Descente Infinie + Deduction

Claus-Peter Wirth

Dept. of Computer Science, Universität des Saarlandes, D–66123 Saarbrücken, Germany

                             cp@ags.uni-sb.de
                   http://ags.uni-sb.de/~cp/welcome.html

Research Report 737/2000, FB Informatik, Univ. Dortmund

August 2, 2000

Definition “wellfoundedness” changed, Aug. 5, 2001 (in honor of Jörg H. Siekmann’s 60^{th} birthday)

Polarity of choice-conditions swapped (Definition 9.2) and quasi-existentiality added (Definition 5.2, Definition 9.4, Lemma 11.2(6), Lemma 12.3(6), Definition 13.4, &c.), Feb. 1,

2002

Overall improved, esp. Lemma A.2 and its consequences, Dec. 13, 2002

Final edition, Feb. 1, 2003

Abstract: Although induction is omnipresent, inductive theorem proving in the form of descente infinie has not yet been integrated into full first-order deductive calculi. We present such an integration for (possibly even higher-order) classical logic. This integration is based on lemma and induction hypothesis application for free variable sequent and tableau calculi. We discuss the appropriateness of these types of calculi for this integration. The deductive part of this integration requires the first combination of raising, explicit variable dependency representation, the liberalized δ-rule, and preservation of solutions.

Contents

1 Motivation 1 2 Orientation 3

2.1 Design Goals for Inductive Inference Systems . . . . . . . . . . . . . . . 3 2.2 Why Sequent and Tableau Calculi . . . . . . . . . . . . . . . . . . . . . 5 2.3 Sequent and Tableau Calculi . . . . . . . . . . . . . . . . . . . . . . . . . 6

3 Basics 9 3.1 Syntactical Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.2 Semantical Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4 Introduction 13 4.1 Descente Infinie: A Primitive Example . . . . . . . . . . . . . . . . . . . 13 4.2 Example: Induction Ordering in QuodLibet . . . . . . . . . . . . . . . 16 4.3 Descente Infinie and Foundedness . . . . . . . . . . . . . . . . . . . . . . 17 4.4 Dependent Choice, Wellfoundedness, and Descente Infinie . . . . . . . . 17 4.5 Without Skolemization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 4.6 Preservation of Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 4.7 The Liberalized δ-rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5 Existential Substitutions 23 6 Existential Valuations 25 7 Validity 26 8 Motivation for Reduction and Strong Validity 27 9 Choice-Conditions 29 10 Strong Validity 31 11 Reduction 32 12 Counterexamples and Foundedness 33 13 Abstract Sequent and Tableau Calculus 37 13.1 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 13.2 Safeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

14 Concrete Sequent and Tableau Calculus 42 15 Example: Lemma Application 45 16 Example: Mutual Induction 47 17 Sequents versus Tableaus in ITP 50 18 Example: Eager Hypotheses Generation 53 19 Example: Variable Induction Ordering 56 20 Optimizations 61

20.1 Variable-Condition versus Free Universal Variables . . . . . . . . . . . . 63 20.2 Improving Multiple γ-Rule Applications . . . . . . . . . . . . . . . . . . 63

21 Conclusion 65 A Additional Lemmas 67 B Proofs 68 C Notes 85 D References 93

1 Motivation

When deductive validity (i.e. validity in all models) is introduced to students it comes with some calculus which is complete for first-order logic. If this calculus happens to be a sequent or a tableau calculus including a Cut rule, the students can compare the formal proofs with the informal ones they are hopefully acquainted with. To our opinion, these calculi can mirror the human proof search process better than others. Although to know a complete calculus does not mean to know much about theorem proving, the interrelation of a human-oriented calculus and the informal proof search of the students will turn out to be fruitful for their later mathematical work. It is a pity that—while nearly all proofs of a working mathematician include induction—nothing comparable for inductive validity is offered to the students. Some may argue that this is generally impossible because not even the first-order theory of the Peano algebra of natural numbers is recursively enumerable. Nevertheless, there really is some general way in that many working mathematicians search for an informal proof, may it be inductive or not. The inductive version of this proof search method goes back to the ancient Greeks, was rediscovered under the name “descente infinie ou indéfinie” by Pierre de Fermat (1607?–1665), and today is sometimes called “minimal criminal” (popular) or “implicit induction” (in opposition to “explicit induction” found e.g. in Boyer & Moore (1979) and Walther (1994); for disambiguation and history of the notions of “explicit”, “implicit”, “inductionless induction”, and “descente infinie”, cf. Wirth (2003)). If you want to prove a conjecture, this method requires that you show, for each assumed counterexample of the conjecture, the existence of another counterexample of the conjecture that is strictly smaller in some wellfounded ordering. The working mathematician applies it in the following fashion.

He starts with the conjecture and simplifies it in case analyses which can be described as steps in a sequent or tableau calculus with Cut. When he realizes that the goals become similar to a different instance of the conjecture, he applies the conjecture just like a lemma, but keeps in mind that he actually has applied some induction hypothesis. Finally, he searches for some wellfounded ordering in which all the instances of the conjecture that he has applied as induction hypotheses are smaller than the original conjecture itself.

Looking for a formal inductive calculus for mirroring this style of human inductive theorem proving (ITP), the “implicit induction” of Bachmair (1988) was a starting point because it included induction hypothesis application; but it was restricted to first-order universally quantified pure equations and was not human-oriented. In Wirth (1997) we have presented a human-oriented inductive calculus for first-order universally quantified clausal logic. In Kühler (2000)—implemented as the QuodLibet system—this calculus is extended with a necessary concretion for reasoning on the induction ordering and with a tactic-based concept for proof guidance that is intended to partially automate the construction of proofs.

Extending this approach to full first-order logic turned out to be more difficult than expected: The state-of-the-art free variable first-order tableau calculi were not suited for the integration of descente infinie because they confused the Herbrand universes with their Skolem functions and did not preserve solutions (i.e. closing substitutions) (like Prolog does), thereby destroying the wellfoundedness of descente infinie.

In this paper we show how deductive theorem proving should look like from the point of view of induction in the style of descente infinie. While many possible choices in the design of calculi for deductive theorem proving do not really matter because the alternatives are dual to each other, they do make an important difference when one wants to integrate descente infinie.

Nevertheless, even the researcher who is not interested in induction can learn something on computation of solutions, lemma application, and the details of the difference between the δ-rule and the liberalized δ-rule (δ^{+}). These details become obvious when the preservation of solutions (closing substitutions) is considered besides soundness.

The crucial step, however, in this paper is the integration of induction in the style of descente infinie into the framework of state-of-the-art deductive theorem proving. This is achieved by an inference method called induction hypothesis application, which—roughly speaking—differs from lemma application in producing an additional ordering goal. Even for the experts in ITP, the following aspects will be new: Tableau presentation, full firstorder and higher-order formulas, and free (existential) variables.

While the details and technical means of this paper (like a new semantics for Hilbert’s ε-terms and for formulas with three different kinds of free variables (existential, universal, ε-constrained)) may turn out to be useful also in other contexts, they originate from the hard search for a solution to the single problem that gives this paper its meaning:

The first integration of the ancient ideas of deduction and descente infinie into a formal framework of practical relevance.

While the usual notions of completeness are irrelevant for this integration because we are interested not just in the mere existence of proofs but of proofs of a special intentional form; in order to go beyond a philosophical discussion it is necessary to formally prove its soundness with mathematical rigor, although the semantical means for this proof are very involved. The technical difficulty of the proofs could be reduced by choosing a different special representation for each single aspect, but we think that the concepts gain credit from the possibility to integrate them into a uniform framework. The framework—once accepted—does not need the complicated and philosophically doubtful (cf. e.g. Wittgenstein (1939)) semantical justifications anymore. Due to the simplicity of the framework itself and due to the experience with an implemented sub-system (cf. Kühler (2000)) we have reason to hope that first-order realizations of it do not provide more difficulty to students than calculi for first-order deduction.

The paper organizes as follows: After introducing the relevant notions in Sections 2 to 4, we explicate the kernel of our new approach in Sections 5 to 14. Then we illustrate the practical relevance with several simple examples, including the search for a lower bound for the Ackermann function (Section 18) and Newman’s Lemma (Section 19). After concluding in Section 21 we append all the proofs and notes. Please do try not to read the notes on a first reading!

����� ����������� ������ ��� ���������

The ideas live together easily,

��� ���� �� ����� ����� ��� ��� ������

But the realizations clash heavily.

Friedrich Schiller. Wallensteins Tod, 2. Aufzug, 2. Auftritt.

2 Orientation

In this section we describe the area of this paper. As the design of inference systems for proof search is the subject of this paper, we discuss our design goals carefully and conclude that sequent and tableau calculi are the best candidates for satisfying them.

2.1 Design Goals for Inductive Inference Systems

Based on experiences with more or less automated inductive theorem provers for classical logic, such as Nqthm, Inka, Rrl, Unicom, Spike, Expander, &c., cf. Boyer & Moore (1988), Biundo &al. (1986), Kapur & Zhang (1989), Gramlich & Lindner (1991), Bouhoula & Rusinowitch (1995), Padawitz (1998), resp., we have come to adopt a rather pragmatic viewpoint with respect to ITP: Successful use of an inductive theorem prover in “real-life” problem domains has not been possible yet without a knowledgeable human user who can interact with the system on various levels. Accordingly, we think that even the development of the theoretical concepts of a new theorem prover—including its inference system—should begin with a clear emphasis on user interaction, whereas automatic proof guidance is seen as a long-term goal. Therefore, the following two requirements are main design goals for our inference systems:

I. We expect the inference system to comply with human (inductive) proof techniques in that it enables users to naturally realize their proof ideas in terms of the inference system.

II. Users should have no difficulties in understanding and searching for formal proofs represented with the inference system, no matter whether they try to follow them on the mere syntactical level or try to grasp overall “strategic” aspects of the proofs.

These design goals are contrary to those often found in deductive theorem proving, where most restrictive normal form calculi used to be preferred. Nevertheless, the point of view found in Giese (1998) is—though still more technical—already getting quite close to ours.

Refining the first design goal we obtain the following requirements:

I.1. All proof problems and sub-problems, defining equations, lemmas, and induction hypotheses should be represented homogeneously, so that the conclusion and all premises of any inference rule can be expressed in the same language. This enables the user to utilize the full power of the whole inference system on all problems and sub-problems and to choose freely and flexibly between eager or lazy strategies for any proof problem.

I.2. Another important point is that the inference system includes inference rules for most elementary proof steps, so that the user can force the prover to follow his proof ideas as closely as possible. We consider availability of atomic inference steps to be more important than having (derived) higher-level inference rules. Applied in nontrivial proof problems higher-level inference rules tend to be too restrictive, while an inference system comprising a multitude of simple “fine-grain” inference rules can be used to (interactively) construct even very difficult proofs.

Refining the second design goal we obtain the following requirements:

II.1. The inference system should support a natural flow of information in the sense that a certain decision can be delayed or a commitment deferred until the state of the proof attempt provides information that is sufficient to make a successful decision. Examples for unnatural flow of information are:

(a) Instantiating induction hypotheses in induction step formulas of explicit induction long before the hypotheses become applicable, cf. Protzen (1994).

(b) The γ-rule of sequent or tableau calculi without free variables, where instantiations have to be guessed long before it can be recognized which instantiations will make a proof attempt successful.

(c) The ∨-introduction (∨I) and the indirect-proof (⊥_{c} or A ∨ ¬A) rules in natural deduction calculi for classical logic: The first requires a decision for one of two disjunctive alternatives and the second a decision of when to start an indirect proof, both of which are not at all necessary in classical logic.^{1}

Together with the homogeneous and flexible formulation of the inference rules, the natural flow of information should make it possible to replace a certain amount of proof planning based on some special abstractive representation (cf. e.g. Kerber (1998)) with heuristic search based on the homogeneous representation in the inference system.

II.2. Another requirement that is very important for efficiency of automated as well as interactive theorem proving is goal-directedness. Goal-directedness means that every problem in the graph of a proof attempt is connected with the theorem to be proved. For inductive theorem proving this is even more important than for deductive theorem proving: The crucial point is that we often have to invent some new lemmas to close the gap between the induction conclusion and the induction hypotheses. This creative invention can be guided by the user’s knowledge of the domain or more automatically by the applicable lemmas, the (expanded) induction conclusion, and the induction hypotheses. Without the goal-directedness given by the connection with the induction conclusion and the induction hypotheses the missing lemmas can hardly be guessed. Note that (disregarding proof length) such creative steps are not necessary for deductive theorem proving because according to Gentzen’s Hauptsatz a proof of a deductive theorem does not need to invent new formulas but can be restricted to “sub”-formulas of the theorem, although this notion of “sub”-formula is closed under instantiations with a usually infinite number of terms. On the contrary, the application of hypotheses and lemmas inside an inductive reasoning cycle cannot generally be eliminated in the form of Gentzen’s Hauptsatz, cf. Kreisel (1965). Thus, for ITP, creativity cannot be restricted to finding the proper instantiations, but requires the invention of new formulas, possibly in an enrichment of the signature and in an extension of the specification.

As a first step towards achieving the above design goals, we have an inference system in mind that explicitly provides the concepts of induction hypothesis and induction ordering. With the latter concept we associate means of supplying induction ordering conditions with sufficient expressiveness and flexibility, i.e. explicit weights. Concerning the concept of induction hypothesis, we intend an inference system that does not “hide” several (applications of) induction hypotheses in a single inference step. We rather think of an inference system that “knows” what an induction hypothesis is, i.e. it includes inference rules that provide or apply induction hypotheses, given that certain ordering conditions resulting from these applications can be met by an induction ordering. Obviously, such an inference system is an inference system for descente infinie and not an inference system restricted to explicit induction as found in the ITP systems Nqthm, Inka, and Rrl and still in Kreitz & Pientka (2000). Furthermore, the intended inference system supports eager as well as lazy generation of induction hypotheses and mutual induction. As a consequence, we obtain the following essential requirement for our inference system:

The inference system must be capable of representing an induction hypothesis as a whole and in recognizable form. Not an inference rule nor input normalization may decompose a conjectured inductive theorem (into “sub”-formulas) before the induction hypotheses have been extracted from it.

2.2 Why Sequent and Tableau Calculi

This section requires some deeper understanding of inference systems and can well be skipped.

The considerations of Section 2.1 may help settling the following question: Which deductive inference systems are well suited for an integration of descente infinie? Note that in the more restricted framework of explicit induction, obtaining an inference system for ITP from a deductive inference system is far simpler: Since induction is captured in a single inference rule then, this “induction rule” can be just added to the given deductive inference system without affecting the rest of the inference system. When integrating descente infinie, however, the whole inference system is affected.

As proof search is very hard in Hilbert calculi, they are not adequate for theorem proving in general. Not too much better for proof search in classical logic are natural deduction calculi, cf. Gentzen (1935), Prawitz (1965), due to their unnatural flow of information as indicated in Section 2.1 (II.1.c). For descente infinie, natural deduction is additionally problematic because the proofs are augmented with assumptions that conflict with our concept of induction hypothesis.

Sergey Yu. Maslov’s general idea of inversion (cf. Maslov (1971)) seems not to be appropriate for inductive theorem proving because an inductive proof where the induction conclusion is a formula at the top lacks goal-directedness when starting from the bottom. This lack of goal-directedness is very similar to that of the more familiar framework of non-refutational resolution and paramodulation (cf. Lee (1967)), where the resolution rule is applied to axioms only, and the task is to infer a formula that subsumes the theorem. Non-refutational resolution seems not very appropriate for deductive theorem proving because it is not goal-directed. In the context of inductive theorem proving, however, nonrefutational resolution could be considered goal-directed because it starts with the axioms plus the induction hypotheses, and formulas that subsume the induction conclusions are to be inferred. Nevertheless, the goal-directedness given by the induction hypotheses is not sufficient. Since numerous lemmas may be applicable and applications of lemmas tend to be “closer” to applications of induction hypotheses than to the conclusions, it is practically impossible to find the appropriate ones unless the conclusion has been expanded to a large degree. Mostly under the name “rippling” a lot of work has been done on the heuristic control of this search problem, cf. e.g. Bundy &al. (1993), Hutter (1997). Furthermore, nonrefutational resolution is not goal-directed in the base cases and in those parts of the proof that lie below applications of induction hypotheses. Finally, since inductive proofs use to follow the recursive definitions of the specification, non-refutational resolution requires to paramodulate with the defining rules from right to left. This can result in a high branching degree for some of the non-recursive cases and make a proper combination of the cases of the definition difficult (i.e. “unfolding” (or “expanding”) a definition is easier than “folding” it). All in all, we conclude that non-refutational resolution and paramodulation as well as the general idea of inversion are not adequate for ITP. Thus, a reasonable integration of descente infinie into resolution and paramodulation must be refutational. Due to the problems discussed above, such an integration must be similar to Expander (cf. Padawitz (1996), Padawitz (1998)), which is the only system for resolution and descente infinie I know. In Expander, the induction hypotheses (which are special super-clauses (i.e. disjunctions of super-literals, which are conjunctions of literals) with additional existential variables) are applied very similar to the super-clauses in Sergey Yu. Maslov’s inverse method (cf. Lifschitz (1989)) that generate inference rules operating on clauses. Moreover, goal-directedness also w.r.t. the induction conclusion is achieved here by starting from the negated induction conclusion in the form of a set of “goals”, i.e. clauses in dual notation for user readability. Contrary to this, the inverse method starts from the set of tautologies, which has the advantage of deductive completeness but lacks goal-directedness w.r.t. the induction conclusion. Nevertheless, from my experiences with Expander, I am not at all convinced that it satisfies our main design goals (I) and (II) of Section 2.1 well.

2.3 Sequent and Tableau Calculi

Now the only remaining family of well-known deductive inference systems is that of sequent (cf. Gentzen (1935), Lifschitz (1971)), tableau (cf. Smullyan (1968), Fitting (1996)), and matrix calculi (cf. Wallen (1990)). While matrix calculi have implementational advantages (cf. Section 20.2 and Wallen (1990)), in this paper we will only consider sequent and tableau calculi because their presentation is simpler. Fortunately, these calculi—cf. the following sections—do admit an integration of descente infinie in a way that is adequate in our opinion:

• By adding a powerful inference rule for applying induction hypotheses, we obtain an inference system for ITP that is optimally goal-directed w.r.t. the induction conclusions and sufficiently goal-directed w.r.t. the induction hypotheses.

• Starting with the sequent to be proved, the problem of proving a sequent (goal) is reduced to the problem of proving another set of sequents (sub-goals), which can be considered to be its children. Applying such reduction steps recursively results in a tree-like proof structure, which is augmented with cyclic arguments resulting from inference rules generated by induction hypotheses. A proof having the simple structure of a tree is easy to understand for users and a good basis for automatic tactics and heuristic proof search.

We assume some familiarity with sequent or tableau theorem proving. We recommend Gentzen (1935) and Fitting (1996) as excellent introductions to the subject.

In Smullyan (1968), rules for analytic deductive theorem proving are classified as α-, β-, γ-, and δ-rules independently from a concrete calculus.^{2}

α-rules describe the simple and

β-rules the case-splitting (or \underline{b}ranching) propositional proof steps.

γ-rules show existential properties, either by exhibiting a term witnessing to the existence or else by introducing a special kind of variable, called “dummy” in Prawitz (1960) and Kanger (1963), “free variable” in footnote 11 of Prawitz (1960) and in Fitting (1996), and “meta variable” in Giese (1998) e.g.. We will call these variables free existential variables. By the use of free existential variables we can delay the choice of a witnessing term until the state of the proof attempt gives us more information which choice is likely to result in a successful proof. It is the important addition of free existential variables that makes the major difference between the free variable calculi of Fitting (1996) and the calculi of Smullyan (1968). Since there use to be infinitely many possibly witnessing terms (and different branches may need different ones), the γ-rules (under assistance of the β-rules) often destroy the possibility to decide validity because they enable infinitely many γ-rule applications to the same formula.

δ-rules show universal properties simply with the help of a new symbol, called a “parameter” or an “eigenvariable”, about which nothing is known. Since the present free existential variables must not be instantiated with this new parameter, in the standard framework of Skolemization and unification the parameter is given the present free existential variables as arguments. In this paper, however, we will use nullary parameters, which we call free universal variables. These variables are not free in the sense that terms to replace them may be chosen freely, but in the sense that their occurrences must not be bound by any quantifier or other binder. Our free universal variables are similar to the parameters of Kanger (1963) because a free existential variable may not be instantiated with all of them. We will store the information on the dependency between free existential variables and free universal variables in variable-conditions.

Other rules may be added for an appropriate treatment of often used reasoning like unification, rewriting with equalities and logical equivalences, and human-oriented reasoning like Cut.

Besides these rules we would like to have rules for lemma application that apply the theorem proved in one tree as a lemma in the proof tree of another theorem. Moreover, induction hypothesis application will look like lemma application but generate extra branches (in the latter tree), which require to prove that the instance of the applied theorem (induction hypothesis) is somehow smaller in a wellfounded ordering than the theorem (induction conclusion) that it is going to prove.

Although the following inference rules from Theor. 14.1 of Section 14 cannot be completely understood at this early stage, they may clear away some fog. They are presented in the sequent calculus style. Moreover, note that in old times when trees grew upwards, Gerhard Gentzen would have written the inference rules such that passing the line meant consequence. We have inverted the rules. Thus, in our case, passing the line means reduction, and trees grow downwards.

Let A and B be formulas, Γ, Π, and Λ be sequents (i.e. disjunctive lists of formulas), x ∈ V_{bound} a bound variable, and F the current proof forest containing all free variables already used, esp. those from A and Γ Π:

α-rules: \frac{Γ ¬¬A Π}{A Γ Π} \frac{Γ (A∨B) Π}{A B Γ Π} \frac{Γ ¬(A∧B) Π}{\overline{A} \overline{B} Γ Π} \frac{Γ (A⇒B) Π}{\overline{A} B Γ Π} \frac{Γ (A⇐B) Π}{A \overline{B} Γ Π}

β-rules: In the following rules we may choose none or one, but not both of the formulas in optional brackets!

\frac{Γ (A∧B) Π}{A [ \overline{B} ] Γ Π  B [ \overline{A} ] Γ Π}  \frac{Γ ¬(A∨B) Π}{\overline{A} [ B ] Γ Π  \overline{B} [ A ] Γ Π}
\frac{Γ ¬(A⇒B) Π}{A [ B ] Γ Π  \overline{B} [ \overline{A} ] Γ Π}  \frac{Γ ¬(A⇐B) Π}{\overline{A} [ \overline{B} ] Γ Π  B [ A ] Γ Π}

γ-rules: Let x^{∃} ∈ V_{∃} \ V(F) be a new^{3} free existential variable:

\frac{Γ ∃x. A Π}{A\{x↦x^{∃}\} Γ ∃x. A Π}  \frac{Γ ¬∀x. A Π}{\overline{A\{x↦x^{∃}\}} Γ ¬∀x. A Π}

δ-rules: Let x^{∀,w} ∈ V_{∀,w} \ V(F) be a new^{4} weak free universal variable:

\frac{Γ ∀x. A Π}{A\{x↦x^{∀,w}\} Γ Π} ( V_{∃}(A, Γ Π, ℶ) ∪ V_{∀,s}(A, Γ Π, ℶ) ) × \{x^{∀,w}\}

\frac{Γ ¬∃x. A Π}{\overline{A\{x↦x^{∀,w}\}} Γ Π} ( V_{∃}(A, Γ Π, ℶ) ∪ V_{∀,s}(A, Γ Π, ℶ) ) × \{x^{∀,w}\}

Liberalized δ-rules: Let x^{∀,s} ∈ V_{∀,s} \ V(F) be a new^{5} strong free universal variable:

\frac{Γ ∀x. A Π}{A\{x↦x^{∀,s}\} Γ Π} \begin{matrix}\{(x^{∀,s}, \overline{A\{x↦x^{∀,s}\}})\} \\ V_{free}(A) × \{x^{∀,s}\} \end{matrix}

\frac{Γ ¬∃x. A Π}{\overline{A\{x↦x^{∀,s}\}} Γ Π} \begin{matrix}\{(x^{∀,s}, A\{x↦x^{∀,s}\})\} \\ V_{free}(A) × \{x^{∀,s}\} \end{matrix}

Rewrite-Rules: Let s and t be terms (of the same type). Let B be one of the formulas (s≠t) or (t≠s). Let A[t] denote the formula A[s] with some occurrences of s replaced with t:

\frac{Γ A[s] Π B Λ}{A[t] Γ Π B Λ}  \frac{Γ B Π A[s] Λ}{A[t] Γ B Π Λ}
Cut:  \frac{Γ}{A Γ  \overline{A} Γ}

3 Basics

We make use of “[…]” for stating two definitions, lemmas, or theorems (and their proofs &c.) in one, where the parts between ‘[’ and ‘]’ are optional and are meant to be all included or all omitted. ‘N’ denotes the set of and ‘≺’ the ordering on natural numbers. ‘Z’ denotes the set of integers. We define N_{+} := { n ∈ N | 0 ≠ n }. We use ‘⊎’ for the union of disjoint classes and ‘id’ for the identity function. For classes R, A, and B we define domain and range, (domain-) restriction and range-restriction, as well as image^{6} and reverse-image:

\begin{aligned}dom(R) & := & \{ a | ∃b. (a, b) ∈ R \} & ; & ran(R) & := & \{ b | ∃a. (a, b) ∈ R \} & ; \\ _{A}↿R & := & \{ (a, b) ∈ R | a ∈ A \} & ; & R↾_{B} & := & \{ (a, b) ∈ R | b ∈ B \} & ; \\ ⟨A⟩R & := & \{ b | ∃a ∈ A. (a, b) ∈ R \} & ; & R⟨B⟩ & := & \{ a | ∃b ∈ B. (a, b) ∈ R \} & . \end{aligned}

Let ‘R’ denote a binary relation. R is said to be a relation on A if dom(R)∪ran(R) ⊆ A. R is irreflexive if id ∩ R = ∅. It is A-reflexive if _{A}↿id ⊆ R. Simply speaking of a reflexive relation we refer to the biggest A that is appropriate in the local context, and referring to this A we write R^{0} to ambiguously denote _{A}↿id. Furthermore, we write R^{1} to denote R. For n ∈ N_{+} we write R^{n+1} to denote R^{n}∘R, so that R^{n} denotes the n step relation for R. The transitive closure of R is R^{+} := ⋃_{n∈N_{+}} R^{n}. The reflexive & transitive closure of R is R^{∗} := ⋃_{n∈N} R^{n}. The reverse^{7} of R will be denoted with R^{−1}. A sequence (s_{i})_{i∈N} is non-terminating in R if s_{i} R s_{i+1} for all i ∈ N. R is terminating if there are no non-terminating sequences in R. A relation R (on A) is wellfounded if any non-empty class B (⊆A) has an R-minimal element, i.e. ∃a ∈ B. ¬∃a′ ∈ B. a′R a.

A quasi-ordering ‘≲’ on a class A is an A-reflexive and transitive (binary) relation on A. As with all our asymmetric relation symbols we define a≳b if b≲a. By an (irreflexive) ordering ‘<’ we mean an irreflexive and transitive relation, sometimes called “strict partial ordering” &c. by other authors. A reflexive ordering ‘≤’ on A is an Areflexive, antisymmetric, and transitive relation on A. The ordering < of a quasi-ordering or a reflexive ordering ≲ is ≲\≳, and ≲ is called wellfounded if < is wellfounded.

Furthermore, we use ‘∅’ to denote the empty set as well as the empty function or empty word. Functions are nothing but (right-) unique relations and the meaning of ‘f∘g’ does not depend on f and g being only relations or even functions. Thus, ‘(f∘g)(x)’ means ‘g(f(x))’. The class of total functions from A to B is denoted with A → B. The class of (possibly) partial functions from A to B is denoted with A ⇝ B. Both → and ⇝ associate to the right, i.e. A ⇝ B → C reads A ⇝ (B → C).

Lemma 3.1 If R is a wellfounded relation, then R^{+} is a wellfounded ordering.

3.1 Syntactical Conventions

We define a sequent to be a list of formulas.^{8} The conjugate of a formula A (written: \overline{A} ) is the formula B if A is of the form ¬B, and the formula ¬A otherwise. Note that the conjugate of the conjugate of a formula is the original formula A again, unless A has the form ¬¬B.

In the tradition of Gentzen (1935), Hilbert & Bernays (1968/70), and Snyder & Gallier (1989) we assume the following four sets of symbols to be disjoint:

V_{∃}  free existential variables, i.e. the free variables of Fitting (1996)
V_{∀}  free universal variables, i.e. nullary parameters, instead of Skolem functions
V_{bound} bound variables, i.e. variables for bound use only
Σ  constants, i.e. the function (and predicate) symbols from the signature

We split the free universal variables V_{∀} into weak free universal variables V_{∀,w} that behave as in the weak version of Wirth (1998) and are introduced by the non-liberalized δ-rules; and strong free universal variables V_{∀,s} that behave as in the strong version and are introduced by the liberalized δ-rules:

V_{∀} = V_{∀,w} ⊎ V_{∀,s}.

We define the free variables by

V_{free} := V_{∃} ⊎ V_{∀}

and the variables by

V := V_{bound} ⊎ V_{free}

We use ‘V_{k}(Γ)’ to denote the set of variables from V_{k} occurring in Γ.

Due to the possibility to rename bound variable occurrences w.l.o.g. (λα-conversion) and in the tradition of Hilbert & Bernays (1968/70), we do not permit binding of variables that already occur bound in a term or formula; i.e. e.g. ∀x. A is only a formula in our sense if A does not contain a binder on x like “∀x. ”, “∃x. ”, “λx. ”, “εx. ”. The simple effect is that human beings can more easily read our formulas and that our γ- and δ-rules (and our λβ-reduction) can simply replace all occurrences of x. Moreover, we assume that all binders have minimal scope, e.g. ∀x, y. A ∧ B reads (∀x. ∀y. A) ∧ B.

For a substitution σ we denote with ‘Γ σ’ the result of replacing each occurrence of a variable x ∈ dom(σ) in Γ with σ(x). In default situations, we tacitly assume that all occurrences of variables from V_{bound} in terms and formulas on top level and in the ranges of substitutions are bound occurrences (i.e. that a variable x ∈ V_{bound} occurs only in the scope of a binder on x) and that each substitution σ satisfies dom(σ) ⊆ V_{free}, so that no bound occurrences of variables can be replaced and no additional variable occurrences can become bound (i.e. captured) when applying σ.

