P [X]
This is an expression of Induction-1 which makes explicit the cases of empty subtrees, also discovered experimentally using the induction schema discovery. L and R are assumed to be non-empty trees. In order to encode this conveniently during the proof, they are replaced by A, a, B and C, b, D , respectively.

The extracted algorithm is:

∀ n,a,b,A,B,C,D         F [ε] = 1 F [ ε, n, ε ] = 2 [n] F [ A, a, B , n, ε ] = 3 [n, A, a, B, F [ A, a, B ]] F [ ε, n, C, b, D ] = 4 [n, C, b, D, F [ C, b, D ]] F [ A, a, B , n, C, b, D ] = 5 [n, a, b, A, B, C, D, F [ A, a, B ], F [ C, b, D ]]        

Refining induction by lazy reasoning

As shown in the general introduction, sometimes the concrete induction principle which is used for proving does not succeed. In this case, one needs to think about a more powerful principle and reiterate the proof attempt. We present here a technique able to find automatically and in a lazy way, during the proof, new term-based Noetherian induction principles which are necessary.

The technique helps to prove a formula ∀

x Φ[x] by lazy induction, where x is a vector of variables. Firstly, we start to instantiate variables from x, then transform the resulted instances by using deductive rules. The instantiation and deduction steps can be intertwined up to the moment when instances of Φ[x] are encountered. Finally, an instance Φ[t] can be used as induction hypothesis for the induction case Φ[x]θ if t < < t xθ, where the vectors t and xθ are represented as multisets of terms. This is a particular case of the formula-based Noetherian induction method presented in Chapter 2 for which the cyclic proofs have only 1-cycles and the IHs are instances of the root formula.

The cumulative substitution θ is built from the proof. To illustrate its computation, we represent the proof derivation as a tree for which the root node is labeled by Φ[x]. Two kinds of non-root nodes are distinguished: instantiation nodes and deductive nodes. The instantiation nodes are direct successors of a node N labeled by a formula with free variables for which some of them are instantiated with terms whose variables are fresh. The set of instance formulas labeling all the instantiation nodes should cover the formula labeling N and can be built from the sort of the instantiated variables. For example, if N is labeled by the formula Φ[X], a covering set of instance formulas is {Φ{X → }, Φ{X → L, n, R }}, where L, n, R are fresh variables. In the graphical representation of a proof tree, the relation between a node and its direct instantiation nodes are represented by downward solid arrows annotated by the corresponding instantiation substitution. The deductive nodes are direct successors of nodes to which a deductive operation has been applied. These relations are graphically represented as curly arrows annotated by identity substitutions. The cumulative substitution is the composition of the substitutions annotating the nodes from the path leading from the root node, in our case the node labeled by Φ[x], to the node labeled by the induction hypothesis, in our case Φ[t]. This scenario can be illustrated as below:

Φ[x] θ k 1 Ó Ó θ1 ' ' Φ[x]θ k 1 . . . Φ[x]θ 1 θ2 Ψ[y] θn-1 . . . 1 1 θ k 3 Ó Ó . . . Ψ[y]θ n-1 θn Φ[t] l l In our scenario, Φ[t] is an instance of Φ[x].
In addition, it can be used as an induction hypothesis if t is smaller than

xθ 1 θ 2 • • • θ n-1 θ n .
Example 10 By lazy induction, one can benefit of more effective induction reasoning, involving only useful induction hypotheses.

Let us assume the following scenario for processing a formula Φ[X], where X is a binary tree:

Φ[X] {X → } Ô Ô {X → L,n,R } 2 2 Φ[ ] Φ[ L, n, R ] θ id Φ[R] q q
Here, θ id is the identity substitution {L → L; n → n; R → R}. Φ[R] can be used as induction hypothesis in the proof of the case Φ[ L, n, R ] because R has a number of elements smaller than L, n, R .

The corresponding explicit induction principle is:

P [ε] ∀ n,L,R P [R]) =⇒ P [ L, n, R ] =⇒ ∀ X P [X]
Example 11 More specific induction schemas can also be generated by lazy induction, as shown in the following scenario:

Φ[X] {X → } | | {X → L,n,R } 7 7 Φ[ ] Φ[ L, n, R ] {R → ... } y y {R → } 1 1 θ id G G θ id u u Φ[ L, n, ] s s Φ[R] i i Φ[ L, n, . . . ] Φ[ L, n, ] θ id 9 9 Φ[L] u u
The corresponding explicit induction principle is:

P [ε] ∀ n,L P [L] =⇒ P [ L, n, ε ] ∀ n,L,R (P [ L, n, ε ] ∧ P [R]) =⇒ P [ L, n, R ] =⇒ ∀ X P [X]

Conclusions

We have defined a set of conjectures that can be proved using cyclic induction by following a similar scenario and based on the variable instantiation schema of the Peano induction. We have shown how to implement the cyclic induction reasoning in Coq, by means of external libraries and functional schemas issued from the definition of new function symbols. The associated explicit induction principles, automatically generated by Coq, are more complex than the Peano induction principle. On the other hand, all but three conjectures have also been proved by Peano induction but their proofs are ad hoc and do not follow the cyclic proof script. Indeed, they are very different in terms of scenario, length and difficulty.

The procedure for generating explicit induction principles from cyclic induction reasoning was successfully used for the synthesis of algorithms for binary trees. It led to discovering new recursion structures that are not given from the beginning by the induction principle, new induction schemas and new algorithms with nested recursion.

4

Tool: the SPIKE Prover SPIKE, an induction-based theorem prover built to reason on conditional theories with equality, is one of the few formal tools able to perform automatically mutual and lazy induction. Designed at the beginning of 1990s, it has been successfully used in many non-trivial applications and served as a prototype for different proof experiments and extensions. The first paper introducing SPIKE is [Bouhoula et al., 1992], published shortly after the tool was created. The goal of this chapter is to highlight and bring together in one spot the major changes supported by SPIKE since then.

Context. Historically, SPIKE was built during a period when several formula-based Noetherian induction methods issued from Musser's completion-based inductionless induction (or proof-byconsistency) technique [Musser, 1980] have been designed. Some of them have been implemented into theorem provers, for example, RRL [START_REF] Kapur | [END_REF]] integrated the test-set induction method [START_REF] Kapur | [END_REF], and Focus [START_REF] Bronsard | [END_REF] a generalization of the term-rewriting induction [START_REF] Bronsard | [END_REF] for conditional theories. Inspired by the rewriting techniques previously tested with the ORME system [Lescanne, 1990], SPIKE [Bouhoula et al., 1992] implemented a different induction method [Kounalis andRusinowitch, 1990b, Bouhoula et al., 1995] that combines features from explicit induction and inductive completion techniques.

As time went by, SPIKE was continuously considered among the 'active' automatic inductionbased provers; it mainly served as a prototype for testing several extensions of conditional theories and induction-based reasoning techniques that led to many successful proof experiments on non-trivial applications. In this chapter, we highlight the major changes supported by SPIKE since the publication of [Bouhoula et al., 1992], which gave rise to its current version. The source code, examples of specification files, and papers related to different applications and extensions are available online [The SPIKE development team, 2020].

The content of this chapter is based on the paper [Stratulat, 2020]. In the rest of the chapter, we set the theoretical backgrounds of the reasoning by induction on equational clauses, then we introduce the inference system of SPIKE and the layout of a standard specification file. In the end, we show how to prove conjectures and interact with the tool.

The inference system and proof strategies

In this section, we first present the general setting for proving by implicit induction, then introduce the inference system of SPIKE followed by the layout of specification files. Finally, we present the different ways the user can interact with the tool.

4.1.1 The 'reasoning by implicit induction' setting SPIKE implements an instance of the formula-based Noetherian induction principle applied on a Noetherian poset of equational clauses (or just clauses). Several clauses can be simultaneously tested to verify whether they are consequences of a given set of axioms Ax written as conditional equalities. SPIKE can reason on sorted and constructor-based specifications that should satisfy some properties, like the ground convergence and (strongly sufficient) completeness [Bouhoula, 1997]. These constraints guarantee the existence of the initial model for Ax. Formally, assuming that M is the initial model of Ax, we denote by Φ |= M φ the fact that the clause φ is an initial M-consequence (or just consequence) of a set of conditional equalities Φ. φ is initially M-valid (or just valid) and denoted by |= M φ iff it is a consequence of Ax.

The induction proof method used by SPIKE, called implicit induction and detailed in Chapter 1, is based on reductive techniques as rewriting. By implementing the formula-based Noetherian induction principle, it can naturally perform lazy and mutual induction steps. The mutual induction feature helped SPIKE to prove the Gilbreath Card trick problem [Huet, 1991], firstly with 5 lemmas [Bouhoula and Rusinowitch, 1993] then with only 2 lemmas [START_REF] Bouhoula | [END_REF], while other provers using different proof techniques succeeded with significantly more lemmas (see [START_REF] Bouhoula | [END_REF] for a comparison).

The ground convergence and completeness properties of a specification can be checked more easily, by using syntactic criteria, if the specification is many sorted and the set of function symbols is split into constructor and defined function symbols. SPIKE was initially designed to deal with free constructors such that there is no equality relation between any two different constructor symbols. Several extensions have been introduced in SPIKE since [Bouhoula et al., 1992] in order to deal with: i) non-free constructors [Bouhoula and Jouannaud, 2001], ii) parameterized specifications [Bouhoula, 1994b, Bouhoula, 1996], iii) associative-commutative theories [Berregeb et al., 1996], iv) observational proofs [START_REF] Berregeb | Observational proofs with critical contexts[END_REF]Rusinowitch, 2002], and v) simultaneous check of the completeness and ground convergence properties of a specification [Bouhoula, 2009]. Most of them led to distinct proof systems that are no longer maintained in spite of their theoretical and practical interests.

The inference system

In [Bouhoula et al., 1992], the inference rules and the proof strategy implementing the implicit induction method were built-in. Each rule is a transition between pairs (E, H), where E are conjectures and H are premises consisting of previously processed conjectures that do not have minimal counterexamples, i.e., minimal ground clauses that are not valid. By applying a rule, a conjecture from the current proof state is replaced by a potentially empty set of new conjectures, and may be added as a premise in order to participate to further inference steps. Proof derivations are built by successively applying inference rules starting from an initial state. They may finish with i) success, if they end with an empty set of conjectures, ii) error, if a counterexample is detected, and iii) failure, if none of the previous cases is encountered and no rule can be applied. A proof is a successful derivation that starts with an empty set of premises.

Later on, different proof needs led to hardcode into the system several variants of a same rule. More flexibility has been achieved with the addition of a strategy language [START_REF] Alouini | [END_REF] allowing to define new proof strategies by the user. It has been combined later with a methodology for building modular inference rules using contextual cover sets (CCSs), detailed later in Section 8.1. The core of the methodology is the abstract inference system A, defined and proved sound in [Stratulat, 2001]. A is similar to the inference system I from Chapter 1 and is made of two rules: AddPremise and Simplify, defined as:

AddPremise: (E ∪ {φ}, H) A (E ∪ Φ, H ∪ {φ}),
if, for any counterexample φτ of φ, there is a counterexample ψ in i) E ∪ Φ such that ψ < φτ , or ii) H such that ψ ≤ φτ .

Simplify:

(E ∪ {φ}, H) A (E ∪ Φ, H), if, for any counterexample φτ of φ, there is a counterexample ψ in E ∪ Φ ∪ H such that ψ ≤ φτ .
Each inference rule replaces a conjecture φ with a potentially empty set of new conjectures Φ. Φ is built in two steps as a CCS of φ, thanks to the compositional properties of CCSs. Firstly, an intermediate CCS of φ is built, then for each intermediate clause another CCS is built and stored as new conjectures. The set of IHs allowed by a rule to be used when building a CCS is referred to as context. AddPremise adds φ as a premise and Simplify allows bigger contexts. It has been shown in [Stratulat, 2001] that i) the abstract inference system is sound, i.e., one can conclude from a proof that its initial conjectures are valid, and ii) the inference rules define the biggest contexts compared to similar abstract rules proposed in the literature. For practical reasons, the abstract system was extended with a third rule, Delete, that is a particular case of Simplify when Φ is empty.

Any SPIKE inference rule instantiates one of the abstract rules by implementing its elementary CCSs, i.e. the CCSs that are not built using composition operations, by the means of reasoning modules. A reasoning module can produce a CCS with a particular reasoning technique using in terms of IHs clauses from the context defined by the instantiated abstract rule. The main reasoning techniques are based on rewriting, case analysis and variable instantiations.

We give as example the definition of a rewriting-based inference operation implemented as an instance of Simplify: rewriting_rule = simplify(id,[rewriting(rewrite,L|R|C, * )]);

In the first step, the identity reasoning module id builds {φ} as the intermediate CCS for φ. The application of the rule succeeds if, in the second step, the rewriting module succeeds to rewrite once, due to the rewrite argument and at any position ( * ), the only clause φ of {φ} with conditional rewrite rules from the lemmas (L), axioms (R) and current context (C). The resulting clause is the unique clause of Φ.

Some of the reasoning techniques have been changed since [Bouhoula et al., 1992]. For example, the technique for instantiating variables with elements of a test-set, based on the depth of the lhs of the axioms [START_REF] Bouhoula | [END_REF], was replaced by a narrowing technique involving only the axioms defining the head symbol of some (sub)term including the variables to be instantiated [START_REF] Barthe | [END_REF].

New reasoning techniques have been added to deal with non-trivial applications. The implementation of a combination between a decision procedure for linear arithmetic and a congruence closure algorithm [Stratulat, 2000b, Armando et al., 2002] allowed to validate the MJRTY algorithm [START_REF] Boyer | [END_REF]] using a lemma proposed by N. Shankar (according to [Howe, 1993]); also, more than 60% of the conjectures required to certify the conformity algorithm for a telecommunication protocol [START_REF] Rusinowitch | [END_REF] have been automatically proved. This implementation, as well as the 'black-box' integration schema of the Z3 [De Moura and Bjørner, 2008] SMT solver as a reasoning module, are described in [Stratulat, 2014]. SPIKE also includes several decision procedures for proving inductive theorems without induction reasoning [START_REF] Aoto | [END_REF]. They help to decide the inductive validity of equations involving natural numbers and lists.

The validation of the JavaCard platform [START_REF] Barthe | [END_REF], detailed in Chapter 5, was the most challenging case study ever experienced by SPIKE. The inference system has been adapted to manage variables of parameterized sorts as well as existential variables. New inference rules have been designed to better handle the information from the conditional part of (conditional) conjectures, like i) the auto simplification rule in order to rewrite with an equality condition other parts of the conjecture, and ii) the augmentation rule which adds new conditions issued from the conclusion of a conditional equality given as lemma if the conditions of the lemma are proved from the conditions of the conjecture. The efficiency of the implementation has been improved for dealing with specifications counting more than 400 defined function symbols and 2200 axioms, for example by recording the failure context at the conjecture level in order to avoid useless computation.

As shown in [START_REF] Bronsard | [END_REF], the implicit induction method is based on a unique induction ordering, globally defined over the set of clauses derived during a proof. It is implemented by reductive inference systems such that, at the ground level, the new conjectures from any proof step are smaller than (and sometimes equal to) the replaced conjecture. The reductive techniques, as rewriting, introduce new ordering constraints to be satisfied by the specification as well as the conjectures from the proof derivation. The induction ordering is the multiset extension of the mpo ordering [Baader and Nipkow, 1998] over terms using a precedence over the function symbols provided by the user. The mpo ordering also serves to orient the axioms into rewrite rules. Since some reasoning techniques, like the instantiation of variables from the current conjecture, require the reduction of the instances by rewriting, SPIKE warns the user if the mpo ordering built from the input precedence cannot orient the axioms into rewrite rules. If no precedence is provided by the user, SPIKE analyses the axioms and tries to infer a successful precedence.

The inference system of SPIKE has been extended to implement for the first time reductive-free cyclic proofs [Stratulat, 2012], also described in Chapter 2, by keeping the best features of explicit and implicit induction reasoning. To recall, a cycle consists of a circular linked list of proof derivation chunks, called history chunks. Each link symbolises the application of an instance of the head conjecture from a history chunk as IH in the proof of the conjecture ending the previous history chunk in the list. Following the DRaCuLa proof strategy, the cycle can discharge its linking IHs by checking ordering constraints involving only instances of the conjectures starting the history chunks. Therefore, the cyclic induction reasoning allows to use non-reductive proof techniques along history chunks and axioms not orientable into rewrite rules as long as the ordering constraints are satisfied.

A useful property for an inference system is the refutational soundness, which guarantees that, whenever a counterexample is detected at the current step, the initial conjectures are refuted. Very few inference rules implemented by SPIKE may add new counterexamples during the proof derivation, e.g., by the generalisation of existential into universal variables [START_REF] Barthe | [END_REF]. By attaching history information to each conjecture, the detected counterexamples can lead to particular ground instances of the initial conjectures that can be further checked for validity.

The refutational completeness is another useful property, satisfied by previous inference systems [Bouhoula et al., 1995, Bouhoula, 1997]. Since the addition of a strategy language, this property is no longer guaranteed because the fairness of the inference system, forbidding persistent conjectures along its derivations, may be broken. However, the user still can use some built-in strategies known to be refutationally complete. A classical proof strategy mainly privileges the inference rules that are instances of Delete, then Simplify, and finally AddPremise. We give as example the definition of the fullind strategy. The reasoning module total case rewriting, implementing the conditional rewriting technique, was used to build instances of both Simplify and AddPremise. try and repeat take a list of rules as arguments. try visits each rule in the list until the first succeeds. repeat executes them repeatedly until no new conjecture is produced or a counterexample is found. The print * rules print the current state of the proof. start with points to the used strategy.

% instances of

The layout of a specification file

The structure of a standard SPIKE specification from the file name.spike is: specification: name % the axiomatic definition of a many sorted constructor-based specification sorts: list of sorts constructors: list of constructor symbols defined functions: list of defined function symbols axioms: list of axioms for each defined function symbols % the induction ordering greater: list of precedencies over the function symbols equiv: list of equivalent function symbols % the completeness and ground convergence properties properties: list of properties % the proof strategies strategy: list of inference rules and proof strategies % the priority over the head symbols used by the instantiation technique conjectures: list of conjectures User interactions. The proofs, generated by the command spike bc name.spike, are highly automatic, the user interactions mainly defining i) the precedence used by the mpo ordering, ii) the inference rules and the proof strategy, iii) the precedence over the head symbols of the (sub)terms to which the new instantiation technique can be applied, and iv) lemmas. Once a conjecture has been proved, it can participate as lemma in the proof of further conjectures listed in the conjectures section.

On the other hand, the generated proofs may involve many non-trivial inference steps for which the human checking process is tedious and error-prone. We have shown how to i) validate SPIKE proofs [Stratulat, 2010, Stratulat and[START_REF] Stratulat | [END_REF] using the certification environment provided by the Coq system [The Coq development team, 2020], and ii) define Coq tactics that call directly SPIKE and transform the generated proofs into Coq scripts [Henaien and Stratulat, 2013], according to a methodology that automatically translates into Coq script the proof steps performed by most of its inference rules.

The user can also interact with SPIKE by the means of i) extra sections, for example use: nats; 16 for activating the combination of the decision procedure for linear arithmetic and the congruence closure procedure, and ii) command-line arguments given to spike bc, as:

-debug: to identify syntactic errors in the specification file, 16 To be added just after the specification section.

-maximal: to print the proof in detail, -coqc spec and -coqc: to generate the Coq specification, and translate the generated proof into Coq script, respectively, and -dracula: to generate cyclic proofs using the DRaCuLa strategy.

Coding

languages. SPIKE was initially written in the 'light' version of the Caml [START_REF] Cousineau | [END_REF]] functional language by Adel Bouhoula during his PhD thesis [Bouhoula, 1994a]. SPIKE has been completely redesigned for adopting an object-oriented paradigm along the ∼ 18500 lines of OCaml [Leroy et al., ] code. Some of the original features are still missing, like the graphical interface and the procedures for checking the completeness and ground convergence properties.

A complete example of SPIKE specification

We provide the SPIKE specification of different definitions of 'even' and 'odd' operations that have been tested with the DRaCuLa strategy, as described in Chapter 2.

Conclusions

We have given an overview of the current version of SPIKE and highlighted the main changes and extensions since [Bouhoula et al., 1992]. Additional information about SPIKE and its applications can be found on the website [The SPIKE development team, 2020].

5

Application: Validation of the JavaCard Platform The bytecode verifier (BCV), which performs a static analysis to reject potentially insecure programs, is a key security function of the Java(Card) platform. Over the last few years there have been numerous projects to prove formally the correctness of bytecode verification, but relatively little effort has been made to provide methodologies, techniques and tools that help such formalisations. [Barthe et al., 2001b, Barthe et al., 2002b] developed a methodology and a specification environment featuring a neutral mathematical language based on conditional rewriting, that considerably reduce the cost of specifying virtual machines.

In this chapter, based on [START_REF] Barthe | [END_REF], we show that such a neutral mathematical language based on conditional rewriting is also beneficial for performing automatic verifications on the specifications, and illustrate in particular how implicit induction techniques can be used for the validation of the Java(Card) Platform. More precisely, we report on the use of SPIKE, presented in Chapter 4, to establish the correctness of the BCV. The results are encouraging, as many of the intermediate lemmas required to prove the BCV correct can be proved with SPIKE.

Settings. Virtual machines, such as the Java(Card) Virtual Machine, provide a means to ensure security of mobile code, because the virtual machine controls the interaction between the applet and its environment and hence reduces the risk of malicious applets performing a security attack. Furthermore, such architectures rely on several mechanisms, known as security functions. A crucial such security function of the Java(Card) architecture is the bytecode verifier which performs a static analysis on programs and rejects potentially insecure programs.

Over the last few years there have been numerous projects to specify such virtual machines and their bytecode verifiers, and to prove the correctness of bytecode verification. While several projects have been very successful in their work, such endeavours are labour-intensive and suffer from the lack of adequate tool support, see the related works from Section 5.4. Our line of work is precisely to develop methodologies, techniques and tools that reduce the cost of developing and maintaining such formalisations.

CertiCartes In early work [Barthe et al., 2001b, Barthe et al., 2002b], we have developed a robust methodology to validate bytecode verifiers. The methodology consists in defining three virtual machines:

• a reference, so-called defensive, virtual machine where values are tagged by their type and where typing information is verified at run-time;

• an abstract virtual machine that manipulates types and that is used for bytecode verification;

• a "standard", so-called offensive, virtual machine, where values are untyped, and which relies on successful bytecode verification to eliminate type verification at run-time.

The advantages of our methodology is three-fold:

1. the offensive and abstract virtual machines can be derived from the defensive virtual machine using abstraction techniques;

2. the correctness of bytecode verification is now crisply stated as: "the offensive and defensive virtual machines coincide on those programs that pass bytecode verification";

3. the correctness of bytecode verification follows from the correctness of the abstractions of the defensive virtual machine into an offensive and an abstract virtual machine respectively, and from a generic development that establishes the correctness of the derivation of the bytecode verifier from the abstract virtual machine-the development is presented in [Nipkow, 2001] and further refined in [Barthe andDufay, 2003, Klein, 2003].

Jakarta In previous work [Barthe et al., 2002a, Barthe et al., 2001a], we argue that a neutral mathematical language is beneficial for performing automatic transformations on the specifications. Further, we introduce the Jakarta Specification Language (JSL), a simple typed specification language based on conditional rewriting, and the Jakarta Transformation Kit (JTK), an abstraction engine which constructs an offensive and an abstract virtual machine from the defensive virtual machine. The results with the JTK are encouraging, as it automates to a large extent the derivation of the offensive and abstract virtual machine; indeed, user interaction is limited to abstraction scripts that contain information on how the abstractions are to be constructed, and that are typically 10 times shorter than the latter.

Structure of the chapter. The chapter has four sections. Section 5.1 provides the necessary background on CertiCartes and introduces the problem to be addressed. Section 5.2 describes the main improvements that were implemented in SPIKE to handle the specification and validation of virtual machines. In Section 5.3, we turn to the application of SPIKE for proving the cross-validation of virtual machines. Section 5.4 discusses about related works.

A primer on CertiCartes

CertiCartes is an in-depth feasibility study in the formal verification, using the Coq proof assistant [The Coq development team, 2020], of the JavaCard Platform-recall that JavaCard is a dialect of Java tailored towards programming multi-application smartcards. In a nutshell, CertiCartes contains formal specifications of (one-step execution of) a defensive, an abstract and an offensive JavaCard Virtual Machine (JCVM) and of the BCV, and a proof that the defensive and offensive VMs coincide on those programs that pass bytecode verification.

Virtual Machines

In order to formalize the semantics of the virtual machines:

• we model programs as a triple consisting of a list of classes, a list of interfaces, and a list of methods.

Classes, interfaces and methods are represented likewise as appropriate tuples;

• we define for each machine a notion of state: dstate which builds upon typed values for the defensive machine, astate which takes types as values for the abstract machine, and ostate which builds upon untyped values for the offensive machine. Further, we define an associated notion of return states: drstate for the defensive machine, arstate for the abstract machine, and orstate for the offensive machine, that extends states with a tag to account for normal/abnormal termination, and in the case of the abstract machine returns lists of states to account for non-determinism;

• we model the semantics of each JavaCard bytecode b as a function ?exec_b: ?state → r?state, where ? ranges over d, a and o-note that in our formalisation, the JCVM instruction set is factorized into 45 generic instructions, as many instructions only differ by the type of their arguments, and can be factorized using a polymorphic instruction. Typically, the function ?exec_b extracts values from the state, performs type verification on these values, and extends/updates the state with the results of executing the bytecode;

• we model one-step execution as a function ?exec: ?state →r?state which inspects the state to extract the JavaCard bytecode b to be executed and then calls the corresponding function ?exec_b.

In order to prove the correctness of the BCV, we must prove three crucial properties about virtual machines: • CDO: the offensive abstract virtual machine is a sound abstraction of the defensive virtual machine, as illustrated by the commuting (up to the absence of typing error in the defensive execution) diagram in Figure 5.1, where s2os is the function mapping states to offensive states (by omitting types from values), and rs2ors denotes its lifting to return states;

• CDA: the abstract virtual machine is a sound abstraction of the defensive virtual machine, as illustrated by the commuting (up to subtyping, as indicated by the relation in the right arrow, and under suitable conditions, e.g. that execution does not raise an exception and keeps in the same frame) diagram in Figure 5.2, where s2as is the function mapping states to abstract states (by projecting values to types), and rs2ars denotes its lifting to return states;

• MON: the abstract virtual machine is monotonic w.r.t. the order induced by the inheritance relations on classes and interfaces.

For each of the properties considered, the proof proceeds by a case analysis on the bytecode to be executed, and then by an analysis of the possible outcomes of execution.

Bytecode verifier

The BCV is derived by instantiating a dataflow analyser with the abstract JCVM, and its correctness is derived from CDO, CDA and MON, using a generic (i.e. independent from the specifics of the JCVM) proof that justifies the dataflow analysis and the compositional, method-by-method, algorithm underlying bytecode verification, see [START_REF] Barthe | [END_REF], Klein and Nipkow, 2003, Nipkow, 2001].

Improvements of SPIKE

SPIKE provides an environment to verify clausal formulas in the initial model of many-sorted constructor-based theories presented by first-order conditional rules, and hence seems to be a good candidate for proving CDA, CDO and MON. Nevertheless, the standard distribution of SPIKE could not be used, since its specification language is too restricted, and its proof engine is not sufficiently optimized. Below we report on a number of improvements that were undertaken in order to apply SPIKE to our problem.

At the specification language

Parameterized Specifications The JavaCard VMs specifications are based on an important number of parameterized datatypes and functions. In particular, polymorphic lists are used intensively in the memory model: for example the heap is described as a list of objects, and the stack as a list of frames; further, each frame comes up with an operand stack and a set of local variables, each of which is described as a list of values. However, such parameterized specifications are not handled by the standard version of SPIKE. In order to perform our case study, we had to extend the syntax, type checking and inference system of SPIKE to deal with parameterized specifications-a similar work is described in detail in [Bouhoula, 1996], but had not been integrated in the standard version of SPIKE.

Introduction of Existential Variables

The axioms of standard SPIKE specifications consist in conditional rewrite rules of the form l1 = r1, . . . , ln = rn ⇒ g → d where all variables in conditions and d are required to occur in g. Formally, SPIKE requires that var(d) ⊆ var(g) and that for 1 ≤ i ≤ n, var(li) ⊆ var(g) and var(ri) ⊆ var(g). However, most functions defining the semantics of the JCVM fail to meet this requirement, as variables in the ris are fresh. In order to handle the JCVM specifications, we have enhanced SPIKE with the ability to handle such variables, which we call existential.

Obtaining SPIKE specifications of the JCVMs We have implemented mechanisms that may be used to compile a large class of Coq specifications to JSL and SPIKE, and that have been used to produce SPIKE specifications of the JCVMs from CertiCartes.

At the proof engine

We only provide a concise and informal description of the extensions that we have implemented, and briefly indicate their impact on soundness.

Adaptation of the Inference System

In order to handle the extensions of the specification language, we have modified the inference system, and in particular the Generate rule, an instance of the abstract rule AddPremise from Chapter 4. Similar to the ConjSup rule from Chapter 1, it instantiates variables and rewrites with conditional rewrite rules the clause instances using narrowing techniques. First, the parameterized variables cannot be instantiated by Generate rules during the proofs. Second, the Generate rule is modified so that SPIKE i) forbids the instantiation of existential variables, unless all induction variables are tagged as existential; ii) does not put the current conjecture in the set of premises if its cover set instances are simplified with conditional rewrite rules introducing existential variables. W.r.t. i), observe that if no special provision were made, no inference rule could be applied if all induction variables are tagged as existential. In some circumstances however, we may want the proof to proceed, and so we force such a behavior by generalizing existential variables to universal ones in order to perform Generate. One drawback of this solution is the loss of refutational soundness, as the new rule potentially introduces new artificial counterexamples in the derivation by a generalization operation. Nevertheless, the new rule preserves the soundness of the system. W.r.t. ii), existential variables break the order condition requiring that the left hand side be greater than the conditions and the right hand side. This implies that if the current conjecture would contain a counterexample, the new set of conjectures cannot guarantee a smaller one. However, this condition is crucial for allowing the current conjecture to participate to further inferences [Stratulat, 2001]. In such cases, the transformation of a cover set instance Cσ can be considered as an instance of Simplify rule from Chapter 4, which in addition (w.r.t. the Generate rule) allows the use of H instances equivalent to Cσ. Summing up, the resulting system is sound, but not refutationally sound.

Improvements over the Inference System

New Induction Schemas In the standard implementation, Generate produces intermediate instances of the current conjecture C using cover substitutions that instantiate some of its (induction) variables with elements of the cover set of their types. Therefore, the number of cover substitutions is exponential w.r.t. number of induction variables. For real applications such as the cross-validation of the JCVMs, this induction scheme may quite often generate thousands of cover substitutions. Such cases imply prover performances unacceptably poor.