While we use upper case Greek letters for sequences, we denote our weight constructs (which guarantee the wellfoundedness of induction) with Hebrew letters. Note that the beginning of the Hebrew alphabet is all we need: ℵ aleph, ℶ beth, ℷ gimel (which we do not use anymore because it was found hard to disambiguate it from ℶ), and ℸ daleth. Together with a sequent, a weight forms a syntactical construct^{9}:

Definition 3.2 (Syntactical Construct, Weight Construct) A syntactical construct is a pair (Γ, ℵ) consisting of a sequent Γ and a weight construct ℵ. A weight construct is a triple (w, <, ≲) consisting a (“weight”) term w (of type say α), an (“induction ordering”) term <, and an (“induction quasi-ordering”) term ≲, both of type α → α → bool (or equivalently α×α). The set of all syntactical constructs is denoted by ‘SynCons’. The function ‘logic’ extracts the logic part (here: the sequents) of a set G of syntactical constructs: logic(G) := dom(G).

Syntactical constructs are the basic data structure for ITP, just as sequents or formulas are for the deductive case. They consist of purely syntactical elements although the terms w, <, ≲ may exceed the terms of our formulas and sequents. E.g., < and ≲ may be (free existential) predicate variables or λ-terms, which are not terms in first-order languages. As they do not have to interact with our sequents before they are instantiated and applied (λβ-reduced), the language of our deductive logic can still be first-order.

3.2 Semantical Requirements

Validity is expected to be given relative to some Σ-structure (Σ-algebra, Σ-frame) A, assigning a non-empty universe (or “carrier” or “object domain”) (to each type).

For X ⊆ V we denote the set of total A-valuations of X (i.e. functions mapping variables to objects of the universe of A (respecting types)) with X → A and the set of (possibly) partial A-valuations of X with X ⇝ A.

For τ ∈ X → A we denote with ‘A⊎τ’ the extension of A to the variables of X. More precisely, we assume the existence of some evaluation function ‘eval’ such that eval(A⊎τ) maps any term whose free occurring symbols are from Σ⊎X into the universe of A (respecting types) s.t. for all x ∈ X:

eval(A⊎τ)(x) = τ(x)

Moreover, eval(A⊎τ) maps any formula B whose free occurring symbols are from Σ⊎X to TRUE or FALSE, such that B is valid in A⊎τ iff eval(A⊎τ)(B) = TRUE.

For any Σ-structure A with valuation τ ∈ V ⇝ A, the only additional assumptions we need here are the following two basic properties of most semantics:

Explicitness-Lemma (Andrews (1972), Lemma 2; Andrews (2002), Proposition 5400; Fitting (2002), Proposition 2.30)

The value of the evaluation function on a term or formula B does not depend on the variables that do not occur free in B: For X being the set of the variables that occur free in B, if X ⊆ dom(τ):

eval(A⊎τ)(B) = eval(A ⊎ _{X}↿τ)(B).

Substitution-Lemma (Andrews (1972), Lemma 3; Andrews (2002), Lemma 5401(a); Enderton (1973), p. 127; Fitting (1996), p. 120; Fitting (2002), Proposition 2.31)

For any substitution σ and term or formula B, if the variables that occur free in Bσ belong to dom(τ):

eval(A⊎τ)(Bσ) = eval( A ⊎ ( σ ⊎ _{V\dom(σ)}↿id ) ∘ eval(A⊎τ) )( B ).

Note that we take the operator ‘∘’ to have higher priority than the operators ‘∪’ and ‘⊎’.

Further properties of validity or evaluation are definitely not needed. Note that we have left open what our formulas and what our Σ-structures are. All we need are the above basic requirements. In order not to confuse classical first-order reading, we do not use any special jargon or notation in this paper—except two higher-order ones: Currying, and calling all elements of Σ “constants”. Nevertheless, we can assume practically any logic with exactly two truth values here, including intensional, modal,^{10} and higher-order^{11} logics.

4 Introduction

In this section we introduce the interdisciplinary background required to understand the formal treatment in the following sections. Experts in mathematical induction may esp. skip Section 4.2 and Section 4.4.

4.1 Descente Infinie: A Primitive Example

In this section we present a primitive example proof in the sequent calculus of QuodLibet (cf. Kühler (2000)) in order to give the readers an intuitive understanding of our view of descente infinie.

The signature is as follows: We only have the single type nat of natural numbers. We use zero 0 : nat and successor s : nat → nat as constructors for the type nat. Moreover, + : nat → nat → nat is a defined function on the natural numbers.

We use x, y for variables of the type nat where superscripts like in x^{∀,w} indicate a weak free universal variable different from x.

The axioms are as follows:

\begin{matrix}(nat1) & ∀x. & ( x=0 ∨ ∃y. x=s(y) ) \\ (+1) & ∀x. & x + 0 = x \\ (+2) & ∀x, y. & x + s(y) = s(x + y) \end{matrix}

(nat1) says that any natural number is zero or the successor of another natural number, while (+1) and (+2) define the function ‘+’.

Now we want to prove that 0 is neutral also to the left:

(+1sym)  0 + x^{∀,w} = x^{∀,w}; w1^{∃}(x^{∀,w}), <1^{∃}, ≲1^{∃}

Note that in the syntactical construct (+1sym) the semi-colon is used to separate its sequent from the following weight construct, where the weight term w1^{∃}(x^{∀,w}) measures the induction hypothesis (+1sym) in the induction ordering given by ‘<1^{∃}’ and ‘≲1^{∃}’. Why these explicit weights are so important in descente infinie is explained in Wirth & Becker (1995) and more detailed in Wirth (1997), Section 12.

Before we come to our proof tree in XQuodLibet we first give an informal proof in the working mathematician fashion.

We have to show

0 + x^{∀,w} = x^{∀,w}. (1)

As, by (nat1), each natural number is either zero or not, we do the following case analysis:

\underline{x^{∀,w} = 0:} We have to show

0 + 0 = 0, (1.1)

which follows from (+1).

\underline{x^{∀,w} = s(y^{∀,w}):} We have to show

0 + s(y^{∀,w}) = s(y^{∀,w}), (1.2)

which by (+2) we can rewrite into s(0 + y^{∀,w}) = s(y^{∀,w}), (1.2.1) which we can again rewrite with the induction hypothesis (1) (setting {x^{∀,w}↦y^{∀,w}}) into

s(y^{∀,w}) = s(y^{∀,w}), (1.2.1.1)

which is an equality axiom.

We still have to find an induction ordering <1^{∃} and some weight term w1^{∃}(x^{∀,w}) for “ 0 + x^{∀,w} = x^{∀,w} ” such that the instance of the applied induction hypothesis is smaller than the induction conclusion we are just proving, i.e. such that w1^{∃}(y^{∀,w}) <1^{∃} w1^{∃}(x^{∀,w}). By our case assumption this is nothing but

w1^{∃}(y^{∀,w}) <1^{∃} w1^{∃}(s(y^{∀,w})). (1.2.1.2)

But this is trivial: We simply set w1^{∃}(x) := x, choose <1^{∃} to be the ordering ≺ on natural numbers and ≲1^{∃} to be its reflexive ordering ⪯, and get the ordering axiom

y^{∀,w} ≺ s(y^{∀,w}). (1.2.1.2.1)

In XQuodLibet the proof tree of this proof will be displayed very similar to the following figure.

(1) 0 + x^{∀,w} = x^{∀,w}; w1^{∃}(x^{∀,w})

(nat1), γ, β, δ, Rewrite^{+}

(1.1) 0 + 0 = 0; w1^{∃}(0)

(1.2) 0 + s(y^{∀,w}) = s(y^{∀,w}); _{w1^{∃}(s(y^{∀,w}))}

(+1), γ (+2), γ, Rewrite

(1.2.1) s(0 + y^{∀,w}) = s(y^{∀,w}); _{w1^{∃}(s(y^{∀,w}))}

(+1sym) as induction hypothesis instantiated via {x^{∀,w}↦y^{∀,w}}, Rewrite

(1.2.1.1) s(y^{∀,w}) = s(y^{∀,w}); _{w1^{∃}(s(y^{∀,w}))} (1.2.1.2) _{w1^{∃}(y^{∀,w})}<_{w1^{∃}(s(y^{∀,w}))}; _{w1^{∃}(s(y^{∀,w}))}

AX

Set weight: w1^{∃}(x) := x

(1.2.1.2.1) y^{∀,w}<s(y^{∀,w}); s(y^{∀,w})

AX

Actually, only the square boxes are part of the proof tree. The round-edged boxes show applications of inference rules. While in QuodLibet several inference rules may be applied to a single node of a proof tree (yielding alternative proof attempts in and-or-trees) for the theoretical considerations in this paper we will always apply inference rules only to leaf nodes, resulting in the and-trees that are common for sequent and tableau calculi. Although the round-edged nodes are actually not part of our proof trees here, they are quite useful:

1. In our tree presentation we can check whether the tree is closed simply by realizing that all leaves are round-edged nodes. This means that, in addition to the standard notion of a tree (cf. Knuth (1997 f.), Vol. I), as a special feature we assume an explicit representation of leaves, so that, when we add the elements of a set G as children to a leaf node l, this l is not a leaf anymore, even if G is empty. This feature is not only useful for implementation purposes (where we have to record somewhere why a branch is closed) but also in the theory we present in this paper, where the validity of the root sequent of a proof tree is always supposed to reduce to the validity of all leaf sequents of a proof tree and the closed branches should not be considered.

2. We have used round-edged nodes to give some information how inference steps can be achieved in terms of general inference rules like the ones presented at the end of Section 2.3, which are more elementary than the inference rules in QuodLibet.

E.g., “ (nat1), γ, β, δ, Rewrite^{+} ” in the first round-edged box means that we should actually use the axiom (nat1) and apply a γ-, a β-, and a δ-step and several Rewritesteps to it in order to get the following partial proof tree below, where in the last inference steps (resulting in (1.1) and (1.2)) the left-most literals of the parents of the leaf nodes are safely (cf. Section 13.2) thrown away (because x^{∀,w} is in solved form^{12}).

(1) \begin{matrix}¬∀x. ( x=0 ∨ ∃y. x=s(y) ), \\ 0 + x^{∀,w} & = & x^{∀,w} & ; & w1^{∃}(x^{∀,w}) \end{matrix} \begin{matrix}¬( x^{∀,w}=0 ∨ ∃y. x^{∀,w}=s(y) ), \\ 0 + x^{∀,w} & = & x^{∀,w} & ; & w1^{∃}(x^{∀,w}) \end{matrix} x^{∀,w}≠0, 0 + x^{∀,w} = x^{∀,w}; w1^{∃}(x^{∀,w})  ¬∃y. x^{∀,w}=s(y), 0 + x^{∀,w} = x^{∀,w}; w1^{∃}(x^{∀,w}) x^{∀,w}≠0, 0 + 0 = 0; w1^{∃}(0)  _{x^{∀,w}≠s(y^{∀,w}), 0 + x^{∀,w} = x^{∀,w}; w1^{∃}(x^{∀,w})} (1.1)  _{x^{∀,w}≠s(y^{∀,w}), 0 + s(y^{∀,w}) = s(y^{∀,w}); w1^{∃}(s(y^{∀,w}))} (1.2)

Note that <1^{∃} and ≲1^{∃} are not used in the XQuodLibet proof because the system provides only a single induction quasi-ordering ≲ and no different choice for ≲1^{∃} and <1^{∃} but ≲ and its ordering <, resp., is possible, cf. Section 4.2.

4.2 Example: Induction Ordering in QuodLibet

In QuodLibet, a tactic-based ITP system for clausal logic, cf. Kühler (2000), we essentially use the size of a uniquely denoting constructor ground term in the standard ordering on natural numbers for each user-defined type. In each of the models that establish the inductive validity for QuodLibet (type-C in Wirth & Gramlich (1994b)) this results in a wellfounded quasi-ordering on the objects of each universe because different constructor ground terms of the same type evaluate to different objects in the universe for this type.

Moreover, there is a special type ORD that can be used for lexicographic combinations of the user-defined types up to a fixed finite length, say m. Note that we cannot take arbitrary length because the lexicographic combination of arbitrary length of wellfounded orderings is not wellfounded: (1) > (0, 1) > (0, 0, 1) > · · · . This m is not limiting the QuodLibet system, however, because it is not implemented: If a proof attempt is successful it has used only a finite number of finite terms and we can assume that m is the maximum length of lexicographic combination occurring in them.^{13}

While for general descente infinie not only the weights but also the induction ordering can be chosen for each proof differently, in QuodLibet it has shown to be adequate to use this fixed wellfounded quasi-ordering (depending on the signature Σ) because the lazy substitution of the 2^{nd} order weight variables during the proofs provides sufficient flexibility for the intended application domain of partially defined recursive functions, cf. Kühler & Wirth (1996), Wirth & Gramlich (1994a).

As in the example proof of Section 4.1, each weight for a conjecture Γ initially is a term w^{∃}(y_{0}^{∀,w}, …, y_{n−1}^{∀,w}) where the y_{i}^{∀,w} are the weak free universal variables of Γ and w^{∃} is a global (rigid) free existential variable that can be chosen during the induction proof appropriately. Most of the time it is sufficient to let w^{∃} be some projection ∀y_{0}, …, y_{n−1}. w^{∃}(y_{0}, …, y_{n−1}) = y_{i}, or more formally, to apply the existential R-substitution {w^{∃} ↦ λy_{0}, …, y_{n−1}. y_{i}}. When the goal is w^{∃}(t_{1}, t_{2}) < w^{∃}(t_{2}, s(t_{1})) for natural number terms t_{i} a good idea might be to choose w^{∃} to be the addition on natural numbers, or when in another proof we have the goals w^{∃}(t_{1}, (t_{1} + t_{2})) < w^{∃}(s(t_{1}), t_{1}) and w^{∃}(t_{1}, t_{2}) < w^{∃}(t_{1}, s(t_{2})) a good idea might be to choose w^{∃} to be the lexicographic combination of length up to 2. Note that for mutual induction with several conjectures it may be necessary to compare lexical tuples of different length, cf. Section 16.

The fixed induction ordering in systems like Nqthm (cf. Boyer & Moore (1988)) or QuodLibet prevent the users from destroying soundness by providing induction orderings that are not wellfounded. Contrary to this, the ITP system Expander (Padawitz (1998)) permits the free choice of any binary relation but the results come with the proviso that this relation is a wellfounded ordering. As wellfoundedness is a property of 2^{nd} order, only in higher-order theorem provers it becomes possible to have variable induction orderings and express their required wellfoundedness in the theorems, as we will do in Section 19.

4.3 Descente Infinie and Foundedness

We still have to explain what the example proof of Section 4.1 has to do with descente infinie. To this end, suppose that there is a counterexample for (1), i.e. some natural number x^{∀,w} s.t. 0 + x^{∀,w} = x^{∀,w} is not the case. Since all branches of our proof tree are closed, the counterexample must have left the tree during the proof. With all the standard steps of deductive theorem proving this is impossible because validity of the children always implies validity of the parent sequent. Thus, the counterexample must have gone through (1.2) and (1.2.1) and then jumped out into the applied induction hypothesis. This means that y^{∀,w} is some counterexample for (1), too. But (1.2.1.2) shows that this counterexample is smaller than our original one. Thus any counterexample would descend infinitely (descente infinie). The above proof tree can be seen as a program for computing, for each given natural number, a purely deductive proof tree when we replace the branch (1.2.1.2) with the recursive call to this program again. Since our induction ordering is wellfounded, the sub-tree (1.2.1.2) guarantees termination. Therefore, we know that after a finite number of recursive calls—although this number of descents may be indefinite (descente indéfinie)— the program will end up in the branch of the base case (1.1).

Definition 4.1 (Method of Descente Infinie) A proposition Γ can be proved by descente infinie as follows:

Show that for each counterexample of Γ there is another counterexample of Γ that is smaller in a wellfounded ordering!

Finally note that for the proof in the working mathematician fashion it is not really important whether the working mathematician thinks in terms of counterexamples. What matters is that he can execute the proof method. Indeed, the higher notion of foundedness (cf. Definition 1 of Wirth & Becker (1995) and Definition 12.2 of this paper) can be applied in order to think about descente infinie without the negative argumentation on counterexamples, but with the positive metaphor of building a supporting frame in a swamp, cf. Section 12.

4.4 Dependent Choice, Wellfoundedness, and Descente Infinie

Although the Axiom of Foundation and even very strong forms of the Axiom of Choice cannot destroy a consistency of set theory (cf. Gödel (1986 ff.), Vol. II), this does not mean that it is generally appropriate to assume the validity of these axioms. The Axiom of Choice is especially inappropriate when one wants to discuss the logical strength of different forms of induction. This is because the Axiom of Choice implies the strongest known forms of induction, so that all forms of induction become valid and of equal logical strength in the presence of the Axiom of Choice. A weak form (or proper logical consequence) of (the strong proper class form of) the Axiom of Choice is the following; cf. Rubin & Rubin (1985), p. 19; Howard & Rubin (1998), Form 43, p. 30.

Definition 4.2 (Principle of Dependent Choice) If R is a binary relation with ran(R)⊆dom(R) ≠ ∅, then R is not terminating.

While we have defined wellfoundedness over the existence of minimal elements in classes, a well-known alternative is to define it as termination of the reverse relation. While the converse of the following principle is tautological, the principle itself is not. Thus it makes wellfoundedness independent of the choice of one of its alternatives for its definition; cf. Howard & Rubin (1998), Form 43 R, p. 32.

Definition 4.3 (Principle of Wellfoundedness) If < is an ordering and > is terminating, then < is wellfounded.

Definition 4.4 (Principle of Descente Infinie) If < is an ordering, the class A has no <-minimal elements (i.e. ∀a ∈ A. ∃a′ ∈ A. a > a′), and Version 1: > ∩ (A×A) is terminating

Version 2: each C ⊆ A totally ordered by < has a <-minimal element then A is empty.

When we used the alternative definition of wellfoundedness, we would need^{14} the Principle of Descente Infinie to guarantee the soundness of the Method of Descente Infinie, cf. Definition 4.1. Indeed, the soundness is achieved by setting A to be the class of counterexamples of Γ in Version 1, which is slightly stronger only at first sight than Version 2, which we got listed in Howard & Rubin (1998), p. 31, as Form 43 K. In fact, all these principles are of equal strength:

Lemma 4.5 The Principles of Dependent Choice, Wellfoundedness, and Descente Infinie (both versions) are logically equivalent to each other in set theory, even without axioms of Choice, Foundation, or Power-set.

Finally, note that theoretically it is also possible to use the strictly stronger Axiom of Choice (or Zorn’s Lemma) instead of the Principle of Dependent Choice in order to get the soundness principle for a stronger induction method than the Method of Descente Infinie by replacing in Definition 4.4 “ > ∩ (A×A) is terminating” with “each non-terminating sequence in > ∩ (A×A) has a < ∩ (A×A) -lower bound”, cf. Geser (1995).

4.5 Without Skolemization

Contrary to most first-order deductive frameworks, Skolemization is not appropriate for descente infinie, for matrix calculi like the ones in Wallen (1990), and some higher-order approaches like Kohlhase (1998). Skolemization has at least three problematic aspects:

1. Skolemization enriches the signature or introduces higher-order variables. Unless special care is taken, this may introduce objects into empty universes, change the notion of term-generatedness or Herbrand or Henkin models, and imply forms of the Axiom of Choice that were not part of the theory before. Above that, the Skolem functions occur in answers to queries or solutions of constraints which in general cannot be translated into the original signature. For a detailed discussion of these problems cf. Miller (1992).

2. Skolemization results in the following simplified quantification structure: For all Skolem functions u⃗ there are solutions to the free existential variables e⃗ (i.e. the free variables of Fitting (1996)) s.t. the quantifier-free theorem Γ (e⃗, u⃗) is valid. Short: ∀u⃗. ∃e⃗. Γ (e⃗, u⃗)

When the state of a proof attempt is represented as the conjunction of the branches of a tree (as e.g. in sequent or (dually) in tableau calculi), the free existential variables become “rigid” or “global”, i.e. a solution for a free existential variable must solve all occurrences of this variable in the whole proof tree. This is because, for B_{0}, …, B_{n} denoting the branches of the proof tree for Γ (e⃗, u⃗), ∀u⃗. ∃e⃗. ( B_{0} ∧ … ∧ B_{n} ) is in general logically strictly stronger than ∀u⃗. ( ∃e⃗. B_{0} ∧ … ∧ ∃e⃗. B_{n} )

Moreover, with this quantification structure it does not seem to be possible to do ITP by descente infinie because the induction hypothesis applications may destroy the counterexample:

When we have some counterexample u⃗ for Γ (e⃗, u⃗) (i.e. there is no e⃗ s.t. Γ (e⃗, u⃗) is valid) then, for different e⃗, different branches B_{i} in the proof tree may cause the invalidity of the conjunction. If we have applied induction hypotheses in more than one branch, for different e⃗ we get different smaller counterexamples for different branches. What we would need, however, is one single smaller counterexample for all e⃗.

3. Skolemization increases the size of the formulas. (Note that in most calculi the only relevant part of Skolem terms is the top symbol and the set of occurring variables.)

The first and second problematic aspects disappear when one uses raising (cf. Miller (1992)) instead of Skolemization. Raising is a dual of Skolemization and simplifies the quantification structure to something like:

There are raising functions e⃗ s.t. for all possible values of the free universal variables u⃗ (i.e. the nullary constants or “parameters”) the quantifier-free theorem Γ (e⃗, u⃗) is valid. Short: ∃e⃗. ∀u⃗. Γ (e⃗, u⃗)

Note that due to the two duality switches “unsatisfiability vs. validity” and “Skolemization vs. raising”, in this paper raising will look much like Skolemization in refutational theorem proving. The difference between raising and Skolemization is best remembered by the fact that raising is related to the γ-rules while Skolemization is related to the δ-rules according to the classification of Section 2.3.

The inverted order of universal and existential quantification of raising (compared to Skolemization) is advantageous because now ∃e⃗. ∀u⃗. ( B_{0} ∧ … ∧ B_{n} ) is indeed logically equivalent to ∃e⃗. ( ∀u⃗. B_{0} ∧ … ∧ ∀u⃗. B_{n} )

Furthermore, the induction hypothesis application of descente infinie works well: When, for some (fixed) e⃗_{0}, we have some counterexample u⃗ for Γ (e⃗_{0}, u⃗) (i.e. Γ (e⃗_{0}, u⃗) is invalid) then one branch B_{i} in the proof tree must cause the invalidity of the conjunction. If this branch is closed, then it contains the application of an induction hypothesis that is invalid for this e⃗_{0} and the u′ resulting from the instantiation of the hypothesis. Thus, u′ together with the induction hypothesis provides the strictly smaller counterexample we are looking for for this e⃗_{0}.

The third problematic aspect disappears when the dependency of variables is explicitly represented in a variable-condition, cf. Kohlhase (1995). This idea actually has a long history, cf. Prawitz (1960), Kanger (1963), Bibel (1987). Moreover, the use of variable-con-ditions frees our free existential variables from carrying around the free universal variables they may depend on. Thus, the free existential variables for first-order bound variables stay first-order.

4.6 Preservation of Solutions

Users even of pure Prolog are not so much interested in theorem proving as they are in computation of answers to queries or of solutions to query variables. The theorem they want to prove usually contains some free existential variables that are instantiated during a proof attempt. When the proof attempt is successful, not only the input theorem is known to be valid but also the instance of the theorem with the substitution built-up during the proof. Since the knowledge of mere existence is less useful than the knowledge of a term that witnesses this existence, theorem proving should—if possible without overhead— always provide these witnessing terms (or solutions). Computation of answers and solutions is no problem for Prolog’s Horn logic theories. For clausal logic theories, in Baumgartner &al. (1997) tableau calculi are used for computation of answers that go beyond simple solutions (i.e. substitutions) in that they are sets of substitutions s.t. the disjunction of the instantiations of the query with these substitutions is in the theory; a possible negation of the query instances is, however, not taken into account. This negation is included in Ten Cate & Shan (2002), where for general first-order theories the answers computed with a tableau calculus are formulas built-up from instances of the query and equalities with any logical operators and quantifiers. For universal theories and quantifier-free queries, these answers do not need quantifiers and are very intuitive. In general, however, when δ-steps occur in a proof, the introduced free universal variables (or Skolem terms) may provide no information on what kind of object they denote. While this is not possible in terms of computability or λ-terms, the information can be provided in form of Hilbert’s ε-terms (cf. Leisenring (1969), Hilbert & Bernays (1968/70), Vol. II), and our calculi will offer this possibility. In order to avoid additional overhead, in this paper, however, we will focus on preservation of solutions instead of computation of answers, which is a more general task. By “preservation of solutions” we mean at least the following property:

All solutions that transform a proof attempt for a proposition into a closed proof (i.e. the closing substitutions for the free existential variables) are also solutions of the original proposition.

Suppose that our original input theorem Γ (e⃗, u⃗) (cf. the discussion in Section 4.5) has been reduced to G(e⃗, u⃗) representing the state of the proof attempt. With “preservation of solutions” we mean that, for any instance e⃗_{0},

G(e⃗_{0}, u⃗) implies Γ (e⃗_{0}, u⃗) for each u⃗. ($)

This is again closely related to descente infinie:

Suppose that we have found some instance e⃗_{0} s.t. for each counterexample u⃗ of G(e⃗_{0}, u⃗) there is a counterexample u′ for the original theorem (i.e. Γ (e⃗_{0}, u′) is invalid) and that this u′ is strictly smaller than u⃗ in some wellfounded ordering. In this case we have proved Γ (e⃗_{0}, u⃗) (and thus Γ (e⃗, u⃗)) only if

each counterexample u⃗ for Γ (e⃗_{0}, u⃗) is also a counterexample for G(e⃗_{0}, u⃗).

The latter is the contrapositive of ($) and therefore logically equivalent to it.

4.7 The Liberalized δ-rule

Definition 4.6 (Variable-Condition) A variable-condition is a subset of V_{free} × V_{free}.

Roughly speaking, for a variable-condition R, (x^{∃}, y^{∀}) ∈ R says that x^{∃} is older than y^{∀}, so that we must not instantiate the free existential variable x^{∃} with a term containing the free universal variable y^{∀}.

While the benefit of the introduction of free existential variables in γ-rules is to delay the choice of a witnessing term (which is required by our design goal of a natural flow of information, cf. Section 2.1), it is sometimes unsound to instantiate a free existential variable x^{∃} with a term containing a free universal variable y^{∀} that was introduced later than x^{∃}:

Example 4.7 ∃x. ∀y. (x = y) is not deductively valid. We can start a proof attempt via: γ-step: ∀y. (x^{∃} = y), ∃x. ∀y. (x = y) δ-step: (x^{∃} = y^{∀}), ∃x. ∀y. (x = y) Now, if we were allowed to substitute the free existential variable x^{∃} with the free universal variable y^{∀}, we would get the tautology (y^{∀} = y^{∀}), i.e. we would have proved an invalid formula. In order to prevent this, the δ-step has to record (x^{∃}, y^{∀}) in the variable-condition, which disallows the instantiation step.

In order to restrict the possible instantiations as little as possible, we should keep our variable-conditions as small as possible. Kanger (1963), Bibel (1987), and Wallen (1990) are quite generous in that they let their variable-conditions become quite big:

Example 4.8 ∃x. ( ∀y. ¬P(y) ∨ P(x) ) can be proved the following way: γ-step: ∀y. ¬P(y) ∨ P(x^{∃}), ∃x. ( ∀y. ¬P(y) ∨ P(x) ) α-step: ∀y. ¬P(y), P(x^{∃}), ∃x. ( ∀y. ¬P(y) ∨ P(x) ) Liberalized δ-step: ¬P(y^{∀,s}), P(x^{∃}), ∃x. ( ∀y. ¬P(y) ∨ P(x) ) Instantiation step: ¬P(y^{∀,s}), P(y^{∀,s}), ∃x. ( ∀y. ¬P(y) ∨ P(x) ) The last step is not allowed in the above citations, so that another γ-step must be applied to the original formula in order to prove it. Our instantiation step, however, is perfectly sound: Since x^{∃} does not occur in ∀y. ¬P(y), the free variables x^{∃} and y^{∀,s} do not depend on each other and there is no reason to insist on x^{∃} being older than y^{∀,s}. Indeed, moving-in the existential quantifier transforms the original formula into the logically equivalent formula ∀y. ¬P(y) ∨ ∃x. P(x), which (after a preceding α-step) enables the δ-step introducing y^{∀,s} to come before the γ-step introducing x^{∃}.

Keeping the variable-conditions generated by the δ-rule small results in exponential and even non-elementary reduction of the size of smallest proofs. The “liberalization of the δ-rule” has the following history of reduction in size of smallest proofs: Smullyan (1968), Hähnle & Schmitt (1994) (δ^{+}), Beckert &al. (1993) (δ^{+^{+}}), Baaz & Fermüller (1995) (δ^{∗}), Cantone & Nicolosi-Asmundo (2000) (δ^{∗^{∗}}). The step from δ^{+} to δ^{+^{+}} (just like the step from δ^{+^{+}} to Giese & Ahrendt (1999) (δ^{ε})) does not reduce the variable-condition (as all others do) but reduces the number of Skolem symbols (just like the step from δ^{∗} to δ^{∗^{∗}}). While the liberalized δ-rule of Smullyan (1968) is already able to prove the formula of Ex. 4.8 with a single γ-step, it is much more restrictive than the δ^{+}-rule which can treat free existential variables. For this paper, the change from the non-liberalized δ-rule to the liberalized δ^{+}- rule is the problematic one because it destroys the preservation of solutions, cf. Section 8. Some further improvements over δ^{+} are considered in Section 20.