In order to overcome this problem, we have implemented the following narrowing-based induction scheme, which leads to a major improvement in terms of performance: assume that there exists a (sub)term t of C whose head symbol is defined and that unifies with left-hand sides of the axioms defining the head symbol. From the most general unifier, we can immediately deduce that the cover substitution σ and the axiom that can simplify Cσ. Therefore, the number of cover substitutions is limited to the number of axioms defining the head symbol, usually ranged to tens. As explained above, the improved schema is sound because the specification is constructor-based, complete and strongly complete. The last property guarantees that the disjunction of the conditions related to instances of axioms having the same left-hand side is valid.

Although of no incidence for our purpose, this scheme is not fit to prove conjectures having different (sub)terms that share induction variables, as for the associativity of the addition over naturals; it leads to a proof divergence.

Auto Simplification:

( Therefore, we have adapted the following heuristics: recursively, if the (sub)term t shares induction variables with other (sub)term t of C, compute also the cover substitutions and apply the heuristics for t as for t. Since the number of (sub)terms of C is finite, this heuristics terminates. At the end, by the combination of the partial cover substitutions, it returns a set of cover substitutions such that the resulted instances of C can be simplified at any position corresponding to the terms treated by the heuristics (like t and t ). In our proofs, the number of cover substitutions still remains ranged to tens.

E ∪ {C[s = t]}, H) ---→ Ax spike (E ∪ {C }, H) if s > e t

New Inference Rules

The following inference rules, illustrated in Figure 5.3, have been added in order to exploit the conditions of conjectures:

1. auto simplification. It allows the rewriting of a conjecture with its negative literals, and allows to eliminate an existential variable from the rest of a conjecture as soon as it appears in a top position in equalities. Note that the order >e is an extension of the usual recursive path ordering to existential variables: for example, an existential variable x is always greater than any term that does not contain x and is not itself an existential variable;

2. congruence closure. If a conjecture contains as conditions the literals of the form s = t and t = u then the new literal s = u is added to the conditions. The new literals are built using a completion algorithm having as input all the negative literals of the current conjecture. The procedure is refined by looking in priority for new equalities between constructor terms. If the head symbols of the both sides of a new equality are the same, we can derive new equalities by a decomposition operation, otherwise the clause is eliminated from the set of conjectures;

3. augmentation. Given a conditional clause, its conclusion can be added to the conditions cond of a conjecture if the conditions of the clause are discharged by cond [Boyer and Moore, 1988b]. The typical use of this rule in our applications is when the clause is a non-orientable user-defined lemma.

Additional applicability conditions are put such that each of these inference rules is an instance of the Simplify rule. Hence the soundness of these rules follows from the soundness of the abstract inference system A from Chapter 4. The application strategy of the inference rules is standard, by trying firstly the Simplify rules that do not add new conjectures, then the other Simplify rules and, finally, the Generate rules.

Implementation Optimisations Another major improvement in terms of execution time is the recording of the failures of the inference rules application in order to avoid useless computation. Some of the recordings are performed at the level of clauses (for example, for subsumption), others at the level of terms (for example, for rewriting). If a rewrite operation with an unconditional rule fails at a given position of a conjecture, the rule's identification number is associated to that position such that the rule is avoided in the further rewriting operations as long as the term containing the position does not change.

Applications to JavaCard

In this section, we describe the results of our experiments of using the extended version of SPIKE to prove CDO, CDA and MON. For each instruction, we have three modules, one for each property CDA, CDO, and MON; this separation has no other purpose than convenience for carrying our experiments and collecting statistics. Each module consists of three parts: an algebraic specification, in our case parts of the description of the JCVMs, a logical theory to be proven, in our case some assumptions about the program and statements of CDA, CDO and MON, and a strategy that determines the prover's behavior during the proofs. The modules are available at https://members.loria.fr/SStratulat/files/verificard.tgz for the Linux distributions.

The module begins with the name of the specification, and follows by declaring the types (or sorts), constructor symbols, and defined functions of the specification. Then the behavior of defined functions is specified by means of clauses. The module is completed by fixing a proof strategy, and by declaring of the conjectures to be proven; note that conjectures are formulated as equational clauses.

CDO

The new version of SPIKE has been used to verify CDO for most instructions (41 out of 45). Figure 5.4 provides an excerpt of the SPIKE module used to prove CDO for the function CONV, that factors several of the conversion bytecodes of the JCVM: s2b (short to bytes), s2i (short to integers), i2b (integers to bytes), i2s (integers to short). Figure 5.1 provides some statistics about this experiment. In the second column, we indicate if the proof has been already done (yes) or not yet (n.y.). The third column presents the number of lemmas introduced by the user (and proved previously by SPIKE), while the other columns show respectively the number of Generate rules, normalization operations with unconditional rules, case rewriting with conditional rules, syntactic subsumption rules, tautology elimination rules and the execution time. Note that most proofs are automatic, i.e. do not require users to provide SPIKE with additional lemmas, and done in a reasonable time.

CDA and MON

We are now working on the proofs of CDA and MON, and have proven both properties for around half of the instructions. These properties are more challenging to prove than CDO, in particular because they rely on a number of invariants about JavaCard programs and the JCVM memory model. Thus users must provide appropriate invariants for the proofs to go through; as the formulation of such invariants can only be made during proofs, the benefits of automation are less clear for CDA and MON.

Assessment

We briefly comment on the effectiveness of the tool, and establish a comparison with our work on CertiCartes.

Automation SPIKE provides a reasonable level of automation, and there is no need to tune the strategy for each lemma to be proved. The best results are achieved with CDO, which for many bytecodes can be proved automatically, i.e. without requiring the users to provide intermediate lemmas. As explained above, the level of automation is lower for CDA and CDO. We detail below two directions for improvement.

Counterexamples SPIKE provides useful feedback to the specifier. By permitting the automatic refutation of false conjectures, SPIKE highlights, at a relatively low cost, possible problems in the specifications. This is essential for complex, large-scale formalisations which are bound to contain bugs, at least in their initial stages.

Expressivity SPIKE is expressive enough for specifying the virtual machines, and the properties CDO, CDA and MON. However it is not expressive enough to prove the correctness of the BCV, see below.

Comparison with CertiCartes CDA, CDO and MON have been proved independently in the Coq proof assistant. The comparison is without surprise, e.g. SPIKE provides a better level of automation than Coq, but on the other hand proofs that are not automatic may be harder to go through in SPIKE. Further, Coq is more expressive than SPIKE, and provides an adequate environment to specify (and prove) some properties of the JavaCard platform that cannot even be stated in SPIKE-most of the work reported in [START_REF] Barthe | [END_REF]] cannot be cast in SPIKE.

Directions for improvement

Conclusions and related works

shape, and could be generated automatically so as to minimize user interactions. One possibility that we are exploring is to exploit the abstraction script used to generate the offensive/abstract machine from the defensive one for generating such lemmas;

• Connection with Coq: while SPIKE provides a reasonable level of automation, not all proofs can be performed automatically. Further, Coq is more expressive than SPIKE, as explained above. In this respect, it may be beneficial to connect Coq and SPIKE so that Coq users may appeal to SPIKE to discharge some proof obligations automatically, as is done for example for Coq and Elan [START_REF] Nguyen | [END_REF]. In particular, such a connection would allow users to discharge automatically many trivial (sub)cases of CDA and MON, namely those which do not rely on any invariant. Some preliminary work is presented in Chapter 6.

Conclusions and related works

Our work is an attempt to apply rewriting techniques to validate security architectures for low-level languages used in smartcards. There have been a number of other applications of rewriting techniques to security, but these works focus on different aspects of security, such as network security and cryptographic protocols, see e.g. [START_REF] Cervesato | [END_REF], Denker et al., 2000].

Our work is related to existing efforts to provide formal specification and correctness proofs for open platforms, including those carried by E. Giménez and co-authors at Trusted Logic, by J.-L. Lanet and co-workers at Gemplus [Casset et al., 2002] (abstract B machines for the JCVM and BCV), by T. Nipkow and co-workers at Munich [Klein and Nipkow, 2003] (Java, JVM, BCV, and compiler in Isabelle), by J Strother Moore and co-workers at U. of Texas (JVM and BCV in ACL2)-note that some other works, e.g. [Stärk et al., 2001, Coglio et al., 1998] provide machine executable semantics, but pencil-and-paper formal proofs. We refer to [START_REF] Hartel | [END_REF] for further information, and limit ourselves to notice that most of these specifications implicitly use a restricted framework, but our work is distinctive by expliciting and taking advantage of this restricted framework.

Closest to our work is the work by A. Gordon and D. Syme [START_REF] Syme | [END_REF], which aims at automatic type-safety proofs for low-level languages. They identify a restricted framework in which specifications and properties can be expressed, and enhance the proof assistant HOL with suitable decision procedures, inspired from SVC (Stanford Validity Checker), to achieve a high degree of automation. Our methodology, which aims at validating automatically derived abstractions, seems crisper but we lack grounds for comparison -it would be interesting to validate, as they do, the .NET virtual machine, for carrying such a comparison.

6

Certifying Formula-based Noetherian Induction Reasoning Compared to the term-based Noetherian induction instances, the formula-based instances are not directly supported by the current proof assistants. In this chapter, we present general formal tools for certifying formulabased Noetherian induction proofs by the Coq proof assistant, then show how to apply them to certify proofs of conjectures about conditional specifications, built with: i) a reductive rewrite-based induction system, and ii) a reductive-free cyclic induction system. The generation of reductive proofs and their certification process can be easily automatised, without requiring additional definitions or proof transformations, but may involve many ordering constraints to be checked during the certification process. On the other hand, the reductive-free proofs generate fewer ordering constraints, may involve more general specifications and the certification process is more effective. However, their proof generation is less automatic and the generated proofs need to be normalised before being certified. The methodology for certifying reductive-free cyclic induction proofs related to conditional specifications can be easily adapted to certify any formula-based Noetherian induction reasoning.

In practice, the methodology has been implemented to automatically certify implicit induction proofs generated by the SPIKE theorem prover as well as reductive-free cyclic proofs built by the same system but in a less automatic way.

The content of the chapter is based on the papers [Stratulat, 2010, Stratulat and Demange, 2011, Henaien and Stratulat, 2013, Stratulat, 2017b].

Structure of the chapter. The chapter is organised in five sections, as follows. The Coq formalisation of the formula-based Noetherian induction principle and the certification methodology are presented in Section 6.1. Section 6.2 introduces different implicit induction inference systems. A first attempt to certify the proofs of the theorems for the P&Q example, given in the General Introduction, is presented. Afterwards, the certification of the implicit proof of the property on even and odd is explained using a functional programming style. The proofs of these properties are redone in Section 6.3 using cyclic inference systems and showed that the certification of the cyclic proof concerning the P&Q example is successful by using a logic programming style. The instructions for generating implicit and cyclic proofs by the SPIKE prover as well as their conversion into Coq script are presented in Section 6.4. Section 6.5 concludes.

The full source code, including the used libraries, reasoning systems, specifications and proofs, is provided as supplementary material at https://members.loria.fr/SStratulat/files/jsc-pas.zip and on SPIKE's website https://github.com/sorinica/spike-prover.

Formalising formula-based Noetherian induction proofs

The Coq formalisation of formula-based Noetherian induction proofs is based on ideas presented in [Stratulat, 2010, Stratulat and[START_REF] Stratulat | [END_REF], initially developed for certifying implicit induction proofs. Mainly, we associate to each formula a measure value that will help to compare formulas, hence to define the induction ordering < f . Given a list LF of pairs of the form (φ, µ φ ) including the formulas to be proved and their corresponding measure values, the formula-based Noetherian induction principle can be reformulated as follows:

(∀p ∈ LF, (∀p ∈ LF, snd(p ) < f snd(p) ⇒ f st(p )) ⇒ f st(p)) ⇒ ∀p ∈ E, f st(p),
where the f st (resp., snd) function returns the first (resp., second) projection of a pair.

In Coq, the conditional part of the outermost implication can be formalised as:

Lemma main : ∀ F, In F LF → (∀ F', In F' LF → less (snd F' ) (snd F ) → fst F' ) → fst F.
We assume that the induction ordering, denoted by less, is well-founded and stable under substitutions. In the following, less is assumed to implement < f as a multiset extension of an rpo. In this case, the measure value of a formula can be represented as the multiset of terms occurring in it. Given two pairs (φ1, µ φ 1 ) and (φ2, µ φ 2 ), we say that φ1 is smaller than φ2 if less µ φ 1 µ φ 2 holds.

The main induction steps for proving the validity of the formula φ from each pair of LF are:

1. the deduction part: choose the (instances of) formulas from LF as IHs that help proving φ; 2. the ordering part: show that the chosen IHs in the deduction part are smaller than φ.

The ordering part can be omitted if the deduction part does not involve induction reasoning. The deduction part can be performed with different inference systems, as it will be shown in Sections 6.2, 6.3, and 6.4.

The less ordering has to be defined explicitly, for example, using the syntactic representations of terms provided by the COCCINELLE library [START_REF] Contejean | [END_REF], Contejean et al., 2010], a Coq library modelling mathematical notions for rewriting such as term algebras and induction orderings, or using the more general CoLoR library [Blanqui and Koprowski, 2011]. Both libraries can be used independently or combined, but in the subsequent examples only COCCINELLE will be used.

Formalising the induction ordering and measure values with COC-CINELLE

Formalising the induction ordering A COCCINELLE abstract term is recursively defined as:

Inductive term : Set := | Var : variable → term | Term : symbol → list term → term.
Theorem prec wf: well founded prec.

The 'stability under substitutions' and well-foundedness properties of rpo mul are scripted as:

Theorem rpo mul subst : ∀ A B : (list term), ∀ bb:nat, rpo mul bb A B → ∀ σ, rpo mul bb (map (apply subst σ) A) (map (apply subst σ) B ).

Theorem wf rpo mul : well founded prec → ∀ bb, well founded (rpo mul bb).

Finally, the less induction ordering is defined as an instance of rpo mul initialising some internal data structures. For example, the value given as argument to rpo and rpo mul is set to the constant max size (usually a big natural value):

Notation less := (rpo mul (bb (empty rpo infos max size))).

Formalising the measure values Formulas and their measure values should share variables such that whenever a formula φ changes by instantiation, its measure value µ φ changes accordingly. The pair (φ, µ φ ) can be represented as the anonymous function fun x ⇒ (φ, µ φ ), where µ φ is the measure of φ formalised as a list of COCCINELLE terms and x is the vector of universally quantified variables shared between µ φ and φ.

The process for converting terms from the LF formulas into COCCINELLE terms can be fully automatised, as follows:

• for each inductive set representing a type employed in the specification, a new model function translating its constructor terms can be defined. For example, the translation function defined for nat, the Coq builtin type for naturals built from the constructors O and S, is:

Proving formulas from LF

The LF list from the main lemma should be adapted to include anonymous functions instead of pairs. The new LF should have the type of the form:

Definition type LF := argument sort → (Prop × (List.list term)),
where argument sort is the sort written in a curried form of the most general version of the vector of shared variables allowing to define each anonymous function from LF.

By using the new LF definition, the main lemma becomes:

Lemma main : ∀ F, In F LF → ∀ u, (∀ F', In F' LF → ∀ u , less (snd (F' u )) (snd (F u)) → fst (F' u )) → fst (F u).
All formulas from the LF list can be automatically certified by proving the all true theorem, based on the main lemma and the general Noetherian induction principle built in Coq:

Theorem all true: ∀ F, In F LF → ∀ u: nat, fst (F u).
As a case study, the methodology will be used in Sections 6.2 and 6.3 for certifying proofs of conjectures about conditional specifications.

Certifying implicit induction proofs

Inference systems for implicit induction

We define a minimalistic and concrete implicit induction inference system, denoted by I b s , able to prove the conjectures from the P&Q example.

InstNat (I ): (E ∪ {φ x }, H) I b s (E ∪ {φ{x → 0}, φ{x → S(x )}}, H)
, where x is a fresh variable.

DelInst (D): (E ∪ {φ}, H) I b s (E, H), if ∃ψ ∈ H ∪ Ax and a substitution σ such that φ ≡ ψσ. RedEq (R): (E ∪ {φ}, H) I b s (E ∪ i {liσ = riσ}, H ∪ {φ})
, if there is an axiom i li = ri ⇒ l = r and a substitution σ such that φ ≡ (lσ = rσ).

InstNat replaces an equality φ with a natural variable x by two equalities derived from φ by instantiating φ with 0 and the successor of a fresh natural variable, respectively. DelInst deletes the processed conjecture if it is an instance of a premise or axiom. Finally, RedEq replaces any unconditional equality that matches the conclusion of a conditional axiom with the set of the corresponding instances of the conditions of the conditional axiom. In addition, the processed conjecture is added as premise.

The specification of the predicates P and Q will be done using conditional axioms, built from the translation of the inductive definitions of the predicates P and Q into the boolean functions p and q, respectively:

p(0) = true (6.1) p(x) = true ∧ q(x, S(x)) = true ⇒ p(S(x)) = true (6.2) p(x) = f alse ⇒ p(S(x)) = f alse (6.3) q(x, S(x)) = f alse ⇒ p(S(x)) = f alse (6.4) q(x, 0) = true (6.5) p(x) = true ∧ q(x, y) = true ⇒ q(x, S(y)) = true (6.6) p(x) = f alse ⇒ q(x, S(y)) = f alse (6.7) q(x, y) = f alse ⇒ q(x, S(y)) = f alse (6.8)
where f alse and true are the usual boolean constants.

In order to define the ordering < for this example, the measure value of an equality of the form i li = ri ⇒ l = r is defined as the multiset of terms i |li| ∪ i |ri| ∪ |l| ∪ |r|, where |t| is defined as

• {x, x} if t is of the form p(x),
• {x, x, y} if t is of the form q(x, y),

• {t}, otherwise.

The ordering used for comparing multisets of terms is the multiset extension of the mpo using the precedence f alse <F true <F 0 <F S. It can be noticed that for any conditional axiom defining p and q, of the form i ei ⇒ e, we have that ei < e. This property will be useful for the sound application of the RedEq rule. The I b s -proof of the equality q(x, y) = true is:

({q(x, y) = true}, ∅) ({q(x, 0) = true, q(x, S(y )) = true}, {p(S(x )) = true, q(x, S(y )) = true})

D I b s ({q(x, S(y )) = true}, {p(S(x )) = true, q(x, S(y )) = true}) D I b s (∅, {p(S(x )) = true, q(x, S(y )) = true})
where the underlined equalities are the processed conjectures from each proof state.

Theorem 12 (soundness of I b s ) The inference system I b s is sound.

Proof It follows directly from the soundness of the inference system A, presented in Section 4.1.2, if we prove that each I b s -rule is the instance of an A-rule.

• InstNat is an instance of Simplify because if the processed conjecture φ x has a counterexample then it should be in the set of new conjectures {φ{x → 0}, φ{x → S(x )}}

• DelInst is an instance of Simplify because whenever the equality instantiated by the processed conjecture φ is an axiom, then φ has no counterexamples, or a premise ψ from the current state, then any counterexample φτ is an instance of ψ.

• RedEq, using the conditional axiom i li = ri ⇒ l = r for which there is a substitution σ such that the processed conjecture φ is (lσ = rσ), is an instance of AddPremise. This is because whenever φ has a counterexample φτ , one of the equalities from the multiset i {liστ = riστ } is a counterexample smaller than φτ (≡ (lστ = rστ )), by the fact that li = ri < l = r, for each i, and the 'stability under substitutions' property of <.

Thanks to Theorem 12, we can conclude that q(x, y) = true is a consequence of the axioms defining p and q.

6.2.2 A first attempt to certify the proof of q(x, y) = true

A translation of the functions p and q in Coq, using a functional programming style, can be

Fixpoint p (u:nat) : bool := match u with | 0 ⇒ true | (S u' ) ⇒ if andb (p u' ) (q u' (S u' ))
then true else false end with q (x y: nat): bool := match y with | 0 ⇒ true | (S y' ) ⇒ if andb (p x ) (q x y' ) then true else false end.

Unfortunately, Coq is not able to prove automatically the termination of the P and Q functions, yielding the message Error: Cannot guess decreasing argument of fix. Moreover, specifying user-defined well-founded orderings for proving that an argument is decreasing is not allowed for mutually recursive functions, as it is clearly stated by the message Error: Cannot use mutual definition with well-founded recursion or measure. We will show in Subsection 6.3.3 how to handle this situation using the logic programming style.

Coq formalizations of implicit induction proofs

In the rest of the section, we will stick to formalize implicit induction proofs that involve equational specifications convertible into valid Coq script, by using a functional programming style. Let us consider the function symbols even and odd, recursively defined over naturals, as: even(0) = true (6.9) even(S(x)) = odd(x) (6.10)

odd(0) = f alse (6.11)
odd(S(x)) = even(x) (6.12)

as well as the addition over naturals, denoted by '+' and defined by the axioms:

0 + x = x (6.13) S(x) + y = S(x + y) (6.14)
The Coq translation of the equational definitions yields functions whose termination can be automatically checked: We can go further and try to prove the more complex conjecture

odd(u1 + u2) = true ∧ even(u2 + u3) = true ⇒ odd(u1 + u3) = true (6.15)
by using reductive reasoning techniques. Rewriting is a most effective reductive technique for reasoning on equational specifications.

Let ≺ be a reduction ordering over terms and ρ a set of rewrite rules. A term u can be rewritten to u by the rewrite operation u →ρ u if there are a rewrite rule l = r ∈ ρ and a substitution σ such that lσ is a subterm of u. The rewrite operation builds u from u by replacing the subterm lσ by rσ. By abuse of notation, →ρ is extended to rewrite conditional equalities: if a conditional equality e of the form i li = ri ⇒ l = r has a term s ∈ i {li, ri} ∪ {l, r} that is rewritten to s using rewrite rules from ρ then we write e →ρ e , where e derives from e by replacing s with s .

Example 13 The axioms (6.9)-(6.14) can be oriented from left to right using as reduction ordering the mpo built from the precedence over the function symbols stating that f alse <F true <F 0 <F S <F + <F even and even ∼F odd.

Let ≤ be the well-founded and 'stable under substitutions' quasi-ordering over the equalities whose strict part is the multiset extension ≺ ≺ of the reduction ordering ≺. The measure value of an equality of the form i li = ri ⇒ l = r is defined for this example as the multiset of terms i {li, ri} ∪ {l, r}.

Theorem 13 (reductiveness of rewriting) Let ρ be a set of rewrite rules and e, e two equalities. If e →ρ e , then e ≺ ≺ e.

Proof Let us assume that e is of the form i li = ri ⇒ l = r and that s ∈ i {li, ri} ∪ {l, r} was rewritten to s by a rewrite rule g → d from ρ. Then, there is a substitution σ such that gσ is a subterm of s. By the 'stability under substitutions' property of ≺, we have that dσ ≺ gσ, and by the 'stability under contexts' property, s ≺ s holds.

On the other hand, the measure value of i li = ri ⇒ l = r is the multiset i {li, ri} ∪ {l, r}, s being one of its elements. By the definition of the multiset extension relation, the replacement of s by s in this multiset yields a smaller multiset, hence e ≺ ≺ e.

Proofs of the conjecture (6.15) can be built using the inference system I f s :

GenNat (G): (E ∪ {φ x }, H) I f s (E ∪ {φ1, φ2}, H ∪ {φ})
, where φ{x → 0} →Ax φ1, φ{x → S(x )} →Ax φ2 and x is a fresh variable.

SimpEq (S ):

(E ∪ {φ}, H) I f s (E ∪ Φ, H), if either i) φ is a tautology; in this case Φ is empty; or, ii) φ → Ax∪(E∪Φ∪H) ≤φ ψ; in this case, Φ is {ψ}. Subsumption (E ): (E ∪ {φ}, H) I f s (E, H), if φ is an instance of an equality from H. Negative Clash (N ): (E ∪ {φ}, H) I f s (E, H), if φ is a conditional equality and true = f alse or f alse = true is a condition of φ.
GenNat firstly instantiates a natural variable of the processed conjecture by 0 and the successor of a fresh natural variable, then rewrites the two instances with axioms, the results of the rewriting operations being stored as new conjectures. At the end, the processed conjecture is saved as a new premise. SimpEq either deletes the tautologies or performs rewrite operations on the processed conjecture with axioms or instances of equalities from the current state. Subsumption deletes the processed conjecture if it is an instance of a premise. Finally, Negative Clash deletes the conditional equalities having a false condition of the form true = f alse or f alse = true.

The I f s -proof of (6.15) is more complex than that of the conjecture q(x, y) = true. For lack of space, the conditional equalities from this proof will be presented in a more compact way, as atoms. The list of atoms and their corresponding conditional equalities are: As for the I b s -proof of the equality q(x, y) = true, the processed conjectures from each state are underlined. * S I f s means that SimpEq was applied several times. The induction reasoning occurs while executing the Subsumption rule, the instances of premises used as IHs being built by need.

Theorem 14 (soundness of I f s ) The inference system I f s is sound.

Proof As for the proof of Theorem 12, we show that each I f s -rule is the instance of an A-rule. • GenNat is an instance of the two-step version of AddPremise, presented in Figure 8.2 and explained in Subsection 8.1.2. If the processed conjecture φ x has a counterexample φτ then it should be in the set of intermediary conjectures {φ{x → 0}, φ{x → S(x )}}. Since the two intermediary conjectures are rewritten with axioms, the set of new conjectures has a counterexample smaller than φτ , by the reductiveness property of rewriting and the 'stability under substitutions' property of ≤.

• SimpEq is an instance of Simplify. If the processed conjecture φ has a counterexample φτ , then φ should be rewritten to ψ with i) axioms, or ii) other equalities from the current state or from the new set of conjectures which are smaller or equal than φ. We have that ψ < φ by the reductiveness property of rewriting and ψτ < φτ by the 'stability under substitutions' property of <. If ψτ is false, then ψτ is a counterexample from the new set of conjectures which is smaller than φτ . If ψτ is true, it means that the rewrite rule e was selected from the current state and satisfies e ≤ φ. By the 'stability under substitutions' property of ≤, we have that eτ ≤ φτ . Moreover, eτ is a counterexample since φτ is false but ψτ is true.

• Subsumption is an instance of Simplify because whenever the processed conjecture φ is an instance of a premise, any counterexample of φ is also a counterexample of that premise.

• Negative Clash is an instance of Simplify because the processed conjecture has no counterexamples.

By Theorem 14, we conclude that the conjecture (6.15) is a consequence of the axioms defining even, odd and '+'.

Certification of implicit induction proofs for Coq formalisations using the functional programming style

The induction ordering is built similarly as for the P&Q example, shown in Subsection 6.1.1, excepting that the precedence over the function symbols changes, as follows:

Inductive symb : Set := | id 0 | id S | id true | id false | id even | id odd | id plus. Definition index (f : symb) := match f with | id 0 ⇒ 2 | id S ⇒ 3 | id true ⇒ 4 | id false ⇒ 5 | id even ⇒ 10 | id odd ⇒ 10 | id plus ⇒ 7
end. The formula-based Noetherian induction principle will be applied on the set of all equalities encountered in the implicit induction proof of e 13(u1, u2, u3). The LF list type LF 13 and its type LF 13 are: The measure value attached to any equality e in the corresponding anonymous function is the list of the literate representation in COCCINELLE of the terms from e.

The main lemma becomes:

Lemma main 13 : ∀ F, In F LF 13 → ∀ u1 u2 u3, (∀ F', In F' LF 13 → ∀ e1 e2 e3, less (snd (F' e1 e2 e3 )) (snd (F u1 u2 u3 )) → fst (F' e1 e2 e3 )) → fst (F u1 u2 u3 ).
The proof of the main 13 lemma starts with a case analysis on the anonymous functions from LF 13. We describe the scenarios for building the Coq script by translating every single implicit induction inference step. Given an anonymous function F ∈ LF 13,

• the main steps for generating the Coq script for the case when a GenNat rule is applied on an equality e from F are:

1. generation and application of the instantiation schema. The instantiation schema of variables from e consists in replacing a variable v of natural sort with 0 and successor of a fresh variable. In Coq, this can be easily performed with the destruct tactic applied on v. However, an instantiation schema reproduced by the means of functional schemes [START_REF] Barthe | Efficient reasoning about executable specifications in Coq[END_REF] is more flexible than the instantiation schemas issued from the definitions of inductive sets on which the destruct tactic are based:

Fixpoint f (u1: nat) {struct u1} : nat := match u1 with | 0 ⇒ 0 | (S u2) ⇒ 0 end.
Functional Scheme f ind:= Induction for f Sort Prop.

The functional scheme can be applied on any natural variable u1, as follows: pattern u1, (f u1). apply f ind.

2. validation of each instance and ordering constraint. For each equality instance φ generated during the application of GenNat, we assign to F the anonymous function from LF 13 that corresponds to the equality resulting from the rewriting of φ in the I f s -proof. If the axioms are put in the Coq rewrite base, the logical equivalence between φ and the rewritten instance can be automatically checked by the auto tactic. The ordering constraints requiring that the measure value of the equality from F be smaller than µ φ are also automatically checked by user-defined tactics. The rewrite model tactic simplifies µ φ by unfolding the model nat translation functions on the subterms of φ of the form (model nat (S u)). The solve rpo mul tactic i) replaces the terms of the form (model nat u) by COCCINELLE variables, ii) performs the comparison test, representing a test case for checking Theorem 13, and iii) by the 'stability under substitutions' property of rpo mul, preserves the comparison result for the instance built with the substitution mapping the COCCINELLE variables to the corresponding (model nat u) terms.

• the scenario corresponding to the application of a SimpEq rule using rewriting is similar to that presented at the step (2) of the scenario built for GenNat. The tautologies are eliminated by the auto tactic;

• the application of a Negative Clash corresponds to the application of the discriminate tactic;

• the Subsumption steps are ignored because the equality from the anonymous function F is an instance of an equality from another anonymous function from LF 13.

Next, we show that any formula from LF 13 is true:

Theorem all true 13 : ∀ F, In F LF 13' → ∀ (u1 : nat) (u2 : nat) (u3 : nat), fst (F u1 u2 u3 ).
Finally, our property is certified:

Theorem true 13 : ∀ (u1 : nat) (u2 : nat) (u3 : nat), odd (plus u1 u2 ) = true → even (plus u2 u3 ) = true → odd (plus u1 u3 ) = true.

Certifying cyclic proofs

In the previous section, we have shown that the computational cost for certifying implicit induction proofs also depends on the number of equalities encountered in the proofs. In practice, it is common that implicit induction provers (automatically) generate large proofs, with hundreds or thousands of equalities (see Chapter 5). In this case, the proof certification effort becomes non-negligeable. We present a different method for proving conjectures about conditional specifications, based on a reductive-free cyclic induction approach proposed in Chapter 2 for which the certification process is more effective. The proofs are built by outlining the non-trivial induction reasoning in terms of cycles of equalities. Compared to the validation process of implicit induction proofs from Section 6.2, the validation of cyclic proofs needs fewer ordering constraints and shorter LF lists.