Note that liberalization of the δ-rule is not a simple task because it easily results in unsound calculi, cf. Kohlhase (1995) w.r.t. our Ex. 4.9 and Kohlhase (1998) w.r.t. our Ex. 14.2. The difficulty lies with instantiation steps that relate previously unrelated variables:

Example 4.9 ∃x. ∀y. Q(x, y) ∨ ∃u. ∀v. ¬Q(v, u) is not deductively valid (to wit, let Q be the identity relation on a non-trivial universe). Consider the following proof attempt: One α-, two γ-, and two liberalized δ-steps result in

(∗) Q(x^{∃}, y^{∀,s}), ¬Q(v^{∀,s}, u^{∃}), ∃x. ∀y. Q(x, y), ∃u. ∀v. ¬Q(v, u)

with variable-condition

(#) R := {(x^{∃}, y^{∀,s}), (u^{∃}, v^{∀,s})}

Note that the non-liberalized δ-rule would additionally have produced (x^{∃}, v^{∀,s}) or (u^{∃}, y^{∀,s}) or both, depending on the order of the proof steps. When we now instantiate x^{∃} with v^{∀,s}, we relate the previously unrelated variables u^{∃} and y^{∀,s}. Thus, our new goal

Q(v^{∀,s}, y^{∀,s}), ¬Q(v^{∀,s}, u^{∃}), ∃x. ∀y. Q(x, y), ∃u. ∀v. ¬Q(v, u)

must be equipped with the new variable-condition (u^{∃}, y^{∀,s}). Otherwise we could instantiate u^{∃} with y^{∀,s}, resulting in the tautology Q(v^{∀,s}, y^{∀,s}), ¬Q(v^{∀,s}, y^{∀,s}), … Note that in the standard framework of Skolemization and unification, this new variablecondition is automatically generated by the occur-check of unification: When we instantiate x^{∃} with v^{∀,s}(u^{∃}) in Q(x^{∃}, y^{∀,s}(x^{∃})), ¬Q(v^{∀,s}(u^{∃}), u^{∃}), … we get Q(v^{∀,s}(u^{∃}), y^{∀,s}(v^{∀,s}(u^{∃}))), ¬Q(v^{∀,s}(u^{∃}), u^{∃}), … which cannot be reduced to a tautology because y^{∀,s}(v^{∀,s}(u^{∃})) and u^{∃} cannot be unified. When we instantiate the variables x^{∃} and u^{∃} in the sequence (∗) in parallel via

($) σ := {x^{∃}↦v^{∀,s}, u^{∃}↦y^{∀,s}},

we have to check whether the newly imposed variable-conditions are consistent with the substitution itself. In particular, a cycle as given (for the R of (#)) by

u^{∃}  _{R} v^{∀,s}_{σ^{−1}} y^{∀,s}_{σ^{−1}} x^{∃}_{R}

must not exist.

5 Existential Substitutions

Several binary relations on free variables will be introduced in this and the following sections. The overall idea to be remembered is that when (x, y) occurs in such a relation this means something like “x is necessarily older than y” or “the value of y depends on or is described in terms of x”.

Definition 5.1 (E_{σ}, U_{σ}) For a substitution σ we define the existential relation to be

E_{σ} := { (z^{∃}, x) | x ∈ dom(σ) ∧ z^{∃} ∈ V_{∃}(σ(x)) },

and the universal relation to be U_{σ} := { (y^{∀}, x) | x ∈ dom(σ) ∧ y^{∀} ∈ V_{∀}(σ(x)) }.

Definition 5.2 ([[Quasi-]Existential] R-Substitution) Let R be a variable-condition, cf. Definition 4.6. σ is an R-substitution if σ is a substitution for that R ∪ E_{σ} ∪ U_{σ} is wellfounded. σ is existential if dom(σ) ⊆ V_{∃}. σ is quasi-existential if dom(σ) ⊆ V_{∃} ⊎ V_{∀,s}.

Note that, regarding syntax, (x, z^{∃}) ∈ R is intended to mean that an R-substitution σ may not replace x with a term in which z^{∃} occurs, i.e. (z^{∃}, x) ∈ E_{σ} must be disallowed, i.e. R ∪ E_{σ} must be wellfounded. As another example, take from Ex. 4.9 the variable-con-dition R of (#) and the σ of ($). As explained there, σ must not be an R-substitution due to the cycle

u^{∃}  _{R} v^{∀,s}_{U_{σ}} y^{∀,s}_{U_{σ}}  x^{∃}_{R}

which just contradicts the wellfoundedness of R ∪ U_{σ}. Note that in practice w.l.o.g. R, E_{σ}, and U_{σ} can always be chosen to be finite, so that R ∪ E_{σ} ∪ U_{σ} is wellfounded iff it is acyclic.

After application of an R-substitution σ, in case of (x, y^{∀}) ∈ R, we have to update our variable-condition R in order to ensure that x is not replaced with y^{∀} via a future application of another R-substitution that replaces a free variable say u^{∃} occurring in σ(x) with y^{∀}. In this case, the transitive closure of the updated variable-condition has to contain (u^{∃}, y^{∀}). But we have u^{∃} E_{σ} x R y^{∀}. This means that R ∪ E_{σ} must be a subset of the updated variable-condition. Besides this, we have to add steps with U_{σ} again.

Definition 5.3 (σ-Update) Let R be a variable-condition and σ be a substitution. The σ-update of R is R ∪ E_{σ} ∪ U_{σ}.

Example 5.4 In the proof attempt of Ex. 4.9 we applied the existential R-substitution σ′ = {x^{∃}↦v^{∀,s}} where R = {(x^{∃}, y^{∀,s}), (u^{∃}, v^{∀,s})}. Note that U_{σ′} = {(v^{∀,s}, x^{∃})} and E_{σ′} = ∅. Thus, the σ′- update of R is then given by the following finite graph whose transitive closure is irreflexive and thus a wellfounded ordering.

u^{∃}  _{R} v^{∀,s}_{U_{σ′}} y^{∀,s}  x^{∃}_{R}

Note that our treatment of variable-conditions here is not arbitrary, but carefully designed according to the following items.

• For efficiency reasons we should never compute transitive closures but simply keep adding new edges to a graph. The relevant wellfoundedness-checks can then be performed as acyclicity-checks, which have a time complexity that is linear in the number of edges. This cannot be improved.

• All other approaches I found in the literature are either more complicated and less powerful or else unsound, cf. Section 4.7. The version presented here is optimal for the choices described in the following two items.

• It is with our variable-conditions that we have invested most effort in the possibility of an efficient implementation and where we are already very close to an implementation. Actually, we have even sacrificed some other possibilities for efficiency; namely for the liberalization of the δ-rule (cf. Section 4.7) we sacrificed the possibility to represent Henkin quantifiers or K. Jaakko J. Hintikka’s IF logic, cf. Hintikka (1996). Nevertheless, you can have them if you really want them.^{15}

• For simplicity of implementation we even have made re-use and permutations of free existential variables like {x^{∃}↦u^{∃}, u^{∃}↦x^{∃}} impossible. Indeed, all these substitutions lead to a cycle in the existential relation and thus are no R-substitutions according to the above definitions. Re-use and permutations of free existential variables are not appropriate in practice because then we need a time reference in addition to the name of a free existential variable to retrieve its solution or value. Nevertheless, you can have them if you really want them, and we have worked out everything for you in a sequence of notes^{16} because this non-trivial enterprise put to test the well-designedness of the concepts of the whole modeling presented in this paper.

6 Existential Valuations

Let A be some Σ-structure. We now define semantical counterparts of our existential R-substitutions, which we will call “existential (A, R)-valuations”.

As such an existential (A, R)-valuation e takes over the role of the raising functions of Section 4.5, it does not simply map each free existential variable directly to an object of A (of the same type), but must have the ability to additionally read the values of some free universal variables under an A-valuation τ ∈ V_{∀} → A. More precisely, e gets some restriction of τ, say τ′ ∈ V_{∀} ⇝ A with τ′⊆ τ, as a second argument. Short:

e : V_{∃} → (V_{∀} ⇝ A) ⇝ A.

Moreover, for each free existential variable x^{∃}, we require the set dom(τ′) of free universal variables read by e(x^{∃}) to be identical for all τ. This identical set will be denoted with S_{e}⟨{x^{∃}}⟩ below. More technically, we require that there is some “semantical relation” S_{e} ⊆ V_{∀}×V_{∃} s.t. for all x^{∃} ∈ V_{∃}:

e(x^{∃}) : (S_{e}⟨{x^{∃}}⟩ → A) → A.

Note that, for each e : V_{∃} → (V_{∀} ⇝ A) ⇝ A, at most one semantical relation exists, namely

S_{e} := { (y^{∀}, x^{∃}) | x^{∃} ∈ V_{∃} ∧ y^{∀} ∈ dom(⋃(dom(e(x^{∃})))) }.

In the following definitions we are slightly more general because we want to apply the terminology not only to free existential variables but also to strong free universal variables.

Definition 6.1 (Semantical Relation (S_{e})) The semantical relation of e is

S_{e} := { (y, x) | x ∈ dom(e) ∧ y ∈ dom(⋃(dom(e(x)))) }.

e is semantical if e is a partial function on V s.t. for all x ∈ dom(e):

e(x) : (S_{e}⟨{x}⟩ → A) → A.

Definition 6.2 (Existential (A, R)-Valuation) Let R be a variable-condition and A a Σ-structure. e is an existential (A, R)-valuation if e : V_{∃} → (V_{∀} ⇝ A) ⇝ A, e is semantical, and R ∪ S_{e} is wellfounded.

Finally, we need the technical means ϵ that turns an existential (A, R)-valuation e together with a valuation τ of the free universal variables into a valuation ϵ(e)(τ) of the free existential variables:

Definition 6.3 (ϵ) We define the function

ϵ : (V ⇝ (V ⇝ A) ⇝ A) → (V ⇝ A) → V ⇝ A

for e : V ⇝ (V ⇝ A) ⇝ A, τ ∈ V ⇝ A, x ∈ V by ϵ(e)(τ)(x) := e(x)(_{S_{e}⟨{x}⟩}↿τ).

7 Validity

We are now going to define R-validity of a set of sequents with free variables, in terms of validity of a formula.

Definition 7.1 (Validity, K) Let R be a variable-condition, A a Σ-structure, and G a set of sequents. G is R-valid in A if there is an existential (A, R)-valuation e s.t. G is (e, A)-valid. G is (e, A)-valid if G is (τ, e, A)-valid for all τ ∈ V_{∀} → A. G is (τ, e, A)-valid if G is valid in A ⊎ ϵ(e)(τ) ⊎ τ. G is valid in A if Γ is valid in A for all Γ ∈ G. A sequent Γ is valid in A if there is some formula listed in Γ that is valid in A. Validity in a class of Σ-structures is understood as validity in each of the Σ-structures of that class. If we omit the reference to a special Σ-structure we mean validity &c. in some fixed class K of Σ-structures, e.g. the class of all Σ-structures (Σ-algebras) or the class of Herbrand Σstructures (term-generated Σ-algebras), cf. Wirth & Gramlich (1994b) for more interesting classes for establishing inductive validities.

Example 7.2 (Validity)

For x^{∃} ∈ V_{∃}, y^{∀} ∈ V_{∀}, the sequent x^{∃}=y^{∀} is ∅-valid in any A because we can choose S_{e} := V_{∀}×V_{∃} and e(x^{∃})(τ) := τ(y^{∀}) for τ ∈ V_{∀} → A, resulting in ϵ(e)(τ)(x^{∃}) = e(x^{∃})(_{S_{e}⟨{x^{∃}}⟩}↿τ) = e(x^{∃})(_{V_{∀}}↿τ) = τ(y^{∀}). This means that ∅-validity of x^{∃}=y^{∀} is the same as validity of ∀y. ∃x. x=y. Moreover, note that ϵ(e)(τ) has access to the τ-value of y^{∀} just as a raising function f for x in the raised (i.e. dually Skolemized) version f(y^{∀})=y^{∀} of ∀y. ∃x. x=y.

Contrary to this, for R := V_{∃}×V_{∀}, the same formula x^{∃}=y^{∀} is not R-valid in general because then the required irreflexivity of S_{e}∘R implies S_{e} = ∅, and e(x^{∃})(_{S_{e}⟨{x^{∃}}⟩}↿τ) = e(x^{∃})(_{∅}↿τ) = e(x^{∃})(∅) cannot depend on τ(y^{∀}) anymore. This means that (V_{∃}×V_{∀})-validity of x^{∃}=y^{∀} is the same as validity of ∃x. ∀y. x=y. Moreover, note that ϵ(e)(τ) has no access to the τ-value of y^{∀} just as a raising function c for x in the raised version c=y^{∀} of ∃x. ∀y. x=y.

For a more general example let G = { A_{i,0} … A_{i,n_{i}−1} | i ∈ I }, where for i ∈ I and j ≺ n_{i} the A_{i,j} are formulas with free existential variables from x⃗ and free universal variables from y⃗. Then (V_{∃}×V_{∀})-validity of G means validity of ∃x⃗. ∀y⃗. ∀i ∈ I. ∃j ≺ n_{i}. A_{i,j} whereas ∅-validity of G means validity of ∀y⃗. ∃x⃗. ∀i ∈ I. ∃j ≺ n_{i}. A_{i,j}

8 Motivation for Reduction and Strong Validity

Besides the notion of validity we need the notion of reduction. Roughly speaking, a set G_{0} of sequents reduces to a set G_{1} of sequents if validity of G_{1} implies validity of G_{0}. This, however, is too weak for our purposes here because we are not only interested in validity but also in preserving the solutions for the free existential variables: For ITP, computation of answers and solutions, and constraint solving it is important that the solutions of G_{1} are also solutions of G_{0}. Thus, we could define that G_{0} R-reduces to G_{1} if (e, A)-validity of G_{1} implies (e, A)-validity of G_{0} for each existential (A, R)-valuation e. This definition works well with all inference rules at the end of Section 2.3 with the exception of the liberalized δ-rules.

The additional solutions (or existential substitutions) that result from the smaller variable-condition generated by the liberalized δ-rule admit additional proofs and answer computations compared to the (non-liberalized) δ-rule. These additional solutions do not add much difficulty when one is interested in validity only, cf. e.g. Hähnle & Schmitt (1994), but when also the preservation of solutions is required, they pose some problems because they may tear some strong free universal variable, say y^{∀,s}, out of its context, namely out of the scope of the quantifier eliminated by y^{∀,s}:

Example 8.1 (Reduction & Liberalized δ-Steps) In Ex. 4.8 a liberalized δ-step reduced ∀y. ¬P(y), P(x^{∃}), … to ¬P(y^{∀,s}), P(x^{∃}), … with empty variable-condition R := ∅. The latter sequent is (e, A)-valid for the existential (A, R)-valuation e given by

e(x^{∃})(τ) := τ(y^{∀,s}).

The former sequent, however, is not (e, A)-valid when P^{A}(a) is true and P^{A}(b) is false for some a, b from the universe of A. To see this, take some τ with τ(y^{∀,s}) := b.

How can we solve the problem exhibited in Ex. 8.1? I.e. how can we change the notion of reduction such that the liberalized δ-step becomes a reduction step?

The first approach one may try is to allow a slight modification of e to e′ such that e′(x^{∃})(τ) = a. However, such a modification of e does not go together well with our requirement of preservation of solutions. Besides, this first approach eventually fails because it is not possible to preserve reduction under Instantiation steps:

E.g., an Instantiation step with the existential R-substitution {x^{∃}↦y^{∀,s}} transforms the reduction of Ex. 8.1 into the reduction of ∀y. ¬P(y), P(y^{∀,s}) to ¬P(y^{∀,s}), P(y^{∀,s})

Taking τ, e, and A as in Ex. 8.1, the new latter sequent is still (e, A)-valid. There is, however, no modification e′ of e such that the new former sequent is (τ, e′, A)-valid.

Learning from this, the second approach one may try is to allow a slight modification of τ instead. E.g., for the reduction step of Ex. 8.1, one would require the existence of some π ∈ {y^{∀,s}} → A s.t. the former sequent is (π ⊎ _{V_{∀}\{y^{∀,s}}}↿τ, e, A)-valid instead of (τ, e, A)-valid. Choosing π := {y^{∀,s}↦a} would solve the problem of Ex. 8.1 then: Indeed, the former sequent is (π ⊎ _{V_{∀}\{y^{∀,s}}}↿τ, e, A)-valid because for the e of Ex. 8.1 we have e(x^{∃})(π ⊎_{V_{∀}\{y^{∀,s}}}↿τ) = (π ⊎_{V_{∀}\{y^{∀,s}}}↿τ)(y^{∀,s}) = a.

Moreover, with this approach, reduction is preserved under Instantiation steps.

The problems with this approach arise, however, when one asks whether there has to be a single π for all τ or, for each τ, a different π:

Example 8.2 Consider the following liberalized δ-step where the additional free universal variable z^{∀} occurs in the principal formula, namely the reduction of ∀y. z^{∀}≠y, z^{∀}=x^{∃} to z^{∀}≠y^{∀,s}, z^{∀}=x^{∃}

For the e of Ex. 8.1 (which gives x^{∃} the value of y^{∀,s}) the latter sequent is (e, A)-valid.

Different π: In case of R = ∅, the former sequent must be (π ⊎_{V_{∀}\{y^{∀,s}}}↿τ, e, A)-valid for all τ. This can only hold when the π ∈ {y^{∀,s}} → A can change when the τ-value of z^{∀} changes:

E.g., for τ := {y^{∀,s}↦a, z^{∀}↦b} we need π(y^{∀,s}) := b,
while for τ := {y^{∀,s}↦b, z^{∀}↦a} we need π(y^{∀,s}) := a.

Indeed, in the reduction above, y^{∀,s} is functionally dependent on z^{∀}. This dependency is the main^{17} reason for our requirement on our liberalized δ-rule to insert (z^{∀}, y^{∀,s}) into the variable-condition, cf. the end of Section 2.3.

Single π: In case of R = {(x^{∃}, z^{∀})}, the former sequent of Ex. 8.2 is not R-valid in general. Thus, in order to preserve the connection between reduction and validity (cf. Lemma 11.2(1)), the step of Ex. 8.2 must not be a reduction, i.e. the former sequent must not be (π ⊎_{V_{∀}\{y^{∀,s}}}↿τ, e, A)-valid for all τ. Therefore, π must not depend on the τvalue of z^{∀}, contrary to the item above. Note that such a dependency would effectively allow x^{∃} to read the value of z^{∀}, which is explicitly forbidden by the variable-condi-tion R.

Thus, the only solution can be that π (just like e) depends on some values of τ but not on others. Since we are interested in extracting information on the solution of free existential variables of the original theorem from a completed proof, we want to have the additional possibility to look up what role the strong free universal variables introduced by liberalized δ-steps really play. And this is what the choice-conditions of the following section are about. With the help of these choice-conditions we can then define the notion of strong validity which gives the strong free universal variables an extra treatment and solves the problem of Ex. 8.1 by disallowing the value b for y^{∀,s} via a choice-condition that requires to choose a value for y^{∀,s} such that P(y^{∀,s}) becomes true.

9 Choice-Conditions

As will be explained below, choice-conditions are closely related to Hilbert’s ε-terms, cf. Hilbert & Bernays (1968/70), Vol. II and Leisenring (1969). For a motivational introduction to choice-conditions as an indefinite semantics for Hilbert’s ε-terms, cf. Wirth (2002). Note that the optional part [⋯] in the following definition is only needed for modeling “subordinate” ε-terms (or “untergeordnete” ε-Ausdrücke according to Hilbert & Bernays (1968/70), Vol. II, p. 24) and not for the combination of descente infinie and deduction where we only need ε-binding on top level.

Definition 9.1 (Choice-Condition, Extension) C is an R-choice-condition if R is a wellfounded variable-condition, C is a partial function from V_{∀,s} into the set of formulas, and z R^{+} y^{∀,s} for all y^{∀,s} ∈ dom(C) and z ∈ V_{free}(C(y^{∀,s}))\{y^{∀,s}}.

More generally, the values of C can be formula-valued λ-terms where, for y^{∀,s} ∈ dom(C) and C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B,

B is a formula whose free occurring variables from V_{bound} are among {v_{0}, …, v_{l−1}} ⊆ V_{bound}

and where, for v_{0} : α_{0}, …, v_{l−1} : α_{l−1}, we have

y^{∀,s} : α_{0} → … → α_{l−1} → α_{l} for some type α_{l},

and any occurrence of y^{∀,s} in B must be of the form y^{∀,s}(v_{0}) ⋯ (v_{l−1}).

(C′, R′) is an extension of (C, R) if C is an R-choice-condition, C′ is an R′-choice-condition, C⊆C′, and R⊆R′.

Definition 9.2 (Compatibility) Let C be an R-choice-condition, A a Σ-structure, and e an existential (A, R)-valuation. π is (e, A)-compatible with (C, R) if

1. π : V_{∀,s} → (V_{∀,w} ⇝ A) ⇝ A is semantical (cf. Definition 6.1) and R ∪ S_{e} ∪ S_{π} is wellfounded.

2. For all y^{∀,s} ∈ dom(C) with C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B and τ ∈ V_{∀,w} → A and χ ∈ {v_{0}, …, v_{l−1}} → A:

If, for some η ∈ {y^{∀,s}} → A,

B is ( _{V_{∀,s}\{y^{∀,s}}}↿(ϵ(π)(τ)) ⊎ η ⊎ τ ⊎ χ, e, A )-valid, then B is (ϵ(π)(τ) ⊎ τ ⊎ χ, e, A)-valid.

Item 1 of this definition is quite technical and needed for lemma application. Roughly speaking, it says that the flow of information between variables expressed in R, e, and π is acyclic.

Item 2 of (e, A)-compatibility of π with say ( {(y^{∀,s}, λv_{0}…. λv_{l−1}. B)}, R ) means that a different choice for the ϵ(π)(τ)-value of y^{∀,s} cannot give rise to a previously not given validity of the formula B in A ⊎ ϵ( e )( ϵ(π)(τ) ⊎ τ ) ⊎ ϵ(π)(τ)⊎τ ⊎χ, or that ϵ(π)(τ)(y^{∀,s}) is chosen such that B becomes valid if such a choice is possible. This is closely related to Hilbert’s ε-operator in the sense that y^{∀,s} is given the value of

λv_{0}…. λv_{l−1}. εy. (B{y^{∀,s}(v_{0}) ⋯ (v_{l−1}) ↦ y})

for an arbitrary y ∈ V_{bound}\V(B).

As the choice for y^{∀,s} depends on the other free variables of λv_{0}…. λv_{l−1}. B (i.e. the free variables of λv_{0}…. λv_{l−1}. εy. (B{y^{∀,s}(v_{0}) ⋯ (v_{l−1}) ↦ y}) ), we required the inclusion of this dependency into the transitive closure of the variable-condition R in Definition 9.1.

Note that the empty function ∅ is an R-choice-condition for any wellfounded (which in the following will always be the case) variable-condition R. Moreover, any π : V_{∀,s} → {∅} → A is (e, A)-compatible with (∅, R) due to S_{π} = ∅. Indeed, a compatible π always exists:

Lemma 9.3 Let C be an R-choice-condition, A a Σ-structure, and e an existential (A, R)-valuation. Now, there is some π that is (e, A)-compatible with (C, R).

Finally, we need means for expressing the requirement on a quasi-existential substitution to replace the strong free universal variables in a way that goes together well with the compatibility of Definition 9.2(2):

Definition 9.4 (Q_{C,σ}) For a substitution σ and an R-choice-condition C, we require Q_{C,σ} to be a function from dom(C) ∩ dom(σ) into the set of sequents s.t. for each y^{∀,s} ∈ dom(C) ∩ dom(σ) with C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B, we have Q_{C,σ}(y^{∀,s}) =

∀v_{0}…. ∀v_{l−1}. ( ∃y. (B{y^{∀,s}(v_{0}) ⋯ (v_{l−1}) ↦ y}) ⇒ B )σ

for an arbitrary y ∈ V_{bound}\V(C(y^{∀,s})).

After global application of an R-substitution σ we now have to update both R and C:

Definition 9.5 (Extended σ-Update) Let C be an R-choice-condition and σ a substitution. The extended σ-update (C′, R′) of (C, R) is given by:

C′ := { (x, Bσ) | (x, B) ∈ C ∧ x ∉ dom(σ) },
R′ is the σ-update of R.

Lemma 9.6 (Extended σ-Update) Let C be an R-choice-condition, σ an R-substitution, and (C′, R′) the extended σ-update of (C, R). Now: C′ is an R′-choice-condition.

10 Strong Validity

Definition 10.1 (Strong Validity) Let C be an R-choice-condition, A a Σ-structure, and G a set of sequents. G is (C, R)-strongly valid in A if there is an existential (A, R)-valuation e s.t. G is (C, R)-strongly (e, A)-valid. G is (C, R)-strongly (e, A)-valid if for some^{18} π that is (e, A)-compatible with (C, R), G is strongly (π, e, A)-valid. G is strongly (π, e, A)-valid if G is (ϵ(π)(τ) ⊎ τ, e, A)-valid for each τ ∈ V_{∀,w} → A. The rest is given by Definition 7.1.

Note that strong validity is called “strong” because it treats the strong free universal variables properly, whereas (weak) validity of Definition 7.1 does not. It is generally not the case, however, that strong validity is logically stronger than weak validity. The logical strength of the two cannot be compared easily, but we do not need to know more than the following two lemmas.

Lemma 10.2 (From Weak to Strong Validity) Let C be an R-choice-condition, A a Σ-structure, and G a set of sequents. Now: If G is V_{∃}×V_{∀}-valid in A, then G is R-valid and (C, R)-strongly valid in A.

On the other hand, from (C, R)-strong validity of a set of sequents G we should be able to infer (∅, R′)-strong validity and (weak) R′-validity for some G with the strong free universal variables renamed to some new free existential variables.

Lemma 10.3 (From Strong to Weak Validity) Let C be an R-choice-condition, A a Σ-structure, and G a set of sequents. Let ς ∈ V_{∀,s}(G) → (V_{∃}\V(G)) be injective. If G is (C, R)-strongly valid in A, then Gς is (∅, R′)-strongly valid and (weakly) R′-valid in A for any R′ ⊆ (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ⊎ ς^{−1}) ∘ R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ⊎ V_{∃}×V_{∀,s}.

11 Reduction

Definition 11.1 (Reduction) Let C be an R-choice-condition, A a Σ-structure, and G_{0}, G_{1} sets of sequents. G_{0} (C, R)-reduces to G_{1} in A if for each existential (A, R)-valuation e and each π that is (e, A)-compatible with (C, R):

if G_{1} is strongly (π, e, A)-valid, then G_{0} is strongly (π, e, A)-valid.

In the following lemma skip the very technical optional part [⋯] on a first reading! (If you nevertheless want to understand the meaning of O and N, have a look at the text preceding Lemma A.2.)

Lemma 11.2 (Reduction) Let C be an R-choice-condition; A a Σ-structure; G_{0}, G_{1}, G_{2}, and G_{3} sets of sequents.

1. (Validity)

Assume that G_{0} (C, R)-reduces to G_{1} in A. Now: If G_{1} is (C, R)-strongly valid in A, then G_{0} is (C, R)-strongly valid in A.

2. (Reflexivity) In case of G_{0}⊆G_{1}: G_{0} (C, R)-reduces to G_{1} in A.

3. (Transitivity) If G_{0} (C, R)-reduces to G_{1} in A and G_{1} (C, R)-reduces to G_{2} in A, then G_{0} (C, R)-reduces to G_{2} in A.

4. (Additivity)

If G_{0} (C, R)-reduces to G_{2} in A and G_{1} (C, R)-reduces to G_{3} in A, then G_{0}∪G_{1} (C, R)-reduces to G_{2}∪G_{3} in A.

5. (Monotonicity) For (C′, R′) being an extension of (C, R):

(a) If G_{0} is (C′, R′)-strongly valid in A, then G_{0} is (C, R)-strongly valid in A.

(b) If G_{0} (C, R)-reduces to G_{1} in A, then G_{0} (C′, R′)-reduces to G_{1} in A.

6. (Instantiation) For an [quasi-] existential R-substitution σ and the extended σ-update (C′, R′) of (C, R) [and for O, N with O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N,

N ⊆ dom(C) \ O, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, and N ∩ V(G_{0}, G_{1}) = ∅ ]:

(a) If G_{0}σ [ ∪ ⟨O⟩Q_{C,σ}] is (C′, R′)-strongly valid in A, then G_{0} is (C, R)-strongly valid in A.

(b) If G_{0} (C, R)-reduces to G_{1} in A, then G_{0}σ (C′, R′)-reduces to G_{1}σ [ ∪ ⟨O⟩Q_{C,σ}] in A.

12 Counterexamples and Foundedness

For powerful ITP we have to be able to restrict the test of whether the weight of a hypothesis is smaller than the weight of a goal (which has to be satisfied for the permission to apply the hypothesis to the goal) to the special case semantically described by their logic parts. This can be achieved by considering only such instances of their weights that result from valuations that describe invalid instances of their logic parts. A syntactical construct (cf. Definition 3.2) augmented with such a valuation providing extra information on the invalidity of its logic part in some Σ-structure A is our formal means to capture the notion of “counterexample”.

Definition 12.1 (Counterexample) Let A be a Σ-structure from K, C be an R-choice-condition, e be an existential (A, R)- valuation and π be (e, A)-compatible with (C, R). (S, τ) is an (π, e, A)-counterexample (for S) if S is a syntactical construct, τ ∈ V_{∀,w} → A, and logic({S}) is not (ϵ(π)(τ) ⊎ τ, e, A)-valid. (Thus, the logic part of a syntactical construct S is strongly (π, e, A)-valid iff S has no (π, e, A)-counterexamples.)

Now we come to the crucial notion notion of foundedness, which for ITP is what the notion of reduction is for deduction. Due to its technical complexity, before coming to its definition, let us motivate the notion of foundedness with the metaphor of building a supporting frame in a swamp.

1. We can fix a construction element H to a construction element H′ on a strictly lower level of the supporting frame resulting in the construction

\begin{matrix}H \\ ↓ \\ H′ \end{matrix}

for which we also write H↘H′ and which expresses that if H needs some support, then it can get it from the element H′ below.

In the world of induction this means that if an element of the set H has a counterexample, then there is a counterexample for an element of H′ whose weight term is strictly smaller in the induction ordering < that must be identical for both counterexamples.

2. We can fix a construction element H to a construction element (G, L) on the same or lower level of the supporting frame resulting in the construction

H↷(G, L)

In the world of induction this means that if an element of H has a counterexample, then there is a counterexample for an element of G or L. Moreover, if this counterexample is from G, then it has to be smaller or equal in the induction quasi-ordering ≲ that must be identical for both counterexamples. Note that ‘H’ stands for the induction \underline{h}ypotheses, ‘G’ for the sub-\underline{g}oals of H, and ‘L’ for the \underline{l}emmas of the proof.

3. We can fix a construction element H partly to a construction element (G, L) on the same or lower level and partly to a construction element H′ on a strictly lower level of the supporting frame resulting in the construction

\begin{matrix}H & ↷ & (G, L) \\ ↓ \\ H′ \end{matrix}

for which we also write H ↘/↷ (H′, G, L). In the world of induction this means that if an element of H has a counterexample, then there is a counterexample for an element of H′, G, or L. Moreover, if this counterexample is from H′ then it has to be strictly smaller and if it is from G it has to be equal or smaller than the original counterexample from H in the induction ordering they share.

Now, if we have a supporting frame of the form H ↘/↷ (H, G, L), i.e.

H↷(G, L) ; ↓ ; H↷(G, L) ; ↓ ; ⋮

and we know that the swamp is wellfounded (i.e. we get to solid ground everywhere if we only go deep enough) then we know that H is sufficiently supported against sinking by the element (G, L) alone, i.e. H↷(G, L). In the world of induction this means that all sequents of the elements of the set H are inductively valid provided that the base cases in G and the lemmas in L are, cf. Lemma 12.3(7).

Finally, note that the expressive power of ↘/↷ is higher than that of ↘ and ↷ together: {S}↘H ∨ {S}↷(G, L) implies {S} ↘/↷ (H, G, L) for S ∈ SynCons, but the converse does not hold in general because different counterexamples for S may have smaller counterexamples in different sets. Thus we define ↘/↷ first:

Definition 12.2 (Foundedness) Let C be an R-choice-condition. Let G_{0}, G_{1}, H, L ⊆ SynCons. Now: G_{0} is (C, R)-strict/quasi-founded on (H, G_{1}, L) (denoted by G_{0} ↘/↷_{C,R} (H, G_{1}, L)) if ∀A ∈ K. ∀e existential (A, R)-valuation. ∀π (e, A)-compatible with (C, R).

∀S ∈ G_{0}. ∀τ. ( \begin{matrix}& ((S, τ) is an (π, e, A)-counterexample) \\ ⇒ & ∃S′, τ′. ( \begin{matrix}& ((S′, τ′) is an (π, e, A)-counterexample) \\ ∧ & ( \begin{matrix}& ∃Γ, Γ′, w, w′, <, <′, ≲, ≲′, δ, δ′w̄, w̄′, ⊲, ⊲ ∼. \\ ( & (Γ, (w, <, ≲)) = S ∧ (Γ′, (w′, <′, ≲′)) = S′ ∧ δ = ϵ(π)(τ) ⊎ τ ∧ δ′ = ϵ(π)(τ′) ⊎ τ′ ∧ w̄ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w) ∧ w̄′ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(w′) ∧ ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<) ∧ ⊲ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′) ∧ ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲) ∧ ⊲ ∼ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′) ∧ ( \begin{matrix}( & S′ ∈ H ∧ w̄′⊲^{+}w̄ ∧ ⊲∘⊲ ∼ ⊆ ⊲^{+} ∧ ⊲ is wellfounded & ) \\ ∨ & \binom{S′ ∈ G_{1}}{∧ w̄′ (⊲ ∼ ∪ ⊲)^{∗} w̄} \end{matrix}) & ) \\ ∨ & S′ ∈ L \end{matrix} ) \end{matrix}) \end{matrix})

G_{0} is strictly (C, R)-founded on H (denoted by G_{0}↘_{C,R}H) if G_{0} ↘/↷_{C,R} (H, ∅, ∅).

G_{0} is (C, R)-founded on (G_{1}, L) (denoted by G_{0}↷_{C,R}(G_{1}, L)) if G_{0} ↘/↷_{C,R} (∅, G_{1}, L).

Note that H↷_{C,R}(∅, L) iff logic(H) (C, R)-reduces to logic(L) in all A ∈ K.

Moreover, note that in case of “<” &c. being no proper terms of our (possibly firstorder) logic language, “eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<)” is to be taken a shorthand for

{ (a, b) eval( A ⊎ ϵ(e)(δ) ⊎ δ ⊎ {x↦a, y↦b} )( x < y ) = TRUE },

for two distinct variables x, y ∈ V_{bound}\V(<).

Furthermore, note that the definition could be simplified by requiring ⊲ ∼ to be a wellfounded quasi-ordering and ⊲ to be its ordering. For proof-technical convenience, however, we prefer the weaker requirements: E.g., if we want to formally prove that wellfoundedness of a relation R implies termination of the transitive closure of its reverse, the above conditions should be satisfied when we set ⊲ to R (and ⊲ ∼ to ∅).

Moreover, note that our induction ordering is semantical (cf. Definition 13.7 of Wirth (1997)) in the sense that it cannot depend on the syntactical term structure of a weight w but only on the value of w under the evaluation function. In Wirth (1997) we have rigorously investigated the price one has to pay for the possibility to have induction orderings also depending on the syntax of weights. For powerful concrete inference systems this price turned out to be surprisingly high. Besides this, after improving the ordering information in descente infinie by our introduction of explicit weights (cf. Wirth & Becker (1995)) the former necessity of sophisticated induction orderings that exploit the term structure (cf. e.g. Bachmair (1988)) does not seem to exist anymore.

Finally, note that the whole Section 13 depends only on those properties of foundedness that are given in the following lemma (and on the definition of ↷_{C,R} in terms of ↘/↷_{C,R}).

Lemma 12.3 (Foundedness) Let C be an R-choice-condition; G_{i}, G′_{i}, H_{i}, L_{i} ⊆ SynCons.

1. (Validity)

Assume G_{0}↷_{C,R}(G_{1}, L_{1}).

(a) If logic(G_{1}∪L_{1}) is (C, R)-strongly valid, then logic(G_{0}) is (C, R)-strongly valid, too.

(b) Let A ∈ K, e be an existential (A, R)-valuation and π be (e, A)-compatible with (C, R). If logic(G_{1}∪L_{1}) is strongly (π, e, A)-valid, then logic(G_{0}) is strongly (π, e, A)-valid, too.

2. (Reflexivity)

In case of G_{0} ⊆ G_{1}∪L_{1}: G_{0} ↘/↷_{C,R} (H_{1}, G_{1}, L_{1}).

3. (Transitivity)

(a) If G_{0}↷_{C,R}(G_{1}, L_{1}) and G_{1} ↘/↷_{C,R} (H_{2}, G_{2}, L_{2}), then G_{0} ↘/↷_{C,R} (H_{2}, G_{2}, L_{1}∪L_{2}).

(b) If G_{0}↷_{C,R}(G_{1}, L_{1}) and L_{1}↷_{C,R}(G_{2}, L_{2}), then G_{0}↷_{C,R}(G_{1}, G_{2}∪L_{2}).

4. (Additivity)

If ∀i ∈ I. G_{i} ↘/↷_{C,R} (H_{i}, G′_{i}, L_{i}), then ⋃_{i∈I} G_{i} ↘/↷_{C,R} (⋃_{i∈I} H_{i}, ⋃_{i∈I} G′_{i}, ⋃_{i∈I} L_{i}).

5. (Monotonicity) For (C′, R′) being an extension of (C, R): If G_{0}↷_{C,R}(G_{1}, L_{1}), then G_{0}↷_{C′,R′}(G_{1}, L_{1}).

6. (Instantiation)

For an [quasi-] existential R-substitution σ and the extended σ-update (C′, R′) of (C, R) [and for O, N with O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N,

N ⊆ dom(C) \ O, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, and N ∩ V(G_{0}, G_{1}, L_{1}) = ∅, and L_{2} a set of syntactical constructs with logic(L_{2}) = ⟨O⟩Q_{C,σ} ]:

If G_{0}↷_{C,R}(G_{1}, L_{1}), then G_{0}σ↷_{C′,R′}(G_{1}σ, L_{1}σ [ ∪ L_{2}]).

7. (Descente Infinie) If H_{1} ↘/↷_{C,R} (H_{1}, G_{1}, L_{1}), then H_{1}↷_{C,R}(G_{1}, L_{1}). ^{19}

13 Abstract Sequent and Tableau Calculus

Now we are going to abstractly describe inductive sequent and tableau calculi. We will later show that the usual deductive calculi are instances of our abstract calculi and that descente infinie can be applied. The benefit of the abstract version is that every instance is automatically sound. Due to the small number of inference rules and the locality of soundness, this abstract version is not really necessary for deductive calculi. For inductive calculi, however, due to a bigger number of inference rules (which usually have to be improved now and then) and the globality of soundness, such an abstract version is very helpful, cf. Wirth & Becker (1995), Wirth (1997). Note that the design of our abstract calculi is not ad hoc. Cf. Wirth & Becker (1995), Wirth (1997) for the discussion of alternatives.

Compared to the well-known deductive proof trees, the difference is that the sequents are replaced with syntactical constructs, i.e. to each sequent a weight construct is added for controlling the loops in ITP. Moreover, in inductive tableau calculi, the proof trees differ from those in deductive tableau calculi in that their roots are labeled with weight constructs instead of formulas.

Definition 13.1 (Proof Forest) An (inductive) proof forest in a sequent (or else: tableau) calculus is a quintuple

(F, C, R, L, H)

where C is an R-choice-condition, L, H ⊆ N_{+}×N_{+}, and F is a partial function from N_{+} into the set of pairs (S, t), where S is a syntactical construct and t is a tree whose nodes are labeled with syntactical constructs (or else: whose root is labeled with a weight construct and whose other nodes are labeled with formulas).

Note that L records the lemma applications and H the induction hypothesis applications as explained below Definition 13.2. Furthermore, the tree t is intended to represent a proof attempt for the hypothesis S. In case of a tableau calculus, the nodes of t are labeled with formulas; the root, however, with a weight construct. In case of a sequent calculus, the nodes are labeled with syntactical constructs. While the syntactical constructs at the nodes of a tree in a sequent calculus stand for themselves as goals, in a tableau calculus all the ancestors have to be included to make up a syntactical construct and, moreover, the labeling formulas are in negated form:

Definition 13.2 (Goals(), AX, Closedness) ‘Goals(T)’ denotes the set of syntactical constructs labeling the leaves of the trees in the set T (or else: the set of syntactical constructs (Δ, ℶ) with Δ resulting from listing the conjugates of the formulas labeling a branch from a leaf to the root (exclusively) in a tree t in T and ℶ being the label of the root of the tree t). In what follows, we assume AX to be some set of axioms. By this we mean that AX is V_{∃}×V_{∀}-valid (for all A ∈ K). (By Lemma 10.2, this means that AX is R-valid and (R, C)- strongly valid for any R-choice-condition C. For K cf. the last sentence in Definition 7.1.) Typically, AX contains all sequents of the forms Γ A Π \overline{A} Λ and Γ (s=s) Π for sequents Γ, Π, Λ, formulas A, and terms s. The tree t is closed if logic(Goals({t})) ⊆ AX .

Why do we consider a proof forest instead of a single proof tree only? The possibility to have an empty proof forest provides a nicer starting point. Besides that, if we have two proof trees F (i) = ((Γ, ℵ), t) and F (i′) = ((Γ′, ℵ′), t′), we can apply Γ′ as a lemma in the tree t of (Γ, ℵ) and record this lemma application by inserting (i′, i) into L. We can also apply (Γ′, ℵ′) instantiated with μ as an induction hypothesis in the tree t of (Γ, ℵ) and record this induction hypothesis application by inserting (i′, i) into H. In the latter case we have to add additional goals to t that express that the weight term of ℵ′μ is smaller than the weight term of ℵ and that the induction (quasi-) orderings of ℵ′μ and ℵ are identical. When only a single constant induction (quasi-) ordering is given (as in QuodLibet, e.g.), the latter equality is trivial and the weight constructs can be simplified to consist of weight terms only. Provided that the lemma application relation L∘H^{∗} is wellfounded and all trees (i′′, (S′′, t′′)) with i′′(L∪H)^{∗}i are closed, this proves that Γ is (C, R)-valid. Contrary to deductive theorem proving, for descente infinie the availability of lemma and induction hypothesis application of this form is really necessary.

The following definition provides some syntactical sugar to make the following more readable.

Definition 13.3 (Hyps(), Trees()) For A being a set of pairs (S, t) consisting of a syntactical construct S and a tree t, we define the hypotheses of A by Hyps(A) := dom(A) and the trees of A by Trees(A) := ran(A).

In the following definition, abstract proof steps of the following three different kinds are considered: A Hypothesizing step starts a new proof tree for a new conjecture; an Expansion step expands a proof tree; and an Instantiation step globally instantiates some free variables in the whole proof forest. As the definition is quite long and hard, we give some hints directly following the definitions of Expansion and Instantiation.

Definition 13.4 (Abstract Sequent (or else: Tableau) Calculus)

We start with the empty proof forest (F, C, R, L, H) := (∅, ∅, ∅, ∅, ∅) and then iterate only the following kinds of modifications of (F, C, R, L, H) (resulting in (F′, C′, R′, L′, H′)):

Hypothesizing:

Let (C′, R′) be an extension of (C, R). Set L′ := L and H′ := H. Let i ∈ N_{+} \ dom(F). Let (Γ, ℵ) be a syntactical construct. Let t be the tree with a single node only, which is labeled with (Γ, ℵ) (or else: with a single branch only, s.t. Γ is the list of the conjugates of the formulas labeling the branch from the leaf to the root (exclusively) and ℵ is the label of the root). Then we may set F′ := F ∪ {(i, ((Γ, ℵ), t))}.

Expansion:

Let (C′, R′) be an extension of (C, R). Let N_{L}, N_{H} ⊆ dom(F). Set L′ := L ∪ N_{L}×{i} and H′ := H ∪ N_{H}×{i}. Let (i, (S, t)) ∈ F. Let l be a leaf in t. Let (Δ, ℶ) be the label of l (or else: result from listing the conjugates of the formulas labeling the branch from l to the root (exclusively) and ℶ be the label of the root of t). Let G be a set of syntactical constructs (or else: let M be a set of sequents and set G := { (ΠΔ, ℶ) | Π ∈ M }).

Now if  {(Δ, ℶ)} ↘/↷_{C′,R′} ( Hyps(⟨N_{H}⟩F), G, Hyps(⟨N_{L}⟩F) ),  ($)

then we may set F′ := (F \{(i, (S, t))}) ∪ {(i, (S, t′))}, where t′ results from t by adding to the former leaf l, exactly for each syntactical construct S′ in G, a new child node labeled with S′ (or else: exactly for each sequent Π in M a new child branch s.t. Π is the list of the conjugates of the formulas labeling the branch from the leaf to the new child node of l).

Hints: Expansion steps are parameterized with a syntactical construct (Δ, ℶ), two sets N_{H}, N_{L} ⊆ dom(F), and a set of sequents G s.t. ($) holds. While Hyps(⟨N_{H}⟩F) and Hyps(⟨N_{L}⟩F) contain the hypotheses of the proof trees that are applied as induction hypotheses or lemmas, resp., the syntactical constructs in G become the new child nodes of the former leaf node labeled with (Δ, ℶ). For tableau calculi, however, this set G of syntactical constructs must actually have the form { (ΠΔ, ℶ) | Π ∈ M } because an Expansion step cannot remove formulas from ancestor nodes. This is because these formulas are also part of the goals associated with other leaves in the proof tree.

Instantiation:

Let σ be an [quasi-] existential R-substitution and (C′, R′) the extended σ-update of (C, R). Set F′ := { (i, ((Γ σ, ℵσ), tσ)) | (i, ((Γ, ℵ), t)) ∈ F }. Assume that for each y^{∀,s} ∈ dom(C) ∩ dom(σ) there is some j_{y^{∀,s}} ∈ dom(F) with

logic(Hyps(⟨{j_{y^{∀,s}}}⟩F′)) = {Q_{C,σ}(y^{∀,s})} .

For each i ∈ dom(F) set (I abbreviating H^{∗}⟨{i}⟩)

D(i) := dom(C) ∩ dom(σ) ∩ R^{∗}⟨V_{∀,s}(Goals(Trees(⟨I⟩F)), Hyps(⟨{i} ∪ L⟨I⟩⟩F))⟩

Then we may set L′ := L [ ∪ { (j_{y^{∀,s}}, i) | i ∈ dom(F) ∧ y^{∀,s} ∈ D(i) }] and H′ := H.

Hints: An Instantiation step globally instantiates free existential and free universal variables via a substitution σ. It is simple unless strong free universal variables are substituted and the parts in optional brackets become relevant. In this case, every replacement of a strong free universal variable y^{∀,s} must be justified by a lemma Q_{C,σ}(y^{∀,s}) (cf. Definition 9.4) given by the hypothesis of a proof tree number j_{y^{∀,s}}, which must be added in a preceding Hypothesizing step unless it is already present. Note that this lemma is special in the sense that it is not applied locally in some proof tree but globally. Esp. problematic is the possibility that y^{∀,s} occurs in the proof of the lemma itself. If we are not very careful, the lemma becomes a lemma of itself, resulting in a cyclic lemma application relation. Then our whole proof work is in vain because no validities whatsoever can be inferred. Therefore, since we do not want to reintroduce the lemma as an open lemma and prove it again, we take a very close look on which of our (possibly open) lemmas really depend on the justifying lemma Q_{C,σ}(y^{∀,s}) after global application of σ. Our solution is that the lemma is relevant for any proof tree number i whose proof state (i.e. the goals, the hypothesis itself, and the lemmas, cf. Definition 13.5) contains free variables that may depend on y^{∀,s}; i.e. for any i with y^{∀,s} ∈ D(i).

13.1 Soundness

The following invariant condition captures the soundness of our proof trees. Roughly speaking (when neither a lemma nor an induction hypothesis has been applied), the validity of the goals of a tree is to imply the validity of the sequent of this tree; short: “The leaves imply the root.”

Definition 13.5 (Soundness Invariant Condition) The soundness invariant condition on (F, C, R, L, H) is that (F, C, R, L, H) is a proof forest and that, for all (i, (S, t)) ∈ F,

{S} ↷_{C,R} ( Goals(Trees(⟨I⟩F)), Hyps(⟨L⟨I⟩⟩F) ) for I := H^{∗}⟨{i}⟩.

I are the numbers of the proof trees whose hypotheses have been applied in the tree t as induction hypotheses, and Goals(Trees(⟨I⟩F)) is the set of goals of these proof trees. Hyps(⟨L⟨I⟩⟩F) = { S′ | F (i′) = (S′, t′) ∧ i′Li ∧ i ∈ I } are the lemmas on that Γ depends.

Theorem 13.6 (Successful Proof) Let the proof forest (F, C, R, L, H) satisfy the above soundness invariant condition. Let (i, ((Γ, ℵ), t)) ∈ F. Assume that all trees in Trees(⟨(L∪H)^{∗}⟨{i}⟩⟩F)

(i.e. in { t′ | (i′, (S′, t′)) ∈ F ∧ i′ (L∪H)^{∗} i })

are closed and that L∘H^{∗} is wellfounded. Now: Γ is (C, R)-strongly valid and, for any injective ς : V_{∀,s}(Γ) → (V_{∃}\V(Γ)), Γ ς is (∅, R′)-strongly valid and (weakly) R′-valid for any R′ ⊆ (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ⊎ ς^{−1}) ∘ R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ⊎ V_{∃}×V_{∀,s}.

Theorem 13.7 (Soundness) The above soundness invariant condition is always satisfied for the sequent (or else: tableau) calculus of Definition 13.4.

13.2 Safeness

While the soundness invariant condition of Definition 13.5 (“the leaves imply the root”) is an essential one, its converse, namely “the root implies the leaves”, which we call safeness, is useful in practice for failure detection.

Definition 13.8 (Safeness Invariant Condition) The safeness invariant condition on (F, C, R, L, H) is that, for all (i, ((Γ, ℵ), t)) ∈ F,

logic(Goals({t})) (C, R)-reduces to {Γ }.

Definition 13.9 (Safeness of Steps and Sub-rules) An Expansion step of the sequent calculus of Definition 13.4 is safe if (referring to the variables introduced there) logic(G) (C′, R′)-reduces to {Δ}. A sub-rule of the Expansion rule of the sequent calculus of Definition 13.4 is safe if it describes only safe Expansion steps. An Instantiation step of the sequent (or else: tableau) calculus of Definition 13.4 is safe if Q_{C,σ}(y^{∀,s}) is (C′, R′)-strongly valid due to Theor. 13.6 for all y^{∀,s} ∈ dom(C) ∩ dom(σ), i.e. all trees in Trees(⟨(L′∪H′)^{∗}⟨{j_{y^{∀,s}}}⟩⟩F′) are closed and L′∘H′^{∗} is wellfounded.

No notions of safeness are given for Expansion steps of the tableau calculus and for Hypothesizing steps. This is because these steps preserve the safeness invariant condition trivially. Furthermore, note that an Instantiation step can only be unsafe if strong free universal variables are instantiated.

Theorem 13.10 (Safeness) The above safeness invariant condition is always satisfied for the tableau calculus of Definition 13.4 if all Instantiation steps are safe. The above safeness invariant condition is always satisfied for the sequent calculus of Definition 13.4 if all Expansion and Instantiation steps are safe.

Suppose we have disproved a goal of a tree t with (i, ((Γ, ℵ), t)) ∈ F, i.e. found out that the goal is invalid. If safeness is provided for the whole construction of t, then we know that Γ is invalid. If some steps in t may be unsafe, we should backtrack up to an “unsafe” step that may have caused this invalidity. When we suppose that all Expansion and Instantiation steps are safe, the only reason not to remove the hypothesis Γ can be that it was valid originally but in the meanwhile invalidated by an instantiation:

• If there have been no Instantiation steps affecting the sequent Γ, then we should remove (i, ((Γ, ℵ), t)) from the proof forest F and undo all its applications as a lemma or as an induction hypothesis, i.e. e.g. the Expansion steps of Definition 13.4 where i occurs in the sets N_{L}, N_{H}, resp..

• Otherwise, we should undo an Instantiation step affecting the sequent Π, and then see whether we can still detect a failure by again disproving the disinstantiated goal.

14 Concrete Sequent and Tableau Calculus

The examples of α-, β-, γ-, δ-, liberalized δ-, Rewrite-, and Cut-rules at the end of Section 2.3 can be modeled as safe Expansion steps as follows: Let

\frac{Δ}{Π_{0} … Π_{n−1}} \begin{matrix}C′′ \\ R′′ \end{matrix}

denote a sub-rule of the Expansion rule of the sequent calculus of Definition 13.4 which is given by N_{L} := N_{H} := ∅ (i.e. neither lemmas nor induction hypotheses are applied), G := {(Π_{0}, ℶ), …, (Π_{n−1}, ℶ)}, C′ := C ∪ C′′, and R′ := R ∪ R′′. For C′′ = R′′ = ∅, the ‘C′′’ and ‘R′′’ to the right are omitted.

For such a rule being a safe sub-rule of the Expansion rule of the sequent calculus of Definition 13.4 we have to show that C′ is an R′-choice-condition, that {(Δ, ℶ)} ↘/↷_{C′,R′} (∅, G, ∅), and that logic(G) (C′, R′)-reduces to {Δ}.

Theorem 14.1 Taking F = (F, C, R, L, H), the examples of α-, β-, γ-, δ-,^{20} liberalized δ-, Rewrite-, and Cut-rules at the end of Section 2.3 are safe sub-rules of the Expansion rule of the sequent calculus of Definition 13.4.

Note that the resp. rules for the tableau calculus of Definition 13.4 differ only in M consisting of the sub-sequents containing the new (i.e. the first one or two) formulas of the sequents below the bar.

The following example shows that R′′ of the liberalized δ-rule at the end of Section 2.3 must indeed contain V_{∀}(A) × {x^{∀,s}} and that the transitive closure over R′ must be considered for the property of being an existential R′-substitution.

Example 14.2 ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

is not deductively valid (to wit, let Q be the identity relation on a non-trivial universe). γ-step: ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y^{∃}) ), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) Liberalized or non-liberalized δ-step:

( ∀z. Q(x^{∀}, z) ∨ ¬Q(x^{∀}, y^{∃}) ), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

with variable-condition (y^{∃}, x^{∀}). α-step: ∀z. Q(x^{∀}, z), ¬Q(x^{∀}, y^{∃}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) ) Liberalized δ-step: Q(x^{∀}, z^{∀,s}), ¬Q(x^{∀}, y^{∃}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

with additional choice-condition (z^{∀,s}, ¬Q(x^{∀}, z^{∀,s})) and additional variable-condition (x^{∀}, z^{∀,s}), i.e. the current variable-condition R′ is given by

y^{∃}  _{R} x^{∀} _{R′′} z^{∀,s}

Note that now we have y^{∃}R′^{+}z^{∀,s} although y^{∃} does not appear in Q(x^{∀}, z).

Thus, both the inclusion of the free universal variables of the principle formula into the domain of the variable-condition and the transitive closure over it are necessary for σ := {y^{∃}↦z^{∀,s}} not being an existential R′-substitution in our state of proof. The latter fact is, however, essential for soundness, because without it we could complete the proof attempt by application of σ in an Instantiation step, leading to the tautology

Q(x^{∀}, z^{∀,s}), ¬Q(x^{∀}, z^{∀,s}), ∃y. ∀x. ( ∀z. Q(x, z) ∨ ¬Q(x, y) )

Now we will present one primitive rule for applying (Φ, ℸ) instantiated with a substitution ϱ as a lemma or as an induction hypothesis to expand a goal (Δ, ℶ) of a proof tree t. We will formulate this as an Expansion step in the tableau calculus of Definition 13.4 (sequent calculus analogously) as follows.

Theorem 14.3

The following describes two sub-rules of the Expansion rule of the tableau calculus of Definition 13.4:

Let (F, C, R, L, H), (Δ, ℶ), and (C′, R′) be given as in the Expansion rule. Let (j, ((Φ, ℸ), t′′)) ∈ F. Let Y ⊆ { y^{∀,w} ∈ V_{∀,w}(Φ, ℸ) ( V_{∃}(Φ, ℸ) ∪ V_{∀,s}(Φ, ℸ) ) × {y^{∀,w}} ⊆ R′ }. Let ϱ ∈ Y → (V_{∃}\V(F, C, R)) be an injective substitution.

Lemma Application: Set N_{L} := {j} and N_{H} := ∅. Set M to be the set containing the single-formula sequents \overline{Bϱ} for each formula B listed in the sequent Φ.

Induction Hypothesis Application: Set (w, <, ≲) := ℶ and (w′, <′, ≲′) := ℸ. Let α be the type of w and w′. Set N_{L} := ∅ and N_{H} := {j}. Set M to be the set containing the following sequents:

1. \overline{Bϱ} for each formula B listed in the sequent Φ

2. w′ϱ < w

3. ∀p : α → bool. ( ∃a : α. p(a) ⇒ ∃a : α. ( \begin{matrix}& p(a) \\ ∧ & ¬∃a′ : α. \binom{p(a′)}{∧ a′<a} \end{matrix} ) )

where “p(a)” abbreviates “p(a)=true” &c. and “ α → bool” must have the standard interpretation of a predicate over “α”.

4. ∀x, y : α. ( x < y ⇔ x (<′ϱ) y )
5. ∀x, y : α. ( x ≲ y ⇔ x (≲′ϱ) y )
6. ∀x, y, z : α. ( (x < y ∧ y ≲ z) ⇒ x < z )

Each of the sequents (3)-(6) can be omitted if the following holds, resp., for any A ∈ K, existential (A, R′)-valuation e, and π and τ s.t. π is (e, A)-compatible with (C′, R′) and ((Δ, ℶ), τ) is an (π, e, A)-counterexample, and for δ := ϵ(π)(τ) ⊎ τ, ⊲ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<), and ⊲ ∼ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲) :

3. ⊲ is wellfounded.

4. ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ).

5. ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ).

6. ⊲ ∘ ⊲ ∼ ⊆ ⊲^{+}.

Note that Y contains exactly those weak free universal variables of (Φ, ℸ) that have neither free existential variables nor strong free universal variables of (Φ, ℸ) in their scopes when imagining any list of quantifiers for all free variables of (Φ, ℸ) that represents (a superset of) R′. In other words, the variables in Y are those weak free universal variables on that neither a solution for the free existential variables nor a choice-condition for the strong free universal variables in (Φ, ℸ) depends. Therefore, the variables in Y are those which we can instantiate when applying the lemma or induction hypothesis (Φ, ℸ). Although it does not seem impossible to instantiate more variables, this does not seem to be necessary:

• We can extend R′ with ( V_{∃}(Φ, ℸ) ∪ V_{∀,s}(Φ, ℸ) ) × {y^{∀,w}} in order to instantiate y^{∀,w} when applying the lemma, provided that R′ is still wellfounded. If this extension of R′ makes a query variable useless (i.e. blocks a solution for a free existential variable), we have to take a higher-order query variable instead, cf. Section 18.

• I do not known any more general approach in the literature. E.g., in Baaz &al. (1997), the inductive part of theorem proving is triggered by application of a δ-rule and the variable y of the quantifier removed by the δ-rule becomes the induction variable. In our approach, the δ-rule application would replace y with a new free universal variable y^{∀,w} and extend the variable-condition with (V_{∃}(Φ, ℸ) ∪ V_{∀,s}(Φ, ℸ)) × {y^{∀,w}} so that y^{∀,w} ∈ Y would hold.

Moreover, note that there is no analogon of Theor. 14.3 using a set of strong free universal variables instead of the set Y of weak free universal variables. This requires the presence of weak free universal variables even if we are not interested in (non-liberalized) δ-steps. One should always use weak free universal variables in Hypothesizing steps. In order to have more useful lemmas and induction hypothesis, we sometimes even have to split a tree at an inner position with a Hypothesizing step introducing a new hypothesis with weak free universal variables replacing the strong free universal variables and apply this new hypothesis as a lemma to the new leaf of the old tree, closing this branch, cf. the discussion at the end of Section 17.

Furthermore, note that, although Theor. 14.3 does not forbid, it would be silly to destroy the wellfoundedness of L∘H^{∗} required in Theor. 13.6. Thus, it is reasonable to forbid i (L∪H)^{∗} j for a lemma application and i H^{∗}∘(L∘H^{∗})^{+} j for an induction hypothesis application.