Inference systems for cyclic induction

We introduce the abstract inference system D , similar to the system D from Chapter 2, which consists of the following three rules:

Deduction: E ∪ {φ} D E ∪ Φ, where i) ∀ψ ∈ Φ, V ar(ψ) ⊆ V ar(φ), and ii) Φ has a counterexample whenever φ has a counterexample.

Split: E ∪ {φ} D E ∪ Φ,
where Φ is {φσ | σ ≡ i {xi → ti} and ∀i, xi ∈ V ar(φ) and V ar(ti) are fresh}, and whenever φ has a counterexample φτ , Φ has φτ as counterexample.

Induction: E ∪ {φ} D E ∪ Φ, where i) there exists an instance ψδ of a previously generated equality ψ such that Φ or ψδ has a counterexample whenever φ has a counterexample, and ii) V ar(ψδ) ⊆ V ar(φ) and ∀ψ ∈ Φ, V ar(ψ ) ⊆ V ar(φ).

Compared to the implicit induction inference rules, the D -rules are transitions between multisets of equalities that transform an equality (i.e., the processed conjecture) into a set of new equalities (i.e., new conjectures). Deduction ensures that for any counterexample of the processed conjecture there is a counterexample in the set of new conjectures. Split is a particular case of Deduction, requiring that the set of new conjectures consists of instances of the processed conjecture. Finally, Induction is the only rule that performs induction reasoning, by allowing instances of previously generated equalities in the derivation to be used as IHs when transforming the processed conjecture. It can be seen as a generalisation of Deduction since for any counterexample of the processed conjecture we may not require for a counterexample in the set of new conjectures if the equality used as IH has already a counterexample.

Definition 3 (D -preproof ) Given a multiset of equalities E 0 , any finite derivation of the form

E 0 D . . . D ∅ is a D -preproof of E 0 .
Concrete inference rules can be built by showing how the new conjectures from the D -rules are generated using specific reasoning techniques. Based on the reasoning techniques employed by the inference system I b s from Section 6.2, we can build the inference system I b c :

DelInst' (Dc): E ∪ {φ} I b c E, if there are ψ ∈ Ax and a substitution σ such that φ ≡ ψσ.

RedEq' (Rc

): E ∪ {φ} I b c E ∪ i {liσ = riσ}, if i li = ri ⇒ l = r ∈ Ax and ∃σ such that φ ≡ (lσ = rσ) or φ ≡ (rσ = lσ). SplitNat (Sc): E ∪ {φ x } I b c E ∪ {φ{x → 0}, φ{x → S(x )}}
, where x is a fresh variable.

IndNat (Ic): E ∪ {φ} I b c E, if there are a previously generated equality ψ and a substitution σ such that φ ≡ ψσ.

DelInst' deletes the processed conjecture if it is an instance of an axiom. RedEq' firstly checks whether the processed conjecture is an instance of the conclusion of some axiom, then adds as new conjectures the set of corresponding instances of the conditions of the axiom. SplitNat applies on conjectures with natural variables and replaces them by their instances resulted by replacing some natural variable with 0 and successor of a new variable. Finally, IndNat deletes the processed conjecture if it is an instance of a previous conjecture in the derivation.

Theorem 15 Any I b c -rule is an instance of a D -rule.

Proof We perform a case analysis on the I b c -rules:

• DelInst' is an instance of Deduction for the case when the set of new conjectures is empty since the processed conjecture has no counterexamples;

• RedEq' is an instance of Deduction because for any counterexample of the processed conjecture φ there is one in the set of corresponding instances of the equality conditions of the axiom whose conclusion was instantiated by φ;

• SplitNat is an instance of Split since any counterexample of the processed conjecture is also a counterexample in the set of new conjectures;

• IndNat is an instance of Induction because any counterexample of the processed conjecture is also a counterexample of the previous equality whose instance was used as IH.

An I b c -preproof of a multiset of equalities E 0 is any finite I b c -derivation that starts with E 0 and finishes with an empty set of equalities.

Example 14

The following I b c -preproof of {q(x, y) = true} can be built by using the axioms (6.1)-(6.8) and the proof scenario given at the general introduction:

{q(x, y) = true} Sc I b c {q(x, 0) = true, q(x, S(y )) = true} Dc I b c {q(x, S(y )) = true} Rc I b c {q(x, y ) = true, p(x) = true} Ic I b c {p(x) = true} Sc I b c {p(0) = true, p(S(x )) = true} Dc I b c {p(S(x )) = true} Rc I b c {p(x ) = true, q(x , S(x )) = true} Ic I b c {q(x , S(x )) = true} Ic I b c
∅, where the processed conjectures are underlined.

In order to check the soundness of the induction reasoning employed in D -preproofs, we will illustrate the D -preproofs as oriented graphs for which the nodes are equalities from the preproof and the arrows are of two kinds: i) downward arrows that link a processed conjecture to any new conjecture, and ii) upward (dashed) arrows that connect a processed conjecture to the previous conjecture whose instance was used as IH in an induction step. The instantiating substitutions used in split and induction steps annotate the corresponding arrows, those from the induction steps being written in boldface style. We denote a node by R node if R is the name of the D -rule applied on the equality labelling the node. Also, an IH-node is any node labelled by an equality whose instance was used as IH.

Example 15 The I b c -preproof from Example 14 is illustrated as the oriented graph from Figure 6.1.

q(x, y) = true {y →0}

w w {y →S(y )} 9 9 q(x, 0) = true q(x, S(y )) = true w w q(x, y ) = true A cycle of a D -preproof can be represented as a circular list of paths such that each path has nodes from only one tree derivation of the preproof. Oriented graphs may have minimal cycles, i.e., cycles that do not contain other cycles, and strongly connected components.

Example 16 The oriented graph from Figure 6.1 has 3 minimal cycles:

• [q(x, y) = true, q(x, S(y )) = true, q(x, y ) = true],

• [p(x) = true, p(S(x )) = true, p(x ) = true], and • [q(x, y) = true, q(x, S(y ) = true, p(x) = true, p(S(x )) = true, q(x , S(x )) = true] By abuse of notation, the nodes from the paths have been denoted by the labelling equalities.

We can build a well-founded partial ordering <C over the set of strongly connected components C of any D -preproof. Given two strongly connected components p1 and p2, we write p1 <C p2 if there is a path in the cyclic graph of the D -preproof leading any node of p2 to any node of p1.

Cyclic proofs

A D -preproof of a multiset of equalities E 0 , built using a set of axioms Ax, is sound if Ax |= E 0 . Any sound preproof is also called a proof. In order to prove the soundness of a preproof p, we define ordering constraints for normalised cycles for which each path starts with an equality labelling a root of some tree derivation from the graph of p. This property can be achieved if any non-root IH-node is transformed into a root IH-node, as illustrated in Figure 6.2 and referred to as the normalisation operation. Any transformation detaches the subtree rooted by the non-root IH-node, labelled by φ, from the graph to become a new tree, by preserving a copy of the IH-node. Next, an upward arrow is added to link the copy node with the root node of the new tree. By labelling it with the identity substitution σ φ id , the transformation simulates the application of Induction on the formula labelling the copy node, using as IH-node the root node of the new tree. It can be noticed that the transformation does not generate new strongly connected components.

A strongly connected component is normalised if each of its minimal cycles is normalised. A D -preproof is normalised if each of its strongly connected components is normalised. Since the number of non-root IH-nodes of a D -preproof is finite, the normalisation process is finite. Moreover, the normal form is unique, independent from the order of processing the non-root IH-nodes.

Example 17 The I b c -preproof from Figure 6.1 has one non-root IH-node, labelled by p(x) = true. The result of the transformation applied on it is illustrated in Figure 6.3. The minimal cycles of the strongly connected component are all normalised:

• first cycle: [q(x, u) = true, q(x, S(y )) = true, q(x, y ) = true], φ

V V f f becomes (root node) φ φ (copy node) σ φ id σ φ id σ φ id P P Y Y Figure 6.2:
The transformation of a non-root IH-node.

• second cycle: [p(x) = true, p(S(x )) = true, p(x ) = true], and

• third cycle: [q(x, y) = true, q(x, S(y )) = true, p(x) = true],
[p(x) = true, p(S(x )) = true, q(x , S(x )) = true].

q(x, y) = true {y →0}

x x {y →S(y )} 9 9 Proof The normalisation process may generate new tree derivations. If S is the set of the equalities labelling their root nodes, then S is S ∪ S .

p(x) = true {x →0} A A {x →S(x )} q(x, 0) = true q(x, S(y )) = true w w p(S(x )) = true A A p(0) = true q(x, y ) = true {y →y } {y →y } {y →y } p(x) = true {x →x} {x →x} {x →x} X X q(x , S(x )) = true {x →x ;y →S(x )} {x →x ;y →S(x )} {x →x ;y →S(x )} n n p(x ) = true {x →x } {x →x } {x →x }
Example 18 Figure 6.3 also is a I b c -preproof for {p(x) = true, q(x, y) = true}.

We can associate a substitution σ to each node n of a D -preproof. If n is a direct offspring of a Split node, then σ is the instantiating substitution used by the Split operation to generate n, otherwise σ is the identity substitution. To each path in a tree derivation, of the form [n1, . . . , n k ], we can also associate the cumulative substitution represented by the composition of substitutions σ1 • • • σ k , where each σi (i ∈ [1..k]) is the substitution associated to the node ni. φ(n) denotes the equality labelling the node n.

Definition 4 (n-cycle discharging IHs) An n-cycle, made of a circular list of n(>0) paths [n 1 1 , . . . n p1 1 ], . . . , [n 1 n , . . . , n pn n ] from a strongly connected component p, discharges the IHs φ(n 1 j )δj (j ∈ [1..n]) if, for any i ∈ [1..n], we have that φ(n 1 next(i) )δ next(i) <p φ(n 1 i )θi
, where θi is the cumulative substitution for the path [φ(n 1 i ), . . . , φ(n

p i i )], next(i) = 1 + (i mod n)
and <p is a well-founded and 'stable under substitutions' ordering defined over the instances of the equalities labelling the root nodes of p.

Example 19

The IHs used in the minimal cycles from Figure 6.3 and detailed in Example 17 are discharged if:

• (q(x, y) = true){x → x; y → y } <p (q(x, y) = true){x → x; y → S(y )} in the first cycle, • (p(x) = true){x → x } <p (p(x) = true){x → S(x )}
in the second cycle, and

• (q(x, y) = true){x → x ; y → S(x )} <p (p(x) = true){x → S(x )} and (p(x) = true){x → x} <p (q(x, y) = true){x → x; y → S(y )} in the third cycle,
where p denotes the strongly connected component of the I b c -preproof in Figure 6.3. The ordering <p has to be defined such that the following four ordering constraints are satisfied: q(x, y ) = true <p q(x, S(y )) = true, p(x ) = true <p p(S(x )) = true, q(x , S(x )) = true <p p(S(x )) = true and p(x) = true <p q(x, S(y )) = true. By proceeding similarly as in Section 6.2, we can define the measure value of an equality l = r as the multiset of terms |l| ∪ |r|, where |t| is defined as

• {x, x} if t is of the form p(x),
• {x, x, y} if t is of the form q(x, y), and

• {t}, otherwise.

The ordering constraints are satisfied if the induction ordering used for comparing multisets of terms is the multiset extension of the mpo based on the precedence f alse <F true <F 0 <F s.

Theorem 16 [soundness of D -preproofs] Any D -preproof is sound if the minimal cycles from its normal form discharge their IHs.

Proof Let P be a D -preproof and P its normal form such that all minimal cycles from P discharge their IHs. By contradiction, we assume that P is not sound, i.e., there is an equality e proved by P that is false. By Lemma 6, e labels one of the root nodes of P .

The set C of strongly connected components from the graph of P forms a partition of the nodes from the graph of P . Let <C denote the well-founded ordering defined over the elements of C. We perform a classical induction reasoning over the elements of C. The base case. Let us assume that e labels the root node n from one of the <C-minimal strongly connected components of C, denoted by p. Let us also assume that n is the only node from p. Hence, φ(n) ≡ e. Since φ(n) is false, it cannot label a leaf node, so there is a D -rule that was applied on φ(n). The nodes labeled by the resulting equalities, as well as the corresponding IH-node for the case when Induction was applied on φ(n), should be from p, by the minimality of p. This contradicts the fact that p has only one node.

Therefore, p should have at least two nodes. Again, let n be some root node from p such that φ(n) ≡ e. We will show that Induction should be applied with a false IH on φ(n) or on an equality deriving from φ(n). We will perform a case analysis:

• We assume that Deduction or Split were applied on φ(n) in the inference step E ∪ {φ(n)} D E ∪ Φ.

Since φ(n) is false, it has a counterexample. By the definition of these rules, there is an equality in Φ that has a counterexample.

• If Induction was applied on φ(n) in the inference step E ∪ {φ(n)} D E ∪ Φ, using an instance of the previously generated equality ψ as IH, since φ(n) is false, it has a counterexample. Cf. Induction definition, either Φ or ψ has a counterexample.

Any rule applied on φ(n) can also be applied on some of its counterexamples φ(n)τ for which the IH and new equalities are ground because the IH and new equalities have variables included in V ar(φ(n)). When a rule is applied on φ(n)τ , we can have that either i) there is an offspring of n, denoted by n , such that φ(n )τ is a counterexample, or ii) Induction was applied on φ(n) using the IH h and hτ is a counterexample. For the case ii), we are done, as required. For the case i), we can apply the same reasoning on n as for n. Either Induction was applied with a false IH and we are done, or again case i) holds. This process cannot continue forever since the visited nodes follow some path in the tree derivation rooted by n, which is finite, so case ii) eventually happens.

We denote by n f the Induction-node identified by this process, by n h its IH-node and by φ(n h )δ the false coresponding IH, knowing that n and n f may refer to the same node. The path [n, . . . , n f ] is part of a cycle c from p, of the form [n h , . . .], . . . , [n, . . . , n f ], that links back n h to n. We will show that there is a minimal n-cycle cm of the form [n h , . . .], . . . , [n, . . . , n f ] which may be different from c. If c is minimal, then cm will denote c. Otherwise, c includes another cycle c , meaning that c has fewer nodes. In this case, the nodes of c can be described as the union of the nodes of another cycle c , also with fewer nodes, and the nodes of c . If [n, . . . , n f ] is a path from c , then we apply the same reasoning on c as for c. Otherwise, [n, . . . , n f ] is a path from c and we can also apply the same reasoning on c as for c. This process should finish because the number of nodes in p is finite. We denote by cm the last cycle including [n, . . . , n f ]. Hence, cm is minimal, of the form [n h , . . .], . . . , [n, . . . , n f ]. Then, the IH φ(n h )δ is discharged by cm, and we have that φ(n)θ >p φ(n h )δ, where θ is the cumulative substitution for the path [n, . . . , n f ].

We have that φ(n)τ, . . . , φ(n f )τ are the counterexamples identified during the process, and the IH φ(n h )δτ is a counterexample. It can be noticed that φ(n f ) can be generated from φ(n)θ by applying only the Deduction rules used on the equalities labeling the nodes encountered when traversing the path [n, . . . , n f ]. So, φ(n f )τ can be derived from φ(n)θτ by applying the same rules. This is possible only if φ(n)τ is an instance of φ(n)θ, i.e., there is a matching substitution σ such that φ(n)θσ ≡ φ(n)τ . Since φ(n f ) can be generated from φ(n)θ, we have φ(n f )σ ≡ φ(n f )τ . On the other hand, the substitution θ replaces a set x of variables from φ(n) by terms with fresh variables, so no variable from x is in φ(n f ). Since φ(n f )σ ≡ φ(n f )τ , the terms mapped in σ and τ by the variables occurring in φ(n) should be the same. Therefore, we have φ(n)θσ ≡ φ(n)θτ . So, φ(n)θτ ≡ φ(n)τ . By the 'stability under substitutions' property of <p, we have that φ(n)θτ >p φ(n h )δτ , so φ(n)τ >p φ(n h )δτ .

We can apply a similar reasoning on φ(n h )δτ as for φ(n)τ and show that there is a minimal n-cycle c m of the form [n h , . . .], . . . , [n h , . . . , n f ], for which φ(n h )δ h is the IH used by the Induction rule applied on φ(n f ). It can be shown that φ(n h )δτ >p φ(n h )δ h δτ holds. A similar reasoning can be done on the counterexample φ(n h )δ h δτ as for φ(n h )δτ , and so on ad infinitum, to build the infinite strictly <p-decreasing sequence φ(n)τ >p φ(n h )δτ >p φ(n h )δ h δτ >p . . . This contradicts the fact that <p is well-founded.

The step case. Let us assume that e labels the root node of an arbitrary non <C-minimal strongly connected component p from C. By induction hypothesis, we assume that the root nodes of any strongly connected component <C-smaller than p are labelled by true equalities. If p has only one node, the only rule that can be applied on e is Induction. The new equalities and the IH should label root nodes from strongly connected components <C-smaller than p, hence they are true by induction hypothesis. By the definition of Induction, e should be true, hence contradiction.

So, p should have at least two nodes. By using similar arguments as for the base case and using the induction hypothesis, we can show that an infinite strictly <p-decreasing sequence of counterexamples of equalities labeling root nodes from p can be built.

Example 20 (cont. Example 19) The I b c -preproof from Figure 6.3 is sound because all the IHs from its minimal cycles are discharged. Therefore, q(x, y) = true and p(x) = true are true.

Certification of cyclic proofs for Coq formalisations using the logic programming style

Let us recall the definition of the inductive predicates P and Q from the P&Q example, by following the logic programming style:

Inductive P: T → Prop := p1: P zero | p2: ∀ x, (P x ∧ Q x (succ x )) → P (succ x ) with Q: T → T → Prop := q1: ∀ y, Q y zero | q2: ∀ x y, (Q x y ∧ P x ) → Q x (succ y).
Any equality of the form t = true is translated to the atom t. The variables from the equational specifications and cyclic proofs are either universally quantified or free variables in the corresponding Coq specifications and proofs.

The formula-based Noetherian induction principle will be applied on the set built only from the equalities whose instances are used as induction hypotheses in the cycles, in our case, the two atoms labelling the root nodes. The LF list LF PandQ and its type type LF PandQ are: The main lemma becomes:

Definition type LF PandQ := T → T → Prop × List.list term. Definition LF PandQ:= [Pu, Qxy].
Lemma main PandQ : ∀ F, In F LF PandQ → ∀ u, (∀ F', In F' LF PandQ → ∀ u , less (snd (F' u )) (snd (F u)) → fst (F' u )) → fst (F u).
Its proof starts by a case analysis on the possible values of F, which can be either Pu or Qxy. The generation of the Coq script for each case starts by a split rule instantiating a natural variable with 0 and the successor of a fresh variable. In Coq, this can be easily performed with the destruct tactic or by the means of functional schemes, as shown in the proof of Lemma main 13 at the end of Section 6.2.

The proof of each resulted case follows some path from a root node to a leaf node in the cyclic graph from Figure 6.3. The generation of the Coq script can be automatised since there is a direct Coq translation of the non-split inference rules, as follows:

• DelInst' is translated to the apply tactic parameterised by the name of the used axiom;

• RedEq' is translated by unfolding the definition of the processed conjecture, using again the apply tactic parameterised by the name of the used axiom;

• the application of IndNat using an induction hypothesis from LF PandQ is translated to pose proof (HFabs0 F ) as Hind. clear HFabs0. assert (fst (F u1 0)) as HFabs0.

apply Hind. trivial in n.

The user-defined tactic trivial in is applied on an index n and checks that F is the (n + 1) element of the LF PandQ list.

Next, any formula defining the anonymous functions of LF PandQ is proved:

Theorem all true PandQ: ∀ F, In F LF PandQ → ∀ u1: T, fst (F u1).
Finally, ∀u, P (u) and ∀x y, Q(x, y) are certified by the following theorems:

Theorem true Pu : ∀ u, P u.

Theorem true Qxy : ∀ x y, Q x y.

Certification of cyclic proofs for Coq formalisations using the functional programming style

Conjecture (6.15) can also be proved using the cyclic inference system I f c , based on the reasoning techniques underlying I f s , presented in Section 6.2:

SplitNat' (S c ): E ∪ {φ x } I f c E ∪ {φ{x → 0}, φ{x → S(x )}}, where x is a fresh variable. DelTaut (Tc): E ∪ {φ} I f c E, if φ is a tautology. NegClash (Nc): E ∪ {φ} I f c E if true = f alse or f alse = true is in the condition part of φ. RedAx (Ac): E ∪ {φ} I f c E ∪ {ψ}, if φ →Ax ψ. DelSub (Ec): E ∪ {φ} I f c E if φ is an instance of a previously generated equality.
The SplitNat' rule is similar to the I b c -rule SplitNat. DelTaut and NegClash delete tautologies and conditional equalities with false conditions, respectively. RedAx rewrites the processed conjecture with axioms.

Finally, DelSub deletes the processed conjecture if it is an instance of a previous equality from the I f c -preproof.

Theorem 17 Every I f c -rule instantiates a D -rule.

Proof We perform a case analysis on the I f c -rules: • SplitNat' is an instance of Split, for the same reasons given for SplitNat in the proof of Theorem 15;

• DelTaut and NegClash are instances of Deduction when the set of new conjectures is empty. This situation is acceptable because the processed conjectures are valid;

• RedAx is an instance of Deduction because for any counterexample φτ of the processed conjecture φ, ψτ is a counterexample of the new conjecture ψ;

• DelSub is an instance of Induction for similar reasons given for IndNat in the proof of Theorem 15.

In the following, we denote by GenNat' the derived I f c -rule that abbreviates the application of SplitNat' rule on the processed conjecture, followed by the application of RedAx on each of the two new conjectures: .4 illustrates the above preproof as an oriented graph. We can distinguish three strongly connected components, denoted by p1, p2 and p3, each of them made of only one minimal cycle, as follows:

e 283 (u5, u3) : odd(u5) = true ∧ odd(u5 + u3) = true ⇒ even(u3) = true e 311 (u3) : odd(0) = true ∧ odd(u3) = true ⇒ even(u3) = true e 317 (u6, u3) : odd(s(u6)) = true ∧ odd(s(u6 + u3)) = true ⇒ even(u3) = true e 333 (u3) : f alse = true ∧ odd(u3) = true ⇒ even(u3) = true
• [e 13 (u1, u2, u3) , e 29 (u4, u2, u3), e 49 (u4, u2, u3), e 119 (u5, u2, u3), e 13 (u5, u2, u3)] for p1, • [e 36 (u2, u3), e 73 (u4, u3), e 91 (u4, u3), e 203 (u5, u3), e 36 (u5, u3)] for p2, and• [e 138 (u2, u3), e 259 (u5, u3), e 283 (u5, u3), e 317 (u6, u3), e 138 (u6, u3)] for p3.

e 13 (u 1 , u 2 , u 3 ) The normalisation process of the I f c -preproof applies the transformation from Figure 6.2 to the two non-root IH-nodes labelled by e 36 (u2, u3) and e 138 (u2, u3). The normal form of the I f c -preproof consists in three derivation trees, rooted by the nodes labelled by e 13 (u1, u2, u3), e 36 (u2, u3) and e 138 (u2, u3).

{u1 →0} t t {u1 →S(u4)} e 23 (u 2 , u 3 ) e 29 (u 4 , u 2 , u 3 ) e 36 (u 2 , u 3 ) {u2 →0} } } {u2 →S(u4)}
The soundness of the I f c -preproof is ensured if the following three constraints are satisfied: e 13 (u1, u2, u3){u1 → S(S(u5)); u2 → u2; u3 → u3} <p 1 e 13 (u1, u2, u3){u1 → u5; u2 → u2; u3 → u3}, e 36 (u2, u3){u2 → u5; u3 → u3} <p 2 e 36 (u2, u3){u2 → S(S(u5)); u3 → u3}, and e 138 (u2, u3){u2 → u6; u3 → u3} <p 3 e 138 (u2, u3){u2 → S(S(u6)); u3 → u3}. Different well-founded and 'stable under substitutions' orderings over multisets of terms can be used to implement <p 1 , <p 2 and <p 3 , for example the multiset extension of the mpo using any precedence.

The strategy for certifying a normalised D -preproof integrating a (potentially empty) set C of strongly connected components is based on a partial ordering defined on the components of some partition P over the root nodes of the normalised D -preproof. P is built such that two nodes are in the same component if they belong to the same strongly connected component of C. The partial ordering, denoted by < P , extends <C in such a way that, for any two components c1 and c2, we have c1 < P c2 if there is an Induction node in the trees rooted by nodes from c2 whose corresponding IH-node is a root node from c1. The strategy is to certify the proofs of the multisets of equalities labelling the root nodes of each component from P , in distinctive steps and in increasing ordering w.r.t. < P .

Example 21 The certification of the normalised I f c -preproof of {e 13 (u1, u2, u3)} starts with the certification of the proofs of the equalities labelling the root nodes of the <C-minimal strongly connected components, i.e., p2 and p3, followed by the certification of the proof of the equality labelling the root node of p1.

The certification process for the proof of the multiset of equalities labelling the root nodes of a component c of P is similar to that given for implicit induction proofs in Subsection 6.2.4. First, we define the LF list as the set of anonymous functions built for the equalities labelling the root nodes from c. Second, the instantiation schemas from the GenNat' steps are defined using functional schemes, or the destruct tactic. Third, the proof of the main lemma is built by translating in Coq script the I f c -steps encountered by following the paths from root to leaf nodes in the trees rooted by the nodes of c, using similar translations as shown in Subsection 6.2.4. In addition, the application as IH of any instance of some equation e n not labelling any node from c is translated to apply true n. The proposed certification strategy ensures that the proof of the theorem true n is certified before its use by the apply tactic. Multiple rewrite steps can be performed with the simpl tactic. Finally, the theorem all true is certified, followed by the certification of the true theorems about the equalities labelling each node of c.

As example, we will only detail the certification process for the proof of e 13 (u1, u2, u3), knowing that the certification of the proofs for e 36 (u2, u3) and e 138 (u2, u3) was already completed and done in a similar way. The LF list for p1 is defined as:

Definition LF 13 := [F 13 ].
where F 13 is defined as F 13 from Subsection 6.2.4.

The functional schemes associated to the GenNat' steps are defined as: The Coq script for the proofs of the remaining theorems is omitted, but it is available online as supplementary material.

Theorem all true 13 : ∀ F, In F LF 13 → ∀ (u1 : nat) (u2 : nat) (u3 : nat), fst (F u1 u2 u3 ).

Theorem true 13 : ∀ (u1 : nat) (u2 : nat) (u3 : nat), odd (plus u1 u2 ) = true → even (plus u2 u3 ) = true → odd (plus u1 u3 ) = true.

Automatic certification of SPIKE proofs

The user can also interact with the SPIKE prover by the means of i) extra sections, for example use: nats;17 for activating the combination of the decision procedure for linear arithmetic and the congruence closure procedure, and ii) command-line arguments given to spike bc, such as -coqc spec, -coqc, and -dracula.

In an automatic way, SPIKE can prove the conjecture (6.15) from Section 6.2 by both implicit and cyclic induction. The numerical annotations of the atoms from the presented proofs correspond to numbers labelling conjectures in the SPIKE proofs. SPIKE can also automatically translate the implicit induction proof into valid Coq script. In order to do this, the Coq script translating the axioms and model functions is inlined in the SPIKE specification and should be provided by the user. It is prefixed by $ and ignored by SPIKE during the proof development. On the other hand, the cyclic proof was manually translated into Coq script by modifying the Coq script generated for the implicit induction proof.

Conclusions

We have provided the formal tools to certify formula-based Noetherian induction reasoning with Coq. As an alternative to the built-in explicit induction techniques, we have opened the perspective to directly implement in Coq formula-based Noetherian induction methods that effectively manage the lazy, simultaneous and mutual induction reasoning. Compared to the methods consisting in translating particular classes of formula-based Noetherian induction proofs to an explicit induction form, our approach can generate a constructive Coq proof from any formula-based Noetherian induction proof. The main challenges to face are i) the explicit representation of the underlying induction ordering that is not built-in in Coq and that should be supported by external libraries, and ii) the automatisation of the certification process. Classical Coq proofs can also be built using the 'Descente Infinie' induction principle [Stratulat, 2010].

The formal tools have been used to automatically certify implicit induction and cyclic proofs. The implicit induction reasoning is reductive and can be easily automatised, while the cyclic reasoning is reductive-free, requires fewer ordering constraints and allows for more general specifications, but is less automatisable [Stratulat, 2012]. In practice, the Coq script translating cyclic proofs may be (much) shorter than that for implicit induction proofs, hence easier to certify. The number of ordering constraints and the size of the LF lists has a strong impact on the complexity of the generated Coq script. For instance, the script generated from the implicit induction proof of the conjecture (6.15) deals with a unique LF list of 28 anonymous functions and certifies 30 ordering constraints, while the Coq script translating the cyclic proof has only three singleton LF lists and 3 ordering constraints to be checked.

The certification methodology has been tested with SPIKE on different other examples, among which the validation of a conformity algorithm for a telecommunication protocol [START_REF] Rusinowitch | [END_REF]. As shown in [START_REF] Stratulat | [END_REF], most of the lemmas have been automatically certified by Coq. On the other hand, the methodology is limited for several reasons. SPIKE cannot translate the proof steps built with some of its inference rules, e.g., those requiring arithmetic reasoning due to the complexity of the underlying decision procedures, or some rules are correctly translated only under certain conditions. In fact, the translation process does not guarantee the conversion of any SPIKE proof to a valid Coq script. Also, an inconvenient for the potential users is represented by the necessity to inline Coq code in the SPIKE specification. [Brotherston and Simpson, 2011] is the de facto standard sequent-based cyclic inference system for performing lazy induction reasoning on specifications based on first-order logic with inductive definitions (FOL ID ). The CLKID ω proofs are represented as finite derivation trees with nodes labelled by sequents. A particular feature is that cycles can be built by establishing connections between terminal and non-terminal nodes labelled with identical sequents. The soundness of CLKID ω proofs is entailed from some global trace condition by using Infinite Descent induction arguments [Wirth, 2004]. This condition requires that, for every infinite path in the cyclic derivation of a false sequent, all successive steps starting from some point are decreasing and certain steps occurring infinitely often are strictly decreasing w.r.t. some semantic ordering.

Part III

Bridges with

CLKID ω has been implemented in the Cyclist prover [Brotherston et al., 2012]. Since the global trace condition is an ω-regular property, Cyclist can check it during the proof construction or post hoc as an inclusion between two Büchi automata by calling an external model checker. It turns out that the inclusion test may be costly. Indeed, for any proof P , the approach requires the construction of the automaton complementary to that accepting strings over infinite progressing traces in P , based on a complementation method for Büchi automata as described in [START_REF] Kupferman | [END_REF]. The method ensures that, for every automaton with n states, the generated complementary automaton has at least 2 O(n log n) states [Michel, 1988]. In case of failure of the inclusion test, previous proof steps should be reconsidered, requiring that existing connections be broken, proof steps cancelled or different inference rules applied. Hence, it may happen that the test be executed several times during the proof construction. For the proofs of the toy examples from [Brotherston et al., 2012], the percentage of time taken by the soundness check include values from 0% to 44%.