All of the sequents (3)-(6) can be omitted if we (as in QuodLibet, cf. Section 4.2) require that Σ contains (for each type) the binary predicate (or boolean function) symbols ≲ and < and that each Σ-structure A assigns to them a wellfounded quasi-ordering ≲^{A} and its ordering <^{A}, resp.. The sequents (5) and (6) can also be omitted in the important special case (cf. Section 19) that the third component ⊲ ∼ of the weight constructs is restricted to be the empty relation ∅.

Detailed examples on how Theor. 14.3 must be instantiated for a meaningful application are given in Section 15 (lemma) and Section 16 (induction hypothesis), &c..

15 Example: Lemma Application

In this example we will keep to the following: The proofs are presented in the tableau calculus. As there are no inductive proofs, we omit the weight constructs completely. As no liberalized δ-rules are applied, the choice-conditions are always empty. As all proof trees have branching degree 1, we do not depict them. Assume that in the signature Σ we have the operator ∗, the constant 1, and the inverse function inv. We start with the empty proof forest (∅, ∅, ∅, ∅, ∅). We start the new proof tree number 1 for

(1) x_{1}^{∀,w} ∗ (y_{1}^{∀,w} ∗ z_{1}^{∀,w}) = (x_{1}^{∀,w} ∗ y_{1}^{∀,w}) ∗ z_{1}^{∀,w}

by a Hypothesizing step in the tableau calculus of Definition 13.4, just as two new proof trees for

(2) 1 ∗ x_{2}^{∀,w} = x_{2}^{∀,w}

(3) inv(x_{3}^{∀,w}) ∗ x_{3}^{∀,w} = 1.

With these three trees we have the axioms of group theory at hand via lemma application. Now we really want to prove something. We start the new proof tree number 4 for

(4) ∀x. x ∗ inv(x) = 1

by a Hypothesizing step. The the root of proof tree 4 is labeled with

¬∀x. x ∗ inv(x) = 1

A δ-step (cf. Theor. 14.1) adds the child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ 1

Our variable-condition is still empty because no free variables occur in x ∗ inv(x) = 1. Applying the sequent of proof tree 3 in the way of Theor. 14.3 adds the new child

inv(x1^{∃}) ∗ x1^{∃} = 1

to proof tree 4 and inserts the pair (3, 4) into our lemma application relation. A Rewrite step (cf. Theor. 14.1) with this equality from right to left produces the new child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ inv(x1^{∃}) ∗ x1^{∃}

Applying the sequent of proof tree 2 in the way of Theor. 14.3 adds the new child

1 ∗ x2^{∃} = x2^{∃}

to proof tree 4 and inserts the pair (2, 4) into our lemma application relation. An Instantiation step (cf. Definition 13.4) transforms this child into

1 ∗ x1^{∃} = x1^{∃}

which can be used for a Rewrite step from right to left adding the child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ inv(x1^{∃}) ∗ (1 ∗ x1^{∃})

Now our variable-condition is R := {(x1^{∃}, x2^{∃})}. Since x2^{∃} does not occur anywhere else in our current proof forest, this R does not put any restrictions on existential R-substitutions, unless we re-use x2^{∃}.^{21} Therefore, in future applications of Theor. 14.3 we will not introduce new free existential variables at all when we already know how to instantiate them. Applying the sequent of proof tree 3 in the way of Theor. 14.3 adds the new child

inv(x3^{∃}) ∗ x3^{∃} = 1

A Rewrite step (cf. Theor. 14.1) with this equality from right to left produces the new child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ inv(x1^{∃}) ∗ ((inv(x3^{∃}) ∗ x3^{∃}) ∗ x1^{∃})

With two applications of the sequent of proof tree 1, this can be rewritten into

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ (inv(x1^{∃}) ∗ inv(x3^{∃})) ∗ (x3^{∃} ∗ x1^{∃})

Note that our lemma application relation now is {1, 2, 3} × {4}. Applying the sequent of proof tree 3 in the way of Theor. 14.3 adds the new child

inv(x4^{∃}) ∗ x4^{∃} = 1

In order to use this for a Rewrite step from left to right we apply the unifier σ := {x1^{∃}↦inv(x3^{∃}), x4^{∃}↦inv(x3^{∃})} to the whole proof forest and—after the Rewrite step—get the new child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ 1 ∗ (x3^{∃} ∗ inv(x3^{∃}))

Note that this unifier is an existential R-substitution and that the σ-update of R is given

by  x3^{∃} _{E_{σ}}_{E_{σ}} x1^{∃}  _{R} x2^{∃} x4^{∃}

which still puts no restrictions whatsoever on existential R-substitutions of the free universal variables that are still present in our tree.^{22} With an application of the sequent of proof tree 2, this can be rewritten into

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ x3^{∃} ∗ inv(x3^{∃})

An Instantiation step produces the new child

x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w}) ≠ x_{4}^{∀,w} ∗ inv(x_{4}^{∀,w})

Now the tree is closed because all sequents of the form (t = t) Λ are assumed to be in our axioms AX. By Theor. 13.6 we now know that ∀x. x ∗ inv(x) = 1 is ∅-valid, provided that the proof trees 1, 2, and 3 are closed, which is the case when we assume their sequents to be in AX.

Now we start proof tree 5 for

(5) x_{5}^{∀,w} ∗ inv(x_{5}^{∀,w}) = 1

by a Hypothesizing step. Note that the sequent is not really different from that of proof tree 4. In order to have only one version of each lemma and to know how it looks like, we should make up our minds for one of the two forms. We do prefer the form of proof tree 5 because it will be more useful for ITP. For deductive theorem proving, the two only differ in that the form of proof tree 5 is handier for lemma application. To see this, we will prove each with the help of the other. A lemma application according to Theor. 14.3 of the sequent of proof tree 4 to proof tree 5 whose root is labeled with x_{5}^{∀,w} ∗ inv(x_{5}^{∀,w}) ≠ 1 adds the child ∀x. x ∗ inv(x) = 1. A γ-step adds the child x5^{∃} ∗ inv(x5^{∃}) = 1. An Instantiation step transforms this into x_{5}^{∀,w} ∗ inv(x_{5}^{∀,w}) = 1. Now proof tree 5 is closed because all sequents of the form A Λ \overline{A} are assumed to be in our axioms AX.

Finally, we start another proof tree number 6 for the sequent of proof tree 4. The root is again labeled with

¬∀x. x ∗ inv(x) = 1

A δ-step adds the child

x_{6}^{∀,w} ∗ inv(x_{6}^{∀,w}) ≠ 1

Applying the sequent of proof tree 5 in the way of Theor. 14.3 adds the new child

x6^{∃} ∗ inv(x6^{∃}) = 1

An Instantiation step transforms this into

x_{6}^{∀,w} ∗ inv(x_{6}^{∀,w}) = 1

Now proof tree 6 is also closed because all sequents of the form A \overline{A} Λ are assumed to be in our axioms AX.

16 Example: Mutual Induction

(2) P(x_{0}^{∀,w}); w2^{∃}(x_{0}^{∀,w})

(nat1), γ, β, δ, Rewrite^{∗}

(2.1) P(0); w2^{∃}(0) (2.2) P(s(x_{1}^{∀,w})); _{w2^{∃}(s(x_{1}^{∀,w}))}

(P1) (P2), γ, β, β

(2.2.1) \begin{matrix}P(x_{1}^{∀,w}) & , \\ P(s(x_{1}^{∀,w})) & ; & w2^{∃}(s(x_{1}^{∀,w})) \end{matrix} (2.2.2) Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})), ¬P(x_{1}^{∀,w}), P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

induction hypothesis appl. of (P3){x_{0}^{∀,w}↦x_{1}^{∀,w}} induction hypothesis application of (Q3){y_{0}^{∀,w}↦x_{1}^{∀,w}, z_{0}^{∀,w}↦s(x_{1}^{∀,w})}

(2.2.1.1) w2^{∃}(x_{1}^{∀,w})<w2^{∃}(s(x_{1}^{∀,w})), P(x_{1}^{∀,w}), P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

(2.2.2.1) w3^{∃}(x_{1}^{∀,w}, s(x_{1}^{∀,w}))<w2^{∃}(s(x_{1}^{∀,w})), Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})), ¬P(x_{1}^{∀,w}), P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

The toy example of this section illustrates how mutual induction works in our framework. Note, however, that (due to mutual induction and non-trivial weights) even this toy example has no straightforward proofs in the ITP calculus of Baaz &al. (1997) or any known ITP system with the exception of QuodLibet. The signature consists of the signature presented in Section 4.1 and additionally contains the predicates P : nat → bool and Q : nat → nat → bool. Besides the axiom (nat1) of Section 4.1, we have the following axioms, defining the special predicates of our example.

(P1)  P(0)
(P2)  ∀x. ( P(s(x)) ⇐ ( P(x) ∧ Q(x, s(x)) ) )
(Q1)  ∀x. Q(x, 0)
(Q2) ∀x, y. ( Q(x, s(y)) ⇐ ( Q(x, y) ∧ P(x) ) )

We want to show that both predicates are tautological:

(P3)  P(x_{0}^{∀,w}); w2^{∃}(x_{0}^{∀,w})
(Q3)  Q(y_{0}^{∀,w}, z_{0}^{∀,w}); w3^{∃}(y_{0}^{∀,w}, z_{0}^{∀,w})

Recall that weight constructs in QuodLibet consist of weight terms only (like w2^{∃}(x_{0}^{∀,w}) in (P3)) because the induction ordering is a globally fixed constant.

(3) Q(y_{0}^{∀,w}, z_{0}^{∀,w}); w3^{∃}(y_{0}^{∀,w}, z_{0}^{∀,w}) (nat1), γ, β, δ, Rewrite^{∗}_{(3.1) \begin{matrix}Q(y_{0}^{∀,w}, 0) & ; \\ w3^{∃}(y_{0}^{∀,w}, 0) \end{matrix}}  _{(3.2) \begin{matrix}Q(y_{0}^{∀,w}, s(z_{1}^{∀,w})) & ; \\ w3^{∃} & ( & y_{0}^{∀,w} & , & s(z_{1}^{∀,w}) & ) \end{matrix}} (Q1)  (Q2), γ, β, β_{(3.2.1) Q(y_{0}^{∀,w}, z_{1}^{∀,w}), Q(y_{0}^{∀,w}, s(z_{1}^{∀,w})); w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w}))}  _{(3.2.2) P(y_{0}^{∀,w}), ¬Q(y_{0}^{∀,w}, z_{1}^{∀,w}), Q(y_{0}^{∀,w}, s(z_{1}^{∀,w})); w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w}))} ind. hyp. appl. of (Q3)\{z_{0}^{∀,w}↦z_{1}^{∀,w}\}  ind. hyp. appl. of (P3)\{x_{0}^{∀,w}↦y_{0}^{∀,w}\}_{(3.2.1.1) w3^{∃}(y_{0}^{∀,w}, z_{1}^{∀,w})<w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w})), Q(y_{0}^{∀,w}, z_{1}^{∀,w}), Q(y_{0}^{∀,w}, s(z_{1}^{∀,w})); w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w}))}  _{(3.2.2.1) w2^{∃}(y_{0}^{∀,w})<w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w})), P(y_{0}^{∀,w}), ¬Q(y_{0}^{∀,w}, z_{1}^{∀,w}), Q(y_{0}^{∀,w}, s(z_{1}^{∀,w})); w3^{∃}(y_{0}^{∀,w}, s(z_{1}^{∀,w}))}

We start with the variable-condition

R := V_{∃}(P3)×V_{∀,w}(P3) ∪ V_{∃}(Q3)×V_{∀,w}(Q3) = {w2^{∃}}×{x_{0}^{∀,w}} ∪ {w3^{∃}}×{y_{0}^{∀,w}, z_{0}^{∀,w}}

in order to have all weak free universal variables of (P3) or (Q3) in the set Y of Theor. 14.3. After several inference steps XQuodLibet presents two partial sequent proof trees for (P3) and (Q3) similar to the first two trees depicted in this section.

Just as in Section 4.1, we have used the round-edged nodes to give some information how the inference steps can be achieved in terms of general inference rules as the ones presented in Theor. 14.1 and Theor. 14.3.

As the inferences applied to (2) do not differ from those applied to (1) in Section 4.1, let us have a closer look at the inference below (2.2).

The defining formula (P2) is applied just like a lemma in Theor. 14.3, i.e. its single formula is added in negated form. Thus, the round-edged node labeled with “(P2), γ, β, β” can be replaced with the following subtree. Note that the γ-step actually first introduces a free existential variable that is then instantiated with x_{1}^{∀,w} in order to close the leftmost leaf of the tree below, which then does not have to be presented anymore.

(2.2)

¬∀x. ( P(s(x)) ⇐ ( P(x) ∧ Q(x, s(x)) ) ),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

¬( P(s(x_{1}^{∀,w})) ⇐ ( P(x_{1}^{∀,w}) ∧ Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})) ) ),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

¬P(s(x_{1}^{∀,w})),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

( P(x_{1}^{∀,w}) ∧ Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})) ),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

(2.2.1)

(2.2.2)

Even more interesting is what happens below (2.2.2). We instantiate the (meta-) variables of Theor. 14.3, in the following way: Φ := Q(y_{0}^{∀,w}, z_{0}^{∀,w}), ℸ := w3^{∃}(y_{0}^{∀,w}, z_{0}^{∀,w}), Y := {y_{0}^{∀,w}, z_{0}^{∀,w}},

ϱ := {y_{0}^{∀,w}↦u^{∃}, z_{0}^{∀,w}↦v^{∃}}, M := {¬Q(u^{∃}, v^{∃}), w3^{∃}(u^{∃}, v^{∃})<w2^{∃}(s(x_{1}^{∀,w}))}. This results in

the tree below. When we instantiate with {u^{∃}↦x_{1}^{∀,w}, v^{∃}↦s(x_{1}^{∀,w})} its left leaf gets closed and its right leaf becomes (2.2.2.1).

(2.2.2)

¬Q(u^{∃}, v^{∃}),
Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})), ¬P(x_{1}^{∀,w}),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

w3^{∃}(u^{∃}, v^{∃})<w2^{∃}(s(x_{1}^{∀,w})),
Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})), ¬P(x_{1}^{∀,w}),
P(s(x_{1}^{∀,w})); w2^{∃}(s(x_{1}^{∀,w}))

We have applied each of the two syntactical constructs (P3) and (Q3) in each of their two proof trees (2) and (3), resp.. Luckily we used induction hypothesis application instead of lemma application. The latter would have resulted in a lemma application relation of {2, 3} × {2, 3} which is not wellfounded and our proof trees would have been useless because we would never be able to apply Theor. 13.6. As we have used induction hypothesis application instead of lemma application, we have produced the four additional leaves (2.2.1.1), (2.2.2.1), (3.2.1.1), and (3.2.2.1), which are still open. We choose our 2^{nd} order weight functions according to w2^{∃}(x) := (x) and w3^{∃}(x, y) := (x, y), using the lexicographic combination of Section 4.2.^{23} Now the proof attempt can be successfully completed: E.g., the first literal of (2.2.1.1) turns into (x_{1}^{∀,w}, 0)<(s(x_{1}^{∀,w}), 0), which after applying (<4) of Note 13, in a γ- and a β-step reads x_{1}^{∀,w}<s(x_{1}^{∀,w}) which is an ordering axiom in QuodLibet, as explained in Note 13.

Finally in this section we should answer the following question: Which steps in this proof were typical for ITP in the sense that their soundness relies on notions of inductive validity instead of the stronger notion of deductive validity? Besides the four induction hypothesis applications, the final branch closure rules for <-literals are typical for induction because they require that, in all models in K, the successor of each natural number is different from that natural number and each natural number is built-up from zero by a finite number of successor steps (i.e. there are neither cycles nor Z-chains in the models, cf. Enderton (1973)).

17 Sequents versus Tableaus in ITP

w2^{∃}(x_{0}^{∀,w}) ¬P(x_{0}^{∀,w}) x_{0}^{∀,w} = 0  _{x_{0}^{∀,w} = s(x_{1}^{∀,w})} ¬P(0)  ¬P(s(x_{1}^{∀,w})) P(0)  P(x_{1}^{∀,w}) P(s(x_{1}^{∀,w}))  ¬P(x_{1}^{∀,w})  ¬Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})) P(x_{1}^{∀,w})  \begin{matrix}w2^{∃} & ( & x_{1}^{∀,w} & ) \\ ≮ & w2^{∃}(x_{0}^{∀,w}) \end{matrix}  Q(x_{1}^{∀,w}, s(x_{1}^{∀,w}))  \begin{matrix}w3^{∃} & ( & x_{1}^{∀,w} & , & s(x_{1}^{∀,w}) & ) \\ ≮ & w2^{∃}(x_{0}^{∀,w}) \end{matrix} \begin{matrix}w2^{∃} & ( & x_{1}^{∀,w} & ) \\ ≮ & w2^{∃}(s(x_{1}^{∀,w})) \end{matrix}  \begin{matrix}w3^{∃} & ( & x_{1}^{∀,w} & , & s(x_{1}^{∀,w}) & ) \\ ≮ & w2^{∃}(s(x_{1}^{∀,w})) \end{matrix}_{x_{1}^{∀,w}≮s(x_{1}^{∀,w})}  _{x_{1}^{∀,w}≮s(x_{1}^{∀,w})}

In this section we are going to compare the appropriateness of sequent versus tableau calculi under the special aspect of ITP. To this end we first see what the sequent calculus proof of Section 16 would look like in a tableau calculus. After the first Hypothesizing step, the initial tableau for (P3) looks the following way.

\begin{matrix}w2^{∃} & ( & x_{0}^{∀,w} & ) \\ ¬P(x_{0}^{∀,w}) \end{matrix}

Note that this differs from (P3) in duality. While this is not a hindrance for completely automatic ITP systems, it poses considerable practical problems in systems where userguidance is possible: The primitive process of switching duality is a typical source of errors for human beings (or me at least).

For the closed complete proof tree for (P3) we have chosen a representation according to clausal tableau calculi because there is not enough space for non-atomic formulas here.

Let us have a closer look at the boxed formula in the tableau. It results from induction hypothesis application of (Q3). Note that the only difference to an Extension step in Model Elimination tableaus (cf. Baumgartner &al. (1997)) lies with the additional child (the boxed node), which asks us to show that the instance of the hypothesis is smaller than the weight of our proof tree. Indeed: As the induction ordering is fixed here, hypothesis application differs from the standard lemma (or axiom) application only in producing an additional <-goal. This makes hypothesis application a little more expensive than lemma application. The left-hand term w3^{∃}(x_{1}^{∀,w}, s(x_{1}^{∀,w})) is the weight term of (Q3) instantiated via {y_{0}^{∀,w}↦s(x_{1}^{∀,w}), z_{0}^{∀,w}↦x_{1}^{∀,w}} because this substitution enables the left sibling of the boxed node to close its branch with the instantiated negated formula of (Q3). The right-hand term w2^{∃}(x_{0}^{∀,w}) comes down from the root of the tree. Contrary to the sequent calculus example where the weight of the root is carried along and updated on its way down, we have to rewrite the variable x_{0}^{∀,w} in it with an ancestor equality literal in order to know what the root weight means in the local context.

Of course, there is an analogous closed tableau for (Q3) because otherwise Theor. 13.6 would not allow us to conclude that P(x_{0}^{∀,w}) is valid.

Note that the sequent calculus proof tree is not equal to the result of the standard transformation of the tableau tree. The standard transformation of a tableau tree into a sequent tree works for inductive trees just as for deductive trees:

1. Bottom-up replace the label of each node with the syntactical construct listing the conjugates of the formulas and the weight labeling the (partial) branch from this node to the root.

2. Remove the root part of the tree where the nodes are ancestors of a node of the initial

Hypothesizing step (in our example: remove the root node). This standard transformation multiplies the number of formulas labeling each proof tree with at most nearly the depth of that tree, but does not use the advantages of sequent calculi, namely the ability to simplify formulas that label ancestor nodes in a tableau calculus. E.g., in the tableau tree it is not possible to rewrite the literal ¬P(x_{0}^{∀,w}) with the equality literals below it in place. In tableau trees, an equality literal can be used to rewrite formulas of its offspring in place, whereas it must copy ancestor formulas beforehand down to its offspring because the ancestor is also part of other branches that do not include the equality literal. Moreover, the weight term can be rewritten in the sequent tree, which again is not possible in the tableau version where the weight is at the root node. Since x_{0}^{∀,w} is in solved form after the Rewrite steps, we know that validity cannot rely on the equality literals containing it. This means that we can safely remove both equality literals in the sequent tree so that they do not appear in (2.1) and (2.2). Removing redundant formulas is the most important simplification step besides contextual rewriting. This is impossible in tableau trees unless the redundancy of the formula is due to the ancestor nodes only, which is the case only for useless formulas that should not have been added at all.

Note that formulas like (nat1) from Section 4.1 make equality omnipresent in ITP and that these simplification steps are even more important in inductive than in deductive theorem proving: Not only do they play a role in the generation of appropriate induction hypotheses; in addition to the detection of invalid input theorems they are an essential part of the failure detection process that has to compensate for over-generalization of induction hypotheses: Indeed, ITP often is only successful when one tries to show theorems that are more general than the ones one initially intended to show. This is because an inductive theorem is not only a task (as goal) but also a tool (as induction hypothesis) for ITP. This generalization is unsafe in the sense that it may over-generalize a valid hypothesis into an invalid one. Therefore, generalization should not be modeled in Expansion steps within a tree. Instead, the generalized sequent should start a new tree (Hypothesizing step) and be later applied to the original tree as a lemma or an induction hypothesis. Since even a valid input theorem may result in an invalid goal due to over-generalization, the ability of an ITP system to detect invalid goals is of major importance in practice, cf. Section 13.2.

In Wirth (1997) and in QuodLibet the Expansion from (2) into (2.1) and (2.2) is done in a single inference step called “substitution add” applying a “covering set of substitutions”. Note that the state of the sequent proof resulting from this step is much simpler than the corresponding state of the tableau proof. The former consists of the nodes (2.1) and (2.2) and has two formulas and one variable. The latter consists of a six node tree with five formulas and two variables. This is of practical importance because tactics for proof search are more easily confused with less concise proof state representations. The rest of the whole sequent proof is analogous to the tableau proof with the exception that all rewrite steps of the tableau tree are omitted since there are no equality literals to rewrite with and the terms are already in normal form.

Another possibility restricted to sequent calculi is that each syntactical construct labeling a node in the trees can be applied as an induction hypothesis. We do not see a real advantage in this because splitting the tree in two above such an induction hypothesis results in a better structure of the proof forest and in more successful proofs because we can adjust the syntactical construct appropriately: Suppose we had not started a new proof tree for the hypothesis for Q but instead kept the hypothesis for Q down in the tree (2) at position (2.2.2). Several unsafe generalization steps would have been necessary before

Q(x_{1}^{∀,w}, s(x_{1}^{∀,w})), ¬P(x_{1}^{∀,w}), P(s(x_{1}^{∀,w})); w0^{∃}(s(x_{1}^{∀,w}))

would have become useful as an induction hypothesis, namely removing the second and third formula, generalizing s(x_{1}^{∀,w}) to a new variable, and switching to a weight that measures also this new variable.

Moreover, in practice one should not apply the hypothesis for Q in the tree for P before it is obvious that the tree for Q mutually needs the hypothesis for P: Most of the time a proof for Q can be completed in a proof forest not containing the tree for P. In this case, not only the number of trees in the proof forest for Q gets smaller, but also the tree for P because (Q3) can then be applied as a lemma and not as an induction hypothesis, which cuts off the rightmost <-branch of the proof tree of P.

18 Example: Eager Hypotheses Generation

Let us try to find a lower bound for the Ackermann function ack : nat → nat → nat w.r.t. the ordering on natural numbers less : nat → nat → bool, assuming the following axioms.

(ack1)  ∀y. ack(0, y)=s(y)
(ack2) ∀x, y. ack(s(x), 0)=ack(x, s(0))
(ack3) ∀x, y. ack(s(x), s(y))=ack(x, ack(s(x), y))
(less1)  ∀y. less(0, s(y))=true
(less2)  ∀x. less(x, 0)=false
(less3) ∀x, y. less(s(x), s(y))=less(x, y)

The standard lemmas for less that have very simple inductive proofs in QuodLibet are:

(less4)  ∀x. less(x, s(x))
(less5)  ∀x, y. ( less(x, y) ⇒ less(x, s(y)) )
(less6)  ∀x, y. ( less(s(x), y) ⇒ less(x, y) )
(less7) ∀x, y, z. ( \binom{less(x, y)}{∧ less(y, z)} ⇒ less(s(x), z) )

Note that for Boolean terms t we abbreviate the equation t=true with t. Moreover, note that (less7) is a strengthened version of transitivity. The simple transitivity is a simple consequence of it, using (less6).

Let us start with a Hypothesizing step in the sequent calculus of Definition 13.4, posing the query for a lower bound z0^{∃} : nat → nat → nat

(4) less(z0^{∃}(x_{0}^{∀,w}, y_{0}^{∀,w}), ack(x_{0}^{∀,w}, y_{0}^{∀,w})); w4^{∃}(x_{0}^{∀,w}, y_{0}^{∀,w})

with variable-condition R := {z0^{∃}, w4^{∃}} × {x_{0}^{∀,w}, y_{0}^{∀,w}}.

Note that we have to let z0^{∃} be a higher-order variable: If z0^{∃} were a first-order variable, it could not depend on x_{0}^{∀,w} and y_{0}^{∀,w} due to R, resulting in a constant lower bound that would not be too interesting. If we did not include z0^{∃} into dom(R), however, Theor. 14.3 would not permit us to do induction on x_{0}^{∀,w} and y_{0}^{∀,w} because they would not be elements of the set Y.

Applying (nat1) (cf. Section 4.1) as a lemma according to Theor. 14.3 yields the two goals

(4.1) less(z0^{∃}(0, y_{0}^{∀,w}), ack(0, y_{0}^{∀,w})); w4^{∃}(0, y_{0}^{∀,w}) (4.2) less(z0^{∃}(s(x_{1}^{∀,w}), y_{0}^{∀,w}), ack(s(x_{1}^{∀,w}), y_{0}^{∀,w})); w4^{∃}(s(x_{1}^{∀,w}), y_{0}^{∀,w})

just it was as it was explained at the end of Section 4.1, adding {z0^{∃}, w4^{∃}} × {x_{1}^{∀,w}} to the variable-condition. The same procedure again yields

(4.2.1) less(z0^{∃}(s(x_{1}^{∀,w}), 0), ack(s(x_{1}^{∀,w}), 0)); w4^{∃}(s(x_{1}^{∀,w}), 0) (4.2.2) less(z0^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), ack(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))); w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))

adding {z0^{∃}, w4^{∃}} × {y_{1}^{∀,w}} to the variable-condition.

Rewriting (4.1), (4.2.1), and (4.2.2) with (ack1), (ack2), and (ack3), resp., yields

(4.1.1) less(z0^{∃}(0, y_{0}^{∀,w}), s(y_{0}^{∀,w})); w4^{∃}(0, y_{0}^{∀,w}) (4.2.1.1) less(z0^{∃}(s(x_{1}^{∀,w}), 0), ack(x_{1}^{∀,w}, s(0))); w4^{∃}(s(x_{1}^{∀,w}), 0) (4.2.2.1) less(z0^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), ack(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))); w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))

In our previous examples the generation of induction hypotheses was always lazy in the sense of Protzen (1994). In this case, however, in order to be able to use goal-directedness also w.r.t. the induction hypotheses, we should generate them eagerly in the way suggested by the recursion analysis of explicit induction, cf. e.g. Boyer & Moore (1979), Walther (1992).

Recursion analysis and eager hypotheses generation are very useful for finding simple proofs completely automatically. Although the ITP system Nqthm (cf. Boyer & Moore (1988)) cannot accept (4) because it does not have any free existential variables (not even existential quantification), if we instantiate (4) with the proper lower bound, Nqthm proves (4) completely automatically, even when the lemma (less7) is not provided and the function ‘less’ is redefined so that the built-in features for treating arithmetic cannot help. Moreover, during this proof the fascinating Nqthm guesses (less7) completely automatically using the goal-directedness w.r.t. the eagerly generated induction hypotheses. Indeed, if the eagerly generated induction hypotheses happen to be the right ones, they can help us to find missing lemmas or to find proper instantiations for free existential variables. Since it is folklore heuristic knowledge in ITP that a strong lower bound is often found by first finding a weaker one and then improving it, we should not look for an optimal lower bound with difficult proof but for a reasonable lower bound with simple proof.

Note that eager hypotheses generation is not possible with the induction rules of Baaz &al. (1997).

In our example, the induction hypotheses suggested for (4.2.1.1) and (4.2.2.1) result from matching the ack-subterm of (4) to the ack-subterms of (4.2.1.1) and (4.2.2.1). For (4.2.1.1) we get the substitution {x_{0}^{∀,w}↦x_{1}^{∀,w}, y_{0}^{∀,w}↦s(0)} and for (4.2.2.1) the substitutions {x_{0}^{∀,w}↦x_{1}^{∀,w}, y_{0}^{∀,w}↦ack(s(x_{1}^{∀,w}), y_{1}^{∀,w})} and {x_{0}^{∀,w}↦s(x_{1}^{∀,w}), y_{0}^{∀,w}↦y_{1}^{∀,w}} resulting in:

(4.2.1.1.1) ¬less(z0^{∃}(x_{1}^{∀,w}, s(0)), ack(x_{1}^{∀,w}, s(0))), less(z0^{∃}(s(x_{1}^{∀,w}), 0), ack(x_{1}^{∀,w}, s(0))); w4^{∃}(s(x_{1}^{∀,w}), 0) (4.2.1.1.2) w4^{∃}(x_{1}^{∀,w}, s(0))<w4^{∃}(s(x_{1}^{∀,w}), 0), less(z0^{∃}(s(x_{1}^{∀,w}), 0), ack(x_{1}^{∀,w}, s(0))); w4^{∃}(s(x_{1}^{∀,w}), 0) (4.2.2.1.1) ¬less(z0^{∃}(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w})), ack(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))),

less(z0^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), ack(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))); w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))

(4.2.2.1.2) w4^{∃}(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))<w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), …

(4.2.2.1.1.1) ¬less(z0^{∃}(s(x_{1}^{∀,w}), y_{1}^{∀,w}), ack(s(x_{1}^{∀,w}), y_{1}^{∀,w})),

¬less(z0^{∃}(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w})), ack(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))),

less(z0^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), ack(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))); w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))

(4.2.2.1.1.2) w4^{∃}(s(x_{1}^{∀,w}), y_{1}^{∀,w})<w4^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w})), …

After setting w4^{∃}(x, y) := (x, y), the goals (4.2.1.1.2), (4.2.2.1.2), and (4.2.2.1.1.2) can be closed due to their first formulas. The whole proof up to now is the “eager induction hypotheses generation” suggested by recursion analysis of (4).