Example 22 Following [Brotherston et al., 2012], the predicates P and Q from Example 1 can be specified in FOL ID using the following productions: ⇒ P (0) (7.1)

P (x) ∧ Q(x, s(x)) ⇒ P (s(x)) (7.2) ⇒ Q(x, 0) (7.3) P (x) ∧ Q(x, y) ⇒ Q(x, s(y)) (7.4)
where 0 and s are the usual constructor symbols for naturals. Similarly, N is defined as:

⇒ N (0) (7.5) N (x) ⇒ N (s(x)) (7.6)
According to Table 1 from [Brotherston et al., 2012], Cyclist can prove the sequent N (x), N (y) Q(x, y) in about half a second, by building a proof tree with only 13 nodes. The validation process required 181 calls to the external model checker, among which 171 calls are failing. 31% of the time is spent on the soundness check.

Our approach. A different approach for checking the soundness of derivations built with a restricted version of CLKID ω , denoted by CLKID ω N , is based on ordering constraints. It is inspired from the material presented in Chapter 6 about performing cyclic Noetherian induction to check inductive consequences of conditional specifications. The proofs generated by this approach are normalized to sets of tree derivations and represented as directed graphs (for short, digraphs) allowing some terminal nodes to be connected to root nodes. The minimal cycles resulting by following the arrows in the digraph are denoted as cyclic lists of paths leading a root to a terminal node in the same tree derivation. The ordering constraints for checking the proof soundness involve only comparisons between instances of root formulas. The main advantages of our approach are twofold: i) the worst-case time complexity of the validation procedure is polynomial, and ii) the proofs can be certified by Coq using the approach described in Chapter 6.

Structure of the chapter. Mostly based on [Stratulat, 2017a, Stratulat, 2018], the chapter is structured in five sections. Section 7.1 is a quick presentation to the logical framework based on FOL ID and an introduction to CLKID ω N . In Section 7.2, we introduce the normalized form of CLKID ω N pre-proofs and define ordering and derivability constraints that guarantee the global trace condition. The implementation of the method is described in Section 7.3. A comparison with the automata-based method is given. On the other hand, we give an example that shows that our procedure is semi-decidable. In Section 7.4, we show that FOL ID pre-proofs can be dually represented as cyclic and Noetherian induction proofs. The conclusions are given in the last section.

The logical framework

The logical setting relies on FOL ID with equality, as presented, e.g., in [Brotherston, 2006, Brotherston andSimpson, 2011].

Syntax. We assume that Σ is a (countable) language built on a finite alphabet of arity-fixed function symbols F and predicate symbols, and V an enumerable set of variables. Each predicate symbol is either inductive (i.e., defined by axioms as below) or ordinary (i.e., not inductive). P (t1, . . . , tn) is an inductive atom, where P is an inductive predicate symbol and t1, . . . , tn are terms. F V (S) denotes the set of free variables from the set of formulas S.

Each inductive predicate symbol P is defined by a finite inductive definition set of productions (axioms) consisting of implication formulas of the form

( h m=1 Qm(um) ∧ l m=1 Pi m (tm)) ⇒ P (t), (7.7)
where h, l, i1, . . . , i l are naturals and Q1, . . . , Q h (resp., Pi 1 , . . . , Pi l ) are ordinary (resp., inductive) predicate symbols. (7.7) is an unconditional production if h = 0 and l = 0. If not, (7.7) is a conditional production and h m=1 Qm(um)∧ l m=1 Pi m (tm) is its condition. Φ denotes the set of productions defining each inductive predicate symbol.

The CLKID ω N inference system. CLKID ω N is built from a finite set of inference rules that process sequents. A sequent is a logical construction of the form Γ ∆, where Γ and ∆ are finite multisets of first-order formulas and referred to as antecedents and succedents, respectively. An inference rule transforms a sequent, called conclusion, into a (potentially empty) multiset of sequents, called premises; they are separated by a horizontal line followed by the name of the rule. Most of the CLKID ω N inference rules transform one (principal) formula from the conclusion. In this case, it is explicitly represented in the sequent. A more detailed presentation of the sequent calculus can be found elsewhere, e.g., [START_REF] Negri | [END_REF].

Γ ∩ ∆ = ∅ (Ax) Γ ∆ Γ ∆ Γ ⊆ Γ, ∆ ⊆ ∆ (W k) Γ ∆ Γ F, ∆ Γ G, ∆ (∧R) Γ F ∧ G, ∆ Γ F, ∆ (¬L) Γ, ¬F ∆ Γ, F ∆ (¬R) Γ ¬F, ∆ Γ, F ∆ Γ, G ∆ (∨L) Γ, F ∨ G ∆ Γ F, G, ∆ (∨R) Γ F ∨ G, ∆ Γ, F, G ∆ (∧L) Γ, F ∧ G ∆ Γ F, F, ∆ (contrR) Γ F, ∆ Γ ∆ (Subst) Γ[θ] ∆[θ] Γ F, ∆ Γ, G ∆ (⇒ L) Γ, F ⇒ G ∆ Γ, F, F ∆ (contrL) Γ, F ∆ Γ, F [{x → t}] ∆ (∀L) Γ, ∀xF ∆ Γ F, ∆ x ∩ F V (Γ ∪ ∆) = ∅ (∀R) Γ ∀xF, ∆ Γ, F ∆ x ∩ F V (Γ ∪ ∆) = ∅ (∃L) Γ, ∃xF ∆ Γ F, ∆ Γ, F ∆ (Cut) Γ ∆ Γ F [{x → t}], ∆ (∃R) Γ ∃xF, ∆ Γ, F G, ∆ (⇒ R) Γ F ⇒ G, ∆
(= R) Γ t = t, ∆ Γ[{x → u}] ∆[{x → u}]
x is not a variable of u (= L) Γ, x = u ∆ The unfold rule unrolls the definition of the inductive symbol to transform some succedent atom of a sequent. We denote the unfolding of P (t ) with the production (7.7), when P (t ) ≡ P (t)[σ], by

Γ Q 1 (u 1 )[σ], ∆ . . . Γ Q h (u h )[σ], ∆ Γ P i1 (t 1 )[σ], ∆ . . . Γ P i l (t l )[σ], ∆ (R.(7.7)) Γ P (t ), ∆
The case rule is a left-introduction operation for inductive predicate symbols: case distinctions (Case P ) Γ, P (s 1 , . . . , s n ) ∆ Every production, of the form (7.7) such that t ≡ (t 1 , . . . , t n ), produces the case distinction Γ, s 1 = t 1 , . . . , s n = t n , Q 1 (u 1 ), . . . , Q h (u h ), P i1 (t 1 ), . . . , P i l (t l ) ∆ (7.8)

Each variable y from (7.7) is fresh w.r.t. the free variables from the conclusion of the rule (y can be renamed to a fresh variable, otherwise). P i1 (t 1 ), . . . , P i l (t l ) are case descendants of P (s 1 , . . . , s n ).

CLKID ω N pre-proof trees. A derivation tree for some sequent S is built by successively applying inference rules starting from S. The terminal nodes in the tree can be either leaves or buds. A leaf is labelled by a sequent that is the conclusion of a 0-premise inference rule. A bud is every node labelled by a sequent that is the conclusion of no rule. For each bud, there is a companion, i.e., an internal node having the same sequent labelling. If a companion is annotated by some sign (e.g., † or * ), then the buds related to it are uniquely annotated by that sign followed by a number.

Definition 5 (pre-proof tree, induction function for tree) The pair (D, R) denotes a pre-proof tree of some sequent S, where D is a finite derivation tree whose root is labelled by S and R is a defined induction function assigning a companion to every bud in D.

Example 23 A CLKID ω N pre-proof tree of N (x), N (y) R(x, y) is Γ[{x → u; y → t}] ∆[{x → u; y → t}] (= L) , Γ[{x → t; y → u}], x = u ∆[{x → t; y → u}]
would replace u by u and delete u = u. If S(N n-1 )[θ c

(n-1,n) θ] is of the form Γ, u = u ∆, the same result can be achieved with CLKID ω N by applying (W k) instead:

Γ ∆ (W k) Γ, u = u ∆ So, the list [S(N 1 )[θ c (1,n) ], . . . , S(N n-1 )[θ c (n-1,n) ], S(N n )] is admissible. [S(N 1 )[θ c (1,n) ], . . . , S(N n-1 )[θ c (n-1,n) ], S(N n ), S(B)
] is also admissible, as shown for the first case.

A path has cycles if some nodes are repeated in the path. The set of strongly connected components (SCCs) of a digraph P of some pre-proof tree-set (MD, MR), for which every non-singleton SCC has at least one cycle, is a partition of P. Additionally, if P is acyclic, each of its nodes is a singleton SCC.

Example 25 The digraph of the normalised pre-proof tree-set from Example 24 is:

N x, N y 1 R(x, y) {x →0} x x {x →sx } @ @ N y 2 R(0, y) N x , N y 3 R(sx , y) {y →0} @ @ {y →sy } N x , N y 5 R(sx , sy ) N x 4 R(sx , 0) N x 10 R(x , 0) {x →0} y y {x →sx } N x , N y 6 R(ssx , y ) π N x 9 R(x , 0) G G 11 R(0, 0) N x 12 R(sx , 0) π N ssx , N y 7 R(ssx , y ) N x 13 R(x , 0) N x, N y 8 R(x, y) q q N x 14 R(x , 0) a a
The sequent labelling a node is annotated by the number of the node in the digraph. The digraph has two non-singleton SCCs: i) π:{N 10 , N 12 , N 13 , N 14 }, and ii) π : {N 1 , N 3 , N 5 , N 6 , N 7 , N 8 }.

Defining the ordering and derivability conditions

The premises for defining the new soundness criterion are similar to [Stratulat, 2017a]. Let π be a SCC from P and < a an ordering stable under substitutions, defined over the set S of instances of the IAAs from the sequents labelling nodes inside π. Given a path p in π, we say that an IAA τ j derives from an IAA τ i using the trace (τ k ) (k≥0) along p if i < j. Also, given two arbitrary substitutions γ and δ, we say that τ j [γ] derives from τ i [δ] using (τ k ) (k≥0) along p. < π is the multiset extension of < a .

The ordering constraints from a multiset extension relation comparing two sequent instances can be combined with derivability constraints on IAAs to give the < π -derivability relation, referred to as ordering-derivability when the ordering is not known. For this, we assume that every sequent S has associated a measure value (weight), denoted by A S and represented by a multiset of IAAs of S.

Definition 11 (< π -derivability) Let N i and N j be two nodes occurring in some path p from π, and θ, δ be two substitutions. We define A S(N i )[θ] (resp., A S(N j )[δ] ) as the multiset, resulting from A S(N i )[θ] (resp., A S(N j )[δ] ) after the pairwise deletion of all common IAAs from A S(N i )[θ] and A S(N j ) [δ] . In addition, we For similar reasons as given for S(N h )[δ h ], we can show that S(N h )[δ h τ ] is false, hence it can be treated similarly as S(N h )[δ h ]. And so on, the process can be repeated to produce an infinite strictly < πdecreasing sequence s of measure values associated to instances of sequents labelling root nodes from π, of the form

A S(N )[θ c ••• ] > π A S(N h )[θ c 1 τ ••• ] > π A S(N h )[••• ] > π . . . We can associate to s the infinite admissible list l s of its sequents [S(N )[θ c • • • ], S(N h )[θ c 1 τ • • • ], S(N h )[• • • ], .
. .] and define the path p underlying l s as the concatenation of the rb-paths from π that built s, i.e., [N, . . . , B, N h , . . . , N f , . . .]. By the construction of s, every successive (Subst)-, bud and root nodes in p are labelled by the same sequent instance in l s , so the (Subst)-steps are stuttering in l s . By Lemma 10, all (Gen)-can be replaced by (W k)-steps. p is of the form [N ∞ . . . , N 1 , . . . , N 0 ] where N 0 , N 1 , . . . , N ∞ are an infinite number of all the occurrences of N in p.

We will show that there is a trace following p that has an infinite number of progress points. As explained in [Brotherston and Simpson, 2011], it means that there is an infinite strictly decreasing sequence of ordinals, hence contradiction. Since p is the concatenation of rb-paths in π and π discharges its IHs, for each such rb-path the bud sequent is < π -derivable from the cumulative instance, along the rb-path, of the root sequent. By Lemma 11, there is an instance S(N ∞ )[θ ∞ ] such that S(N 0 ) is < π -derivable from it along p, where θ ∞ is the composition of all cumulative substitutions of the rb-paths from l. For any two consecutive nodes N i and

N i-1 (i ∈ [1..∞]), we have that S(N i-1 )[θ i-1 ] is < π -derivable from S(N i )[θ i ],
where θ i (resp., θ i-1 ) are the compositions of all cumulative substitutions of the rb-paths along

[N i , . . . , N 0 ] (resp., [N i-1 , . . . , N 0 ]).
Let us denote by S (resp, S ) the sequent

S(N i )[θ i ] (resp., S(N i-1 )[θ i-1 ]), for some i ∈ [1..∞]
. By Definition 11 and the transitivity of the < π -derivability relation, for each IAA l from A S there is an IAA l from A S such that l derives from l . Therefore, there are n traces along the path p [N ∞ , . . . , N i ],

where n is the number of IAAs from S.

We will show that the traces along p have an infinite number of progress points. By contradiction, we assume that this number is finite. Therefore, there is a subpath p of p whose traces have no progress points and there exists j ∈ [1..∞] such that N j and N j-1 belong to p . Let us denote by S j (resp, S j-1 ) the sequent S(N j )[θ j ] (resp., S(N j-1 )[θ j-1 ]). Since S j-1 is < π -derivable from S j , we have that A Sj-1 < π A Sj . By the definition of < π as a multiset extension of the ordering < a over the instances of IAAs from the root sequents in π, there should be an IAA l ∈ A Sj-1 for which there is another IAA l ∈ A Sj such that l < a l and l derives from l , i.e., l and l are from an infinite trace t following (a subpath of) p which has no progress points. According to the definition of a trace (see Definition 8) and the way l s was built, l < a l is possible only if the subtrace of t from l to l has at least one progress point, so contradiction. Otherwise, l ≡ l since i) l s is admissible, ii) the (Subst)-steps are stuttering, iii) the (Gen)-steps can be replaced by (W k)-steps, and iv) the instantiation steps that built s preserve the equality relations.

Example 26 For the sequents labelling the nodes from the digraph given in Example 24, we define the measure values A N t R(t,0) = {N t}, ∀t, and

A N t1,N t2 R(t1,t2) = {N t 2 }, ∀t 1 , t 2 . The IH S(N 13 ) is < π - derivable from S(N 10 )[{x → sx }], hence discharged by the SCC π using the trace [N x , N x , N x ], if {N x } < π {N sx }. Also, the IH S(N 7 ) is < π -derivable from S(N 1 )[{x → sx ; y → sy }] in the SCC π using the trace [N y, N y, N y , N y , N y , N y ] if {N y } < π {N sy }.
The ordering constraints hold if < π and < π are the multiset extensions of a rpo < rpo for which z < rpo sz, for every variable z.

By Theorem 19, the root sequents in the pre-proof tree-set, S(N 1 ) and S(N 10 ), are true.

Validation costs. We analyse the worst-case time complexity for validating the soundness of a preproof tree of n nodes with p (< n) buds occurring in non-singleton SCCs. The number of operations for normalising a CLKID ω N pre-proof of n nodes is given by the sum of non-root companions, non-terminal (Subst)-nodes and nodes labelled by some sequent that is the premise of a rule r different from (Subst). So, it is smaller than 3n. Let c be the maximal cost of an operation, including the node duplication and the creation of a (Subst)-node or bud-companion relation. Their total cost is smaller than 4nc (the second operation duplicates nodes twice). If c is the constant representing the cost for annotating a substitution, the cost for building the digraph of the normalized pre-proof tree-set is smaller than nc . The partition of a digraph in SCCs can be done in linear time [Tarjan, 1972].

The cost for evaluating the ordering-derivability constraints is computed as follows. If B denotes a bud occurring in a non-singleton SCC, the IH that instantiates S(B) is unique because B has only one companion and at most one companion can be the root of the tree including B. The number of <-derivability constraints is that of their buds, i.e., p. In the worst case, p is n -1. The validation cost of a <-derivability constraint is the sum of the costs of derivability and ordering constraints. The time complexity for checking whether an IAA l derives from another IAA l is linear w.r.t. the size of the history of l, which is a value smaller than n. The time complexity for checking a multiset extension relation is O(rq), where r and q are the number of IAAs from the measure value of the compared sequents. In the worst case, when all bud IAAs have their history of length n and p is n -1, the time complexity for checking the derivability constraints is O(n 2 k 2 ), where k is the maximal cardinality of a sequent's measure value. Similarly, the worst-case validation cost of the ordering constraints is polynomial in k, the maximal size of a literal and n, if the time complexity for comparing two IAAs is at most polynomial, for example by using a Knuth-Bendix ordering [Baader and Nipkow, 1998].

Implementation

The method has been implemented in Cyclist and its extended version is called E-Cyclist. Cyclist builds the pre-proofs using a depth-first search strategy that aims at closing open nodes as quickly as possible. Whenever a new cycle is built, the model checker is called to validate it. If the validation result is negative, the prover backtracks by trying to find another way to build new cycles. Hence, it may happen that the model checker be called several times during the construction of a pre-proof.

To each root r from the digraph P of a normalized pre-proof tree-set, the method attaches a measure M(r) consisting of a multiset of IAAs of the sequent labelling r, denoted by S(r). The procedure for computing these measure values is given by Algorithm 3.

Algorithm 3 GenOrd(P): to each root r of P is attached a measure M(r) for all root r do M(r) := ∅ end for for all rb-path r → b from a non-singleton SSC do if there is a trace between an IAA A of S(b) and an IAA A of S(r) then add A to M(rc) and A to M(r), where rc is the companion of b end if end for Since the number of rb-paths is finite, Algorithm 3 terminates.

Example 27

The measure values for the roots from the normalised pre-proof tree-set from Example 24 are built as follows.

Firstly, the measure for the roots, denoted by ( * ) and ( †), are the empty multisets. Then, we analyse each rb-path found in a non-singleton SCC of the digraph from Example 25. The rb-path from ( †) to the bud ( †) has a trace N x , N x , N x , N x , so the new measure value for ( †) is {N x }. Finally, the rb-path from ( * ) to the bud ( * ) has a trace N y, N y, N y , N y , N y , N y, so the new measure value for ( * ) is {N y}.

Our method is semi-decidable as Algorithm 3 may compute measure values that do not pass the comparison test for some non-singleton SCCs that are validated by the model checker. For this case, we considered an improvement consisting of the incremental addition of IAAs from a root sequent that are not in the measure value of the corresponding root r. Such an addition does not affect the comparison value along the rb-paths starting from r, it affects only the comparison tests for the rb-paths ending in the companions of r. This may duplicate some IAAs from the value measure of the roots from the rb-paths leading to these companions and the duplicated IAAs have to be processed as the added IAAs from the beginning. And so on, until no changes are performed anymore.

Table 7.1 illustrates some statistics about the proofs of the conjectures considered in Table 1 from [Brotherston et al., 2012]. They have been produced with CLKID ω N by using or not our improved method integrated in a version of Cyclist tagged as 'CSL-LICS14' in the git repository at https://github.com/ngorogiannis/cyclist. The IAAs are indexed in Cyclist to facilitate the construction of traces and the way they are indexed influence how the proofs are built. The column labelled 'Time-E' (resp., 'Time') is the proof time measured in milliseconds (resp. not) using our method. 'SC%' shows the percentage of time taken to check soundness. 'Depth' shows the depth of the proof, 'Nodes' the number of nodes in the proof, and 'Bckl.' the number of back-links in the proof. The last column shows the number of calls to the model checker as (calls on unsound proof)/(total calls) when our method is not used. The proofs have been performed on a MacBook Pro with a 2,7 GHz Intel Core i7 processor and 16 GB of memory. We can notice that, by using our method, the execution time is reduced by a factor going from 1.43 to 5.

Theorem

Time-E Time SC% Depth Nodes Bckl. Uns. Even with the improved version of Algorithm 3, the method remains semi-decidable.

/All O 1 x N x 2 7 61 2 9 1 0/1 E 1 x ∨ O 2 x N x 4 11 63 3 19 2 0/4 E 1 x ∨ O 1 x N x 2 9 77 2 13 2 2/5 N 1 x Ox ∨ Ex 3 7 52 2 8 1 0/1 N 1 x ∧ N 2 y Q(x, y) 297 425 40 4 19 3 168/181 N 1 x Add(x, 0, x) 1 5 76 1 7 1 0/1 N 1 x ∧ N 2 y ∧ Add 3 (x, y, z) N z 8 14 38 2 8 1 4/5 N 1 x ∧ N 2 y ∧ Add 3 (x, y, z) Add(x,
Example 28 Figure 7.5 is the screen capture of a Cyclist derivation built while proving N x ∧ N y R(x, y). It can be noticed that that the computed measure values did not pass the comparison test while the model checker succeeds. Luckily, the prover backtracked and finally found the same proof as that built using the model checker.

The source code of the implementation can be downloaded from https://members.loria.fr/ SStratulat/files/e-cyclist.zip.

Converting cyclic to Noetherian induction reasoning

Cyclic pre-proofs can also be validated by Noetherian induction reasoning. The conversion process is explained using as example the Cyclist proof of the P&Q example.

The Cyclist proof

The inductive predicates P , Q and N from the P&Q example are encoded in Cyclist as :

N { true ⇒ N (0) N1(x) ⇒ N (s(x)) } ; P { true ⇒ P (0) P1(x) & Q2(x, s(x)) ⇒ P (s(x)) } ; Q { true ⇒ Q(x, 0) Q1(x, y) & P2(x) ⇒ Q(x, s(y)) } ;
The Cyclist proof of the P&Q conjecture from Example 2 is given in Figure 7.6. Most of the inference rules are similar to those used to build the pre-proof from the previous section. (L.U nf.) implements the CLKID ω N 's (Case)-rule; it is prefixed by the inductive predicate symbol that has served to generate the variable instantiation schema. A case analysis is performed instead when the argument of the inductive predicate is a non-variable term (see its application on the sequent labelling the node [12]). (R.U nf.) is similar to the CLKID ω N 's (R.)-rule, excepting that it is less precise since only the used inductive predicate symbol is specified instead of the exact axiom. It also allows to unfold inside the conjunctions from the succedent part of the sequents. (R.And) and (W eaken) correspond to (∧ R) and (W k), respectively. Other rules are:

• (Id), applied on leaves labelled with sequents whose succedent is known to be true,

• (Backl), applied on every bud; it is followed by a singleton list containing the companion,

• (Subst), the LK's substitution rule, and • (Ex F also), applied on leaves labelled with sequents whose antecedent is false.

The last rule assumes that the function symbols are distinct. In addition, Cyclist assumes that they are injective.

Compared to the original pre-proof, the cyclic pre-proof is enriched with the bud-companion relations. The trace-based soundness arguments showing that it is indeed a proof are not given here. Instead, the reader may consult Example 5.2.3 from [Brotherston, 2006] presenting a different CLKID ω proof of our P&Q conjecture.

The conversion procedure

Our conversion procedure is based on the ordering-based checking procedure.

Theorem

# SCC Root Sequents Measure values O 1 (x) N (x) 1 O 1 (x) N (x) {x} E 1 (x) ∨ O 2 (x) N (x) 2 E 1 (x) N (x) {x} O 2 (x) N (x) {x} E 1 (x) ∨ O 1 (x) N (x) 1 E 1 (x) N (x) {x} O 1 (x) N (x) {x} N 1 (x) O(x) ∨ E(x) 1 N 1 (x) O(x) ∨ E(x) {x} N 1 (x) ∧ N 2 (y) Q(x, y) 1 N 1 (x) ∧ N 2 (y) Q(x, y) {x, x, y, y} N 1 (x) ∧ N 2 (z) ∧ N 3 (s(z)) Q(x, z) ∧ P (x) {x, x, z, z, s(z)} Add(0, 0, 0) 0 N 1 (x) Add(x, 0, x) 1 N 1 (x) Add(x, 0, x) {x} N 1 (x) ∧ N 2 (y) ∧ Add 3 (x, y, z) N (z) 1 N 1 (x) ∧ N 2 (y) ∧ Add 3 (x, y, z) N (z) {x, z} N 1 (x) ∧ N 2 (y) ∧ Add 3 (x, y, z) Add(x, s(y), s(z)) 1 N 1 (x) ∧ N 2 (y) ∧ Add 3 (x, y, z) Add(x, s(y), s(z)) {x, z} N 1 (x) ∧ N 2 (y) R(x, y) 2 N 1 (x) ∧ N 2 (y) R(x, y) {y} N 1 (w)∧N 3 (s(s(w)))∧N 4 (s(w))∧ N 5 (0) R(s(w), 0) {w} Table 7
.2: Statistics about the Noetherian induction proofs issued from Cyclist proofs.

Conclusions

We have presented a new method to validate a class of CLKID ω pre-proof trees by converting them to pre-proof tree-sets, then showing that the global trace condition is implicitly satisfied if some ordering and derivability constraints hold. Every infinite path p from a pre-proof tree normalized to a proof (tree-set) can be built by concatenating path segments from the definition of the minimal cycles of its proof. These constraints ensure that there is an infinitely progressing trace following some tail of p. The ordering constraints can also be used to validate cyclic pre-proofs as Noetherian induction proofs.

Our approach allows more flexibility; a different induction ordering can be defined for each SCC with cycles from the digraph of the proof. This is not the case from the unique induction ordering defined over the buds of a pre-proof tree with trace manifolds [Brotherston, 2005, Brotherston, 2006]. Also, our approach does not require pre-proof trees to be in cycle normal form that are, in the worst case, exponentially bigger.

The soundness check can be done in polynomial time provided that the time complexity for comparing two IAAs is at most polynomial. We defined proof strategies ensuring that the number of ordering constraints equals that of the induction hypotheses that are really required in the proof. In practice, their number is generally small even for proofs concerning real-size applications. For example, every cyclic induction proof from This chapter is based on [Stratulat, 2005, Stratulat, 2007]. We present a framework and a methodology to build and analyse formula-based Noetherian induction inference systems. A stronger connection between different proof techniques like those based on implicit induction and saturation is established by uniformly and explicitly representing them as applications of the formula-based Noetherian induction. The framework offers a clear separation between logic and computation, by the means of i) an abstract inference system that defines the maximal sets of induction hypotheses available at every step of a proof, and ii) reasoning modules that perform the computation and allow for modular design of the concrete inference rules. The methodology is applied to define a concrete implicit induction inferece system and two saturation-based inference systems.

In Chapter 1, we have shown that soundness is a vital property of formula-based Noetherian induction inference systems, which guarantees the persistence of minimal counterexamples in any derivation containing false conjectures. One straightforward application of it concerns the implicit induction inference systems which can prove that the conjectures are valid if the derivations end with an empty set. Another outstanding application refers to saturation-based inference systems; they detect the minimal counterexamples in the last (saturated) state in finite derivations.

The methodology helps to analyse two existent saturation-based inference systems, one based on ordered paramodulation, the other on ordered resolution.

Contributions. Below we listed the main contributions of our approach:

Consolidation of the link between saturation and implicit induction procedures. The design of inference systems that (partially) abstract the computation goes back to the late 80's, early 90's [Bachmair, 1988, Reddy, 1990], as a solution for representing classes of concrete inference systems sharing similar reasoning techniques. In this way, the properties established for abstract systems are naturally propagated to the instantiating systems. In our framework, we pushed this idea further and proposed A s , a saturation-based system that completely abstracts the computation, and showed the resolution-based system RP [START_REF] Bachmair | [END_REF] to be an instance of it. Since A s defines the same induction hypotheses as another implicit induction abstract system [Stratulat, 2005], an even stronger link between saturation-based and implicit induction procedures has been established. This result opens the perspective of designing hybrid inference systems that would be able to perform both implicit induction and saturation-based proofs with minor changes, as explained in [Stratulat, 2005]. It also means that reasoning techniques can be shared: for example, we expect that the approach for integrating Computer Algebra algorithms into implicit induction systems [Armando et al., 2002] be easily adaptable for saturation-based systems.

Definition of stronger redundancy criteria for saturation-based systems. Since similar instantiation results between concrete and abstract systems have already been obtained in [Stratulat, 2001, Stratulat, 2005], A s can be considered as a reference for defining maximal sets of induction hypotheses for many other saturation-based systems. The proposed methodology leaves room for further extensions of existing systems, for example for any concrete RP instance described in [START_REF] Bachmair | [END_REF].

Simple and modular design of sound and concrete saturation-based systems. Prover designers can benefit of our framework to build new and sound saturation-based systems or to extend existing ones. Thanks to the proposed methodology, any rule can be soundly i) designed to integrate and tune specific reasoning techniques, by simply showing it as an instance of an A s -rule, and/or ii) extended to use maximal sets of induction hypotheses. In our approach, the soundness proofs are modular; tedious and error-prone soundness proofs are therefore avoided even for very complex inference systems. The methodology also ensures that the extended systems preserve their refutational completeness, as we have shown for variants of RP. However, it cannot serve to establish the refutational completeness of arbitrary system (see later in the chapter that Property 2 is generally difficult to be proved). Therefore, our methodology completes rather than competes with other techniques for proving the refutational completeness property.

Structure of the chapter. The chapter is organised in 3 sections. Section 8.1 presents a framework and a methodology to design and analyse formula-based Noetherian induction inference systems. As a first application, the framework and methodology are used for building a very simple implicit induction inference system that is sound by construction. The framework and methodology are later applied in Section 8.2 to analyse and extend two saturation-based inference systems that use the paramodulation and resolution techniques. The last section concludes.

The logical framework

Contextual cover sets (CCSs)

We consider sound formula-based Noetherian induction inference systems consisting of sets of inference rules that guarantee the persistence of minimal counterexamples in any derivation, i.e. whenever the processed conjecture has a minimal counterexample, an equivalent counterexample exists in a future state. For example, if φτ is a minimal counterexample of φ at the step E ∪ {φ} E ∪ Φ, the completely automated inference systems require that a counterexample equivalent to φτ be in the next state E ∪ Φ. More precisely, the condition Γ |= φτ should be satisfied, where Γ can contain both (E ∪ Φ) ∼φτ and true formulas: i) the axioms Ax, ii) C 1 ≤φτ , where C 1 has elements of E (but not of Φ) and other conjectures with no minimal counterexamples, iii) C 2 <φτ , where C 2 can be any set of conjectures from the derivation, and iv) Φ ≤φτ . It is assumed that ≤ is a Noetherian quasi-ordering over formulas which is stable under substitutions.