Now, (4.2.2.1.1.1) cries for a lemma application of (less7). Indeed, the lemma can close it, provided that we can identify the pairs (s(z0^{∃}(s(x_{1}^{∀,w}), y_{1}^{∀,w})), z0^{∃}(s(x_{1}^{∀,w}), s(y_{1}^{∀,w}))) and (ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}), z0^{∃}(x_{1}^{∀,w}, ack(s(x_{1}^{∀,w}), y_{1}^{∀,w}))), which is achieved by their most general λβunifier, the projection z0^{∃}(x, y) := y.

Now (4.1.1) reads

(4.1.1’) less(y_{0}^{∀,w}, s(y_{0}^{∀,w})); (0, y_{0}^{∀,w})

which can be closed by an application of lemma (less4).

The only branch that is still open is (4.2.1.1.1’) ¬less(s(0), ack(x_{1}^{∀,w}, s(0))), less(0, ack(x_{1}^{∀,w}, s(0))); (s(x_{1}^{∀,w}), 0)

which can be closed by an application of lemma (less6).

This completes the proof of (4) with the answer that z0^{∃} can be the projection to its second argument, i.e. the lower bound is y_{0}^{∀,w}.

Note that it is possible to do this proof with the first-order system QuodLibet because it is so lazy that one can use a symbol for an undefined function instead of the 2^{nd} order variable z0^{∃}. There is no 2^{nd} order unification but the user can set this function to be the projection during the proof. Since QuodLibet guarantees consistency of the specification (i.e. the existence of models where semantical equality of constructor ground terms implies syntactical equality) (provided arithmetic is consistent, cf. Gentzen (1938)) and admits partially defined and non-terminating functions, the actual proof in QuodLibet differs from the presented one by some additional subgoals that can be closed by a lemma stating that ack is a total function, which has a simple inductive proof. For the details cf. Kühler & Wirth (1996).

19 Example: Variable Induction Ordering

0  :  nat
s  :  nat → nat
true, false  :  bool
∗, Rev  :  (A → A → bool) → A → A → bool
Union  : (A → A → bool) → (A → A → bool) → A → A → bool
Comm, LComm:  (A → A → bool) → (A → A → bool) → bool
Wellf  :  (A → A → bool) → bool

In this section we are going to prove a generalized version of a lemma of M. H. A. Newman, namely that local commutation of two relations implies their commutation, provided that the reverse of their union is wellfounded.

Our displayed simply-typed higher-order signature is used to denote the following: ∗(⟶) contains the transitive closure of the binary relation ⟶ on A, Rev(⟶) is its reverse relation, and Union(⟶, ⟶′) is its union with ⟶′. For all our Boolean terms t we abbreviate the equation t=true with t. For ⟶ : A → A → bool, instead of ⟶(x, y) we write x⟶y, instead of ∗(⟶, x, y) we write x⟶^{∗}y, and instead of Union(⟶, ⟶′) we write ⟶ ∪ ⟶′.

(∗1)  ∀⟶, x, z. ( x⟶^{∗}z ⇔ ( \begin{matrix}& x=z \\ ∨ & ∃y. \binom{x⟶y}{∧ y⟶^{∗}z} \end{matrix} ) )

(Union1) ∀⟶, ⟶′, x, y. ( x(⟶ ∪ ⟶′)y ⇔ \binom{x⟶y}{∨ x⟶′y} )
(Rev1)  ∀⟶, x, y. ( Rev(⟶, x, y) ⇔ y⟶x )

(Comm1), (LComm1), and (Wellf1) are the properties of commutation, local commutation, and wellfoundedness, resp.:

(Comm1)  ∀⟶_{0}, ⟶_{1}. ( \begin{matrix}& Comm(⟶_{0}, ⟶_{1}) \\ ⇔ & ∀x, y_{0}, y_{1}. ( \begin{matrix}( & \begin{aligned}& x⟶^{∗}_{0}y_{0} \\ ∧ & x⟶^{∗}_{1}y_{1} \end{aligned} & ) \\ ⇒ & ∃z. \binom{y_{0}⟶^{∗}_{1}z}{∧ y_{1}⟶^{∗}_{0}z} \end{matrix} ) \end{matrix} )

(LComm1) ∀⟶_{0}, ⟶_{1}. ( \begin{matrix}& LComm(⟶_{0}, ⟶_{1}) \\ ⇔ & ∀x, y_{0}, y_{1}. ( \begin{matrix}( & \begin{aligned}& x⟶_{0}y_{0} \\ ∧ & x⟶_{1}y_{1} \end{aligned} & ) \\ ⇒ & ∃z. \binom{y_{0}⟶^{∗}_{1}z}{∧ y_{1}⟶^{∗}_{0}z} \end{matrix} ) \end{matrix} )

(Wellf1)  ∀r : A → A → bool.
Wellf(r)

⇔ ∀p : A → bool. ( \begin{matrix}& ∃x. p(x) \\ ⇒ & ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ r(y, x)} \end{matrix} ) \end{matrix} )

Note that wellfoundedness and termination are no first-order properties.^{24} The transitivity lemma

(5) u_{0}^{∀,w}⟶^{∗}^{∀,w}u_{2}^{∀,w}, ¬u_{0}^{∀,w}⟶^{∗}^{∀,w}u_{1}^{∀,w}, ¬u_{1}^{∀,w}⟶^{∗}^{∀,w}u_{2}^{∀,w}, ¬Wellf(Rev(⟶^{∀,w})); u_{0}^{∀,w}

can be shown by induction on u_{0}^{∀,w} in ⟶^{∀,w}. Note that we need the wellfoundedness because otherwise ⟶^{∗}^{∀,w} may be a proper super-relation of the transitive closure of ⟶^{∀,w}. I.e. the transitive closure is the smallest solution of (∗1) and in case of wellfoundedness there is only one single solution.

The following lemmas have very simple non-inductive proofs that expand the definition (Wellf1) twice. Note that the expansion of a logical equivalence is nothing but (γ-steps followed by) a kind of Rewrite-step because formulas can be seen as higher-order terms of type bool and the logical equivalence as the equality of type bool.

(6a) ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), Wellf(Rev(⟶_{0}^{∀,w}))

(6b) ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), Wellf(Rev(⟶_{1}^{∀,w}))

Note that commutativity of Union implies that (6a) and (6b) are equivalent, but to prove ⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w} = ⟶_{1}^{∀,w} ∪ ⟶_{0}^{∀,w} we need extensionality which we do not want to discuss here.

Now we are going to show the generalized Newman lemma, namely that wellfoundedness of the reverse of the union plus local commutation implies commutation.

¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}), Comm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Expanding the definition (Comm1), three liberalized δ-steps, and two α-steps yield

¬x^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,s}, ¬x^{∀,s}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,s}, ∃z. \binom{z_{0}^{∀,s}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}z},

¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Now, since we want to do induction on x^{∀,s}, we start a new proof tree for

(7) ¬x^{∀,w}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w}, ¬x^{∀,w}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z},

¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});
x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Note that this differs from the previous sequent (which can immediately be closed by lemma application of (7)) not only in that all free universal variables are weak now (which we also could have achieved by using non-liberalized δ-steps before instead of the liberalized ones) but also in that x^{∀,w} is included in the weight, which is necessary for our intended induction. Actually we have set the weight directly to x^{∀,w} for simplicity. Note that if the heuristic knowledge to recognize the above sequent as the likely induction hypothesis is not present, our calculi violate our design goal of a natural flow of information (cf. Section 2.1) because we sometime later realize that we should have started a new proof tree. With implemented calculi, however, this violation is no problem because one just has to implement a destructive inference rule that automatically splits a proof tree at a given position, reorganizes the former subtree into a new individual proof tree, and closes the cut branch by lemma or induction hypothesis application of the sequent of the new tree.

Moreover, we have added a free existential variable for the induction ordering

<^{∃} : A → A → A → (A → A → bool) → (A → A → bool) → A → A → bool where the last two arguments will be supplied in infix notation below. Note that we have not supplied any induction quasi-ordering, but instead assume it to be the empty relation as in the discussion after Theor. 14.3, so that the sequents (5) and (6) can be omitted from the set M in Theor. 14.3.

We set our variable-condition R := {<^{∃}} × {x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}} in order to have all weak free universal variables of (7) in the set Y of Theor. 14.3.

Expansion of the equivalence (∗1) in the first formula of (7), a β-, a liberalized δ- and an α-step yield:

(7.1) x^{∀,w}≠z_{0}^{∀,w}, ¬x^{∀,w}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, …; …

(7.2) ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w}, ¬x^{∀,w}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z},

¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});
x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Rewriting with the first formula of (7.1) yields:

(7.1.1) ¬x^{∀,w}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ∃z. \binom{x^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, …; …

which is easily proved by setting z to z_{1}^{∀,w} in a γ-step. Expansion of the equivalence (∗1) in the third formula of (7.2), a β-, a liberalized δ- and an α-step yield:

(7.2.1) x^{∀,w}≠z_{1}^{∀,w}, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w}, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, …; …

(7.2.2) ¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w},

∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});

x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Rewriting with the first formula of (7.2.1) yields:

(7.2.1.1) ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w}, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ x^{∀,w}⟶^{∗}_{0}^{∀,w}z}, …; …

Now we have to regenerate the literal ¬x^{∀,w}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w} (which a tableau proof would still have available from (7)) by application of (∗1) and then close this subtree by setting z to z_{0}^{∀,w}.

Expansion of (LComm1) in (7.2.2), γ-, β- and liberalized δ-steps yield two tautologies plus

(7.2.2.1) ¬y_{0}^{∀,s}⟶^{∗}_{1}^{∀,w}y_{2}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{2}^{∀,s},

¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w},

∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});

x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Applying (7) as an induction hypothesis according to Theor. 14.3 with substitution

{x^{∀,w}↦y_{0}^{∀,s}, z_{1}^{∀,w}↦y_{2}^{∀,s}}

yields four tautologies and

(7.2.2.1.1) ¬z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}y_{3}^{∀,s}, ¬y_{2}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{3}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{1}^{∀,w}y_{2}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{2}^{∀,s},

¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w},

∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});

x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

(7.2.2.1.2) y_{0}^{∀,s} <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) x^{∀,w}, …, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, …

(7.2.2.1.3) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ y <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) x} \end{matrix} ) ),
…, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), …

(7.2.2.1.4) ∀x, y : A. \binom{x <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) y}{⇔ x <^{∃}(y_{0}^{∀,s}, z_{0}^{∀,w}, y_{2}^{∀,s}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) y}, …

where (7.2.2.1.1) is presented after application of a liberalized δ- and an α-step. The situation of the first two lines of (7.2.2.1.1) (seen as an antecedent) can be depicted as follows:

x^{∀,w} _{0}_{1}  y_{0}^{∀,s} _{0}^{∗}_{1} _{∗}  z_{0}^{∀,w}_{1} _{∗} y_{1}^{∀,s} _{0}_{∗}_{1} _{∗}  y_{2}^{∀,s} _{0}_{∗} y_{3}^{∀,s} z_{1}^{∀,w}

Application of (5) as a lemma yields (besides a sequent that can be closed by lemma application of (6a))

(7.2.2.1.1.1) ¬y_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{3}^{∀,s}, ¬z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}y_{3}^{∀,s}, ¬y_{2}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{3}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{1}^{∀,w}y_{2}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{2}^{∀,s},

¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, ¬y_{1}^{∀,s}⟶^{∗}_{1}^{∀,w}z_{1}^{∀,w}, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, ¬y_{0}^{∀,s}⟶^{∗}_{0}^{∀,w}z_{0}^{∀,w},

∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), ¬LComm(⟶_{0}^{∀,w}, ⟶_{1}^{∀,w});

x^{∀,w}, <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w})

Applying (7) as an induction hypothesis with substitution {x^{∀,w}↦y_{1}^{∀,s}, z_{0}^{∀,w}↦y_{3}^{∀,s}} yields four tautologies and

(7.2.2.1.1.1.1) ¬z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}y_{4}^{∀,s}, ¬z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}y_{4}^{∀,s}, ¬y_{3}^{∀,s}⟶^{∗}_{1}^{∀,w}y_{4}^{∀,s},

¬y_{1}^{∀,s}⟶^{∗}_{0}^{∀,w}y_{3}^{∀,s}, ¬z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}y_{3}^{∀,s}, …, ∃z. \binom{z_{0}^{∀,w}⟶^{∗}_{1}^{∀,w}z}{∧ z_{1}^{∀,w}⟶^{∗}_{0}^{∀,w}z}, …

(7.2.2.1.1.1.2) y_{1}^{∀,s} <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) x^{∀,w}, …, ¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, …

(7.2.2.1.1.1.3) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ y <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) x} \end{matrix} ) ),
…, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), …

(7.2.2.1.1.1.4) ∀x, y : A. \binom{x <^{∃}(x^{∀,w}, z_{0}^{∀,w}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) y}{⇔ x <^{∃}(y_{1}^{∀,s}, y_{3}^{∀,s}, z_{1}^{∀,w}, ⟶_{0}^{∀,w}, ⟶_{1}^{∀,w}) y}, …

where (7.2.2.1.1.1.1) is presented after application of a liberalized δ- and an α-step, which can be depicted as

x^{∀,w} _{0}_{1}  y_{0}^{∀,s} _{0}^{∗} z_{0}^{∀,w}_{1} _{∗} y_{1}^{∀,s}  _{0}_{∗}_{1} _{∗}  y_{3}^{∀,s}_{1} _{∗} z_{1}^{∀,w}  _{0}_{∗}  y_{4}^{∀,s}

and after a lemma application of (5) (producing another goal closed by lemma application of (6b)).

Now (7.2.2.1.1.1.1) can be closed after setting z to y_{4}^{∀,s} in a γ-step. When we finally apply the existential R-substitution {<^{∃} ↦ λv_{0}, …, v_{4}. (Rev(v_{3} ∪ v_{4}))} and λβ-reduce, we get the following open goals:

(7.2.2.1.2’) Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w}, y_{0}^{∀,s}, x^{∀,w}), …, ¬x^{∀,w}⟶_{0}^{∀,w}y_{0}^{∀,s}, …

(7.2.2.1[.1.1].3’) ∀p : A → bool.

( ∃x. p(x) ⇒ ∃x. ( \begin{matrix}& p(x) \\ ∧ & ¬∃y. \binom{p(y)}{∧ Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w}, y, x)} \end{matrix} ) ),
…, ¬Wellf(Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w})), …

(7.2.2.1[.1.1].4’) ∀x, y : A. ( \begin{matrix}Rev & (⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w}, x, y) \\ ⇔ & Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w}, x, y) \end{matrix} ), …

(7.2.2.1.1.1.2’) Rev(⟶_{0}^{∀,w} ∪ ⟶_{1}^{∀,w}, y_{1}^{∀,s}, x^{∀,w}), …, ¬x^{∀,w}⟶_{1}^{∀,w}y_{1}^{∀,s}, …

which can be easily closed.

20 Optimizations

Note that (as far as Theor. 14.1 and Theor. 14.3 are concerned) the choice-conditions do not have any influence on our proofs when we never instantiate strong free universal variables and when, in the liberalized δ-steps, we always choose a completely new strong free universal variable x^{∀,s} that does not occur elsewhere. Thus, the choice-conditions may be omitted in an implementation. We could, however, use them for the following purposes:

1. We could use the choice-conditions in order to weaken our requirements for our set of axioms AX: Instead of (weak) V_{∃}×V_{∀}-validity of AX, (C, R)-strong validity of AX (which is logically weaker, cf. Lemma 10.2) is sufficient for Theor. 13.6.

2. We can simulate the behavior of an improved version of the δ^{+^{+}}-rule of Beckert &al. (1993) by equating different strong free universal variables whose C-values are initially equal or have become logically equivalent during the proof. Note that this does not anymore require a functional and extensional behavior of choice-conditions as in Wirth (1998). There we had to require that, for (x^{∀,s}, A) ∈ C, the value for x^{∀,s} is not just an arbitrary one from the set of values that make A valid, but a unique element of this set given by some choice-function. In the present version (due to the changed notion of strong validity) it is possible to globally replace not only a free existential variable, but also a strong free universal variable x^{∀,s} with any term that (if possible) makes C(x^{∀,s}) true.

Expressed with Hilbert’s ε-terms (as indicated in Section 9), our treatment is similar to a structure sharing version of the merely intensional treatment of ε-terms in Giese & Ahrendt (1999). Note that our choice-conditions even do not imply a functional dependence of ϵ(π)(τ)(y^{∀,s}) from C(y^{∀,s}); instead the choice of a special value is a step in a proof similar to the instantiation of a free existential variable, and we do not have to commit to this choice for other occurrences of the same ε-term. This means that our choice-conditions work like the word “some” in the in the English language. E.g., “Some human loves some human” is like Loves(x^{∀,s}, y^{∀,s}) with C(x^{∀,s}) = Human(x^{∀,s}) and C(y^{∀,s}) = Human(y^{∀,s}), or like

Loves(εx. Human(x), εx. Human(x))

and follows from Loves(Jack, Jill), Human(Jack), Human(Jill). There is more on this subject in Wirth (2002).

3. Moreover, the choice-conditions may be used to get more interesting solutions:

Example 20.1 Starting with the empty proof forest and hypothesizing

∀x. Q(x, x), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{∃})

with the rules at the end of Section 2.3 we can produce a proof tree with the leaves

¬Q(y^{∃}, y^{∃}), Q(x^{∀,s}, x^{∀,s}), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{∃})

and ¬P(y^{∃}), Q(x^{∀,s}, x^{∀,s}), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), P(z^{∃}) and the ∅-choice-condition {(x^{∀,s}, ¬Q(x^{∀,s}, x^{∀,s}))}.

The existential ∅-substitution {y^{∃}↦x^{∀,s}, z^{∃}↦x^{∀,s}} closes the proof tree via an Instantiation step. The solution x^{∀,s} for our query variable z^{∃} is not very interesting unless the choice-condition tells us to choose x^{∀,s} in such a way that Q(x^{∀,s}, x^{∀,s}) becomes false.

Note that if we had applied the δ-rule instead of the liberalized δ-rule in the above proof, i.e. if we had introduced x^{∀,w} instead of x^{∀,s}, then we would not only be unable to provide any information on our query variable (because the choice-condition is empty), but we would even be unable to finish our proof because due to the new variable-condition R = {(z^{∃}, x^{∀,w})} we cannot apply {y^{∃}↦x^{∀,w}, z^{∃}↦x^{∀,w}} anymore, because it is not an existential R-substitution. With the (weak) δ-rule, all we can show instead is

∀x. Q(x, x), ∃y. ( ¬Q(y, y) ∧ ¬P(y) ), ∃z. P(z)

Thus, it is obvious that the liberalized δ-rule is not only superior^{25} to the (non-liberalized) δrule w.r.t. theorem proving but also w.r.t. computation of answers and solutions. Nevertheless, when interested only in proving theorems not containing strong free universal variables, the choice-conditions do not produce any overhead because they can simply be omitted; thereby leaving the strong free universal variables unspecified just like the Skolem functions in Skolemizing deduction.

The only overhead compared to the standard framework of Skolemization seems to be that we have to compute transitive closures when checking whether a substitution σ is really an existential R-substitution and when computing the σ-update of R. But we actually do not have to compute the transitive closure at all, because the only essential thing is the circularity-check which can be done on a graph generating the transitive closures. This checking is in the worst case linear in

|R| + ∑_{σ} ( |U_{σ}| + |E_{σ}| )

and is expected to perform at least as well as an optimally integrated version (i.e. one without conversion of term-representation) of the linear unification algorithm of Paterson & Wegman (1978) in the standard framework of Skolemization and unification. (Of course, the checking for existential R-substitutions can also be implemented with any other unification algorithm.)

20.1 Variable-Condition versus Free Universal Variables

Not really computing the transitive closure enables another refinement that allows us to go even beyond the fascinating strong Skolemization of Nonnengart (1996). The basic idea of Nonnengart (1996) can be translated into our framework in the following simplified way.

Instead of proving ∀x. (A∨B) it may be advantageous to prove the stronger ∀x. A ∨ ∀x. B, because after applications of α- and liberalized δ-rules to ∀x. A ∨ ∀x. B, resulting in A{x↦x_{A}^{∀,s}}, B{x↦x_{B}^{∀,s}}, the variable-conditions introduced for x_{A}^{∀,s} and x_{B}^{∀,s} may be smaller than the variable-condition introduced for y^{∀,s} after applying these rules to ∀x. (A∨B), resulting in A{x↦y^{∀,s}}, B{x↦y^{∀,s}}, i.e. V_{free}(A) and V_{free}(B) may be proper subsets of V_{free}(A, B). Therefore the proof of ∀x. A ∨ ∀x. B may be simpler than the proof of ∀x. (A∨B). The nice aspect of strong Skolemization roughly translated into our framework is that the intermediately sized V_{free}(A) × {x_{A}^{∀,s}} ∪ V_{free}(A, B) × {x_{B}^{∀,s}} is added to the variable-condition, but only a single Skolem function f is introduced with x_{A}^{∀,s} represented as f(A′, X) and x_{B}^{∀,s} represented as f(A′, B′\A′) where X are some new free existential variables, A′ := V_{∃} ∩ R^{∗}⟨V_{free}(A)⟩, and B′ := V_{∃} ∩ R^{∗}⟨V_{free}(B)⟩. Thus, x_{B}^{∀,s} still becomes dependent on the free variables of the whole disjunction, so that—due to this asymmetry^{26}—it may make an important difference to prove ∀x. (A∨B) or ∀x. (B∨A).

Now, if we do not really compute the transitive closures in our strong version, we can prove A{x↦x_{A}^{∀,s}}, B{x↦x_{B}^{∀,s}} in parallel and may later decide to prove the stronger A{x↦y^{∀,s}}, B{x↦y^{∀,s}} instead, simply by merging the nodes for x_{A}^{∀,s} and x_{B}^{∀,s} and substituting x_{A}^{∀,s} and x_{B}^{∀,s} with y^{∀,s}. Of course, we have to pay the price of checking whether all substitutions are still existential R-substitutions.

Finally note that the same conflict and solution apply to

∀x. (A∧B) vs. ∀x. A ∧ ∀x. B,

although these formulas are logically equivalent: The latter in general produces smaller variable-conditions (unless V_{free}(A) = V_{free}(B)) but the former less free universal variables (Skolem functions) and each of the two may reduce the proof size.

20.2 Improving Multiple γ-Rule Applications

Another optimization, inspired by the ideas of Section 7 of Giese (1998) and Appendix B of Wirth (1997), improves the behavior of multiple γ-rule applications to the same formula. It requires a new kind of free existential variables which are not used for direct instantiation but as generators for the usual kind of free existential variables. In the tableau community these variables are sometimes called “universal” (cf. e.g. Beckert & Hähnle (1998)), but they have nothing to do with our free universal variables here. Thus, we call them generator variables and denote them with x^{∃,g} and V_{∃,g}, &c.. Instead of the γ-rule say

\frac{Γ ∃x. A Π}{A\{x↦x^{∃}\} Γ ∃x. A Π}

we take a rule like

\frac{Γ ∃x. A Π}{A\{x↦x^{∃,g}\} Γ Π}

where ∃x. A is removed and x^{∃,g} is a new generator variable. Other γ-rules are changed analogously. α-rules are not changed and the β-rules at the end of Section 2.3 are restricted in their applicability by the restriction of V_{∃,g}(A) ∩ V_{∃,g}(B) = ∅, which (together with the condition that generator variables do not occur in root sequents of Hypothesizing steps and substitutions of Instantiation steps) guarantees that for each generator variable there is always a single branch in a tree that contains all occurrences of this generator variable. To enable blocked β-rule applications and for Instantiation, we need a generation rule like

\frac{Γ A Π}{A\{x^{∃,g}↦x^{∃}\} Γ A Π}

The δ-rules at the end of Section 2.3 either get restricted by V_{∃,g}(A) = ∅ or otherwise we can proceed in the following less simple but more powerful way: We must treat generator variables like free existential variables and the generation rule must replace each strong (weak ones analogously) free universal variable y^{∀,s} from V_{∀,s}(A)∩⟨{x^{∃,g}}⟩R^{+} in A{x^{∃,g}↦x^{∃}} with a new one, say y∀,s_{′}, and add to the variable-condition R a copy of the graph of ⟨{x^{∃,g}}⟩R^{∗} with x^{∃} instead of x^{∃,g} and y∀,s_{′} instead of y^{∀,s} &c., and add to the choice-condition C something like (y∀,s_{′}, (C(y^{∀,s})){x^{∃,g}↦x^{∃}, y^{∀,s}↦y∀,s_{′}, …}). The nice treatment in Section 7 of Giese (1998) makes the reason for this seemingly complicated procedure obvious by means of Hilbert’s ε-terms.

The crucial step in order to include this into our framework here is to change the notion of (τ, e, A)-validity such that a generator variable x^{∃,g} is treated like a free existential variable with the exception that its value may also be chosen from the values of the free existential variables that have been generated from it; i.e. a value of x^{∃,g} establishing the validity must exist among ϵ(e)(τ)(x^{∃,g}) and the ϵ(e)(τ)(x^{∃}) for the free existential variables x^{∃} generated from x^{∃,g}. Without this, the generation rule would not preserve solutions.

Now, if the A in the γ-rule is a literal or a blocked β-formula, then the new γ-rule plus n generation steps have the effect of n applications of the old γ-rule and no improvement takes place. Otherwise, however, several inference rules may be applied after the new γrule, and when we suddenly discover that we need say P(x^{∃,g}) twice, then we can apply two generation steps instead of repeating the whole subtree up to the γ-rule application.

All in all, we have to admit that the possibilities to improve multiple γ-rule applications are poor in sequent and tableau calculi. In a matrix representation like in Wallen (1990), however, it is possible to dynamically increase the multiplicity and to let all existential variables be generating, no matter whether all occurrences of each variable are on the same branch or not. Thus, an implementation should use matrix calculi instead of the presentationally simpler sequent and tableau calculi used in this paper because then the βand δ-rules do not suffer from the severe restrictions explained above.

21 Conclusion

After introducing the required interdisciplinary background, we have presented a combination of the following features in deductive theorem proving: raising, explicit variable dependency representation, preservation of solutions, and the liberalized δ-rule. To our knowledge^{27} we have presented on the one hand the first sound combination of explicit variable dependency representation and the liberalized δ-rule. And on the other hand the first framework for preservation of solutions in full first-order logic. The difficulties described in Section 8 with the combination of the preservation of solutions and the liberalized δ-rule reveal unexpected details on the nature of the liberalized δ-rule.

The original motivation for our work, however, was not to combine these seemingly contrary features, but to provide the foundation for ITP, where the preservation of solutions is indispensable for the possibility to model descente infinie.

In the present version, lemma application and induction hypothesis application are included for the first time in all calculi: Wirth (1999) included only hypothesis application for the weak version of the calculi of Wirth (1998). For the strong version we surprisingly had to change the notion of strong validity in order to make lemma or induction hypothesis application possible. With this exception and besides lots of minor improvements, the calculi of this paper are the ones of the strong version of Wirth (1998), although we have omitted the word “strong” in the names of the notions wherever we did not present any weak version in this paper.

We have shown how to integrate descente infinie into state-of-the-art classical sequent and tableau calculi. The following aspects are novel compared to the concrete induction calculus of Wirth (1997): The tableau presentation, the possibility to use sequents of full first-order and higher-order formulas instead of literals only, and the important addition of free existential variables, i.e. the “dummies” of Prawitz (1960), making the major difference between the free variable calculi of Fitting (1996) and the calculi of Smullyan (1968). Contrary to Baaz &al. (1997) we really integrate descente infinie: When we start an inductive proof we do not restrict the applicable induction hypotheses. We can do mutual induction and invent completely new induction hypotheses, which can be sequents instead of literals only. Moreover, we can also generate induction hypotheses eagerly in the style of explicit induction, which enables goal-directedness w.r.t. induction hypotheses. Finally, we can have variable induction orderings. Thus, our calculi are much “fatter” than the “lean” calculus of Baaz &al. (1997) where all this is not possible. Furthermore, in Section 17 we exemplified that although tableau calculi may save repetition of formulas, sequent calculi have substantial advantages.

We hope that our examples illustrate that our modeling of descente infinie in sequent and tableau calculi can meet our design goals of Section 2.1 and is of practical relevance. A more convincing example that shows the features in their combined power requires an implementation with a graphical user interface for development as well as for presentation.

Acknowledgments: I would like to thank Paul Howard for a short e-mail communication on the Principle of Dependent Choice that was very helpful to me and Ulrich Kühler for his fascinating XQuodLibet system.

66

A Additional Lemmas

The following lemma—roughly speaking—only says that the Substitution-Lemma can be lifted to existential valuations as expected.

Lemma A.1 Let R be a variable-condition and σ an R-substitution.

1. Let R′ be a variable-condition with R⊆R′. Now:

Each existential (A, R′)-valuation is also an existential (A, R)-valuation.

2. Let R′ the σ-update of R. For each existential (A, R′)-valuation e′ there is some

existential (A, R)-valuation e s.t.

S_{e} = S_{e′} ∘ (_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}

and for all δ ∈ V_{∀} → A:

ϵ(e)(δ) = (_{V_{∃}\dom(σ)}↿id ∪ _{V_{∃}}↿σ) ∘ eval(A ⊎ ϵ(e′)(δ) ⊎ δ).

3. Let (C′, R′) the extended σ-update of (C, R). For each existential (A, R′)-valuation e′ and each π′ that is (e′, A)-compatible with (C′, R′), there is some existential (A, R)- valuation e s.t.