Usually, the minimal counterexample φτ is hard to identify among the other ground instances of φ. To be sure that this condition is satisfied by φτ , it is sufficient to generalise it for any ground instance of φ. To sum up, the condition becomes

Ax ∪ C 1 ≤φγ ∪ C 2 <φγ ∪ Φ ≤φγ |= φγ, for any ground instance φγ, (8.1)
i.e. Φ is a (general) contextual cover set (CCS) of φ in the context C = (C 1 , C 2 ), a concept also defined in [Stratulat, 2000a, Stratulat, 2000b, Stratulat, 2001]. Several kinds of CCSs are distinguished: i) cover set if C 1 = C 2 = ∅, ii) strict if Φ ≤φγ is replaced by Φ <φγ , iii) empty if Φ = ∅, and iv) universal if Ax = ∅. They are not mutually exclusive; for example, any empty CCS is also strict. The notion of cover set as a particular CCS corresponds to that from [START_REF] Bronsard | [END_REF], which is a generalisation of [Reddy, 1990]. Variants of it can be found in different completion-based induction methods [Bachmair, 1988, Zhang et al., 1988, Kounalis and Rusinowitch, 1990b, Kapur et al., 1991]. In the definition (8.1), the formulas from C 1 ≤φγ , C 2 <φγ and Φ ≤φγ can be used to deduce φγ even if they are not true or not yet proved to be true. They play the role of induction hypotheses.

In the rest of the chapter, the 'contextually cover' relation is generalised to sets of formulas:

Ψ C ( < C ) Φ iff Φ is a (strict) CCS of any φ ∈ Ψ in the context C.
Properties As shown in [Stratulat, 2001], the 'contextually covers' relation is a quasi-ordering: i) (reflexivity) Φ C Φ, for any set of formulas Φ, and ii) (transitivity) for any set of formulas Φ, Ψ and Γ, if Φ C Ψ and Ψ C Γ, then Φ C Γ. Due to the transitivity property of C , new 'contextually cover' relations can be obtained by composition operations.

• horizontal composition. Given the chain of 'contextually cover' relations Φ

1 C . . . C Φ i C Φ i+1 C . . . Φ n , then i) Φ i C Φ j , for all i, j ∈ [1..n] with i ≤ j, and ii) if Φ i < C Φ i+1 then Φ k < C Φ j ,
for all k ≤ i and j > i.

• vertical composition. Given the set of formulas

Φ = {φ 1 , . . . , φ n } such that ∀i ∈ [1..n], {φ i } C (resp. < C )Ψ i then Φ C (resp. < C ) n j=1 Ψ j .
Our framework is able to provide maximal sets of induction hypotheses at any step of a derivation by the means of two inference systems A 1 and A 2 .

8.1.2

The A 1 and A 2 inference systems

1-AddPremise (E ∪ {φ}, H) A 1 (E ∪ Φ, H ∪ {φ}) if {φ} < (H, E) Φ 1-Simplify (E ∪ {φ}, H) A 1 (E ∪ Φ, H) if {φ} (E∪H, ∅) Φ Figure 8
.1: The one-step inference rules.

Generally, the CCS contexts may have conjectures from the whole derivation to be computed at any inference step. To automate their computation, a new set of particular formulas will join the set of conjectures such that the context has only formulas from the current state of the derivation. They are called premises and represent processed conjectures that do not contain minimal ground formulas. The inference rules have now the form:

Name (E ∪ {φ}, H) (E ∪ Φ, H ) [if Conditions]
where H and H are premises. The inference system A from Subsection 4.1.2 can be represented using CCSs as in Figure 8.1 by the A 1 inference system. Its rules replace φ by Φ if Φ is a CCS of φ, whose context has only formulas from E and H. In its simplest form, it consists of two inference rules that build the new set of conjectures in just one step. The 1-AddPremise rule firstly computes Φ as a strict CCS of φ, then adds it to the current set of premises to participate to further computations. 1-Simplify does not make such addition, but it is less restrictive: Φ can be a general CCS and instances of E equivalent to φ are allowed. The induction hypotheses from the contexts do not affect the soundness of A 1 .

Theorem 20 The minimal counterexamples are persistent in any A 1 -derivation starting with an empty set of premises.

Proof Similar to the proof of Theorem 6. More complex inference rules can be designed by using the composition properties of CCSs. The inference rules of the inference system A 2 from Figure 8.2 build the new set of conjectures in two steps. At the step (a) of 2-AddPremise, an intermediate CCS of φ is created, denoted by Ψ. Then, for any formula from Ψ a strict CCS is built and added as new conjectures. By vertical composition at the step (b), Φ is a strict CCS of Ψ. Φ is also a strict CCS of φ, by horizontal composition. Similarly, 2-Simplify builds Φ as a CCS of φ. It can be shown that the two-step inference system is sound as in [Stratulat, 2001] and following the idea of the proof of Theorem 20. The one-step inference system is an instance of it by considering {φ} as the (trivial) CCS for {φ} at the step (a) of the corresponding two-step inference rules.

2-AddPremise

(E ∪ {φ}, H) A 2 (E ∪ {φ} ∪ Φ 1 ∪ . . . ∪ Φ p Φ , H ∪ {φ}) if (a) {φ} (H,E∪Φ) p j=1 {ψ j } and (b) {ψ j } < (H,E∪{φ}∪(Φ\Φj )) Φ j , for each j ∈ [1..p] 2-Simplify (E ∪ {φ}, H) A 2 (E ∪ {φ} ∪ Φ 1 ∪ . . . ∪ Φ p Φ , H) if
2-AddPremise is asymmetric in the construction of Φ. To be complete, the two-step inference system should include a variant of 2-AddPremise that creates the strict CCS at the step (a) instead of (b).

Reasoning modules

The inference systems A 1 and A 2 are abstract because they ignore how the CCSs from its inference rules are built. The last components of our framework, the reasoning modules, are in charge to compute the elementary CCSs, i.e. that are not built by composition operations. They represent implementations of reasoning techniques adequate to the nature of the employed consequence relation. The most part of them are deductive, like rewriting and subsumption, and can reason on any kind of consequence relation. Some others are more specific, as the replacement of a natural variable with 0, 1, . . . for the initial consequences, or work only for particular reasoning domains, like the decision procedures.

A reasoning module is defined by two functions that take as arguments a context and a formula for which a CCS is built: i) the generation function g, and ii) the condition function cond, such that whenever g(φ, C) = Φ then {φ} C Φ under the condition cond(φ, C). All the reasoning modules presented in the paper have the trivial condition function that returns true, but in general this is not the case. An inference system is recursive if the validation process of the conditions is performed by the prover itself. Establishing the soundness of recursive systems is more difficult because of the mutual dependency created between the prover and the reasoning modules: on the one hand, the inference rules need reasoning modules that soundly build CCSs and, on the other hand, the reasoning modules need sound validations of their conditions. An integration schema of reasoning modules in recursive implicit induction inference systems has been proposed in [Stratulat, 2001]. It has the advantage that elements of the context given as argument to the condition function can contribute as initial premises to the proof of the conditions.

Methodology for designing and analysing CCS-based inference systems

The framework can be used to design new inference systems and to analyse, improve and extend existing CCS-based inference systems. To build a new inference system that reasons on a given inductive consequence relation, the following steps can be followed:

1. provide a Noetherian ordering over the formulas that is stable under substitutions, Table 8.1: The compatibility predicate.

The soundness of the new inference system is guaranteed if each inference rule is an instance of an A 1 -rule by showing i) the compatibility and ii) the context inclusion of its CCSs w.r.t. the corresponding CCSs defined by the A 1 -rule. The compatibility predicate is defined in Table 8.1. Any kind of generated CCS is compatible with general CCSs (third line) and only the strict and the empty CCSs are compatible with strict CCSs (last line). If the generation function builds a CCS of several kinds, for example a strict cover set, then the result is the disjunction of the compatibility results for each kind.

A context (C 11 , C 12 ) is included in (C 21 , C 22 ) if (C 11 ≤φ ∪ C 12 <φ ) ⊆ (C 21 ≤φ ∪ C 22 <φ )
, for any ground formula φ. Analysing existing systems is an easier task since the ordering and the reasoning techniques are already provided. The most difficult steps are the representation of the derivation states under the form of (E, H) and that of the rules as instances of the abstract rules. Then, the rules can be soundly improved, for example, by expanding the contexts to the maximal values allowed by the abstract rules. Existing systems can be expanded modularly with new rules created in a flexible way, as described in the next section.

Theorem 21 (soundness and refutational completeness of variants) Let S be a refutationally complete inference system that can be extended using the above methodology and let S be such a variant. Then S is sound and refutationally complete.

Case study: designing an implicit induction inference system

An implicit induction inference system will be designed using our methodology to generate proofs that validate properties over the naturals from equational specifications. Ordering The ordering over equalities < e can be defined as a multiset extension of a rpo < t , starting from a precedence < F over the function symbols, because any equality s = t can be represented as the multiset {s, t}: s = t < e l = r if max(s, t) t max(l, r), where max(s, t) is the singleton containing the maximal term between s and t (wrt < t ) when it exists, otherwise {s, t}. We recall that < e and < t are Noetherian and stable under substitutions.

For example, given the precedence 0 < F S (the successor function) < F +, then i) x < t 0 + x, ii) S(x + y) < t S(x) + y and iii) S(x) + 0 = S(x) < e S(S(x) + 0) = S(S(x)). Reasoning Techniques An inductive consequence relation appropriate for equalities is the initial consequence, denoted by |= ini , and a typical reasoning technique for it is the replacement of a variable with finite descriptions of its domain. For the domain of the naturals, the most common are {0, S(x)} and {0, S(0), S(S(x))}.

Two more general, deductive reasoning techniques, will be used: the elimination of identities of the form s = s because they cannot contain counterexamples, and the rewriting. By e[t] p is unambiguously indicated that the equality (or term) e contains the term t at the position p. Then, given a set of rewrite rules ρ, the rewrite relation ρ is defined as e [a σ] p ρ e [b σ] p if a → b ∈ ρ and σ is a substitution.

Reasoning Modules

The previously presented reasoning techniques will serve to build new reasoning modules:

(E ∪ {e}, H) P (E ∪ Φ, H ∪ {e})
if Ψ = g Ex (e, (∅, ∅)) and Φ = e ∈Ψ g R (e , (H, E))

Figure 8.4: The ExpandRewrite rule.

Analysing and extending saturation-based inference systems

The proofs by saturation have an important place in the automated reasoning domain, for instance the Handbook of Automated Reasoning contains at least three chapters devoted to this topic [START_REF] Bachmair | [END_REF], Comon, 2001, Nieuwenhuis and Rubio, 2001]. They provide the means to detect the minimal counterexamples in the last state of any finite derivation. It is required that i) the formulas from the last state be saturated, i.e. no new information can be produced by the exhaustive application of the inference rules, and ii) the inference system be refutationally complete, i.e. the minimal counterexamples from any saturated formulas are 'easily detectable'. Such a minimal counterexample is usually the formula that is false in any model, denoted here by , which is generated if and only if the saturated formulas are unsatisfiable.

To show the flexibility of our approach, we will prove the refutational completeness of a variant of A 1 , denoted by A , for which the CCSs are universal. Indeed, the set of axioms is empty when applying the inference rules, but the argumentation for its refutational completeness is based on the existence of a candidate model [START_REF] Bachmair | [END_REF]] (or generated model [Nieuwenhuis and Rubio, 2001]) for any saturated set of formulas, which plays the role of the axioms when defining counterexamples. We assume that it satisfies the following property:

Property 1 Let (E 0 , ∅) A • • • A (E n , H n ) be a saturated A -derivation such that I E n be a model for E n . Then, an A -inference rule is applicable on any formula from E n containing a minimal counterexample other than .

Theorem 22 (A -refutational completeness) Let (E 0 , ∅) A • • • A (E n , H n ) be a saturated Aderivation with ∈ E n and I E n |= E n . If A satisfies Property 1, for any ground formula φ from E n , I E n |= φ.

Proof By contradiction, we assume that there is a counterexample in E n . Theorem 20 still holds for A as it is an instance of A 1 . Therefore, there is a minimal counterexample γ in the derivation, other than , that should be in E n . On the other hand, Property 1 guarantees the applicability of an A -rule on the formula containing γ, which contradicts the fact that the derivation is saturated.

In the next subsection, the methodology will be used to analyse a paramodulation-based inference system.

Case study 1: a paramodulation-based inference system

The saturation-based inference system to analyse, denoted by G in Figure 8.5 and by G in [Nieuwenhuis and Rubio, 2001], reasons on ground Horn equational clauses of the form e 1 ∧ . . . ∧ e n ⇒ or e 1 ∧ . . . ∧ e n ⇒ e, where e, e 1 , . . . , e n are equalities and s τ (Γ) (resp. s τ (Γ)) means that s u (resp. s u), for any term u from the equalities occurring in Γ. Based on ordered paramodulation, the rule Superposition Left (resp. Superposition Right) transforms (resp. strictly) maximal literals in the processed conjecture, while Equality Resolution eliminates from the negative part of a clause the identities involving its maximal term. It can be noticed that all these rules preserve the processed conjecture in the next derivation. The orderings over terms, ≺, and clauses, ≺ c , are Noetherian and total. The stability of ≺ c is guaranteed because the formulas are ground. It has been shown in [Nieuwenhuis and Rubio, 2001] that G is refutationally complete and that Property 1 is satisfied. Moreover, it is (trivially) sound because all the processed conjectures, and therefore the minimal counterexamples, are preserved in the derivation. reduced by Superposition Left and Superposition Right, and ii) identities of the form s = s are eliminated by Equality Reasoning even if s is not maximal. These weakened versions of the G -rules are still instances of 1-Simplify because it does not require strict CCSs.

Our methodology allows for a fine tuning for powerful and automated inference systems by considering two new rules for each G -rule, with contexts defined by the corresponding one-step A -inference rules:

1. As instances of 1-AddPremise, with respect to their original specifications, Superposition Left and Superposition Right are constrained to forbid the reduction of the maximal terms at the root position in order to build a strict CCS. There is no restriction for Equality Reasoning.

2. As instances of 1-Simplify, the rules are not constrained to reduce maximal terms.

An inference system containing only 1-AddPremise instances is as powerful as G: the processed conjecture is not saved in the new state as a conjecture, but as a premise. Notice that the G and its variants satisfy Property 1 for similar reasons as G.

Theorem 23 The inference system G and its variants are sound and refutationally complete.

Proof By Theorem 22 and the instantiation results.

The saturation process always finishes on ground Horn clauses with any of G, G and G -variants. This is not the case for (Horn) clauses with variables, where the G -variants are expected to be more effective. Techniques for lifting inference systems from the ground to the non-ground case are presented in [Nieuwenhuis andRubio, 2001, Bachmair and[START_REF] Bachmair | [END_REF].

Case study 2: a resolution-based inference system

This time, we will apply the methodology by extending a variant of A 1 , denoted by A s , with a new saturation-based rule.

1-AddPremise (E ∪ {φ}, H)

As (E ∪ Φ, H ∪ {φ}) if {φ} < (H, E) Φ

1-Simplify (E ∪ {φ}, H)

As (E ∪ Φ, H) if {φ} (E∪H, ∅) Φ 1-Saturate (E ∪ {φ}, H)

As (E ∪ Φ, H ∪ {φ}) where Φ is O > (H S , φ) Figure 8.6: The one-step A s -inference rules.

The A s inference system. The saturation-based inference system from Figure 8.6, denoted by A s , consists of three rules. The first two (CCS-based) rules are particular cases of the rules from A 1 , for which the CCSs are universal. The last rule, 1-Saturate, performs saturation-based reasoning before adding the processed conjecture to the premises. If Ψ is a set of premises, Ψ S denotes all formulas from Ψ previously added by 1-Saturate. 1-Saturate firstly replaces φ by the new conjectures obtained by the exhaustive application of saturation-based operations O > (like those based on ordered resolution or paramodulation) between φ and formulas from H S , then adds φ to H.

In order to prove the refutational completeness of A s , the following admissible conditions should be satisfied: i) ≤ is a well-founded quasi-ordering over conjectures that is stable under substitutions and ii) for any saturated set of formulas, there exists a candidate model such that A s satisfies the following property:

Property 2 (A s -reducibility property for minimal counterexamples) Let (E 0 , ∅) As • • • As (∅, H n ) be a saturated A s -derivation such that ∈ H n and I H n S be a candidate model for the set H n S . Then, for any premise φ having a minimal counterexample from H n S , there exists an inference rule in O > between φ and other formulas from H n S that produces a smaller counterexample.

A s is sound if the minimal counterexamples from ∪ i E i of any saturated A s -derivation (E 0 , ∅) As • • • As (∅, H n ) are preserved in H n S . The next theorem states that A s is sound and refutationally complete.

Theorem 24 (soundness and refutational completeness of A s ) Let (E 0 , ∅) Proof To prove the soundness of A s , we firstly show that H n collects all minimal counterexamples from a derivation. Assume that γ is a minimal counterexample for ∪ i E i in I H n S of a saturated derivation (E 0 , ∅) As • • • As (∅, H n ) and let E j (with j ∈ [1..n -1]) be the last set of conjectures in the derivation having a formula φ whose ground instance is a counterexample φτ equivalent to γ (so minimal). Such a set exists since the derivation ends with an empty set of conjectures. We will show that H j+1 has a φτ -equivalent counterexample: i) if 1-AddPremise or 1-Saturate is applied on φ, then φ ∈ H j+1 ; ii) if the 1-Simplify rule (E ∪ {φ}, H) As (E ∪ Φ), H) is applied on φ and E j = E ∪ {φ} , then

((E ∪Φ∪H) ≤φτ ) ⇒ φτ since {φ} (E∪H, ∅) Φ. As (E ∪Φ∪H) <φτ is true in I H n S , the set (E ∪Φ∪H) ∼φτ has a φτ -equivalent counterexample. It cannot be a formula from E ∪ Φ (which builds E j+1 ), otherwise E j is no longer such a last set. So, H (hence H j+1 and, finally, H n ) has a φτ -equivalent counterexample.

The next step in the soundness proof of A s is to show that for any minimal counterexample in H n there exists a premise in H n S having an equivalent counterexample. Let φ ∈ H n be a premise having a minimal counterexample φτ . Notice that φ can be added to H n either by 1-Saturate or 1-AddPremise. If 1-Saturate was applied, we are done. Otherwise, assume that 1-AddPremise was applied on φ, as in the transition (E ∪ {φ}, H) As (E ∪ Φ, H ∪ {φ}). Since {φ} < (H, E) Φ, the relation (H ≤φτ ∪ E <φτ ∪ Φ <φτ ) ⇒ φτ holds in I H n S . Therefore, I H n S |= H ≤φτ ∪ E <φτ ∪ Φ <φτ . On the other hand, (H ∪ E ∪ Φ) <φτ has no counterexample since φτ is minimal and < is stable. Therefore, I H n S |= H ∼φτ . By the stability of ∼, H should have a premise ψ that has a φτ -equivalent counterexample, which has become premise before φ. The same reasoning can be applied to ψ as for φ, and it can be repeated until the derivation is scanned back to its beginning and eventually H becomes empty if 1-Saturate has not yet been applied. In this case, the only rule that can be applied is 1-Saturate and the processed conjecture is preserved in H n S . The refutational completeness property is shown by contradiction. It is assumed that there exists a counterexample in E 0 and, therefore, a minimal counterexample γ ( = ) in H n S , by the soundness property. On the other hand, Property 2 guarantees the existence of an inference rule from O > involving the set Ψ consisting from the premise from H n S having γ and other premises from H n S , that produces a counterexample smaller than γ. Due to the exhaustive application of saturation-based operations in any Inference Computation rule, such an inference should also occur in the derivation when applying 1-Saturate on the last added premise from Ψ. Contradiction.

It may be noticed from the proof of Theorem 24 that the soundness of A s is not affected if i) the processed conjecture is preserved in the new set of conjectures, or ii) the following two inference rules are added:

• EliminatePremise (E, H ∪ {φ}) As (E, H)

• BackwardPremise (E, H ∪ {φ}) As (E ∪ {φ}, H),

where φ (in both rules) does not have minimal counterexamples.

Corollary 2 A s extended with the EliminatePremise and BackwardPremise rules is sound and refutationally complete when Property 2 is satisfied.

In the following, we analyse the RP 'ordered resolution'-based inference system for non-ground clauses from [START_REF] Bachmair | [END_REF]. Before its presentation, we give some basic notions.

Basic notions. We recall that a literal is either an atomic formula A or its negation ¬A. A clause is a disjunction of literals L 1 ∨ . . . ∨ L n that can be represented as the multiset {L 1 , . . . , L n }. To show that a clause C contains a literal L, C is represented as L ∨ C , where C is the subclause containing the rest of the literals from C. If L is a literal, then L is its negation. A clause C subsumes a clause D iff there exists a substitution σ such that Cσ ⊆ D. If D does not subsume C, then C properly (or strictly) subsumes D.

We say that a formula φ is redundant with Φ if φ does not have any minimal counterexample in the candidate model I Φ ; for example, the standard redundancy criterion from [START_REF] Bachmair | [END_REF] defines a clause C as being redundant w.r.t. a set N of clauses if there exist some clauses C 1 , . . . , C k in N such that C 1 , . . . C k |= C and C > C i , for all i with 1 ≤ i ≤ k.

The RP system. RP, reproduced in Figure 8.7, is an abstract system used in a framework that models important classes of reasoning techniques like deduction, deletion and simplification. Its instances help to describe many proof strategies, as those implemented in the Otter system [McCune, 1994].

Each of its inference rules is a transition between triplets (N | P | O) that store the "newly derived", the "processed" and the "old" clauses, respectively. The first three rules eliminate tautologies and subsumed clauses, while the next two rules simplify clauses by resolution. The sixth rule transfers clauses from N to P. It suggests that N and P share the same set of clauses, but this partition is done for efficiency reasons; indeed, the newly derived clauses that are obtained by the application of the last rule are "processed" before migrating to P. The last rule, Inference Computation, is abstract; O S (O, C) performs all possible resolution-based operations between C and clauses from O. The clauses from O are chosen according to the selection function S, given as parameter, that helps to define a wide variety of proof strategies.

A s -representation. Our analysis is based on the aforementioned suggestion. The new rules are obtained by replacing in the RP-rules i) the sets N and P by the set of conjectures E, and ii) O by the premises H. The resulted inference system, denoted by RP , is displayed in Figure 8.8. Clause Processing is now useless and Backward Reduction for P becomes redundant with Forward Reduction, so they will not be mentioned in RP .

Admissible

Conditions.

The inference system RP , as RP, is abstract. In [START_REF] Bachmair | [END_REF], RP has many refutationally complete instances, for example when O S (H, C) applies the rules from the General Ordered Resolution inference system (see Theorem 5.5 in [START_REF] Bachmair | [END_REF]). The Property 2 is also satisfied, according to Theorem 5.4 from [START_REF] Bachmair | [END_REF]. The quasi-ordering over clauses is stable under substitutions and well-founded, having its strict part ≺ total on ground clauses.

Reasoning Modules. We define the following reasoning modules: that Inference Computation can instantiate 1-Saturate. The rule Backward Subsumption for H is an instance of EliminatePremise; whenever a clause C is strictly subsumed by a clause C and C has a counterexample, then C has a smaller one (so the premises to which EliminatePremise is applied never have minimal counterexamples). The rule Backward Reduction is the result of the application of BackwardPremise, followed by Forward Reduction. This instantiation result, the satisfaction of the admissible conditions and Corollary 2 conclude that RP (and therefore RP) is sound and refutationally complete.

RPand RP -variants. The instantiation result and Theorem 21 suggest that, theoretically, the contexts from Tautology Deletion and Backward Subsumption for E can be soundly extended to (E ∪ H, ∅). However, from a practical point of view, this is useless since i) a tautology remains a tautology in any context, and ii) the extended Backward Subsumption would become identical to Forward Subsumption. In fact, Backward Subsumption is kept in RP for efficiency reasons.

An interesting extension would be to add instances of 1-AddPremise to RP . For example, when concluded that other ordering properties encountered in the literature, as the totality, are required either in the computation part or to satisfy additional properties like Property 1. The abstract systems A 1 and A 2 are landmarks for the formula-based Noetherian induction inference systems. As shown for the system A from Section 6.4 [Stratulat, 2000a], they provide the maximal set of induction hypotheses w.r.t. other similar implicit induction abstract systems. We expect similar results for the saturation-based inference systems. Usually, the one-and two-step inference rules are sufficient to apply the methodology, but the framework is able to provide 'more than two'-step rules when necessary. The computation process has the advantage to be parameterisable; it is performed by reasoning modules that allow for the modular design of the concrete inference systems.

The methodology indicates how to instantiate the abstract system with specific reasoning techniques without affecting its soundness. The soundness proofs of concrete procedures become advantageously simpler because the soundness of the abstract systems was established once for all. They are mainly reduced to show that any rule is the instance of an abstract inference rule.

Our work opens opportunities for further developments and new ideas. As example, we will develop in Section C.1 a new proposition for certifying cyclic reasoning by converting cyclic proofs to explicit induction proofs. It is based on the FOL ID logical framework and is more general than that presented in Subsection 3.2.4. The document finishes by presenting other, less detailed, lines of research.

C.1 Detailed project: certification of cyclic reasoning by converting cyclic to explicit induction proofs

Another way to certify cyclic reasoning using Coq is to convert cyclic proofs to explicit induction proofs. In Subsection 3.2.4, we have presented a method for converting to explicit induction proofs cyclic formulabased Noetherian induction proofs that have only 1-cycles and the IHs are instances of the root formula. This approach is rather limited; for example, the cyclic Coq pre-proofs from Example 3 can not be processed because either some IHs are not instances of the root formula or some cycles are not 1-cycles.

In the following, we will present a new and more general conversion procedure, based on the FOL ID logical framework. The reason for choosing FOL ID is two-fold: i) it offers a crispy clear formal framework to explain the conversion procedure, and ii) the FOL ID reasoning can be reproduced by Coq scripts.

C.1.1 The LKID and LKID a explicit induction inference systems

The classical explicit induction inference system for FOL ID is the LKID system [Brotherston and Simpson, 2011]. It includes the LK's rules from Figure 7.1, the CLKID ω N 's unfold rule, as well as a new rule, denoted by (Ind), which represents a left introduction rule for an inductive atom P j (t ): minor premises Γ, F j (t ) ∆ (Ind P j ) Γ, P j (t ) ∆

A minor premise is built from each axiom defining a predicate P that is P j or mutually dependent with P j . The minor premise corresponding to (7.7) is Γ, Q 1 (u 1 ), . . . , Q h (u h ), G 1 (t 1 ), . . . , G l (t l ) F (t ), ∆ (C.2) if (7.7) and Γ, P j (t ) ∆ do not share variables (otherwise, the variables from (7.7) can be renamed accordingly), and G 1 , . . . , G l , F are IH formulas associated to P 1 , . . . , P l , P , respectively. Γ, F j (t ) ∆ is called major premise.

LKID has been shown sound, i.e., every LKID inference rule r is sound (see Proposition 3.5 from [Brotherston and Simpson, 2011]) such that the conclusion of r holds whenever its premises hold.

For our purpose, we assume that there is a non-empty set of admissible inductive atoms.

Definition 13 (admissible inductive atom) An inductive atom P (t) is admissible if the sequent P (t) is true.

Admissible inductive atoms can be used to build the following new rule:

Definition 14 (the (Adm) rule) (Adm) is the 0-premise rule for the right introduction of any admissible inductive atom P (t):

(Adm P (t)) Γ P (t), ∆ Lemma 12 (soundness of (Adm)) The (Adm) rule is sound.

Proof By Definition 13. However, N becomes admissible in a typed system where the type of the argument of N has the free constructors 0 and s. The idea is to use typed formalisms that can reproduce the cyclic and explicit induction reasoning from FOL ID . An example of such a formalism is the calculus of inductive constructions [Paulin-Mohring, 2015, Bertot and[START_REF] Bertot | [END_REF], the logical framework behind Coq, because i) it accepts inductive definitions, and ii) every CLKID ω N and LKID a inference rule can be simulated in Coq. The Coq inference system can directly reproduce the LK, equality, unfold and case rules. The explicit induction schema built by (Ind a ), when applied on an admissible inductive predicate P π defined by axioms of the form (C.7), can be also reproduced by some recursive function that terminates and is complete, by using the functional programming style from Subsection 6.3.4.

In the following, we will show how to build such a function from cyclic pre-proofs.

Definition 17 (constrained CLKID ω N proof tree/tree-set) A constrained CLKID ω N proof tree (resp.,tree-set) is every pre-proof tree (resp., tree-set) whose digraph has only n-cycles that discharge their IHs, according to Definition 12.

Example 37 We show that the pre-proof tree-set from Fig. C.9 can be constrained, too. Its digraph has one SCC with cycles denoted by π, with two 1-cycles and one 2-cycle. By using the cumulative substitutions built in Example 30, we define the ordering constraints for each n-cycle:

• for [N 1 , N 4 , N 5 , N 8 , N 9 ] we have S(N 8 ) < π S(N 1 )[{x → x; y → sz; z → z}];

• for [N 10 , N 11 , N 14 , N 15 , N 16 , N 17 ] we have S(N 16 ) < π S(N 10 )[{x → sz; z → z}];

• for [N 1 , N 4 , N 5 , N 7 ], [N 10 , N 14 , N 15 , N 18 , N 19 ] we have the two constraints S(N 7 ) < π S(N 1 )[{x →

x; y → sz; z → z}] and S(N 18 ) < π S(N 10 )[{x → sz; z → z}].

We define the measure values for each sequent from the pre-proof tree-set, of the form. . . P t (resp., . . . Qt 1 t 2 ), as the multiset {N t, N t} (resp.,{N t 1 , N t 1 , N t 2 }).

The four ordering constraints are : {N x, N x, N z} < π {N x, N x, N sz}, {N z, N z} < π {N sz, N sz}, {N x, N x} < π {N x, N x, N z}, and {N z, N z, N sz} < π {N sz, N sz}. We can notice that the ordering and derivability constraints are satisfied if < a is defined as a rpo based on any precedence over the symbols N , 0 and s.

Lemma 13 Let π be a SCC with cycles from the digraph of a constrained CLKID ω N proof tree-set, F π (t) its conjunction formula and P π its new inductive predicate. If the principal formulas of the (Case)-steps are admissible inductive atoms, there is a constrained CLKID ω N proof tree of P π (t).

Proof Let π be the SCC with cycles from the digraph of a constrained CLKID ω N proof tree-set (MD, MR) whose conjunction formula is F π (t). By construction, the axioms of P π are issued from the individual induction schemas for the k (> 0) root sequents S(N ip ) (p ∈ [1..k]) from π.

One can build a constrained CLKID ω N pre-proof tree of P π (t) by firstly building the pre-proof tree D of Γ P π (t), where Γ ≡ {p | p is an admissible IAA of S(N ip ), ∀p ∈ [1..k]}. For this, we establish a 'visiting' priority among the root sequents of π given, w.l.o.g., by the sequence S(N i1 ), . . . , S(N i k ). Let also t be (t i1 , . . . , t i k ), where each t ij is (t 1 ij , . . . , t

ni j ij ) (j ∈ [1..k]
). The process of building D is finished when the successive constructions of the visiting path, unfolding and bud parts are finished. The 'visiting path' part is built by successively considering each root sequent of π according to the fixed priority. Hence, we start by executing the rules that affect the IAAs along the paths leading N i1 to each of the terminal nodes of the tree rooted by N i1 in MD, i.e., (W k), (contrL), (Gen) and (Case). When finished, the sequent corresponding to a terminal node t is of the form Γ P π (t 1 i1 [θ c ], . . . , t ni 1 i1 [θ c ], t i2 , . . . , t i k ), where θ c is the cumulative substitution for the path p i1 , leading N i1 to t, and Γ is Γ for which the admissible IAAs of S(N i1 ) are replaced by those of the sequent resulting after the last application of a rule that generates new admissible IAAs, i.e., by the last application of (Gen) in p i1 . We continue to build D by considering N i2 and using some path p i2 , as it has been done for N i1 and p i1 . This part finishes when the derivation for the last root sequent in the sequence, N i k , was built. At the end, the succedent atom from each resulting sequent is the conclusion interference. As such efforts rely on similar methodologies described in Chapter 5, it seems interesting to use them to prove the appropriate versions of the CDO, CDA and MON properties. Domain-specific proof environment for certifying low-level languages. A longer term objective would be to develop an environment that provides automatic support for certifying low-level languages. We expect the restricted format of JSL will prove useful for this task. Index rewrite operation, 69 sequent, 90 soundness property, 2 status of a function symbol, 3 strict cover set, 6 strongly connected component, 28 structural induction, 5 subsumption, 117 sufficient completeness, 2 synthesis conjecture, 36 term-based Noetherian induction, 4 term-rewriting induction, 6 test sets, 6 the inference system A, 46 the inference system D, 14 the inference system D , 74 the inference system D c , 19 the inference system I f s , 70 the inference system I b c , 74 the inference system I f c , 80 the inference system I i , 8 the inference system I s , 8 the inference system G, 113 the inference system G , 114 the inference system A , 113 the inference system A 1 , 109 the inference system A 2 , 109 the inference system A s , 115 the inference system P, 112 the inference system RP, 117 the inference system RP , 117 the inference system I, 7 the inference system I b s , 67 the inference system CLKID ω N , 90 the inference system LKID a , 124 total quasi-order, 3 trace, 92 validity, 2 well-founded induction principle, ix

Résumé

Le principe de la récurrence noethérienne est un des plus généraux principes du raisonnement formel. Dans le cadre du raisonnement de premier ordre, nous proposons une classification de ses instances pouvant être partagées en instances basées sur des termes et des formules. Nous donnons un aperçu du raisonnement par récurrence noethérienne basé sur des termes et des formules, et établissons des relations entre eux. Nous montrons que toute preuve intégrant du raisonnement par récurrence noethérienne basée sur des termes peut être convertie en une preuve dont le raisonnement par récurrence est basé sur des formules. La question de la conversion dans l'autre direction reste ouverte. Pourtant, nous identifions certaines classes de preuves par récurrence noethérienne basée sur des formules qui peuvent être traduites en des preuves dont le raisonnement par récurrence est basé sur des termes. Nous établissons des liens entre le raisonnement noéthérien basé sur des formules et d'autres types de raisonnement formel de premier ordre, comme le raisonnement par récurrence cyclique pour la logique de premier ordre avec des définitions inductives (FOL ID ) et le raisonnement basé sur la saturation. Nous avons mis au point des méthodologies pour certifier le raisonnement noethérien basé sur des formules et le raisonnement cyclique pour FOL ID en utilisant l'assistant de preuve Coq.

Les forces et les limites de nos résultats ont été illustrées par des exemples, des études de cas non-triviaux et des expériences informatiques. Les développements logiciels les plus importants sont une nouvelle version du prouveur SPIKE ainsi que E-Cyclist, l'extension du prouveur Cyclist avec une nouvelle méthode de vérification de la correction de ses prépreuves dans FOL ID .

Mots-clés: raisonnement par récurrence noethérienne, raisonnement formel de premier ordre, certification de preuves, SPIKE, Coq.

Figure 1 :

 1 Figure 1: The cases when Hercules wins.

Figure 2 :

 2 Figure 2: The cases when Hercules cuts the necks of Hydra.

[

  y from (Q x y) *) inversion H0. [...]. (* case (Q x zero) *) apply q1. [...]. (* case (Q x (succ y')) *) apply q2. [...]. (* the proof of (Q x y') requires induction reasoning *) Focus 2. (* instantiate x from (P x) *) inversion H. [...]. (* case (P zero) *) apply p1. [...]. (* case (P (succ x')) *) apply p2. [...].

Figure 3 :Figure 4 :

 34 Figure 3: The digraph representation of the Coq pre-proof from Example 2.

  notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 The term-and formula-based instances . . . . . . . . . . . . . . . . . . 3 1.3 Term-based Noetherian induction principles . . . . . . . . . . . . . . . 5 1.4 Formula-based Noetherian induction principles . . . . . . . . . . . . . . 6 1.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Theorem 7

 7 Any term-based Noetherian induction principle can be represented as a formula-based Noetherian induction principle. Proof Let us consider a term-based Noetherian induction principle that proves the validity of a formula φ for all term vectors from a non-empty set E, i.e., if for any term vector m ∈ E, k∈E,k<tm {φ(k)} |= M φ(m) then ∀p ∈ E, |= M φ(p). Let E be the set {φ(p) | p ∈ E}. The equivalent formula-based Noetherian induction principle can be stated as: if for any formula φ(m) ∈ E , φ(k)∈E ,φ(k)< f φ(m) {φ(k)} |= M φ(m) then we have |= M φ(p), ∀φ(p) ∈ E , where φ(k) < f φ(m) is defined as k < t m. Corollary 1 Any term-based Noetherian induction proof can be justified with formula-based induction arguments.

Figure 2

 2 Figure 2.1: A cycle for checking n IHs.

1:

  F alse = T rue ⇒ F alse = T rue and φ 311 2 : T rue = F alse ⇒ T rue = F alse, which are finally deleted by DedNat. The skeleton of the D c -proof is given in Figure 2.2.

Sommaire 3 . 1

 31 Coq experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.1.1 Proving by cyclic induction . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.1.2 Proving by structural induction . . . . . . . . . . . . . . . . . . . . . . . . 29 3.2 Lazy generation of induction schemas for algorithm synthesis . . . . . 36 3.2.1 Sorting of binary trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.2.2 Synthesis problem and method . . . . . . . . . . . . . . . . . . . . . . . . 38 3.2.3 Induction principles and algorithm extraction . . . . . . . . . . . . . . . . 38 3.2.4 Refining induction by lazy reasoning . . . . . . . . . . . . . . . . . . . . . 39 3.3 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

  Rijkl true have the following structure: Theorem Rijkl true: ∀ x u v, Rijkl x u v. Proof. destruct x ; destruct v ; intros. (* case x=0, v=0 *) apply rijkl 1. (* case x=0, v=(S v ) *) apply rijkl 3. (* to complete *) (* case x=(S x ), v=0 *) apply rijkl 2. (* to complete *) (* case x=(S x ), v=(S v ) *) apply rijkl 4. (*to complete*) Qed.

  Sommaire 4.1 The inference system and proof strategies . . . . . . . . . . . . . . . . . 46 4.1.1 The 'reasoning by implicit induction' setting . . . . . . . . . . . . . . . . . 46 4.1.2 The inference system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 4.1.3 The layout of a specification file . . . . . . . . . . . . . . . . . . . . . . . . 49 4.2 A complete example of SPIKE specification . . . . . . . . . . . . . . . . 50 4.3 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

  Delete tautology_rule = delete(id, [tautology]); subsumption_rule = delete(id, [subsumption (L|C)]); negative_clash_rule = delete(id, [negative_clash]); % instances of Simplify decomposition_rule = simplify(id, [negative_decomposition]); total_case_rewriting_rule = simplify(id, [total_case_rewriting (simplify_strat, R, * )]); % instances of AddPremise case_rewriting = add_premise(total_case_rewriting(simplify_strat, R, * ),[id]); split_rule = add_premise(generate,[id]);

  ) = False => even1(S(S(x))) = even(x); odd(x) = True => even1(S(S(x))) = False; odd(0) = False; odd(S(0)) = True; odd(S(S(x))) = odd1(plus(S(S(x)),0)); % not orientable odd1(0) = False; 4.2. A complete example of SPIKE specification odd1(S(0)) = True; even(x) = True => odd1(S(S(x))) = odd(x); even(x) = False => odd1(S(S(x))) = True;

Figure 5

 5 Figure 5.1: Commutative diagram of defensive and offensive execution.

Figure 5

 5 Figure 5.2: Commutative diagram of defensive and abstract execution.

Fixpoint

  model n (v : nat): term := match v with | O ⇒ (Term id 0 nil) | (S x ) ⇒ let r := model n x in (Term id S (r ::nil)) end. For non-inductive types, we have to define translation axioms. E.g., the translation axioms for the type T from the P&Q example, are: Axiom model nat 0 : model nat zero = (Term id zero nil). Axiom model nat succ: ∀ (u1 : T ), model nat (succ u1 ) = (Term id succ ((model nat u1 )::nil)).• the COCCINELLE counterpart of any function or predicate symbol f will be denoted by the symbol id f prefixed by Term. The arguments of id f are given as a Coq list; • the COCCINELLE counterpart of any variable x of sort s will be the term (model s x). Example 12 The measure value used for (Q x zero) in the formula-based Noetherian induction proof from Figure 3 can be represented as the following COCCINELLE term list: (model nat x :: model nat x :: (Term id zero nil) :: nil), corresponding to the literate translation of the multiset {x, x, zero}.

  x) = true, q(x, y ) = true}, {q(x, S(y )) = true}) true, p(S(x )) = true, q(x, y ) = true}, {q(x, S(y)) = true}) x )) = true, q(x, y ) = true}, {q(x, S(y )) = true}) x ) = true, q(x , S(x )) = true, q(x, y ) = true}, {p(S(x )) = true, q(x, S(y )) = true}) D I b s ({p(x ) = true, q(x, y ) = true}, {p(S(x )) = true, q(x, S(y )) = true}) I I b s ({p(0) = true, p(S(x )) = true, q(x, y ) = true}, {p(S(x )) = true, q(x, S(y )) = true}) D I b s ({p(S(x )) = true, q(x, y ) = true}, {p(S(x )) = true, q(x, S(y )) = true}) D I b s({q(x, y ) = true}, {p(S(x )) = true, q(x, S(y )) = true})

Fixpoint

  plus (x y : nat): nat := match x with | O ⇒ y | S x' ⇒ S (plus x' y) end. Fixpoint even (x : nat): bool := match x with | 0 ⇒ true | S x' ⇒ odd x' end with odd (x : nat): bool := match x with | 0 ⇒ false | S x' ⇒ even x' end.

e

  13(u1, u2, u3) : odd(u1 + u2) = true ∧ even(u2 + u3) = true ⇒ odd(u1 + u3) = true e 23(u2, u3) : odd(0 + u2) = true ∧ even(u2 + u3) = true ⇒ odd(u3) = true e 29(u4, u2, u3) : odd(s(u4) + u2) = true ∧ even(u2 + u3) = true ⇒ odd(s(u4 + u3)) = true e 36(u2, u3) : odd(u2) = true ∧ even(u2 + u3) = true ⇒ odd(u3) = true e 49(u4, u2, u3) : even(u4 + u2) = true ∧ even(u2 + u3) = true ⇒ even(u4 + u3) = true e 67(u3) : odd(0) = true ∧ even(u3) = true ⇒ odd(u3) = true e 73(u4, u3) : odd(S(u4)) = true ∧ even(S(u4 + u3)) = true ⇒ odd(u3) = true e 81(u3) : f alse = true ∧ even(u3) = true ⇒ odd(u3) = true e 91(u4, u3) : even(u4) = true ∧ odd(u4 + u3) = true ⇒ odd(u3) = true e 113(u2, u3) : even(0 + u2) = true ∧ even(u2 + u3) = true ⇒ even(u3) = true e 119(u5, u2, u3) : even(s(u5) + u2) = true ∧ even(u2 + u3) = true ⇒ even(s(u5 + u3)) = true e 138(u2, u3) : even(u2) = true ∧ even(u2 + u3) = true ⇒ even(u3) = true e 189(u3) : even(0) = true ∧ odd(u3) = true ⇒ odd(u3) = true e 195(u5, u3) : even(S(u5)) = true ∧ odd(S(u5 + u3)) = true ⇒ odd(u3) = true e 237(u3) : even(0) = true ∧ even(u3) = true ⇒ even(u3) = true e 243(u5, u3) : even(S(u5)) = true ∧ even(S(u5 + u3)) = true ⇒ even(u3) = true e 267(u5, u3) : odd(u5) = true ∧ odd(u5 + u3) = true ⇒ even(u3) = true e 275(u3) : f alse = true ∧ odd(0 + u3) = true ⇒ even(u3) = true e 295(u3) : odd(0) = true ∧ odd(u3) = true ⇒ even(u3) = true e 301(u6, u3) : odd(S(u6)) = true ∧ odd(S(u6 + u3)) = true ⇒ even(u3) = true e 317(u3) : f alse = true ∧ odd(u3) = true ⇒ even(u3) = true Using the notation with atoms, the proof can be represented as: ({e 13(u1, u2, u3)}, ∅) G I c f ({e 23(u2, u3), e 29(u4, u2, u3)}, {e 13(u1, u2, u3)}) * S I c f ({e 36(u2, u3), e 49(u4, u2, u3)}, {e 13(u1, u2, u3)}) G I c f ({e 67(u3), e 73(u4, u3), e 49(u4, u2, u3)}, {e 36(u2, u3), e 13(u1, u2, u3)}) * S I f s ({e 81(u3), e 91(u4, u3), e 49(u4, u2, u3)}, {e 36(u2, u3), e 13(u1, u2, u3)}) (u4, u3), e 49(u4, u2, u3)}, {e 36(u2, u3), e 13(u1, u2, u3)}) u4, u3), e 49(u4, u2, u3)}, {e 36(u2, u3), e 13(u1, u2, u3)}) u4, u3), e 113(u2, u3), e 119(u5, u2, u3)}, {e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) * S I f s ({e 91(u4, u3), e 138(u2, u3), e 13(u5, u2, u3)}, {e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u4, u3), e 138(u2, u3)}, {e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u3), e 195(u5, u3), e 138(u2, u3)}, {e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u5, u3), e 138(u2, u3)}, {e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) * S I f s ({e 36(u5, u3), e 138(u2, u3)}, {e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u2, u3)}, {e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u3), e 243(u5, u3)}, {e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) u5, u3)}, {e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) * S I f s ({e 267(u5, u3)}, {e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) (u3), e 301(u6, u3)}, {e 267(u5, u3), e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) * S I f s({e 317(u3), e 138(u6, u3)}, {e 267(u5, u3), e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) (u6, u3)}, {e 267(u5, u3), e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)}) {e 267(u5, u3), e 138(u2, u3), e 91(u4, u3), e 49(u4, u2, u3), e 36(u2, u3), e 13(u1, u2, u3)})

  Definition type LF 13 := nat → nat → nat → Prop × List.list term. Definition LF 13 := [F 13, . . . ,F 317], (* all equalities from the proof *) where the anonymous functions from LF 13 are: Definition F 13 : type LF 13 := fun u1 u2 u3 ⇒ ( e 13(u1,u2,u3 ), Term id odd (Term id plus (model nat u1 :: model nat u2 :: nil) :: nil) :: Term id true nil :: Term id even (Term id plus (model nat u2 :: model nat u3 :: nil) :: nil) :: Term id true nil :: Term id odd (Term id plus ( model nat u1 :: model nat u3 :: nil) :: nil) :: Term id true nil :: nil). . . . Definition F 317 : type LF 13 := fun u3 ⇒ ( e 317(u3 ), Term id false nil :: Term id true nil :: Term id odd (model nat u3 :: nil) :: Term id true nil :: Term id even (model nat u3 :: nil) :: Term id true nil :: nil).

Figure 6

 6 Figure 6.1: The I b c -preproof of {q(x, y) = true} as an oriented graph.

Figure 6 . 3 :

 63 Figure 6.3: The normalised I b c -preproof of {q(x, y) = true}.

  where the anonymous functions Pu and Qxy associate to the root atoms the measure values defined at Example 19: Definition Pu : type LF PandQ := fun u ⇒ (P u, (model nat u :: model nat u :: nil)). Definition Qxy : type LF PandQ := fun x y ⇒ (Q x y, (model nat x :: model nat x :: model nat y :: nil)).

  Figure6.4 illustrates the above preproof as an oriented graph. We can distinguish three strongly connected components, denoted by p1, p2 and p3, each of them made of only one minimal cycle, as follows:

eFigure 6 . 4 :

 64 Figure 6.4: The graph representation of the I f c -preproof of {e 13 (u 1 , u 2 , u 3 )}.

Fixpoint f 13

 13 (u1 : nat) (u3 : nat) {struct u1 }: nat := match u1, u3 with | 0, ⇒ 0 | S u4, ⇒ 0 end. Functional Scheme f 13 ind := Induction for f 13 Sort Prop. Fixpoint f 49 (u4 : nat) (u3 : nat) {struct u4 }: nat := match u4, u3 with | 0, ⇒ 0 | S u5, ⇒ 0 end. Functional Scheme f 49 ind := Induction for f 49 Sort Prop.The Coq script of the main 13 lemma is:Lemma main 13 : ∀ F, In F LF 13 → ∀ u1 u2 u3, (∀ F', In F' LF 13 → ∀ e1 e2 e3, less (snd (F' e1 e2 e3 )) (snd (F u1 u2 u3 )) → fst (F' e1 e2 e3 )) → fst (F u1 u2 u3 ).Proof. intros F HF u1 u2 u3 ; case In HF ; intro Hind. (* GenNat' on e 13 *) rename u1 into u1. rename u2 into u2. rename u3 into u3. rename u1 into u1. rename u2 into u2. rename u3 into u3. revert Hind. pattern u1, u3, (f 13 u1 u3 ). apply f 13 ind. (* case e 23 *) intros u1 u3. intro. intro HFabs0. simpl. apply true 36. (* case e 29 *) intros u1 u3. intro u4. intro. intro HFabs0. simpl. (* GenNat' on e 49 *) destruct u4. (* we could have used instead the functional scheme f 49 ind *) (* case e 113 *) simpl. apply true 138. (* case e 119 *) pose proof (HFabs0 F 13 ) as Hind. clear HFabs0. assert (fst (F 13 u4 u2 u3 )) as HFabs0. apply Hind. trivial in 0. unfold snd. unfold F 13. rewrite model. abstract solve rpo mul. simpl. simpl in HFabs0. trivial. Qed.

Figure 7

 7 Figure 7.1: Sequent-based rules for classical first-order logic.

Figure 7

 7 Figure 7.2: Sequent-based rules for equality reasoning.

Figure 7

 7 Figure 7.5: A case when the comparison tests fail while the model checker succeeds.

  Figure 8.2: The two-step inference rules.

  2. provide a set of reasoning techniques adequate for the consequence relation, 3. define reasoning modules based on the reasoning techniques, 4. instantiate abstract inference rules by showing how their CCSs are created by the reasoning modules. Kind of CCS produced by the generation function general strict empty cover set universal

  Figure 8.7: RP: the original inference system with triplets as proof states.

  The strengths and limits of our results have been illustrated by examples, non-trivial case studies and computer experiments. The most important software developments are the new version of the SPIKE prover and E-Cyclist (the extension of the FOL ID Cyclist prover with the new checking method for the soundness of FOL ID pre-proofs).

  γ <φσ {γ } |= M φσ . On the other hand, |= M φσ . Therefore, there is a ground instance from Ψ which is a counterexample smaller than φτ . Contradiction.Proof Assume that a conjecture φ has a minimal counterexample φτ . Generate cannot be applied on φ, by Lemma 2. If Simplify is applied to φ in the state (E ∪ {φ}, H), we have(E ∪ Φ ∪ H) ≤φτ |= M φτ .Again by Lemma 2, H cannot have minimal counterexamples. Therefore, a minimal counterexample equivalent to φτ should exist in the conjectures E ∪ Φ from the next state.

	Theorem 6 (Soundness of I) I is sound for any derivation starting with an empty set of premises.

  Check(IHS, E): identifies cycles based on IHs from IHS and conjectures from E

			2.2. The DRaCuLa proof strategy
	Algorithm 2 Ensure: return all IHs from the identified cycles
	ok IHs := ∅
	repeat
	find a non-empty list of n conjectures φ 1 , . . . , φ n
	Algorithm 1 Develop(E): applies successively D-inference rules to build a proof of the conjectures from
	E
	while E is not empty do
	IHS := {ψ | ∃φ ∈ E that attached the unchecked IH ψ}
	choose φ ∈ E with no unchecked IHs
	choose an inference rule to apply on φ
	if the set of IHs attached to φ is not empty then
	the chosen inference rule should be Induction
	else
	if Induction was chosen with the set Ψ of IHs then
	assign as unchecked and attach all IHs from Ψ to φ
	IHS := IHS ∪ Ψ
	end if
	end if
	if the chosen inference rule is Induction then
	ok IHs := ∅
	for all (φ 1 i , δ i ) ∈ IHS do offsprings φ 1 i := {φ | --→ hist	φ ∈ E and φ 1 i ∈ hist}
	if offsprings φ 1 i is empty then ok IHs := ok IHs ∪ {(φ 1 i , δ i )} {φ 1 i was proved }
	end if
	end for
	ok IHs := Check(IHS \ ok IHs, E) ∪ ok IHs
	mark all IHs from ok IHs as checked
	end if
	if all attached IHs to φ are checked then
	apply the chosen inference rule E ∪ {--→ hist	φ} D E ∪ Φ
	attach to each conjecture from Φ an empty set of IHs
	if inference rule is Split then
	hist;(φ,σ) update any cover instance φ ≡ (φ, σ) to ------→	φ
	else
	update each φ ∈ Φ to -------→ hist;(φ,σ id )	φ , where
	σ id is the identity substitution instantiating all variables of φ.
	end if
	E := (E\{φ}) ∪ Φ
	end if
	end while
	1 (i+1) mod n , δ (i+1) mod n ). The n conjectures form a n-cycle if φ 1 (i+1) mod n δ (i+1) mod n is
	smaller than φ 1 i θ i , for any i ∈ [1..n].

Table 2

 2 of a conformance algorithm for the ABR 2.5. Representing implicit induction proofs as cyclic proofs

	#	conjecture	reductive constraints IHs cycles
	1. firstat timeat	23	2
	2. firstat progat	24	2
	3. sorted sorted	5	0
	4. sorted insat1	37	2
	5. sorted insin2	45	2
	6. sorted e two	5	0
	7. member t insin	72	8
	8. member t insat	41	5
	9. member firstat	37	3
	10. timel insat t	10	1
	11. erl insin	11	1
	12. erl insat	10	1
	13. erl prog	38	2
	14. time progat er	20	1
	15. timeat tcrt	16	1
	16. timel timeat max	43	1
	17. null listat	17	2
	18. null listat1	3	0
	19. cons insat	4	1
	20. cons listat	3	0
	21. progat timel erl	48	1
	22. progat insat	156	4
	23. progat insat1	63	3
	24. timel listupto	7	0
	25. sorted listupto	49	3
	26. time listat	27	1
	27. sorted cons listat	62	2
	28. null wind2	7	0
	29. timel insin1	17	1
	30. null listupto1	3	0
	31. erl cons	11	0
	32. no time	35	2
	33. final	29	2
		Total	978	54	46

.1: Statistics of the induction reasoning w.r.t. the ABR implicit induction proofs.

  ". apply r1115 3. apply r1115 3. apply IHu.

	Qed.
	Theorem R1115 true: ∀ x u v, R1115 x u v.
	Proof.
	destruct x ; destruct v ; intros. apply r1115 1.
	apply r1115 3. apply R1115 mix.
	apply r1115 2. apply r1115 1.
	apply r1115 4; apply R1115 mix.
	Qed.

Table 3 .

 3 1: Statistics about the proofs by Peano induction of Rijkl true.

  Conclusions and related works . . . . . . . . . . . . . . . . . . . . . . . . 61

Sommaire 5.1 A primer on CertiCartes . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 5.2 Improvements of SPIKE . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5.2.1 At the specification language . . . . . . . . . . . . . . . . . . . . . . . . . 55 5.2.2 At the proof engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 5.3 Applications to JavaCard . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 5.3.1 CDO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 5.3.2 CDA and MON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 5.3.3 Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 5.4

  Ax spike (E ∪ {cond ∧ t ⇒ l}, H) if there exists a clause cond ⇒ p of R ∪ H c C ∪ E ≺cC s.t.every literal of cond is subsumed by cond

	Augmentation:	(E ∪ {cond ⇒ l
		Figure 5.3: New inference rules.

and C is the clause C rewritten with s → t, excepting the term s of s = t Congruence Closure: (E ∪ {. . . s = t . . . ∧ t = u ∧ . . . ⇒ l}, H) ---→ Ax spike (E ∪ {C }, H) where C ≡ . . . s = t . . . ∧ t = u ∧ . . . s = u ⇒ l C }, H) ---→

Table 5

 5 We see two directions of work for optimizing the usefulness of SPIKE in the context of the certification of the JavaCard Platform:

	specification : CONV
	sorts : list type_prim jcvm_state ...
	constructors :
	Nil: -> (list 'A ); Cons__: 'A (list 'A) -> (list 'A );...
	defined functions :
	CONV___ : type_prim type_prim jcvm_state -> returned_state;...
	axioms :
	% cONV :1
	stack_f (u1) = Nil =>
	cONV (u2, u3, u1) -> abortCode (State_error, u1) ;
	% cONV :2
	stack_f (u1) = Cons (e2, e3),
	extr_from_opstack (u4, opstack(e2)) = Inl (Pair (e5, e6))
	=> cONV (u4, u7, u1) -> update_frame
	(push_opstack (VPrim (tpz2vp (u7, t_convert (u4, u7, e5))), e6, e2),
	u1) ;
	% cONV :3
	stack_f (u1) = Cons (e2, e3),
	extr_from_opstack (u4, opstack (e2)) = Inr (e5)
	=> cONV (u4, u6, u1) -> abortCode (e5, u1) ;
	strategy : ...
	conjectures :
	state = Build_jcvm_state( sh, hp, Cons (h, lf)),
	res = cONV(n, z0, state) =>
	res = abortCode( Type_error, state),
	res = abortCode( Signature_error, state),
	rs2ors( res) = ocONV (n, z0, s2os(state));
	Figure 5.4: An excerpt of a SPIKE specification formalizing the instruction CONV.

• Automatic generation of intermediate lemmas: for a number of bytecodes, SPIKE requires users to provide intermediate results for establishing CDO, CDA and MON. Many of such lemmas are of a similar .1: Statistics for CDO proofs carried on a PC equipped with a 3.06 GHz Pentium processor and 512 Mbytes RAM.

  Certification of cyclic proofs for Coq formalisations using the functional programming style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 6.4 Automatic certification of SPIKE proofs . . . . . . . . . . . . . . . . . . 84 6.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

Sommaire 6.1 Formalising formula-based Noetherian induction proofs . . . . . . . . . 64 6.1.1 Formalising the induction ordering and measure values with COCCINELLE 64 6.1.2 Proving formulas from LF . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 6.2 Certifying implicit induction proofs . . . . . . . . . . . . . . . . . . . . . 67 6.2.1 Inference systems for implicit induction . . . . . . . . . . . . . . . . . . . 67 6.2.2 A first attempt to certify the proof of q(x, y) = true . . . . . . . . . . . . 68 6.2.3 Coq formalizations of implicit induction proofs . . . . . . . . . . . . . . . 69 6.2.4 Certification of implicit induction proofs for Coq formalisations using the functional programming style . . . . . . . . . . . . . . . . . . . . . . . . . 72 6.3 Certifying cyclic proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 6.3.1 Inference systems for cyclic induction . . . . . . . . . . . . . . . . . . . . . 74 6.3.2 Cyclic proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 6.3.3 Certification of cyclic proofs for Coq formalisations using the logic programming style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 6.3.4

  The logical framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 7.1.1 Checking the soundness of pre-proofs . . . . . . . . . . . . . . . . . . . . . 92 7.2 Defining the ordering-based checking criteria . . . . . . . . . . . . . . . 93 7.2.1 Normalising pre-proof trees . . . . . . . . . . . . . . . . . . . . . . . . . . 93 7.2.2 Building the digraph of a pre-proof tree-set . . . . . . . . . . . . . . . . . 95 7.2.3 Defining the ordering and derivability conditions . . . . . . . . . . . . . . 97 7.3 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 7.4 Converting cyclic to Noetherian induction reasoning . . . . . . . . . . 102 7.4.1 The Cyclist proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 7.4.2 The conversion procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 7.4.3 Experimental results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 7.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Motivation. CLKID ω

	7
	Cyclic Induction Reasoning for FOL
	with Inductive Definitions
	Sommaire
	7.1
	Other Reasoning
	Techniques

Table 7

 7

		15	22	32	2	14	1	9/10
	sy, sz)
	N 1 x ∧ N 2 y R(x, y)	266	484	48	4	35	5	149/170

.1: Statistics for proofs using Cyclist.

  Table 2.1 includes at most 8 induction hypotheses and 4 minimal cycles. The logical framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 8.1.1 Contextual cover sets (CCSs) . . . . . . . . . . . . . . . . . . . . . . . . . 108 8.1.2 The A 1 and A 2 inference systems . . . . . . . . . . . . . . . . . . . . . . . 109 8.1.3 Reasoning modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 8.1.4 Methodology for designing and analysing CCS-based inference systems . . 110 8.1.5 Case study: designing an implicit induction inference system . . . . . . . . 111 8.2 Analysing and extending saturation-based inference systems . . . . . 113 8.2.1 Case study 1: a paramodulation-based inference system . . . . . . . . . . 113 8.2.2 Case study 2: a resolution-based inference system . . . . . . . . . . . . . . 115 8.3 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

	8
	Saturation-based Reasoning
	Sommaire
	8.1

  As

  • • • As (∅, H n ) be a saturated A s -derivation such that ∈ H n and I H n S be a candidate model for H n S . Then, A s preserves in H n S any minimal counterexample from ∪ i E i . Moreover, if A s satisfies Property 2 then I H n S |= φ, for any ground instance φ of formulas from E 0 .

Table 8 .