S_{e} = (S_{π′} ∪_{V_{∀,w}}↿id) ∘ (S_{e′} ∘ (_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}})

and for all δ ∈ V_{∀} → A, when τ abbreviates _{V_{∀,w}}↿δ:

ϵ(e)(δ) = (_{V_{∃}\dom(σ)}↿id ∪ _{V_{∃}}↿σ) ∘ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ), Note that R ∪ S_{e} ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}} is wellfounded here.

For dealing with quasi-existential R-substitutions semantically, we need the following technical sub-lemma to Lemma 11.2(5) and Lemma 12.3(5), which was removed from the end of Section 7. Note that, considering those variables that are constrained by the choicecondition C and replaced by the substitution σ, on the one hand, the set O contains the variables whose replacements are supported by the lemmas ⟨O⟩Q_{C,σ} (cf. Definition 9.4). On the other hand, the set N contains the variables that are not supported by such lemmas, plus all the variables that are constrained by C and suffer from this missing support in the sense that they depend on these variables via the variable-condition R.

Lemma A.2 Let C be an R-choice-condition, A a Σ-structure, σ a quasi-existential R-substitution. Let (C′, R′) be the extended σ-update of (C, R). Assume that we have O and N with O ⊆ dom(C)∩dom(σ) ⊆ O ⊎N, N ⊆ dom(C)\O, dom(C)∩⟨N⟩R^{+} ⊆ N. Now, for any existential (A, R′)-valuation e′ and any π′ that is (e′, A)-compatible with (C′, R′) s.t. ⟨O⟩Q_{C,σ} is strongly (π′, e′, A)-valid, there are an existential (A, R)- valuation e and a π that is (e, A)-compatible with (C, R) for which the following holds:

1. For any term or formula B (possibly containing some unbound variables from a set W ⊆ V_{bound}) with N ∩ V(B) = ∅, and for any τ ∈ V_{∀,w} → A and χ ∈ W → A, when we set δ′ := ϵ(π′)(τ) ⊎ τ and δ := ϵ(π)(τ) ⊎ τ:

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B).

2. For any set of sequents G with N ∩ V(G) = ∅:

Gσ is strongly (π′, e′, A)-valid iff G is strongly (π, e, A)-valid.

B Proofs

Proof of Lemma 3.1 Since R^{+} is clearly transitive, it suffices to show that it is wellfounded, because then it is irreflexive. Thus, suppose that there is some class A with ∀a ∈ A. ∃a′ ∈ A. a′R^{+}a. We have to show that A is empty. Set B := { b | ∃a ∈ A. aR^{∗}b }. \underline{Claim 1:} For any b ∈ B, there is some b′ ∈ B with b′Rb. \underline{Proof of Claim 1:} By definition of B and the property of A, there is some a ∈ A with aR^{+}b. Thus, there is some b′ with aR^{∗}b′Rb. \underline{Q.e.d. (Claim 1)} By Claim 1 and the assumption that R is wellfounded, we get A ⊆ B = ∅.

Q.e.d. (Lemma 3.1)

Proof of Lemma 4.5

\underline{\underline{4.2 ⇒ 4.4:}} Let < be an ordering with ∀a ∈ A. ∃a′ ∈ A. a > a′. Set R := > ∩ (A×A).

Now dom(R) = A ⊇ ran(R). Assume A ≠ ∅. By the Principle of Dependent

Choice, R is not terminating. This contradicts Version 1 and Version 2 of the Principle of Descente Infinie.

\underline{\underline{4.4 ⇒ 4.2:}} Let R be a binary relation with ran(R)⊆dom(R) ≠ ∅. We are going to show that R is not terminating.

Set A := \{ a ∃n ∈ N. \binom{a : \{0, …, n\} → dom(R)}{∧ ∀i ≺ n. a_{i}Ra_{i+1}} \}.

Define ≲ on A by a ≳ a′ if \binom{dom(a) ⊆ dom(a′)}{∧ ∀i ∈ dom(a). a_{i} = a′_{i}}. Let < be the ordering of ≲.

\underline{Claim 1:} ∀a ∈ A. ∃a′ ∈ A. a > a′. \underline{Proof of Claim 1:} For a : \{0, …, n\} → dom(R) we have to show the existence of some a′ : {0, …, n, n+1} → dom(R) with a > a′. When we set a′_{i} := a_{i} for i ⪯ n then (due to a_{n} ∈ dom(R)) there exists an a′_{n+1} with a_{n} R a′_{n+1}, and then a′_{n+1} ∈ ran(R)⊆dom(R).

Q.e.d. (Claim 1)

Since dom(R) ≠ ∅ we have A ≠ ∅. Thus, by Claim 1 and the Principle of Descente Infinie (Version 1) there is some non-terminating sequence (a_{i})_{i∈N} in > and we set C := ran(a) or (Version 2) there is some C ⊆ A totally ordered by < that has no <-minimal element. But then ⋃ C is a non-terminating sequence in R.

\underline{\underline{4.4(Version 1) ⇒ 4.3:}} If < is not wellfounded, then there is some non-empty class A with

∀a ∈ A. ∃a′ ∈ A. a>a′. Thus, by the Principle of Descente Infinie,

> ∩ (A×A) is not terminating, which implies that > is not terminating.

\underline{\underline{4.3 ⇒ 4.4(Version 1):}} Let < be an ordering. Then < ∩ (A×A) is an ordering, too. Thus,

if > ∩ (A×A) is terminating, by the Principle of Wellfoundedness,

< ∩ (A×A) is a wellfounded ordering. In case of ∀a ∈ A. ∃a′ ∈ A. a>a′, this means that A must be empty. Q.e.d. (Lemma 4.5)

Proof of Lemma 9.3

Set ⊲ := (R ∪ S_{e})^{+} and S_{π} := ⊲ ∩ (V_{∀,w}×V_{∀,s}). As e is an existential (A, R)-valuation, ⊲ is a wellfounded ordering. With the help of a choice function and by induction on y^{∀,s} ∈ V_{∀,s} in ⊲ we can define π(y^{∀,s}) ∈ (S_{π}⟨{y^{∀,s}}⟩ → A) → A in the following way: Let τ ∈ S_{π}⟨{y^{∀,s}}⟩ → A. In case of y^{∀,s} ∈ V_{∀,s}\dom(C) we choose an arbitrary value for π(y^{∀,s})(τ) from the universe of A (of the appropriate type). Note that universes are assumed to be non-empty, cf. Section 3.2. In case of y^{∀,s} ∈ dom(C), we have the following situation: C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B, B is a formula whose unbound variables from V_{bound} are among {v_{0}, …, v_{l−1}} ⊆ V_{bound} and where, for v_{0} : α_{0}, …, v_{l−1} : α_{l−1}, we have y^{∀,s} : α_{0} → … → α_{l−1} → α_{l} for some type α_{l}, and any occurrence of y^{∀,s} in B is of the form y^{∀,s}(v_{0}) ⋯ (v_{l−1}). In this case, we let π(y^{∀,s})(τ) be the function f that for χ ∈ {v_{0}, …, v_{l−1}} → A chooses a value from universe of A for f(χ(v_{0})) ⋯ (χ(v_{l−1})) such that, if possible, B is (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′ ⊎ χ, e, A)-valid for an arbitrary τ′ ∈ (V_{∀,w}\dom(τ)) → A. Note that this definition of f(χ(v_{0})) ⋯ (χ(v_{l−1})) does not depend on the values of f(χ′(v_{0})) ⋯ (χ′(v_{l−1})) for a different χ′ ∈ {v_{0}, …, v_{l−1}} → A because any occurrence of y^{∀,s} in B is of the form y^{∀,s}(v_{0}) ⋯ (v_{l−1}).

\underline{Claim 1:} For z^{∀} ∈ V_{∀} with z^{∀}⊲y^{∀,s}, (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{∀}) depends only τ, π(z^{∀}), and z^{∀}. \underline{Claim 2:} For x^{∃} ∈ V_{∃} with z^{∃}⊲y^{∀,s}, ϵ(e)(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(x^{∃}) depends only τ, _{⊲⟨\{y^{∀,s}\}⟩}↿π and e(x^{∃}). \underline{Claim 3:} The definition of π(y^{∀,s})(τ) depends only on such π(v^{∀,s}) with v^{∀,s} ⊲ y^{∀,s}. \underline{Claim 4:} The definition of π(y^{∀,s})(τ) does not depend on τ′.

\underline{Proof of Claim 1:} For z^{∀} ∈ V_{∀,w} we have (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{∀}) = τ(z^{∀}) due to z^{∀} ∈ S_{π}⟨{y^{∀,s}}⟩. Moreover, for z^{∀} ∈ V_{∀,s}, we have S_{π}⟨{z^{∀}}⟩ ⊆ S_{π}⟨{y^{∀,s}}⟩, and therefore (ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(z^{∀}) = π(z^{∀})(_{S_{π}⟨\{z^{∀}\}⟩}↿(τ ⊎ τ′)) = π(z^{∀})(_{S_{π}⟨\{z^{∀}\}⟩}↿τ). \underline{Q.e.d. (Claim 1)}

\underline{Proof of Claim 2:} As S_{e}⟨\{x^{∃}\}⟩ ⊆ ⊲⟨\{y^{∀,s}\}⟩, and ϵ(e)(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)(x^{∃}) = e(x^{∃})(_{S_{e}⟨\{x^{∃}\}⟩}↿(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′)) this follows from Claim 1. \underline{Q.e.d. (Claim 2)}

\underline{Proof of Claim 3 and 4:} Since C is an R-choice-condition, we have z ⊲ y^{∀,s} for all z ∈ V_{free}(C(y^{∀,s}))\\{y^{∀,s}\}. Thus, this follows from Claim 1 and Claim 2. \underline{Q.e.d. (Claim 3, 4)}

Now π is well-defined by Claim 3 and Claim 4 and obviously semantical. Thus, item 1 of Definition 9.2 is satisfied because (R ∪ S_{e} ∪ S_{π})^{+} = ⊲ is a wellfounded ordering. For showing item 2, let τ ∈ V_{∀,w} → A, y^{∀,s} ∈ dom(C), and C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B, and assume to the contrary that, for some η ∈ {y^{∀,s}} → A and χ ∈ {v_{0}, …, v_{l−1}} → A, B is (_{V_{∀,s}\{y^{∀,s}}}↿(ϵ(π)(τ))⊎η⊎τ⊎χ, e, A)-valid, but not (ϵ(π)(τ)⊎τ⊎χ, e, A)-valid. This contradicts the definition of π(y^{∀,s})(_{S_{π}⟨{y^{∀,s}}⟩}↿τ) from above due to Claim 4. Q.e.d. (Lemma 9.3)

Proof of Lemma 9.6 Here we denote concatenation (product) of relations ‘∘’ simply by juxtaposition and assume it to have higher priority than any other binary operator. R′^{+} is a wellfounded ordering simply because R′ is the σ-update of R and σ is an R-substitution. Now it suffices to show the following two claims for an arbitrary y^{∀,s} ∈ dom(C′): \underline{Claim 1:} For all z^{∀} ∈ V_{∀}(C′(y^{∀,s}))\\{y^{∀,s}\}: z^{∀}R′^{+}y^{∀,s}. \underline{Claim 2:} For all u^{∃} ∈ V_{∃}(C′(y^{∀,s})): u^{∃}R′^{+}y^{∀,s}. \underline{Proof of Claim 1:} Let z^{∀} ∈ V_{∀}(C′(y^{∀,s}))\\{y^{∀,s}\}. By the definition of C′ this means z^{∀} ∈ V_{∀}(C(y^{∀,s}))\{y^{∀,s}} or there is some u ∈ V(C(y^{∀,s})) with z^{∀} U_{σ} u. Since C is an R-choice-condition, we have z^{∀} R^{+} y^{∀,s} or z^{∀} U_{σ} u R^{∗} y^{∀,s}. As R′ is the σ-update of R, we have R ∪ U_{σ} ⊆ R′.^{28} Thus z^{∀}R′^{+}y^{∀,s}. \underline{Q.e.d. (Claim 1)} \underline{Proof of Claim 2:} Let u^{∃} ∈ V_{∃}(C′(y^{∀,s})). By the definition of C′ there is some v ∈ V(C(y^{∀,s})) with u^{∃} (_{V_{∃}\dom(σ)}↿id ∪ E_{σ}) v. Since C is an R-choice-condition, we have v R^{∗} y^{∀,s}, i.e. u^{∃} (_{V_{∃}\dom(σ)}↿id ∪ E_{σ})R^{∗} y^{∀,s}. As R′ is the σ-update of R, we have (_{V_{∃}\dom(σ)}↿id ∪ E_{σ})R^{∗} ⊆

(R ∪ E_{σ})^{∗} ⊆ R′^{∗}.^{29} Thus u^{∃}R′^{+}y^{∀,s}.  \underline{Q.e.d. (Claim 2)}  Q.e.d. (Lemma 9.6)

Proof of Lemma 10.2 As G is V_{∃}×V_{∀}-valid in A, there is some existential (A, V_{∃}×V_{∀})-valuation e s.t. G is (e, A)- valid. \underline{Claim 1:} e is an existential (A, R)-valuation. \underline{Proof of Claim 1:} As e is an existential (A, V_{∃}×V_{∀})-valuation, S_{e}∘(V_{∃}×V_{∀}) is irreflexive. This means S_{e} = ∅, i.e. (R ∪ S_{e})^{+} = R^{+}. As C is an R-choice-condition, R^{+} is a wellfounded ordering. This means that (R ∪ S_{e})^{+} is a wellfounded ordering, as was to be shown.

Q.e.d. (Claim 1)

By Claim 1, G is immediately R-valid. Moreover, by Claim 1 and Lemma 9.3, there is some π that is (e, A)-compatible with (C, R). As G is (e, A)-valid, G is also (ϵ(π)(τ) ⊎ τ, e, A)- valid for all τ ∈ V_{∀,w} → A. Then, as π is (e, A)-compatible with (C, R), G is (C, R)-strongly (e, A)-valid. Then, by Claim 1, G is (C, R)-strongly valid in A. Q.e.d. (Lemma 10.2)

Proof of Lemma 10.3

As G is (C, R)-strongly valid in A, there are some existential (A, R)-valuation e and some π s.t. π is (e, A)-compatible with (C, R) and G is strongly (π, e, A)-valid.

Set S_{e′} := (_{V_{∀,w}}↿id ∪ S_{π}) ∘ S_{e}↾_{V_{∃}\ran(ς)} ∪ S_{π} ∘ ς. We define e′ via: \underline{For x^{∃} ∈ V_{∃}\ran(ς):} For τ ∈ S_{e′}⟨\{x^{∃}\}⟩ → A:

e′(x^{∃})(τ) := e(x^{∃})(_{S_{e}⟨{x^{∃}}⟩}↿(ϵ(π)(τ ⊎ τ′) ⊎ τ ⊎ τ′))

where τ′ ∈ (V_{∀,w}\dom(τ)) → A. Note that this right-hand side is okay because dom(τ) ⊆ V_{∀,w}; indeed, due to x^{∃} ∉ ran(ς), we have S_{e′}⟨{x^{∃}}⟩ = (V_{∀,w} ∩ S_{e}⟨{x^{∃}}⟩) ∪ (S_{π} ∘ S_{e})⟨{x^{∃}}⟩ ⊆ V_{∀,w}. Furthermore, note that this right-hand side does not depend on τ′ because V_{∀,w} ∩ S_{e}⟨{x^{∃}}⟩ ⊆ S_{e′}⟨{x^{∃}}⟩ = dom(τ), and for y^{∀,s} ∈ S_{e}⟨{x^{∃}}⟩, we have S_{π}⟨{y^{∀,s}}⟩ ⊆ (S_{π} ∘ S_{e})⟨{x^{∃}}⟩ ⊆ S_{e′}⟨{x^{∃}}⟩ and therefore ϵ(π)(τ ⊎ τ′)(y^{∀,s}) = π(y^{∀,s})(_{S_{π}⟨{y^{∀,s}}⟩}↿(τ ⊎ τ′)) = π(y^{∀,s})(_{S_{π}⟨{y^{∀,s}}⟩}↿τ). \underline{For x^{∃} ∈ ran(ς):} For τ ∈ S_{e′}⟨\{x^{∃}\}⟩ → A:

e′(x^{∃})(τ) := π(ς^{−1}(x^{∃}))(τ).

Note that this right-hand side is okay because, due to x^{∃} ∈ ran(ς), we have S_{e′}⟨{x^{∃}}⟩ = S_{π}⟨{ς^{−1}(x^{∃})}⟩ ⊆ V_{∀,w}.

\underline{Claim 1:} e′ is an existential (A, R′)-valuation. \underline{Proof of Claim 1:} Here we denote concatenation (product) of relations ‘∘’ simply by juxtaposition and assume it to have higher priority than any other binary operator. As π is (e, A)-compatible with (C, R), we know that (R ∪ S_{e} ∪ S_{π})^{+} is a wellfounded ordering. Thus, its subset

( (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ∪ (_{V_{∀,w}}↿id ∪ S_{π})S_{e}↾_{V_{∃}\ran(ς)} )^{+}

is a wellfounded ordering, too. Since the domain of this relation and dom(S_{π}) are disjoint from ran(ς), we know that

( (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ∪ (_{V_{∀,w}}↿id ∪ S_{π})S_{e}↾_{V_{∃}\ran(ς)} ∪ S_{π}ς )^{+}

is a wellfounded ordering, too. Since the domain of this relation and V_{∃} are disjoint from V_{∀,s}, we know that

( (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ∪ S_{π}ςς^{−1})R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ∪ V_{∃}×V_{∀,s} ∪ (_{V_{∀,w}}↿id ∪ S_{π})S_{e}↾_{V_{∃}\ran(ς)} ∪ S_{π}ς )^{+}

is a wellfounded ordering, too. Since a step inside the transitive closure of the previous term that can precede ς^{−1} can only be a step with S_{π}ς (due to dom(ς^{−1}) = ran(ς) ⊆ V_{∃}),

( (_{V_{∀,w}∪V_{∃}\ran(ς)}↿id ∪ ς^{−1})R^{+}↾_{V_{∀,w}∪V_{∃}\ran(ς)} ∪ V_{∃}×V_{∀,s} ∪ (_{V_{∀,w}}↿id ∪ S_{π})S_{e}↾_{V_{∃}\ran(ς)} ∪ S_{π}ς )^{+}

is a wellfounded ordering, too. The latter relation is a superset of (R′ ∪ S_{e′})^{+} which we had to show to be a wellfounded ordering. \underline{Q.e.d. (Claim 1)}

As the universes are assumed to be non-empty (cf. Section 3.2), there is some δ ∈ V_{∀,s} → A by the Axiom of Choice. Define π′ by π′(y^{∀,s})(∅) := δ(y^{∀,s}).

\underline{Claim 2:} π′ is (e′, A)-compatible with (∅, R′). \underline{Proof of Claim 2:} We have S_{π′} = ∅. Thus, (R′ ∪ S_{e′} ∪ S_{π′})^{+} is equal to (R′ ∪ S_{e′})^{+}, which is a wellfounded ordering by Claim 1. \underline{Q.e.d. (Claim 2)}

\underline{Claim 3:} For τ ∈ V_{∀,w} → A and x^{∃} ∈ V_{∃}(G): ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(x^{∃}) = ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{∃}). \underline{Proof of Claim 3:} We have x^{∃} ∈ V_{∃}(G) ⊆ V_{∃}\ran(ς). Thus, by the discussion of the first case of the definition of e′, we have ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(x^{∃}) = e′(x^{∃})(_{S_{e′}⟨{x^{∃}}⟩}↿τ) = e(x^{∃})(_{S_{e}⟨\{x^{∃}\}⟩}↿(ϵ(π)(τ) ⊎ τ)) = ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{∃}). \underline{Q.e.d. (Claim 3)}

\underline{Claim 4:} For τ ∈ V_{∀,w} → A and y^{∀,s} ∈ V_{∀,s}(G): ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(ς(y^{∀,s})) = ϵ(π)(τ)(y^{∀,s}). \underline{Proof of Claim 4:} Since ς(y^{∀,s}) ∈ ran(ς), by the discussion of the second case of the definition of e′, we have ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(ς(y^{∀,s})) = e′(ς(y^{∀,s}))(_{S_{e′}⟨{ς(y^{∀,s})}⟩}↿τ) = π(ς^{−1}(ς(y^{∀,s})))(_{S_{π}⟨\{ς^{−1}(ς(y^{∀,s}))\}⟩}↿τ) = π(y^{∀,s})(_{S_{π}⟨\{y^{∀,s}\}⟩}↿τ) = ϵ(π)(τ)(y^{∀,s}). \underline{Q.e.d. (Claim 4)}

\underline{Claim 5:} Gς is strongly (π′, e′, A)-valid. \underline{Proof of Claim 5:} Let τ ∈ V_{∀,w} → A be arbitrary. First by the Substitution-Lemma, second by Claim 3, V_{∀,s}(G) ⊆ dom(ς), Claim 4, and third as G is strongly (π, e, A)-valid, we get: eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(Gς) =

eval\binom{A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ)}{⊎ _{V_{∀,s}\dom(ς)}↿(ϵ(π′)(τ)) ⊎ ς ∘ (ϵ(e′)(ϵ(π′)(τ) ⊎ τ)) ⊎ τ}(G) =

eval( A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ )(G) = TRUE \underline{Q.e.d. (Claim 5)}

\underline{Claim 6:} Gς is R′-valid in A. \underline{Proof of Claim 6:} First note that by Claim 1, e′ is an existential (A, R′)-valuation. Let τ′ ∈ V_{∀} → A be arbitrary. When we set δ := _{V_{∀,s}}↿τ′ and τ := _{V_{∀,w}}↿τ′, we get eval(A ⊎ ϵ(e′)(τ′) ⊎ τ′)(Gς) = eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(Gς) = TRUE, where the latter step is due to Claim 5. \underline{Q.e.d. (Claim 6)}

Now we conclude that Gς is (∅, R′)-strongly valid in A (by Claim 1, Claim 2, and Claim 5) and R′-valid (Claim 6) in A. Q.e.d. (Lemma 10.3)

Proof of Lemma 11.2

(1), (2), (3), and (4) are trivial.

\underline{\underline{(5):}} Let e be an existential (A, R′)-valuation and π be (e, A)-compatible with (C′, R′). Due to R⊆R′ , by Lemma A.1(1), e is an existential (A, R)-valuation, too.

\underline{Claim 0:} π is (e, A)-compatible with (C, R). \underline{Proof of Claim 0:} As π is (e, A)-compatible with (C′, R′), and C⊆C′, π is (e, A)-compatible with (C, R′). As R⊆R′, π is (e, A)-compatible with (C, R). \underline{Q.e.d. (Claim 0)}

\underline{\underline{(5a):}} As G_{0} is (C′, R′)-strongly valid in A, there is an existential (A, R′)-valuation e and

some π s.t. π is (e, A)-compatible with (C′, R′) and G_{0} is strongly (π, e, A)-valid. Thus, by Claim 0, G_{0} is (C, R)-strongly (e, A)-valid. As e is an existential (A, R)-valua-tion, G_{0} is (C, R)-strongly valid in A.

\underline{\underline{(5b):}} Let e and π be given as in (5) above and suppose that G_{1} is strongly (π, e, A)-

valid. Thus, by Claim 0 and since e is an existential (A, R)-valuation and G_{0} (C, R)- reduces to G_{1}, also G_{0} is strongly (π, e, A)-valid as was to be shown.

\underline{\underline{(6a):}} As G_{0}σ ∪ ⟨O⟩Q_{C,σ} is (C′, R′)-strongly valid in A, there is an existential (A, R′)-valu-

ation e′ and some π′ s.t. π′ is (e′, A)-compatible with (C′, R′) and G_{0}σ ∪ ⟨O⟩Q_{C,σ} is strongly (π′, e′, A)-valid. Let e and π be given as in Lemma A.2. Then G_{0} is strongly (π, e, A)-valid. Moreover, as π is (e, A)-compatible with (R, C) and as e is an existential (A, R)-valuation, G_{0} is (C, R)-strongly valid in A.

\underline{\underline{(6b):}} Let e′ be an existential (A, R′)-valuation, π′ be (e′, A)-compatible with (C′, R′), and

suppose that G_{1}σ ∪ ⟨O⟩Q_{C,σ} is strongly (π′, e′, A)-valid. Let π and the existential (A, R)-valuation e be given as in Lemma A.2. Then π is (e, A)-compatible with (C, R), and G_{1} is strongly (π, e, A)-valid. By assumption, G_{0} strongly (C, R)-reduces to G_{1}. Thus, G_{0} is strongly (π, e, A)-valid, too. By Lemma A.2(2), this means that G_{0}σ is strongly (π′, e′, A)-valid as was to be shown. Q.e.d. (Lemma 11.2)

Proof of Lemma 12.3

(1), (2), (3), and (4) are trivial.

\underline{(5):} Let A ∈ K, S ∈ G_{0}, let e be an existential (A, R′)-valuation, and π be (e, A)- compatible with (C′, R′). Suppose that (S, τ) is an (π, e, A)-counterexample. Due to R⊆R′, by Lemma A.1(1), e is an existential (A, R)-valuation, too. As π is (e, A)-compatible with (C′, R′), and C⊆C′, π is (e, A)-compatible with (C, R′). As R⊆R′, π is (e, A)- compatible with (C, R). By assumption, G_{0}↷_{C,R}(G_{1}, L_{1}). Thus, there is some (π, e, A)- counterexample (S′, τ′) with S′ ∈ L_{1} or S′ ∈ G_{1} and in the latter case the long conjunction of the definition of foundedness as was to be shown.

\underline{(6):} Let A ∈ K, let e′ be an existential (A, R′)-valuation, and π′ be (e′, A)- compatible with (C′, R′). Let (Γ, (w, <, ≲)) ∈ G_{0} and assume that ((Γ σ, (wσ, <σ, ≲σ)), τ) is an (π′, e′, A)-counterexample. Assuming that there is no (π′, e′, A)-counterexample of L_{1}σ ∪L_{2}, we have to find some (π′, e′, A)-counterexample ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) with (Γ′, (w′, <′, ≲′)) ∈ G_{1}, plus the long conjunction of the definition of foundedness for e, π replaced with e′, π′, resp., and <, ≲, w, <′, ≲′, w′ replaced with their σ-instantiations. By our assumption on no (π′, e′, A)-counterexamples of L_{2}, we can apply Lemma A.2 to get a an existential (A, R)-valuation e and a π that is (e, A)-compatible with (C, R). Moreover, by this lemma, ((Γ, (w, <, ≲)), τ) is an (π, e, A)-counterexample. By assumption, G_{0}↷_{C,R}(G_{1}, L_{1}). Thus, there is some (π, e, A)-counterexample ((Γ′, (w′, <′, ≲′)), τ′) with (Γ′, (w′, <′, ≲′)) ∈ L_{1} or (Γ′, (w′, <′, ≲′)) ∈ G_{1}, plus in the latter case the long conjunction of the definition of foundedness. By Lemma A.2, this means that ((Γ′σ, (w′σ, <′σ, ≲′σ)), τ′) is an (π′, e′, A)-counterexample. We only have left to show that in the latter case the long conjunction of the definition of foundedness holds when we replace e, π with e′, π′, resp., and <, ≲, w, <′, ≲′, w′ with their σ-instantiations. This is nearly implied by Lemma A.2(1); the only problem is that <, ≲, <′, ≲′ are possibly no terms (so that the B of Lemma A.2(1) cannot be instantiated with them). Thus, for arbitrary τ ∈ V_{∀,w} → A and δ and δ′ given as in Lemma A.2(1), we still have to prove say eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′)(<σ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<). After expanding the shorthand on both sides for some distinct x, y ∈ V_{bound}\V(<, dom(σ), ran(σ)), this follows from eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ {x↦a, y↦b})(x (<σ) y) = (as x, y ∉ dom(σ)) eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ {x↦a, y↦b})((x < y)σ) = (due to Lemma A.2.1) eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ {x↦a, y↦b})(x < y).

\underline{(7):} Let A ∈ K, e be some existential (A, R)-valuation, and π be (e, A)-compatible with (C, R). Let D be the class of (π, e, A)-counterexamples (S, τ) with S ∈ H_{1} for that there is no (π, e, A)-counterexample (S′, τ′) with S′ ∈ L_{1} or S′ ∈ G_{1}, and in the latter case the long existential quantification of the definition of foundedness with the second alternative being valid. It suffices to show that D is empty because this means H_{1}↷_{C,R}(G_{1}, L_{1}). To the contrary, suppose ((Γ′′′, (w′′′, <′′′, ≲′′′)), τ′′′) ∈ D and set δ′′′ := ϵ(π)(τ′′′) ⊎ τ′′′, ⊲ := eval(A ⊎ ϵ(e)(δ′′′) ⊎ δ′′′)(<′′′), and ⊲ ∼ := eval(A ⊎ ϵ(e)(δ′′′) ⊎ δ′′′)(≲′′′). Set

A := \{ eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w) ( \begin{matrix}& ((Γ, (w, <, ≲)), τ) ∈ D \\ ∧ & δ = ϵ(π)(τ) ⊎ τ \\ ∧ & ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<) \\ ∧ & ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲) \end{matrix} ) \}. Then

eval(A ⊎ ϵ(e)(δ′′′) ⊎ δ′′′)(w′′′) ∈ A. Due to the assumed H_{1} ↘/↷_{C,R} (H_{1}, G_{1}, L_{1}) and D ≠ ∅, ⊲^{+} is a wellfounded ordering. Thus, A must have a ⊲^{+}-minimal element w̄. Thus, there must be some ((Γ, (w, <, ≲)), τ) ∈ D with δ = ϵ(π)(τ) ⊎ τ, ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲), and w̄ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w). Then, due to the assumed H_{1} ↘/↷_{C,R} (H_{1}, G_{1}, L_{1}), there must be an (π, e, A)-counter-example ((Γ′, (w′, <′, ≲′)), τ′) with (Γ′, (w′, <′, ≲′)) ∈ H_{1}, ⊲ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′), and w̄′⊲^{+}w̄ for δ′ := ϵ(π)(τ′) ⊎ τ′ and w̄′ := eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(w′). Thus, since w̄ is ⊲^{+}-minimal in A, ((Γ′, (w′, <′, ≲′)), τ′) ∉ D. Thus, there must be some (π, e, A)-counterexample ((Γ′′, (w′′, <′′, ≲′′)), τ′′) either with (Γ′′, (w′′, <′′, ≲′′)) ∈ L_{1}, or otherwise with (Γ′′, (w′′, <′′, ≲′′)) ∈ G_{1}, ⊲ = eval(A ⊎ ϵ(e)(δ′′) ⊎ δ′′)(<′′), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ′′) ⊎ δ′′)(≲′′), and w̄′′ (⊲ ∼ ∪ ⊲)^{∗} w̄′ for δ′′ := ϵ(π)(τ′′) ⊎ τ′′ and w̄′′ := eval(A ⊎ ϵ(e)(δ′′) ⊎ δ′′)(w′′). In both cases, this contradicts ((Γ, (w, <, ≲)), τ) ∈ D; in the latter due to w̄′′ (⊲ ∼ ∪ ⊲)^{∗} w̄. Q.e.d. (Lemma 12.3)

Proof of Theor. 13.6

Let A ∈ K be arbitrary. Since AX is V_{∃}×V_{∀}-valid in A (cf. Definition 13.2) and C is an R-choice-condition, AX is (C, R)-strongly valid in A by Lemma 10.2. By definition, this means that there is some existential (A, R)-valuation e and some π that is (e, A)-compatible with (C, R) s.t. AX is strongly (π, e, A)-valid.