 8 4: RP -rules instantiating the 1-Simplify-rule.

	RP -rule	RM Context Content Kind of CCS
	T.D.	T D	(∅, ∅)	empty
	F.S.	S	(E ∪ H, ∅)	empty
	B.S.(for E)	SS	(∅, E)	empty
	F. R.	SR	(E ∪ H, ∅)	strict

https://www.cs.utexas.edu/users/moore/publications/acl2-papers.html

e.g., https://tip-org.github.io/

https://coq.inria.fr/refman/practical-tools/coqide.html x

The full Coq script is available at https://drive.google.com/file/d/10HUmH4ywl1O1PSPjODH58zXwL6K_KBeL/ view?usp=sharing

The details of the Coq proof can also be accessed at https://drive.google.com/file/d/ 10HUmH4ywl1O1PSPjODH58zXwL6K_KBeL/view?usp=sharing

Such an ordering over equalities can be the multiset extension of the mpo based on the increasing precedence over the function symbols 0, S, and +.

w.r.t. some redundancy criteria.

However, these properties are required to refute conjectures.

More about the links between superposition calculus and induction reasoning can be found in Chapter 8.

The implicit induction and cyclic proof scripts and can also be accessed from http://code.google.com/p/ spike-prover/

The full Coq scripts of the proofs can be found at https://drive.google.com/file/d/19-8D4Cee8I4I_ 98RygwHYUtS-BbZrNMt/view?usp=sharing

More details about the definition of syntactic orderings in Coq is given in Chapter 6.

The square brackets are used for function and predicate applications instead of round brackets.

http://research.microsoft.com/en-us/um/people/sumitg/pubs/synthesis.html

T 1 and T 2 are replaced by F [L] and F [R], respectively.

To be added just after the specification section. More details about SPIKE are given in Chapter 4.

CLKID ω N consists of the rules contained by the LK system[Gentzen, 1935] and displayed in Figure7.1, the rules that process equalities from Figure7.2, as well as the 'unfold' and 'case' rules. (= L) is an instance of the more general CLKID ω version where x can also be a non-variable term.

Part II

Mechanising and Certifying Noetherian Induction Reasoning

Formalising formula-based Noetherian induction proofs

COCCINELLE mutually defines the rpo, denoted by rpo, and its multiset extension rpo mul, together with other inductive predicates:

Inductive rpo (bb : nat) : term → term → Prop := | Subterm : ∀ f l t s, mem equiv s l → rpo eq bb t s → rpo bb t (Term f l ) | Top gt : ∀ f g l l', prec g f → (∀ s', mem equiv s' l' → rpo bb s' (Term f l )) → rpo bb (Term g l' ) (Term f l ) | Top eq lex :

∀ f g l l', status f = Lex → status g = Lex → prec eq f g → (length l = length l' ∨ (length l' ≤ bb ∧ length l ≤ bb)) → rpo lex bb l' l → (∀ s', mem equiv s' l' → rpo bb s' (Term g l )) → rpo bb (Term f l' ) (Term g l ) | Top eq mul :

∀ f g l l', status f = Mul → status g = Mul → prec eq f g → rpo mul bb l' l → rpo bb (Term f l' ) (Term g l )

with rpo eq (bb : nat) : term → term → Prop := | Equiv : ∀ t t', equiv t t' → rpo eq bb t t' | Lt : ∀ s t, rpo bb s t → rpo eq bb s t

with rpo lex (bb : nat) : list term → list term → Prop := | List gt : ∀ s t l l', rpo bb s t → rpo lex bb (s :: l ) (t :: l' ) | List eq : ∀ s s' l l', equiv s s' → rpo lex bb l l' → rpo lex bb (s :: l ) (s' :: l' ) | List nil : ∀ s l, rpo lex bb nil (s :: l )

with rpo mul ( bb : nat) : list term → list term → Prop := | List mul : ∀ a lg ls lc l l', permut0 equiv l' (ls ++ lc) → permut0 equiv l (a :: lg ++ lc) → (∀ b, mem equiv b ls → ∃ a', mem equiv a' (a :: lg) ∧ rpo bb b a' ) → rpo mul bb l' l.

Both rpo and rpo mul take a natural argument bb representing the maximal number of arguments of a function and used for proving its termination. equiv (resp., permut0) is the inductive predicate that checks if two terms are equivalent (resp. two lists of terms are permutable). length (resp., mem) is the usual function computing the length of a list (resp., whether a term is member of a list of terms).

The definitions of the status, prec and prec eq functions are problem dependent. For the P&Q example, they (and other intermediary functions) are defined as:

Definition prec bool (x y:A) : bool := blt nat (index x ) (index y).

Definition prec (x y:A) := prec bool x y = true.

Definition prec eq (x y:A) : Prop := index x = index y.

The abstract COCCINELLE terms become concrete by defining the inductive set for function symbols (symbol), denoted above by symb. The precedence prec defined over symb is based on a (index) function that associates a natural value to each function symbol. Two symbols are equivalent if and only if they have the same indexes. The well-foundedness property of prec can now be formalised as:

(R.(7.9)) N y R(0, y) (R.(7.9)) R(0, 0) where the inductive predicate R is defined, as in [Brotherston et al., 2012], by the productions ⇒ R(0, y) (7.9) R(x, 0) ⇒ R(sx, 0) (7.10) R(ssx, y) ⇒ R(sx, sy) (7.11)

For lack of horizontal space, we have unambiguously omitted the parentheses and commas when denoting some natural and atom N (t), i.e., s(t) (resp., N (t)) becomes st (resp., N t), where t is the notation of t without parentheses. This alternative notation will be used in the following, when necessary.

The double line means that (= L) was applied on each premise of (Case). The (Cut) premise N x N ssx is suppressed on the right-hand branch as in Example 6 of [Brotherston et al., 2012]. The principal formula for each (Case) application is underlined. Finally, the induction function R is defined such that the companion of the bud denoted by ( * 1) (resp., ( †1)) is ( * ) (resp., ( †)).

Semantics. The semantics for FOL ID with equality is defined as in [Brotherston and Simpson, 2011]. Prefixed points of a monotone operator issued from Φ [Aczel, 1977] help to interpret inductive predicates. A standard model for (Σ, Φ) is a first-order structure defined by the least prefixed point, approached by an iteratively built approximant sequence.

Definition 6 (validity of a sequent) Let M be a standard model for (Σ, Φ), Γ ∆ a sequent and ρ a valuation which interprets in M the free variables from the sequent. We write Γ |= M ρ ∆ if whenever G holds in M using ρ, for all G ∈ Γ, there is some D ∈ ∆ that holds in M using ρ. We say that Γ ∆ is M -true if Γ |= M ρ ∆, for every ρ. When M is implicit from the context, true is used instead of M -true.

A rule is sound, or preserves the validity, if its conclusion is true whenever its premises are true. Hence, the conclusion of every 0-premise sound rule is true.

Theorem 18 The CLKID ω N inference rules are sound.

Proof CLKID ω N is an instance of CLKID ω which has been shown sound in [Brotherston and Simpson, 2011].

Definition 7 (sound pre-proof tree) A pre-proof tree of a sequent S is sound if S is true.

Checking the soundness of pre-proofs

Not every pre-proof tree is sound. A very simple example of unsound pre-proof tree can be built for every false sequent S by firstly adding a copy of some antecedent formula using (contrL) then deleting it using (W k). Since the resulting sequent is identical to S, its node is a bud. This finishes the pre-proof tree.

Before presenting the global trace condition, which is a sufficient condition to ensure the soundness of CLKID ω N proofs, we introduce some preliminary definitions. We denote by S(N ) the sequent labelling any node N . A path is a list [N 0 , N 1 , . . .] of nodes in a pre-proof tree such that, for all i ≥ 0, S(N i+1 ) is either one of the premises of the rule applied on S(N i ) if N i is not a terminal node, or S(R(N i )) if N i is a bud. Definition 8 (Trace, Progress point [Stratulat, 2017a]) Let (D, R) be a CLKID ω N pre-proof tree and let [N 0 , N 1 , . . .] be one of its infinite paths and denoted by l. A trace following l is a sequence (τ i ) i≥0 of inductive antecedent atoms (IAAs) such that, for all i, we have that N i is labelled by Γ i ∆ i and:

1. τ i is some P ji (t i ) ∈ Γ i ; 2. if Γ i ∆ i is the conclusion of (Subst) then τ i = τ i+1 [θ], where θ is the substitution used by the LK's (Subst) rule defined as:

3. if Γ i ∆ i is the conclusion of (= L) having t = u as principal formula, there is a formula F such that τ i = F and τ i+1 = F [{t → u}];

4. if Γ i ∆ i is the conclusion of a (Case) rule then either a) τ i+1 = τ i , if τ i is not the principal formula of the rule instance, or b) τ i is the principal formula and τ i+1 is a case descendant of τ i . In the latter case, i is said to be a progress point of the trace; 5. if Γ i ∆ i is the conclusion of any other rule then τ i+1 = τ i .

Remark 1 Non-equality relations between (instances of ) τ i and τ i+1 in the above definition are possible only when i is a progress point.

Remark 2 Condition 3 is an abbreviated form of the case dealing with (= L) in Definition 5.4 from [Brotherston and Simpson, 2011], by applying the discussed restrictions to (= L), i.e., if Γ i ∆ i is the conclusion of (= L), of the form Γ[{x → t; y → u}], t = u ∆[{x → t; y → u}] and having t = u as principal formula, there is a formula F such that

An infinitely progressing trace is a trace with infinitely many progress points. In [Brotherston and Simpson, 2011], it has been shown that a pre-proof tree D is sound if it satisfies the global trace condition, i.e., for every infinite path p in D, there is an infinitely progressing trace following some tail of p.

In the next section, we introduce an approach similar to that used for building Noetherian (wellfounded) induction-based proofs [Stratulat, 2012] to check the global trace condition.

Defining the ordering-based checking criteria

We define ordering and derivability conditions to be satisfied by the digraph representing some normal form of the pre-proof. The normalisation procedure transforms the pre-proof into a set of pre-proof trees, for short pre-proof tree-sets, such that the root of the pre-proof is among the roots of the trees from the normal form. If the sequent labelling the root of the pre-proof is false, one can build an infinite path in the digraph, whose nodes are labelled by false sequents and for which there is an infinite progressing trace following some tail of it.

Normalising pre-proof trees

The normalisation process consists in the exhaustive application of the following three operations.

The first operation applies on an internal node labelled by some premise of (Subst), of the form . . .

The result is displayed in Figure 7.3. The internal node is duplicated and the subtree derivation rooted by it is detached to become a new tree derivation. At the end, we get two distinct pre-proof trees. The two occurrences of the duplicated node establish a new bud-companion relation.

Figure 7.3: The result of the first operation.

The second operation applies on a non-root companion which is duplicated and the subtree derivation rooted by it becomes a new pre-proof tree. The result is displayed in Figure 7.4. The sequent labelling the copy of the companion ( * ) becomes the conclusion of a new (Subst) rule. The substitution used by the new (Subst) rule is chosen such that its premise labels a new bud node labelled by the same sequent as the conclusion, e.g., the empty substitution. The new bud node will have (*) assigned as companion.

Figure 7.4: The result of the second operation.

The last operation applies on a bud node labelled by some sequent that is the premise of a rule r different from (Subst) such that

Let ( * ) denote the companion of the bud node. A new application of (Subst) with the empty substitution was performed on the bud sequent such that the node labelled by its premise becomes the new bud node whose companion is ( * ).

Compared with a similar 2-operation normalisation procedure presented in [Stratulat, 2017a], only the first operation is shared by the two procedures. The other operation of the procedure from [Stratulat, 2017a] applies on non-root companions but does not include the (Subst)-step from Figure 7.4. There is no equivalent for the third operation.

The following properties, related to the normalisation process and the resulting normal form as given by Lemmas 7 and 8, are satisfied.

Lemma 7 (termination) The normalisation process terminates.

Proof The number of nodes that can be processed by the three operations is finite, for every pre-proof tree. In addition, it decrements after applying each operation.

The induction function is extended to allow new bud-companion relations between nodes from different pre-proof trees.

Definition 9 (rb-path, IH-node) An rb-path is a path of the form [R, . . . , H, B] that leads the root R to a bud B in some pre-proof tree of a pre-proof tree-set such that B is the only bud in the path. We will call H an inductive hypothesis node (for short, IH-node).

A path in a pre-proof tree-set (MD, MR) is a list [N 0 , N 1 , . . .] of nodes in MD such that, for all i ≥ 0, S(N i+1 ) is one of the premises of the rule applied on S(N

Lemma 8 The normalisation of any pre-proof (D, R) of a sequent S builds a pre-proof tree-set (MD, MR) for which 1. all companions are root nodes, 2. there is a pre-proof tree rooted by a node labelled by S, and 3. each of its rb-paths [R, . . . , B] has B as the only node that is labelled by the premise of a (Subst) rule. A node is a (Subst)-node if and only if it is an (IH)-node.

Proof Claim 1) follows from the exhaustive application of the second operation.

Claim 2) holds because the first operation duplicates only non-root nodes and the third operation expands bud nodes, so the root nodes do not change. If S labels the root node of a pre-proof tree t having a non-root companion n, t will be processed by the second operation applied on n but will still have its root labelled by S.

Claim 3) holds by the construction of the normal forms.

Example 24 The second operation can be applied on the non-root companion from Example 23, denoted by ( * ), to give the following normalised pre-proof tree-set:

Building the digraph of a pre-proof tree-set

Any pre-proof tree-set can also be represented as a digraph of sequents built from the nodes of its treeset. The digraph associated to a pre-proof tree-set (MD, MR) is crucial in our setting to check whether (MD, MR) is a proof tree-set. Its edges are arrows built as follows:

• a forward arrow leads a node N 1 to a node N 2 if there is a rule that was applied on the sequent labelling N 1 and the sequent labelling N 2 is a premise of the rule;

• a back-link (or backward arrow) starts from a bud and ends to its companion. Some arrows will be annotated by substitutions. Each forward arrow, starting from a (= L)-node whose principal formula is x = u, is annotated by the equality substitution {x → u}. The forward arrow starting from a node N that is different from (= L)-and (Subst)-nodes is annotated with the identity substitution for S(N ), which maps the free variables from S(N ) to themselves. Finally, the forward arrows starting from (Subst)-nodes and the back-links are not annotated. They help to build infinite paths but do not play any role when defining the soundness constraints.

By abuse of notation, a path in a digraph is a (potentially infinite) list of nodes built by following the arrows in the digraph. An rb-path is any path leading a root to some bud node and does not have other bud nodes. Unless otherwise stated, we will consider only rb-paths in the digraphs associated to normalised pre-proof tree-sets.

Remark 3 According to Lemma 8, the bud node B of any such rb-path is the only node in the rb-path for which S(B) is the premise of a (Subst) rule.

Definition 10 (cumulative substitution) An rb-path [N 1 , . . . , N n , B] (n > 0) can be annotated by the cumulative substitution σ all id σ 1 • • • σ n-1 , where σ i is the substitution annotating the forward arrow leading N i to N i+1 , for each i ∈ [1..n -1], and σ all id is the overall identity substitution

A list of sequents [S 1 , . . . , S n ] (n > 0) is admissible if either i) it is a singleton (n = 1), or ii) for every i ∈ [2..n], S i is the premise of some rule whose conclusion is S i-1 . By construction, the list of sequents labelling the nodes from every path from the digraph associated to a pre-proof tree-set is admissible.

Lemma 9 Let [N 1 , . . . , N n-1 , N n , B] be an rb-path.

We define its cumulative list l c as

Then, the following properties hold:

1. l c is admissible, and 2. the rule applied on each S(N i ) is also applicable on

If the rule is (= L), the (= L)-step can be replaced by a (W k)-step, where the LK's (W k) rule is defined as

. By induction hypothesis, we assume that

) is the cumulative substitution annotating [N i , . . . , N n-1 ] and the rules applied on S(N i )[θ c (i,n-1) ] and S(N i ) are the same. We denote by θ c (n-1,n-1) the identity substitution for S(N n-1 ). Let θ c (i,n) be the cumulative substitution annotating [N i , . . . , N n-1 , N n ], for all i ∈ [1..n -1]. Let also θ be the substitution annotating the forward arrow leading N n-1 to N n , which can be either an identity substitution, or an equality substitution. In the first case, for every

) is the LK's rule (∀R) or (∃L), defined below:

and x is the vector of new free variables introduced by these rules, or ii)

] by induction hypothesis, we can apply the same rules on S(N

] is also admissible since S(B) is the premise of a (Subst) rule whose conclusion is S(N n ), by property 2) from Lemma 8.

For the second case, θ is an equality substitution. We have that θ c (i,n) equals θ c (i,n-1) θ, for all i ∈ [1..n -1]. Since the rule applied on a sequent can also be applied on every instance of it, we have that

Notice that the (= L) rule has S(N n ) as premise when applied on

Then, θ is {x → u}. On the one hand, (= L) cannot be applied on S(N n-1 )[θ c

(n-1,n) θ], whose principal formula is u = u, when u is a non-variable term. On the other hand, the generalised form of (= L) from CLKID ω , defined in [Brotherston and Simpson, 2011] as

and ii) l is the unique literal from A S(N j )[δ] that derives from l using some trace following p.

Then, S(N j )[δ] is < π -derivable from S(N i )[θ] along p if for each l ∈ A S(N j )[δ] there exists l ∈ A S(N i ) [θ] such that l > a l and l derives from l using some trace following p.

By the definition of < π as a multiset extension of < a , the following results can be proved when considering some path in π.

Proof By the definition of the ordering constraint in the < π -derivability relation.

Lemma 11 The '< π -derivability' relation is stable under substitutions and transitive.

Proof Let S and S be two sequents such that S is < π -derivable from S along some path p in π. By Lemma 10, A S > π A S . Since < π is stable under substitutions, we have that A S [σ] > π A S[σ] , for every substitution σ. According to Definition 11, the derivability relations between their IAAs do not change by instantiation operations. Therefore, S[σ] is < π -derivable from S [σ] along p. We conclude that the '< π -derivability' relation is stable under substitutions.

To prove the transitivity property, let us assume three sequents S 1 , S 2 and S 3 labelling nodes in a path p built by the concatenation of two paths p 1 and p 2 such that S 3 is < π -derivable from S 2 along p 2 and S 2 is < π -derivable from S 1 along p 1 . We will try to prove that S 3 is < π -derivable from S 1 along p.

Since S 3 is < π -derivable from S 2 along p 2 , by Definition 11 we have that (i1) for each l 3 ∈ A S3 there exists l 2 ∈ A S2 such that l 2 > a l 3 and l 3 derives from l 2 using some trace following p 2 , and (ii1) for each l 3 ∈ A S3 \A S3 , there is some l 2 ∈ A S2 \A S2 such that l 3 ≡ l 2 and l 3 is the unique IAA that derives from l 2 using some trace following p 2 , where A S3 (resp., A S2 ) is the multiset resulting from A S3 (resp., A S2 ) after the pairwise deletion of all common IAAs from A S3 and A S2 . Also, since S 2 is < π -derivable from S 1 along p 1 , we have that (i2) for each l 2 ∈ A S2 , there exists l 1 ∈ A S1 such that l 1 > a l 2 and l 2 derives from l 1 using some trace following p 1 , and (ii2) for each l 2 ∈ A S2 \A S2 , there is some l 1 ∈ A S1 \A S1 such that l 2 ≡ l 1 and l 2 is the unique IAA that derives from l 1 using some trace following p 1 , where A S2 (resp., A S1 ) is the multiset resulting from A S2 (resp., A S1 ) after the pairwise deletion of all common IAAs from A S2 and A S1 . We have to check that for each l 3 ∈ A S3 , there exists l 1 ∈ A S1 such that l 1 > a l 3 and l 3 derives from l 1 using some trace following p, where A S3 (resp., A S1 ) is the multiset resulting from A S3 (resp., A S1 ) after the pairwise deletion of all common IAAs from A S3 and A S1 . Moreover, for each l 3 ∈ A S3 \A S3 , there is some l 1 ∈ A S1 \A S1 such that l 3 ≡ l 1 and l 3 is the unique IAA that derives from l 1 using some trace following p. We consider the following cases:

1. If l 3 ∈ A S3 there exists l 2 ∈ A S2 such that l 2 > a l 3 and l 3 derives from l 2 using some trace t 2 following p 2 .

(a) If l 2 ∈ A S2 there exists l 1 ∈ A S1 such that l 1 > a l 2 and l 2 derives from l 1 by using some trace t 1 following p 1 . Then l 1 > a l 3 by the transitivity of < a , so l 1 ∈ A S1 , l 3 ∈ A S3 and l 3 derives from l 1 using the concatenation of t 1 and t 2 following p.

(b) If l 2 ∈ A S2 \A S2 , there is l 1 ∈ A S1 \A S1 such that l 2 ≡ l 1 and l 2 is the unique IAA that derives from l 1 by using some trace t 1 following p 1 . Since l 1 (≡ l 2 ) > a l 3 , we have that l 1 ∈ A S1 , l 3 ∈ A S3 and l 3 derives from l 1 using the concatenation of t 1 and t 2 following p.

2. If l 3 ∈ A S3 \A S3 there exists l 2 ∈ A S2 such that l 3 ≡ l 2 and l 3 is the unique IAA that derives from l 2 using some trace t 2 following p 2 .

(a) If l 2 ∈ A S2 there exists l 1 ∈ A S1 such that l 1 > a l 2 and l 2 derives from l 1 by using some trace t 1 following p 1 . Then, l 1 > a (l 2 ≡)l 3 , so l 1 ∈ A S1 , l 3 ∈ A S3 and l 3 derives from l 1 using the concatenation of t 1 and t 2 following p.

(b) If l 2 ∈ A S2 \A S2 there exists l 1 ∈ A S1 such that l 1 ≡ l 2 and l 2 is the unique IAA that derives from l 1 by using some trace t 1 following p 1 . This means that l

with l 1 ≡ (l 2 ≡)l 3 and l 3 derives from l 1 using the concatenation of t 1 and t 2 following p. In addition, l 3 is the unique IAA in A S3 that derives from l 1 .

The soundness criterion consists in checking if the sequents labelling (IH)-nodes from every nonsingleton SCC, referred to as induction hypotheses, satisfy some constraints.

Definition 12 (induction hypothesis (IH), IH discharged by a SCC) Let π be a non-singleton SCC and [R, . . . , H, B] an rb-path p in π. We say that the induction hypothesis

where θ c is the cumulative substitution annotating p.

Theorem 19 (soundness) The sequents, labelling the roots from every normalised pre-proof tree-set whose non-singleton SCCs discharge their IHs, are true.

Proof Let M be a standard model for (Σ, Φ) and assume a normalised pre-proof tree-set. Let also P denote its digraph whose non-singleton SCCs discharge their IHs. By contradiction, we assume that there exists a root node N such that S(N ) is false. We define a partial (well-founded) ordering < R over the (finite number of) root nodes from P such that, for every two distinct root nodes N 1 and N 2 , we have N 1 < R N 2 if i) N 1 and N 2 are not in the same SCC, and ii) N 1 can be joined from N 2 in P.

By induction on < R , we consider the base case when N is a < R -minimal node. (The step case, when N is not a < R -minimal node, will not be detailed since it can be treated similarly by assuming that all < R -smaller root nodes are labelled by true sequents.) If N is included in a one-node SCC, N is also a leaf node. The only 0-premise rules are the LK's (Ax) rule as well as (R.) when unfolding with unconditional axioms. In both cases, S(N ) is true which leads to a contradiction.

Let us now assume that N is a < R -minimal node from some non-singleton SCC π. We will analyse all possible scenarios and show that each of them leads to a contradiction. The tree t from P and rooted by N should have buds labelled by false sequents, otherwise S(N ) would be true. Let B be such a bud such that N h is its companion and [N, . . . , H, B] is an rb-path in π. N h should be a root node from π because N is < R -minimal; it is labelled by the false sequent S(B). Since the CLKID ω N rules are sound, by Lemma 9, we conclude that the cumulative instance S(N )[θ c ] is false, where θ c is the cumulative substitution for [N, . . . , H, B]. π discharges its IHs, so we have that

where δ h is the substitution used by the (Subst)-step whose conclusion is S(H). By Lemma 10, we have that

We perform a similar reasoning on N h as for N . There is an rb-path

where θ c 1 is the cumulative substitution annotating [N h , . . . , H , N f ]. By contradiction, we assume that no false instance of S(N h )[δ h ] is shared. Then, one can build a finite bud-free pre-proof tree of S(N h )[δ h ], by using only sound rules. Hence, S(N h )[δ h ] is true, so contradiction. Therefore, there are two substitutions and τ such that

, by the 'stability under substitutions' property of < π . Hence, We recall that, due to the bud-companion relations, the Cyclist pre-proof trees can be represented as graphs that may have non-singleton SCCs, hence allowing for building infinite paths along their cycles. The checking procedure can normalize any Cyclist pre-proof tree T , having only (L.U nf.)-steps that instantiate variables along the cycles, into a forest of connected cyclic pre-proof trees for which i) all companions are root nodes, ii) the root of T is among the root nodes, and iii) every rb-path p, also denoted by r → b when the root r leads to the bud b, ends with a (Subst)-step which is also the unique (Subst)-step in p.

For the P&Q example, the result of the normalisation operation generates two trees, where the node 4 is duplicated twice. Once, to separate from the main tree the subtree rooted by it, followed by the creation of a new bud-companion relation between the nodes 4 and 4 . The other time, to perform a stuttering step, by applying a (Subst)-step with the identity substitution. Below is listed the result of the normalisation step, where only the rb-paths are displayed:

. . . It can be noticed that every infinite path in the Cyclist pre-proof are also reproduced in its normal form, by duplicating the node 4, and viceversa, by deleting some of its occurrences.

The next step is to associate to each root r a measure value in terms of a multiset of inductive atoms occurring in the antecedent part of the sequent labelling r such that some derivability and ordering constraints are satisfied. The derivability constraints consist in checking that, given an rb-path p, some IAA of the sequent labelling its bud can be derived from some IAA of the sequent labelling its root, by following a trace along p. For our example, we list all traces along the rb-path and• 4 → 17: [ and[N 1 x, N 1 x, N 4 sy, N 4 sy, N 5 sy, N 5 sy, N 3 sy, N 3 sz](=).

Each trace [A r , ...., A b ] following any of the above rb-paths was annotated by > if it has at least one progress point, i.e., a step where an IAA changes due to an unfolding occurring inside the application of (L.U nf.), fact also denoted by A r > A b . Otherwise, it is annotated by = and say that A r and A b are equal. An infinitely progressing trace has infinite progress points.

The global trace condition requires that, for any infinite path p, there is an infinitely progressing trace starting from some point of p. This condition is ensured if for each rb-path r → b of p, we have The conversion procedure was implemented in E-Cyclist. For our example, the heuristics proposed the measure value {N 1 x, N 1 x, N 2 y, N 2 y} for the node 0 and {N 1 x, N 1 x, N 2 z, N 2 z, N 3 sz} for the node 4. The derivability and ordering constraints hold for each rb-path, as follows:

The measure values built for the roots help also to compare the roots using well-founded orderings. Given a well-founded ordering < wf over the IAAs and < wf mul its multiset extension, we say that an rb-path

where δ is the substitution used in the Subst-step of r → b and θ is the cumulative substitution for r → b, i.e., the composition of all substitutions instantiating IAAs along r → b. In the Noetherian induction setting, M (c(b))[δ] plays the role of induction hypothesis and M (r)[θ] that of the induction conclusion. We recall that σ id denotes the identity substitution.

Showing that every rb-path is valid is enough to conclude that a pre-proof is a Noetherian induction proof. For our example, the ordering constraints checking the validity of the rb-paths are:

and

where the indexes for the inductive predicates are omitted.

The ordering constraints are satisfied if < wf is a mpo built from any precedence over the symbols {N, s, 0}. In practice, one can consider that all the inductive predicate symbols are equivalent, hence the measure values for the roots are multisets built only from their arguments. For our example, the measure value for the root 0 would be {x, x, y, y} and {x, x, z, z, sz} for the root 4.

Experimental results

We report that the proofs for all these conjectures have been successfully converted to Noetherian induction proofs. Some statistics about the Noetherian induction proofs, as the number of SCCs, the root sequents and their measure values, are given in Table 7.2:

• D. Its generation function is g D (t = t, (∅, ∅)) = ∅ and returns an empty CCS.

• R, with g R (e, (C 1 , C 2 )) = {e }, where e Ax∪C 1 ≤e ∪C 2 <e e . It builds a strict CCS.

• Ex, with g Ex (e[x] p , (∅, ∅)) = {eσ , eσ } that generates a cover set. σ (resp. σ ) is the substitution that replaces x by 0 (resp. S(x ) and x is a fresh variable).

Delete identity

Figure 8.3: The inference system P.

Inference Rules Our inference system P, similar to the inference system I b s from Subsection 6.2.1, will contain the inference rules from Figure 8.3. For example, given the set of orientable axioms that define the addition over the naturals, 0 + x → x and S(x) + y → S(x + y), P can prove x + 0 = x: where by P D (resp. P R and P Ex ) is denoted the application of Delete identity (resp. Rewrite and Expand). The rewrite operations transform the underlined subterms with rewrite rules from the axioms, excepting the last operation that uses the instance S(x ) + 0 → S(x ) from the premises. Instantiation Result P is and instance of A 1 , as shown in Table 8.2.

Table 8.2: P-rules as instances of A 1 -rules.

Each column presents respectively for each P-rule the instantiated A 1 -rule, together with the name of the reasoning module, the context and kind of the generated CCS. It is easy to observe from Table 8.1 and Figure 8.1 that the generated CCSs are compatible with and the contexts are included in the contexts of the corresponding A 1 -rules. Therefore, P is sound and Ax |= x + 0 = x can be concluded.

Simpler proofs of x+0 = x can be obtained from instances of two-step A 2 -rules, like ExpandRewrite in Figure 8.4. As an instance of 2-AddPremise, it allows the addition of x + 0 = x to the set of premises directly from the first step of the proof for a later use as induction hypothesis in the subsequent Rewrite operations.

Superposition Right

G-Variant

G is not adapted for the automated reasoning on long derivations. The time required to apply any of the superposition rules is directly proportional to the size of the current set of conjectures E. Or, this size increases with every inference step and therefore reduces the prover's performances. We propose a G-variant, denoted by G , that reduces considerably the size of E at the expense of less powerful rules by applying our methodology using universal CCSs. A -representation Firstly, an empty set of premises is appended to any G state and the processed conjecture is no longer added to the new set of conjectures. Reasoning Modules The new set of conjectures generated by any G -rule is a strict CCS of the processed conjecture built by one of the following reasoning modules:

1. SR, used by the Superposition Right-variant, has the generation function, g SR , defined as 3. ER is used by Equality Reasoning-variant and has g ER ((Γ, s = s ⇒ ∆), (∅, ∅)) = {Γ ⇒ ∆} that generates a strict CCS because s is maximal and

Instantiation Result Any G -rule is an instance of the 1-Simplify rule of A , as shown in G -Variants In our setting, the ordering c is not required to be total. Such non-total (partial) orderings can be built, for example, by generalising < e from equalities to conditional clauses. Representing

r m as the multiset {s 1 , t 1 , . . . , s n , t n , l 1 , r 1 , . . . , l m , r m } allows for the generation of smaller or equal clauses if: i) non-maximal terms of the processed conjecture are

Tautology Deletion (T.D.):

Forward Subsumption (F.S.):

Backward Subsumption (B.S.):

-for E:

Forward Reduction (F.R.): Forward Reduction builds a strict CCS in the context (H, E), it can send the processed clause directly to H, without performing Inference Computation. Notice that the original RP may obtain the same result by firstly applying Inference Computation followed by Backward Reduction, which is less efficient due to the exhaustive application of O S rules and to the addition of the resulted formulas to the set of conjectures. Translated back to RP , such a rule can be

Conclusions

The presented work has both applicative and theoretical interests. We have proposed a framework and a methodology to design and analyse inference systems implementing the formula-based Noetherian induction principle. A stronger connection between two important fields of the automated deduction, the implicit induction and saturation-based theorem proving, is established. Their logic is captured by an abstract inference system: to witness, the inference systems from the given examples have been shown to be instantiations of it. The orderings over formulas need only to be Noetherian and stable under substitutions to satisfy the soundness property, as can be observed from the proof of Theorem 20. Thanks to the clear separation between the logic and computation provided by the framework, it can be Future Works Let P a be an admissible inductive predicate, recursively defined by a set of axioms that can be either unconditional (of the form of P a (t)) or conditional (of the form ∧ l m=1 P a (t m ) ⇒ P a (t), for some natural l > 0). Based on the (Adm) rule, the derived rule (Ind a )

where F (x) is the IH formula associated to P a for the (Ind) step.

Definition 15 (LKID a , LKID a proof ) LKID a is the particular instance of LKID i) for which the (Ind) rule is replaced by the (Ind a ) rule, and ii) extended with the (Adm) rule. A finite LKID a -derivation tree is a proof if all branches end in a 0-premise rule.

Theorem 25 (soundness of LKID a ) Every sequent Γ ∆ is true if there is an LKID a proof of Γ ∆.

Proof LKID a is a particular version of the sound LKID inference system, that was extended with the sound (Adm) rule.

We will show how to convert CLKID ω N pre-proofs to LKID a proofs. The conversion procedure takes as input i) a CLKID ω N pre-proof tree-set in normal form, and ii) one of its root sequents S. It outputs a sequence of LKID a proofs ending with an LKID a proof of S.

C.1.2 Overview of the procedure

The input pre-proof tree-set (MD, MR) can be seen as a digraph P, as in Subsection 7.2.2. As example, we will consider the pre-proof tree-set corresponding to the digraph from Example 4 concerning the P&Q example.

Example 29 Let us introduce the inductive definitions of P and Q from the P&Q example:

A pre-proof tree-set, rooted by the sequents N x P x and N x, N y Qxy, is illustrated in Figure C.9. For convenience, the sequents are indexed. The node labelled by the sequent Γ i ∆ is denoted as N i .

We denote by S(N ) the sequent labeling any node N from MD. We define a partial order ≤ R over the set of root nodes of MD, as follows: for any two distinct nodes N 1 and N 2 , we have N 1 < R N 2 if N 1 and N 2 are not in the same SCC and N 1 can be reached from N 2 . We have N 1 = R N 2 if both N 1 and N 2 are in the same SCC. The conversion procedure visits each root from MD increasingly, by using as precedence the partial order ≤ R . Let N r be some root. The explicit proof for S(N r ) is recursively built, as follows:

1. let us assume that N r is the only node of a singleton SCC. If N r is a node labeled by a 0-premise rule, the output is the LKID a proof consisting of S(N r ) to which the 0-premise rule is applied. If N r is a bud, let N c be its companion. Since N c is different from N r , it is < R -smaller than N r . By induction hypothesis, its LKID a proof is already built at this stage. The output is the LKID a proof generated in each of the cases.

2. let us now assume that N r is a root node from a non-singleton SCC π. Then, (a) define an explicit induction schema to be applied on the conjunction sequent representing the sequent having an empty antecedent part and the conjunction of the implication formulas of the root sequents from π as the only formula from the succedent part; (b) build the explicit induction proof of the conjunction sequent, starting by applying the induction schema from step (a), then proving each induction case (IC) by following proof steps from π.

The sequents labelling the buds with < R -smaller companions can be proved using the proofs of the companions; (c) prove S(N r ) from the proof of the conjunction sequent.

The conversion procedure outputs the LKID a proofs for each sequent labelling < R -greatest root nodes or for the conjunction sequent of their non-singleton SCC, if case 2 applies. Next, we detail the operations executed at case 2.

C.1.3 Generating the explicit induction schema

Let us assume that the SCC with cycles π has k (> 0) roots N i1 , . . . , N i k , where i 1 , . . . , i k ∈ [1..k] is a permutation of the values from [1..k]. F π (t) denotes the conjunction formula k j=1 C(S(N ij )) associated to π. Its conjuncts do not share free variables (otherwise, the free variables are conveniently renamed),

and n i1 , . . . , n i k ∈ N * . The explicit induction step consists in the application of the (Ind a P π ) rule on the conjunction sequent F π (t), given that P π (t) is an admissible inductive atom and P π is a new inductive predicate symbol associated to π. The axioms defining P π are built from the analysis of the tree derivations rooted by N i1 , . . . , N i k . Each axiom corresponds to some (IC) of the induction schema built from the composition of individual induction schemas defined for each root sequent S(N ij ) (j ∈ [1..k]). This step is detailed in the following.

Building the individual induction schemas

An induction schema for a root sequent S is a collection of induction cases (ICs) that attach a (potentially empty) set of sequents, called induction hypotheses (IH), to an instance of S, called induction conclusion. The instantiating substitutions are denoted as cumulative substitutions consisting of the composition of substitutions used in the (Gen)-steps encountered when traversing a given path, as explained in Subsection 7.2.2.

Example 30

The cumulative substitutions for the paths leading a root to a terminal node in the pre-proof tree-set from Figure C.9 are:

• {x → 0} for the path [N 10 , N 11 , N 12 , N 13 ], and

• the substitution {x → sz; z → z} for the paths [N 10 , N 11 , N 14 , N 15 , N 16 , N 17 ] and [N 10 , N 11 , N 14 , N 15 , N 18 , N 19 ].

Definition 16 (individual induction schema) Let N r be some root from π. The individual induction schema for S(N r ) is built from a set of ICs. A new IC with the induction conclusion S(N r )[θ] is generated for each path p leading N r to a terminal node N t of the tree derivation rooted by N r , where θ is the cumulative substitution for p. When N t is a bud whose companion N h is from π, the explicit induction hypothesis S(N h )[δ] is attached to the induction conclusion S(N r )[θ], where δ is either i) the substitution underlying some (Subst) rule having S(N t ) as premise, if any, or ii) σ

is the premise of a rule other than (Subst).

As shown in Example 30, different paths may have attached the same cumulative substitution. Hence, an induction conclusion may have attached several explicit IHs.

Example 31 (cont. Example 30) By using the previously computed cumulative substitutions, the ICs of the individual induction schema for • N x P x are: i) N 0 P 0, and ii) N sz P sz with the attached explicit IHs N z P z and N z, N sz Qzsz;

• N x, N y Qxy are: i) N x, N 0 Qx0, and ii) N x, N sz Qxsz with the attached explicit IHs N x P x and N z, N x Qxz.

Generating the axioms for P π P π is a single recursive inductive predicate defined by the smallest set of conditional axioms of the form

and unconditional axioms of the form P π (t i1 , . . . , t i k ), where the size of

For each of its attached explicit IHs, there is a premise of (C.7) defined as follows. If the explicit IH is the sequent S(N ir )[δ] (r ∈ [1..k]), the premise is the induction conclusion of (C.7) for which the rth (sub)vector of its arguments is replaced by

). The premises of an axiom having replaced distinct (sub)vectors may be factorized in one premise, which can lead to different definitions for P π . For example, if two premises replace respectively the uth and vth subvector, with u, v ∈ [1..k] and u < v, they can be factorized to give the premise P π (t i1 , . . . , t iu-1 , s iu , t iu+1 , . . . , t iv-1 , s iv , t iv+1 , . . . , t i k ).

Example 32 (cont. Example 31) P π can be defined by the axioms

issued from the individual induction schemas for N x P x and N x, N y Qxy, by factorising the premises. For example, the premise of the axiom (C.10) was factorised from the premises P π (z, x, 0) and P π (s(z), z, s(z)). Another definition of P π can be given with a different factorisation of the premises for (C.11) when (C.11) is replaced by P π (x, z, s(z)) ∧ P π (z, x, z ) ⇒ P π (s(z), x, s(z )).

N t : leaf (one of the three scenarios from above are executed, depending on the nature of N t ) . . . (applying successively the rules from the nodes of p, according to Lemma 9) . . .

(a) Proving an individual IC built by following the path p leading Nr to some terminal node Nt.

The new subgoals after applying (Inda Pπ), (∧L), (∧R) and (W k) on the conjunction sequent.

. . . . . . . . . . . . . . . . . . .

C.1.4 Generating the explicit induction proof

The explicit induction proof of the conjunction sequent starts by a unique explicit induction step using (Ind a P π ). Each IC generates a new conjecture whose proof script can be directly issued by following the paths used to build the individual ICs producing the IC. This is mainly due to Lemma 9.

Applying the (Ind a ) rule on the conjunction sequent

The scenario for applying (Ind a P π ) on the conjunction sequent is given in Figure C.10b, under the assumption that P π is admissible. The double line denotes a sequence of rule applications following (Ind a P π ) that transform each premise of (Ind a P π ) into the individual ICs that helped to built it. It firstly deletes the conjunction symbols from the antecedent part using successive applications of (∧L) rules, then the conjunction symbols from the succedent part using the (∧R) rule. The antecedent formulas from each new sequent, that are not among the explicit IHs attached to the induction conclusion from the succedent, are finally deleted by the

Example 33 (cont. Example 32) Let us assume that N is admissible. We can simplify the LKID a proof by considering the weaker versions of C(N u P u) (resp., C(N x, N y Qxy)) as P u, for any term u (resp., Qxy, for any terms x and y). It can be noticed that the leaves of the derivation are labeled with sequents formalizing ICs of the individual induction schemas for N x P x and N x, N y Qxy.

Proving the individual induction cases

The LKID a derivation for the IC '

Let p be the path used to build the cumulative substitution θ and leading the root N r labeled by (Γ ∆) to the unique terminal node N t in p. The rules applied along p can be used, as indicated by Lemma 9, to generate the sequent labeling N t (resp., the node before N t in p) from the sequent

The LKID a proof is built according to the nature of N t . If N t is a leaf, p is (Subst)-free and the LKID a proof consists in the application of the 0-premise rule on S(N t ). Let us assume that N t is a bud having the node N h as companion, for which S(N h ) ≡ Γ j ∆ j , and δ is i) σ

S(Nt) id

, if S(N t ) is not the premise of a (Subst) rule, or ii) the underlying substitution of the (Subst)-rule having S(N t ) as premise, otherwise. If N h is not from π, the LKID a proof for S(N t ) is a (W k)-step to get Γ j [δ] ∆ j [δ], followed by the (Subst)step to get S(N h ). It finishes by the LKID a proof generated for S(N h ) since N h is < R -smaller than N r . Finally, let us assume that N h is from π. We recall that one can build the derivation of Γ j [δ] ∆ j [δ] from (Γ ∆)[θ], as explained by Lemma 9. Also, we remark that the same derivation is possible if its sequents have added in the antecedent part the same set of formulas, in particular C(S(N

. It continues by deleting the implication, disjunction and conjunction operators using successive applications of (⇒ L), (∧R), and (∨L), and finishes using (Ax) rules; this part is denoted by the horizontal dotted line from We give below some crucial properties of the conversion procedure.

Theorem 26 (termination) The conversion procedure terminates. The set of new inductive predicate symbols and of the axioms defining them is finite.

Proof Our arguments use the fact that the pre-proof tree-set given as input is finite. Hence, the number of iterations, given by the number of root nodes from the input proof, is finite. For each iteration, the operations in the case 1. of the procedure reproduce a tree derivation from the cyclic proof.

For the case 2., the construction of the explicit induction schema is an exhaustive combination of a finite number of individual induction schemas whose computation terminates. The conversion of the explicit induction proof terminates because the paths followed in the input proof are finite.

Theorem 27 (soundness) The output of the conversion procedure, applied on a CLKID ω N pre-proof tree-set in normal form and one of its root sequents S, is an LKID a proof of S if the new inductive predicates are admissible.

Proof Let (MD, MR) be the input CLKID ω N proof. By Theorem 26, the conversion procedure builds for each sequent labeling a root node in MD a finite LKID a -derivation whose terminal nodes are all leaves if the new inductive predicates are admissible. By Definition 15, these derivations are LKID a proofs. Since S labels one of the roots of MD, the conversion procedure builds an LKID a proof of S.

Time complexity

It has been shown in Subsection 7.2.3 that the normalization operation of CLKID ω N pre-proof is linear w.r.t. their number of nodes. Many steps in the execution of the conversion procedure consist in following paths from root to terminal nodes in the input CLKID ω N pre-proof tree-sets. The most costly operation stands in the combination of individual induction schemas during the generation of the axioms for the new admissible inductive predicates. Given a SCC with cycles π, if n is the number of its root nodes and m i the number of ICs of the individual induction schema for the ith root node (i ∈ [1..n]), the number of axioms defining

) is linear with the number of case applications from the tree rooted by the ith root node, which is bounded by the size k of the input cyclic proof. The number of SCCs with cycles is also bounded by k. Hence, the worst-case time complexity is k n .

C.1.5 Checking the admissibility property

In the FOL ID setting, there are very few admissible inductive predicates, e.g., that defined by the unique axiom P (x). Very simple and useful inductive predicates, as N , are not admissible.

Example 36 (N is not admissible in FOL ID ) N (a) holds only if a is a natural number, i.e., of the form s n (0), n ≥ 0.

of some axiom defining P π (modulo variable renaming).

The unfolding part applies the unfold rules with the axioms defining P π .

The bud part consists in the application of (W k)/(contrL) to delete/duplicate IAAs in order to successfully apply (Subst) and generate buds. Let (Subst) be applied on a sequent S of the form Γ P π (t ), where P π (t ) is the condition of some axiom defining P π (modulo variable renaming). Then the substitution underlying (Subst) is the composition of the substitutions δ used to define the IHs that helped to build the condition P π (t ) when defining the axioms of P π . Let R be the induction function assigning the root as companion of every bud node.

We show that the pre-proof tree (D, R) is a constrained proof tree. D has only one SCC with cycles, let it be denoted by π , including only 1-cycles represented by paths leading the root to each of its buds. Every bud sequent is a premise of some (Subst) rule, so the IHs to be discharged by the 1-cycles are the conclusions of these rules. Let [N, . . . , N f , B] be such a 1-cycle. In order to show that the IH S(N f ) is discharged by this 1-cycle, we define for any arbitrary substitution θ the measure value for the instance

where δ is the substitution underlying the (Subst) rule that has S(B) as premise. Therefore, it is enough to show that S(N

where < π is defined as < π . The derivability conditions from the < πderivability relation hold thanks to the way D was build during the 'visiting path' part.

Finally, the derivation tree of P π (t) is built by successively applying (Cut) on every IAA p from Γ. Since p is admissible, (Adm) can be applied on the sequent p, P π (t). At the end, we get Γ P π (t) that is a bud. Since no new n-cycle is built, the pre-proof tree-set consisting of the two derivation trees rooted by P π (t) and Γ P π (t) is a constrained CLKID ω N proof tree.

Example 38 The pre-proof tree from Fig. C.12 is a constrained CLKID ω N proof tree (D, R), too. (Gen) denotes the restricted form of (= L) used by CLKID ω N . We have to check that their IHs are discharged along the four 1-cycles of the unique SCC π . It is sufficient to check that:

This holds since the two IAA multisets of A N x,N x,N y Pπxxy , i.e., {N x, N x} and {N x, N x, N y }, are < π -derivable from the IAA multiset {N x, N x, N sy } of A S( ‡)[{u →0;x →x;y →sy ;y →y }] along [ ‡, . . . , ‡1]; Well-founded proof tree-sets and implementation in Coq The well-founded proof trees/treesets are similar to the constrained ones, excepting that there are no derivability constraints and that the orderings over literals and formulas should be well-founded. Such orderings have been successfully (a) The derivation tree of N u, N x, N y Pπuxy.

The derivation tree of Pπuxy.

Figure C

.12: The pre-proof tree-set for showing the admissibility of P π uxy. used in Chapter 6 to certify cyclic induction reasoning in Coq. The same approach has been adopted to implement the termination orderings for the new inductive predicates, based on i) the Coccinelle library to associate syntactical weights to Coq formulas and to define Noetherian and 'stable under substitutions' orderings over formulas from term algebras, ii) the CoLoR library to build the multiset extensions of the orderings defined with Coccinelle, and iii) the functional (explicit induction) schemas.

Example 39 (Coq proof of the P&Q example by explicit induction) Compared to Example 1, we give definitions of the P and Q inductive predicates that accept only naturals as arguments:

The termination ordering annotates the definition of P π using the axioms from Example 32. For convenience, the triplets (x, y, z) given as argument to P π are represented with pairs as (x, (y, z)), for any natural x, y, z: where (model nat x) is the Coccinelle representation for the variable x of sort nat and mless is the multiset extension of an ordering over multisets of terms. The measure value for the atom P t (resp., Qt 1 t 2 ) is the multiset {t, t} (resp.,{t 1 , t 1 , t 2 }), for any terms t, t 1 , and t 2 . The user should provide the termination proof that checks whether the argument a decreases after each call w.r.t. the ordering following the wf keyword.

P π is also complete because all possible cases for its argument a are considered by the match construction. It helps to define the explicit induction schema P π ind as a new functional schema: Functional Scheme P π ind := Induction for P π Sort Prop.

The inductive predicate PQ defines the conjunction of their root formulas, which are simplified by taking into account the logical representation of sequents and that N is admissible:

The application of P π ind will start the proof of PQ (u, (x, y)):

Theorem pq is true : ∀ u x y, PQ (u, (x, y)).

Proof. intros.

(* application of the explicit induction schema *) pattern (u, (x, y)), (P π (u, (x, y))). apply P π ind; intros; apply r0; subst.

(* case P 0 ∧ Q x 0 *) split. apply p0. apply q0.

(* case P 0 ∧ Q x' (S y') *) inversion H. subst. destruct H1. inversion H1. subst.

split. apply p0. apply q1. trivial. trivial. split. apply p0. inversion H. subst. destruct H7. apply q1. trivial. trivial. (* case P (S u') ∧ Q x 0 *) inversion H. subst. destruct H1. split. apply p1. trivial. trivial. apply q0.

(* case P (S u') ∧ Q x'0 (S y') *) inversion H. subst. inversion H0. subst. destruct H2. destruct H3. split. apply p1. trivial. trivial. apply q1. trivial. trivial. Qed.

After the unfolding of PQ in the goal of each induction case, we get only conjunctions. The proof of each of their conjuncts, resulting after the application of split, is built by firstly unfolding with apply the definitions of P and Q, as shown in Figure 4. After the use of the inversion and destruct tactics on the IHs defined by the induction schema, the remaining formulas are proved by trivial because they also occur in the premise part of the goal.

Finally, the main theorem is proved as a conjunct of the previous theorem:

Theorem q is true : ∀ x y, Q x y. Proof. intros. assert (H:= pq is true x x y). inversion H. destruct H1. trivial. Qed.

C.1.6 Certifying other cyclic proofs

Add 3 (x, y, z) Add(x, s(y), s(z))

Add(x, s(y), s(z))

{x, z}

Table C.5: Statistics about some cyclic proofs.

Table C.5 gives statistics about the cyclic induction proofs of some relevant conjectures taken from the repository of Cyclist (Conjectures 1 to 4), the 2-Hydra example [START_REF] Berardi | [END_REF] (Conjecture 5), and the repository of SPIKE (Conjecture 6), by showing the number of SCCs and their root sequents with the measure values to be used in the definition of the induction ordering. We will discuss the Coq definitions of P π , proposed by the conversion procedure for each conjecture. Only the match cases for the argument a of P π are illustrated. The lhs P π definition from above was used in the proof of Conjecture 1 involving the even (E) and odd (O) predicates, Conjecture 2 concerning the addition (Add), and the formula corresponding to the first root sequent required by Conjecture 4. Being the simplest one, apply P π ind is equivalent to apply the Peano principle. The rhs definition of P π from above was used to prove Conjecture 3.

C.1. Detailed project: certification of cyclic reasoning by converting cyclic to explicit induction proofs

The lhs definition from below helped to prove the other root sequent for Conjecture 4. The rhs one was used to prove the 2-Hydra example. Both are complex and arguably hard to be found eagerly. The last cyclic proof, requiring 8 induction steps, is the largest one. It was built by SPIKE for the conjecture member t insin from Table 2.1, one of the 79 conjectures that helped to prove the equivalence between two conformity algorithms for the ATM networks. It will not be presented here but it can be accessed, as the other proofs and experimental material, from https://drive.google. com/file/d/10HUmH4ywl1O1PSPjODH58zXwL6K_KBeL/view?usp=sharing

C.1.7 Further lines of research

We showed that the use of types allows to define admissible inductive predicates and the application of the conversion procedure in logics that can reproduce the FOL ID inductive reasoning, e.g., the calculus of inductive constructions. This allowed us to certify the FOL ID cyclic reasoning with Coq.

We also showed in Example 2 that Coq is able to build cyclic pre-proofs. We intend to build a Coq plugin that validates such pre-proofs. It can be imagined that the user activates a mode before starting the construction of the pre-proofs such that, when the construction process finishes with 'Qed.', the validation of the pre-proofs is executed.

The validation step can be done in two ways, by using:

1. formula-based Noetherian induction principles, as shown for the cyclic formula-based Noetherian induction pre-proofs from Chapter 6. Recall that the Coq certification process of implicit induction proofs can be completely automatized. Since the pre-proofs can be represented as formula-based Noetherian induction pre-proofs, we expect that the validation step be performed automatically, too;

2. term-based Noetherian induction principles, as shown in this subsection. We expect that the validation process be also highly automatic.

The plugin may include minimal user interactions for choosing the right induction orderings or finishing the termination proofs of the new inductive predicates/functions. We also plan to certify FOL ID cyclic pre-proofs based on a validation process using formula-based Noetherian induction principles. We illustrate below our approach for the Cyclist pre-proof of the main P&Q conjecture.

The Coq script. The Cyclist specification of the main P&Q conjecture and its pre-proof from Figure 7.6 can be translated in the following Coq script: The above equalities can be used for rewriting during the proofs:

Hint Rewrite model nat 0 model nat succ : model nat.

Ltac rewrite model := autorewrite with model nat.

If the pre-proof has several non-singleton SCCs, one should define a precedence w.r.t. their processing order, such that the SCC S 1 is treated after the SCC S 2 if S 1 depends on S 2 . For each SCC S, 1. attach a measure value to each root from S inside a functional to ensure that whenever the root formula is instantiated the mesure value is also instantiated with the same substitution:

define the list of functionals:

Definition LF 0 4 := [F 0,F 4]. 3. define and prove the main lemma by reproducing the parts rooted by the root nodes in the pre-proof; the buds are validated using well-founded induction arguments:

4. prove all formulas from the list of functionals using a formula-based instance of the well-founded induction principle [Stratulat, 2012] as the all true conjecture: Theorem all true 0 4: ∀ F, In F LF 0 4 → ∀ u1 : T, ∀ u2 : T, fst (F u1 u2 ). 5. finally, prove the root conjectures as direct consequences of all true:

C.2 Other projects

C.2.1 Strategies for directly building sound CLKID ω N pre-proofs

We are interested to develop strategies for building sound CLKID ω N pre-proofs without backtracking, which may lead to faster proof developments. A first attempt would be to use Theorem 19. It suggests that sequents can also be proved by directly building sound pre-proof tree-sets. For this purpose, we adapt the DRaCuLa strategy from Chapter 2. Mainly, the trees from a pre-proof tree-set are developed by applying the CLKID ω N rules, as usual, with the following exceptions:

• when applying a (Subst)-rule, the premise becomes a bud sequent, as shown for the first transformation of the normalization procedure. The next step is to develop a new tree rooted by the companion of the bud;

• when a bud is about to be created, several scenarios may happen. As a preliminary step, if its companion is a non-root node, the second transformation of the normalization procedure is applied.

If the bud candidate is part of a SCC that discharges its IHs, the bud is created (scenario 1). If it

is not yet the case, either i) the strategy tries to build a non-singleton SCC, by developing parts from other trees (scenario 2), or ii) the SCC does not discharge its IHs (scenario 3); in this case, a backtracking step is required either to redefine the ordering at the SCC level, or to redo previous steps, or to continue to develop the proof by applying a CLKID ω N rule on the sequent labelling the bud candidate.

For (scenario 1), not only the current bud candidate is created, but all the bud candidates from the SCC are built, hence simultaneous induction is performed.

Example 40 The above strategy can build the pre-proof tree from Example 23. The progression in its construction can be retraced by following the indexes of the sequents labelling the nodes from the digraph displayed in Example 25.

This proof strategy uses heuristics based on ordering constraints, different from the iterative depthfirst search heuristics used by Cyclist. The induction ordering for each non-singleton SCC should be defined only when its construction is completely finished. This is because the induction orderings used to partially discharge some of the IHs may not be sufficient to discharge the new IHs occurring in the pre-proof. If no ordering is found, backtracking steps may be required.

Example 41 One could have built a new bud of (*) from the pre-proof tree of Example 23, by developing ( †) such that N 0 is added as IAA, then (Subst) applied conveniently. The new non-singleton SCC from its digraph is part of the SCC π of the digraph from Example 25. However, the induction ordering < π , defined in Example 26 and used to discharge the IH N 7 , cannot be used to discharge the IH N 10 . Hence, a different induction ordering is required, if any, to discharge the IHs of the new SCC π .

N x, N y

In order to get rid of the backtracking, we can establish a link with reductive reasoning techniques [Stratulat, 2017a]. The idea is that sound pre-proof trees can also be directly generated to satisfy implicitly the ordering constraints, similar to implicit induction proofs, by using a reductive proof strategy based on a unique induction ordering <. Such strategy guarantees that, for every two successive nodes N i and N i+1 from each path p, of the form [N 1 , . . . , N n ] and occurring in the definition of some minimal cycle of its digraph, and i ∈

i ] along p, where f is the index of the IH-node in [N 1 , . . . , N n ] and θ c j is the cumulative substitution for the path [N j , . . . , N f ] (j ∈ [1..f ]). The derivability constraints are satisfied if the syntactic equality relation is not satisfied at least once along p. Indeed, knowing that the <-derivability relation is transitive (Lemma 11), we have that S(N f ) is <-derivable from S(N 1 )[θ c 1 ] along p, as required. If the rule applied at step i is different from (= L), we have that θ c i ≡ θ c i+1 . In this case, it is sufficient to ensure instead that A S(N i+1 ) ≡ A S(N i ) or S(N i+1 ) is <-derivable from S(N i ) along p, due to the 'stability under substitutions' property of <-derivability (again Lemma 11).

Example 42 As a proof of concept, we define the derived rule (DCase): where x is a vector of variables. We also define the (Bud) rule:

∆ subsumes Γ ∆ with substitution σ, i.e., Γ [σ] ⊆ Γ and ∆ [σ] ⊆ ∆. Different variants of the subsumption operation are widely employed by the current theorem provers, Cyclist being one of them.

By using the alternative notation without parentheses, a pre-proof of N x, N y Q(x, y) is built below by firstly trying to apply the unfold rules followed by (Bud), then (Del) and, finally, (DCase). (Del) is a restricted version of the (W k) rule that deletes the IAAs of the form N (t) if none of the inductive succedent atoms from the conclusion has t as argument. It can be noticed that the history of every IAA occurring in each premise of any rule r from the above rules but (Bud) has one of the IAAs from the conclusion of r. The proof strategy is reductive if the measure value for each sequent of the form Γ, N (t) P (t) (resp., Γ, N (t 1 ), N (t 2 ) Q(t 1 , t 2 ) is the multiset of IAAs {N (t), N (t)} (resp., {N (t 1 ), N (t 1 ), N (t 2 )}) and < is defined as the multiset extension of the ordering < a over IAAs from Example 25. It can be checked that the <-derivability constraints are satisfied, by taking into account that the unique non-singeton SCC of the digraph associated to its normalized pre-proof tree-set includes the rb-paths [( * ), . . . , ( * 1)], [( †), . . . , ( †1)], [( * ), . . . , ( †2)], and [( †), . . . , copy of ( * )].

By Theorem 19, our approach allows to prove several conjectures simultaneously. This is a feature specific to formula-based Noetherian induction reasoning which has been already employed by the implicit induction inference systems in Subsection 6.2. It is particularly useful when the proofs of the conjectures are mutually dependent.

Example 43 The normalization step for the pre-proof tree from Example 42 can be avoided if the preproof trees of N x P x and N x, N y Qxy are developed simultaneously.

The ordering constraints are implicitly satisfied by reductive proof strategies.

In the future, we plan to define new (derived) rules and proof strategies that automatically generate more compact reductive proof derivations and provide a better control of the proof development. We intend to integrate these strategies in E-Cyclist. The main challenge of our approach remains to find the 'good' induction orderings.

C.2.2 Certification of saturation-based proofs

In a future line of research, we intend to exploit the link established between Noetherian induction reasoning and saturation-based reasoning in order to apply our certification methodologies from Chapter 6 for certifying the inductionless induction reasoning and other saturation-based reductive reasoning, as those described in Chapter 8.

C.2.3 Applications

A. Certification of the algorithms issued from algorithm synthesis

Our experiments in the Theorema system from Section 3.2 show how one can discover numerous algorithms for the same functions, differing in efficiency and complexity if one applies different induction principles and chooses different alternatives in the proofs. The Coq certification of the synthesized algorithms can be seen as a test for checking the soundness of our approach.

An alternative to avoid the certification step is the generation of the proofs and the implementation of the inference rules and strategies directly in Coq. This would ensure that every synthesized algorithm by these inference rules and strategies is implicitly sound. Some downsides of this approach are: i) its difficulty to prove the soundness of the inference system, and ii) the inadequacy for rapid prototyping and testing new ideas. A reasonable compromise would be to devise procedures for translating the Theorema proofs directly into Coq scripts, by following similar translation procedures as those used for implicit induction proofs in Subsection 6.2.

B. JavaCard

Further case studies. It would be interesting to provide automatic support for the construction and cross-validation of the virtual machines for properties other than typing, e.g.