\underline{Claim 1:} For i′ with i′ (L∪H)^{∗} i and for (i′, ((Γ′, ℵ′), t′)) ∈ F : Γ′ is strongly (π, e, A)-valid. \underline{Proof of Claim 1:} By induction on i′ in (L∘H^{∗})^{+}: Set I := H^{∗}⟨\{i′\}⟩. Due to I ⊆ (L∪H)^{∗}⟨\{i\}⟩ and by the closedness assumption of the theorem we have logic(Goals(Trees(⟨I⟩F))) ⊆ logic(Goals(Trees(⟨(L∪H)^{∗}⟨{i}⟩⟩F))) ⊆ AX. Thus, logic(Goals(Trees(⟨I⟩F))) is strongly (π, e, A)-valid. By induction hypothesis, logic(Hyps(⟨L⟨I⟩⟩F)) is strongly (π, e, A)-valid. Together this means that logic(Goals(Trees(⟨I⟩F)) ∪ Hyps(⟨L⟨I⟩⟩F)) is strongly (π, e, A)- valid, too. (Note that the last step would not be possible for (C, R)-strong validity instead of strong (π, e, A)-validity.) Since (i′, ((Γ′, ℵ′), t′)) ∈ F and (F, C, R, L, H) satisfies the soundness invariant condition, {(Γ′, ℵ′)} ↷_{C,R} (Goals(Trees(⟨I⟩F)), Hyps(⟨L⟨I⟩⟩F)). All in all, by Lemma 12.3(1b), Γ′ is strongly (π, e, A)-valid. \underline{Q.e.d. (Claim 1)}

For the special case of i′ = i, Claim 1 says that Γ is (C, R)-strongly valid in A. Finally, by Lemma 10.3, Γ ς is (∅, R′)-strongly valid and R′-valid in A. Q.e.d. (Theor. 13.6)

Proof of Theor. 13.7

∅ is an ∅-choice-condition and (∅, ∅, ∅, ∅, ∅) vacuously satisfies the soundness invariant condition.

For the iteration steps, we let (i′′, ((Γ′′, ℵ′′), t′′)) ∈ F′ be arbitrary. Assuming the soundness invariant condition for (F, C, R, L, H) and using the abbreviations

I := H^{∗}⟨{i′′}⟩
A := Goals(Trees(⟨I′⟩F))

I′ := H′^{∗}⟨{i′′}⟩
A′ := Goals(Trees(⟨I′⟩F′))
B′ := Hyps(⟨L′⟨I′⟩⟩F′).

we have to show that C′ is an R′-choice-condition and that {(Γ′′, ℵ′′)}↷_{C′,R′}(A′, B′).

\underline{\underline{Hypothesizing:}} Note that F′ is a partial function on N_{+} just like F because of i ∈ N_{+} \

dom(F). Note that R is a variable-condition and that R^{+} is a wellfounded

ordering because C is an R-choice-condition (because (F, C, R, L, H) is assumed to be a proof forest). \underline{i′′ ∈ dom(F):} By assumption,

{(Γ′′, ℵ′′)} ↷_{C,R} (Goals(Trees(⟨I⟩F)), Hyps(⟨L⟨I⟩⟩F)).

As (C′, R′) is an extension of (C, R) and by Lemma 12.3(5), this means

{(Γ′′, ℵ′′)} ↷_{C′,R′} (Goals(Trees(⟨I⟩F)), Hyps(⟨L⟨I⟩⟩F)).

Due to H = H′ we have I = I′, and then due to L = L′ and F ⊆F′, we have

Goals(Trees(⟨I⟩F)) ⊆ A′ and Hyps(⟨L⟨I⟩⟩F) ⊆ B′.

Thus, by Lemma 12.3(2), we have

Goals(Trees(⟨I⟩F))↷_{C′,R′}(A′, ∅) and Hyps(⟨L⟨I⟩⟩F)↷_{C′,R′}(∅, B′).

Thus, by Lemma 12.3(3a,b), we have {(Γ′′, ℵ′′)} ↷_{C′,R′} (A′, B′). \underline{i′′ = i:} Then \{(Γ′′, ℵ′′)\} = \{(Γ, ℵ)\} = Goals(\{t\}) = Goals(\{t′′\}) ⊆ A′ ⊆ A′ ∪ B′. Thus, by Lemma 12.3(2), {(Γ′′, ℵ′′)} ↷_{C′,R′} (A′, B′).

\underline{\underline{Expansion:}} Note that ∀J. Hyps(⟨J⟩F) = Hyps(⟨J⟩F′).

\underline{Claim 1:} Hyps(⟨I′⟩F)↷_{C′,R′}(A, B′).

\underline{Claim 2:} A ↘/↷_{C′,R′} (Hyps(⟨I′⟩F), A′, B′). By Claim 1, Claim 2, and Lemma 12.3(3a), we get

Hyps(⟨I′⟩F) ↘/↷_{C′,R′} (Hyps(⟨I′⟩F), A′, B′).

By Lemma 12.3(7), we get Hyps(⟨I′⟩F)↷_{C′,R′}(A′, B′). Since {(Γ′′, ℵ′′)} ⊆ Hyps(⟨I′⟩F), we have {(Γ′′, ℵ′′)}↷_{C′,R′}(Hyps(⟨I′⟩F), ∅) by Lemma 12.3(2). Thus, by Lemma 12.3(3a), we get {(Γ′′, ℵ′′)}↷_{C′,R′}(A′, B′).

\underline{Proof of Claim 1:} By Lemma 12.3(4) it suffices to show Hyps(⟨\{i′′′\}⟩F)↷_{C′,R′}(A, B′) for any i′′′ ∈ I′. We have

Hyps(⟨{i′′′}⟩F) ↷_{C,R} (Goals(Trees(⟨I′′′⟩F)), Hyps(⟨L⟨I′′′⟩⟩F))

for I′′′ := H^{∗}⟨{i′′′}⟩ by assumption. As (C′, R′) is an extension of (C, R) and by Lemma 12.3(5),

Hyps(⟨{i′′′}⟩F) ↷_{C′,R′} (Goals(Trees(⟨I′′′⟩F)), Hyps(⟨L⟨I′′′⟩⟩F)).

Due to H⊆H′, we have I′′′ ⊆ H′^{∗}⟨{i′′′}⟩ ⊆ H′^{∗}⟨I′⟩ = I′. Thus, Goals(Trees(⟨I′′′⟩F)) ⊆ A and (due to L⊆L′) Hyps(⟨L⟨I′′′⟩⟩F) ⊆ Hyps(⟨L′⟨I′⟩⟩F) = B′. Thus, by Lemma 12.3(2), we get Goals(Trees(⟨I′′′⟩F))↷_{C′,R′}(A, ∅) and Hyps(⟨L⟨I′′′⟩⟩F)↷_{C′,R′}(∅, B′). By Lemma 12.3(3a,b): Hyps(⟨\{i′′′\}⟩F)↷_{C′,R′}(A, B′). \underline{Q.e.d. (Claim 1)}

\underline{Proof of Claim 2:} If i ∉ I′, then we have A = A′ and Claim 2 follows from Lemma 12.3(2). Thus, we may assume i ∈ I′. By construction of t′ we have A\{(Δ, ℶ)} ⊆ A′. Thus, by Lemma 12.3(2),

A\{(Δ, ℶ)} ↘/↷_{C′,R′} (Hyps(⟨I′⟩F), A′, B′).

By assumption we have

{(Δ, ℶ)} ↘/↷_{C′,R′} (Hyps(⟨N_{H}⟩F), G, Hyps(⟨N_{L}⟩F)).

By Lemma 12.3(4), we get Claim 2 due to Hyps(⟨N_{H}⟩F) ⊆ Hyps(⟨I′⟩F), G ⊆ Goals({t′}) = Goals(Trees(⟨{i}⟩F′)) ⊆ A′, and Hyps(⟨N_{L}⟩F) ⊆ Hyps(⟨L′⟨I′⟩⟩F) = B′, which hold due to N_{H} ⊆ H′⟨{i}⟩ ⊆ H′⟨I′⟩ = I′, the construction of t′, and N_{L} ⊆ L′⟨{i}⟩ ⊆ L′⟨I′⟩, resp.. \underline{Q.e.d. (Claim 2)}

\underline{\underline{Instantiation:}} By Lemma 9.6, C′ is an R′-choice-condition.

Set O := D(i′′) and N := dom(C) ∩ ⟨(dom(C) ∩ dom(σ)) \ O⟩R^{∗}.

\underline{Claim 3:} O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, N ⊆ dom(C) \ O, and N ∩ V(Goals(Trees(⟨I⟩F)), Hyps(⟨{i′′}∪L⟨I⟩⟩F)) = ∅. \underline{Proof of Claim 3:} By definition of D(i) and N, the first, second, and third statement are trivial with the exception of N∩O = ∅, which we will show together with the last statement: Set M := R^{∗}⟨V_{∀,s}(Goals(Trees(⟨I⟩F)), Hyps(⟨{i′′}∪L⟨I⟩⟩F))⟩. It now suffices to show N∩M = ∅. If z_{1}^{∀,s} ∈ N, there is some z_{0}^{∀,s} ∈ (dom(C) ∩ dom(σ))\O with z_{0}^{∀,s} R^{∗} z_{1}^{∀,s}, but then, if z_{1}^{∀,s} ∈ M, we get z_{0}^{∀,s} ∈ M and the contradictory z_{0}^{∀,s} ∈ O by definition of O.

Q.e.d. (Claim 3)

By assumption Hyps(⟨{i′′}⟩F) ↷_{C,R} (Goals(Trees(⟨I⟩F)), Hyps(⟨L⟨I⟩⟩F)). Set B′′ := ⋃_{y^{∀,s} ∈ O} Hyps(⟨{j_{y^{∀,s}}}⟩F′). Then we have logic(B′′) = ⟨O⟩Q_{C,σ} according to the requirements of the Instantiation rule. By Claim 3 we can apply Lemma 12.3(6) to get:

{(Γ′′, ℵ′′)} = Hyps(⟨{i′′}⟩F)σ ↷_{C′,R′} (Goals(Trees(⟨I⟩F))σ, Hyps(⟨L⟨I⟩⟩F)σ ∪ B′′)
= (Goals(Trees(⟨I⟩F′)), Hyps(⟨L⟨I⟩⟩F′) ∪ B′′)
= (A′, Hyps(⟨L⟨I′⟩⟩F′) ∪ B′′),

the latter step being due to I = I′. By definition of L′ we have { j_{y^{∀,s}} | y^{∀,s} ∈ O } ⊆ L′⟨{i′′}⟩ ⊆ L′⟨I′⟩. Thus, we have B′′⊆B′. Moreover, due to L⊆L′ , we have Hyps(⟨L⟨I′⟩⟩F′) ⊆ B′. Together this implies Hyps(⟨L⟨I′⟩⟩F′) ∪ B′′ ↷_{C′,R′} (∅, B′), by Lemma 12.3(2). By Lemma 12.3(3b) we get {(Γ′′, ℵ′′)} ↷_{C′,R′} (A′, B′). Q.e.d. (Theor. 13.7)

Proof of Theor. 13.10

The empty proof forest trivially satisfies the safeness invariant condition.

\underline{\underline{Hypothesizing:}} When we assume the old trees from F to satisfy the safeness invariant

condition for (C, R), then they also satisfy it for (C′, R′) by Lemma 11.2(5b)

because (C′, R′) is an extension of (C, R). The new tree (i, ((Γ, ℵ), t)) satisfies the safeness invariant condition because logic(Goals({t})) = {Γ } and {Γ } (C′, R′)-reduces to {Γ } by Lemma 11.2(2).

\underline{\underline{Expansion:}} When we assume the non-expanded trees to satisfy the safeness invariant con-

dition for (C, R), then they also satisfy it for the extension (C′, R′) of (C, R)

by Lemma 11.2(5b). For the new tree (i, (Γ, t′)) we have to show that logic(Goals({t′})) (C′, R′)-reduces to {Γ }. \underline{Claim 1:} logic(G) (C′, R′)-reduces to \{Δ\}. \underline{Proof of Claim 1:} In case of a sequent calculus this is given by the additional requirement of safeness of the Expansion step. In case of a tableau calculus we have logic(G) = { ΠΔ | Π ∈ M }, and the claim follows because because strong (π, e, A)-validity of Δ implies strong (π, e, A)-validity of ΠΔ. \underline{Q.e.d. (Claim 1)} \underline{Claim 2:} logic(Goals(\{t′\})) (C′, R′)-reduces to logic(Goals(\{t\})). \underline{Proof of Claim 2:} As Goals(\{t′\}) \ G ⊆ Goals(\{t\}),

logic(Goals({t′})) \ logic(G) (C′, R′)-reduces to logic(Goals({t}))

by Lemma 11.2(2). Thus, by Claim 1, the claim follows by Lemma 11.2(4) due to Δ ∈ logic(Goals(\{t\})). \underline{Q.e.d. (Claim 2)}

When we assume the old tree (i, ((Γ, ℵ), t)) to satisfy the safeness invariant condition for (C, R), then logic(Goals({t})) (C′, R′)-reduces to {Γ } by Lemma 11.2(5b). By Lemma 11.2(3), together with Claim 2 this implies that logic(Goals({t′})) (C′, R′)-reduces to {Γ }, as was to be shown.

\underline{\underline{Instantiation:}} Assume any old tree (i, ((Γ, ℵ), t)) ∈ F to satisfy the safeness invariant

condition for (C, R), i.e. logic(Goals({t})) (C, R)-reduces to {Γ }. Set O :=

D(i) and N := dom(C) ∩ ⟨(dom(C) ∩ dom(σ)) \ O⟩R^{∗}. \underline{Claim 3:} O ⊆ dom(C) ∩ dom(σ) ⊆ O ⊎ N, dom(C) ∩ ⟨N⟩R^{+} ⊆ N, N ⊆ dom(C) \ O, and N ∩ V(Goals(Trees(⟨I⟩F)), Hyps(⟨{i}∪L⟨I⟩⟩F)) = ∅. \underline{Proof of Claim 3:} Just like the proof of Claim 3 in the proof of Theor. 13.7. \underline{Q.e.d. (Claim 3)}

By Lemma 11.2(6b) and Claim 3, logic(Goals({tσ})) (C′, R′)-reduces to {Γ σ} ∪ ⟨O⟩Q_{C,σ}. As the Instantiation step is safe by assumption, by Theor. 13.7 and Theor. 13.6, ⟨O⟩Q_{C,σ} is (C′, R′)-strongly valid. Thus, logic(Goals({tσ})) (C′, R′)-reduces to {Γ σ}, as was to be shown. Q.e.d. (Theor. 13.10)

Proof of Theor. 14.1

We only prove one example of each kind of rule to be a safe sub-rule of the Expansion rule and leave the others as an exercise.

Due to ran(G) = {ℶ}, for the α-, β-, γ-, Rewrite-, and Cut-rules, it suffices to show that, for each Σ-structure A, each existential (A, R)-valuation e, each π that is (e, A)-compatible with (C, R), each τ ∈ V_{∀,w} → A, and for δ := ϵ(π)(τ) ⊎ τ, the (δ, e, A)-validity of {Δ} is logically equivalent to that of logic(G).

\underline{\underline{α-rule:}} (δ, e, A)-validity of \{Γ (A∨B) Π\} is indeed logically equivalent to that of {A B Γ Π}.

\underline{\underline{β-rule:}} (δ, e, A)-validity of \{Γ (A∧B) Π\} is indeed logically equivalent to that of \{A Γ Π, B [ \overline{A} ] Γ Π\}.

\underline{\underline{γ-rule:}} (δ, e, A)-validity of \{Γ ∃x. A Π\} is indeed logically equivalent to that of

{A{x↦x^{∃}} Γ ∃x. A Π}. The implication from left to right is given because the former sequent is a sub-sequent of the latter. For the other direction, note that although it is clear that (δ, e, A)-validity of A{x↦x^{∃}} implies (δ, e, A)-validity of ∃x. A, we should be a little more explicit here because the standard semantical definition of ∃ (cf. e.g. Wirth (1997), p. 188, or Enderton (1973), p. 82) uses a free universal variable instead of a free existential variable and is somewhat more complicated than it could be in terms of free existential variables. Moreover, in the note above the rule we remarked that the restriction on x^{∃} is not really necessary. Thus, in order to be more explicit here, assume that A{x↦x^{∃}} is (δ, e, A)-valid. Let y^{∀} ∈ V_{∀}\V(A). Then, since A{x↦y^{∀}}{y^{∀}↦x^{∃}} is equal to A{x↦x^{∃}}, we know that A{x↦y^{∀}}{y^{∀}↦x^{∃}} is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Then, by the Substitution-Lemma, A{x↦y^{∀}} is valid in A ⊎ ϵ(e)(δ) ⊎ δ′ for δ′ ∈ V_{∀} → A given by _{V_{∀}\{y^{∀}}}↿δ′ := _{V_{∀}\{y^{∀}}}↿δ and δ′(y^{∀}) := ϵ(e)(δ)(x^{∃}). By the standard semantical definition of ∃ and since binding of x cannot occur in A (as ∃x. A is a formula in our restricted sense, cf. Section 3.1), this means that ∃x. (A{x↦y^{∀}}{y^{∀}↦x}) is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Since y^{∀} does not occur in A, this formula is equal to ∃x. A, which means that the former sequent is (δ, e, A)-valid.

\underline{\underline{Rewrite-rule:}} We have to show that (δ, e, A)-validity of \{Γ A[s] Π B Λ\} is logically

equivalent to that of {A[t] Γ Π B Λ}.

If eval(A ⊎ ϵ(e)(δ) ⊎ δ)(s) ≠ eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t), then both are (δ, e, A)-valid because B is. Otherwise, we set a := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(s), choose some z^{∀} ∈ V_{∀}\V(A[s]), and define δ′ ∈ V_{∀} → A by _{V_{∀}\{z^{∀}}}↿δ′ := _{V_{∀}\{z^{∀}}}↿δ and δ′(z^{∀}) := a. Then a = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(t). Moreover, by the Substitution-Lemma:

eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[s])  =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[z^{∀}]{z^{∀}↦s}) =
eval(A ⊎ ϵ(e)(δ) ⊎ δ′)(A[z^{∀}])  =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[z^{∀}]{z^{∀}↦t}) =
eval(A ⊎ ϵ(e)(δ) ⊎ δ)(A[t]).

Note that the usual problems with variables getting captured by binders cannot occur in our context, because the unbound occurrence of variables from V_{bound} in formulas (like (s≠t)) is not permitted, cf. Section 3.1.

\underline{\underline{Cut:}} Trivial.

\underline{\underline{δ-rule:}} Note that in this proof, we only make use of the weaker conditions on the occurrence of x^{∀,w} given by Note 4.

\underline{Claim 1:} (C′, R′) is an extension of (C, R). \underline{Proof of Claim 1:} Since (F, C, R, L, H) is a proof forest, C is an R-choice-condition. Moreover, C⊆C′ and R⊆R′ are trivial. Thus, we only have to show that C′ is an R′-choice-condition. As C′ = C, we only have to show that R′^{+} is a wellfounded ordering. As ran(R′′) = {x^{∀,w}} and {x^{∀,w}}∩dom(R) = ∅ is required, we have R′′∘R = ∅. As ran(R′′) ∩ dom(R′′) ⊆ V_{∀,w} ∩ (V_{∃} ∪ V_{∀,s}) = ∅, we have R′′∘R′′ = ∅. Therefore, as R^{+} is a wellfounded ordering, R′^{+} is a wellfounded ordering, too. \underline{Q.e.d. (Claim 1)}

Now, we have to show that

{(Γ ∀x. A Π, ℶ)} ↷_{C′,R′} ({(A{x↦x^{∀,w}} Γ Π, ℶ)}, ∅)

Let e and π be arbitrary s.t. e is an existential (A, R′)-valuation and π is (e, A)-compatible with (C′, R′). Assume that ((Γ ∀x. A Π, ℶ), τ) is an (π, e, A)-counterexample. Then, Γ Π is invalid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ.

\underline{Claim 2:} Γ Π is invalid in A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′ and

eval(A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′)(ℶ)

= eval(A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ)(ℶ)

for all τ′ ∈ V_{∀,w} → A with _{V_{∀,w}\{x^{∀,w}}}↿τ′ = _{V_{∀,w}\{x^{∀,w}}}↿τ. \underline{Proof of Claim 2:} Otherwise there must be some u ∈ V_{∀,s}(Γ Π, ℶ) ∪ V_{∃}(Γ Π, ℶ) with x^{∀,w} S_{π} ∘ S_{e} u (the first occurrence of τ′ makes a difference) or x^{∀,w} S_{e} u (the second occurrence of τ′ makes a difference) or x^{∀,w} S_{π} u when the third occurrence of τ′ makes a difference. Note that the fourth occurrence of τ′ cannot make a difference simply because x^{∀,w} does not occur in V(Γ Π, ℶ). Since u R′′ x^{∀,w}, we know that (R′ ∪ S_{e} ∪ S_{π})^{+} is not a wellfounded ordering, which contradicts π being (e, A)-compatible with (C′, R′).

Q.e.d. (Claim 2)

Now, if there is any τ′ ∈ V_{∀,w} → A with _{V_{∀,w}\{x^{∀,w}}}↿τ′ = _{V_{∀,w}\{x^{∀,w}}}↿τ s.t. A{x↦x^{∀,w}} is invalid in A ⊎ ϵ(e)(ϵ(π)(τ′) ⊎ τ′) ⊎ ϵ(π)(τ′) ⊎ τ′, then due to Claim 2 ((A{x↦x^{∀,w}} Γ Π, ℶ), τ′) is the (π, e, A)-counterexample we are searching for. Otherwise, A{x↦x^{∀,w}} is valid in A⊎ϵ(e)(ϵ(π)(τ′) ⊎ τ′)⊎ϵ(π)(τ′)⊎τ′ for all τ′ ∈ V_{∀,w} → A with _{V_{∀,w}\{x^{∀,w}}}↿τ′ = _{V_{∀,w}\{x^{∀,w}}}↿τ.

\underline{Claim 4:} A\{x↦x^{∀,w}\} is valid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ′ for all τ′ ∈ V_{∀,w} → A with _{V_{∀,w}\{x^{∀,w}}}↿τ′ = _{V_{∀,w}\{x^{∀,w}}}↿τ.

\underline{Proof of Claim 4:} Otherwise there must be some u ∈ V_{∀,s}(A\{x↦x^{∀,w}\}) ∪ V_{∃}(A\{x↦x^{∀,w}\}) with x^{∀,w} S_{π} ∘ S_{e} u (the first occurrence of τ makes a difference) or x^{∀,w} S_{e} u (the second occurrence of τ makes a difference) or x^{∀,w} S_{π} u when the third occurrence of τ makes a difference. Since u R′′ x^{∀,w}, we know that (R′ ∪ S_{e} ∪ S_{π})^{+} is not a wellfounded ordering, which contradicts π being (e, A)-compatible with (C′, R′). \underline{Q.e.d. (Claim 4)}

By the standard semantical definition of ∀ (cf. e.g. Wirth (1997), p. 188, or Enderton (1973), p. 82) and since binding of x cannot occur in A (as ∀x. A is a formula in our restricted sense, cf. Section 3.1), Claim 4 means that ∀x. (A{x↦x^{∀,w}}{x^{∀,w}↦x}) is valid in A ⊎ ϵ(e)(ϵ(π)(τ) ⊎ τ) ⊎ ϵ(π)(τ) ⊎ τ, i.e. (ϵ(π)(τ) ⊎ τ, e, A)-valid. Since x^{∀,w} does not occur in A, this formula is equal to ∀x. A, which contradicts ((Γ ∀x. A Π, ℶ), τ) being an (π, e, A)-counterexample.

For the safeness proof, assume that Γ ∀x. A Π is strongly (π, e, A)-valid. For arbitrary τ ∈ V_{∀,w} → A we have to show that A{x↦x^{∀,w}} Γ Π is (δ, e, A)-valid for δ := ϵ(π)(τ) ⊎ τ. If some formula in Γ Π is (δ, e, A)-valid, then the latter sequent is (δ, e, A)-valid, too. Otherwise, ∀x. A is (δ, e, A)-valid. Then, by the standard semantical definition of ∀, A{x↦x^{∀,w}} is (δ, e, A)-valid, too, as was to be shown.

\underline{\underline{Liberalized δ-rule:}} Note that in this proof, we only make use of the weaker conditions on the occurrence of x^{∀,s} given by Note 5.

\underline{Claim 5:} (C′, R′) is an extension of (C, R). \underline{Proof of Claim 5:} Since (F, C, R, L, H) is a proof forest, C is an R-choice-condition. Moreover, C⊆C′ and R⊆R′ are trivial. Thus, we only have to show that C′ is an R′-choice-condition. As x^{∀,s} ∈ V_{∀,s}\dom(C) is required, C′ is also a partial function on V_{∀,s}. As ran(R′′) = {x^{∀,s}} and {x^{∀,s}}∩dom(R) = ∅ is required, we have R′′∘R = ∅. As ran(R′′) ∩ dom(R′′) = {x^{∀,s}} ∩ V_{free}(A) = {x^{∀,s}} ∩ V(A) = ∅ is required, we have R′′∘R′′ = ∅. Therefore, as R^{+} is a wellfounded ordering, R′^{+} is a wellfounded ordering, too. Moreover, for y^{∀,s} ∈ dom(C′), we either have y^{∀,s} ∈ dom(C) and then (V_{free}(C′(y^{∀,s}))\{y^{∀,s}})×{y^{∀,s}} = (V_{free}(C(y^{∀,s}))\{y^{∀,s}})×{y^{∀,s}} ⊆ R^{+} ⊆ R′^{+}, or y^{∀,s} = x^{∀,s} and then (V_{free}(C′(y^{∀,s}))\{y^{∀,s}})×{y^{∀,s}} = (V_{free}(A{x↦x^{∀,s}})\{x^{∀,s}})×{x^{∀,s}} ⊆ V_{free}(A)×{x^{∀,s}} = R′′ ⊆ R′^{+}. \underline{Q.e.d. (Claim 5)}

Now, due to ran(G) = {ℶ}, it suffices to show that, for each Σ-structure A, each existential (A, R′)-valuation e, each π that is (e, A)-compatible with (C′, R′), each τ ∈ V_{∀,w} → A, and for δ := ϵ(π)(τ) ⊎ τ, the (δ, e, A)-validity of

Γ ∀x. A Π is logically equivalent to that of A{x↦x^{∀,s}} Γ Π.

For the soundness direction, we have to show that the former sequent is (δ, e, A)-valid under the assumption that the latter is. If some formula in Γ Π is (δ, e, A)-valid, then the former sequent is (δ, e, A)-valid, too. Otherwise, this means that A{x↦x^{∀,s}} is (δ, e, A)-valid. Since π is (e, A)-compatible with (C′, R′), by item 2 of Definition 9.2, we know that A{x↦x^{∀,s}} is (δ′, e, A)-valid for all δ′ ∈ V_{∀} → A with _{V_{∀}\{x^{∀,s}}}↿δ′ = _{V_{∀}\{x^{∀,s}}}↿δ. This means that A{x↦x^{∀,s}} is valid in A ⊎ ϵ(e)(δ′) ⊎ δ′ for all δ′ ∈ V_{∀} → A with _{V_{∀}\{x^{∀,s}}}↿δ′ = _{V_{∀}\{x^{∀,s}}}↿δ.

\underline{Claim 6:} A\{x↦x^{∀,s}\} is valid in A ⊎ ϵ(e)(δ) ⊎ δ′ for all δ′ ∈ V_{∀} → A with _{V_{∀}\\{x^{∀,s}\}}↿δ′ = V_{∀}\{x^{∀,s}}↿δ. \underline{Proof of Claim 6:} Otherwise we have x^{∀,s}S_{e}u^{∃} for some u^{∃} ∈ V_{∃}(A\{x↦x^{∀,s}\}). But then u^{∃} ∈ V_{free}(A) and then u^{∃}R′′x^{∀,s}. This means that (R′ ∪ S_{e})^{+} is not a wellfounded ordering, which contradicts e being an existential (A, R′)-valuation. \underline{Q.e.d. (Claim 6)}

By the standard semantical definition of ∀ (cf. e.g. Wirth (1997), p. 188, or Enderton (1973), p. 82) and since binding of x cannot occur in A (as ∀x. A is a formula in our restricted sense, cf. Section 3.1), Claim 6 means that ∀x. (A{x↦x^{∀,s}}{x^{∀,s}↦x}) is valid in A ⊎ ϵ(e)(δ) ⊎ δ. Since x^{∀,s} does not occur in A, this formula is equal to ∀x. A, which means that the former sequent is (δ, e, A)-valid as was to be shown.

For the safeness direction, we have to show that the latter sequent is (δ, e, A)-valid under the assumption that the former is. If some formula in Γ Π is (δ, e, A)-valid, then the latter sequent is (δ, e, A)-valid, too. Otherwise, ∀x. A is (δ, e, A)-valid. Then, by the standard semantical definition of ∀, A{x↦x^{∀,s}} is (δ, e, A)-valid, too, as was to be shown.

Q.e.d. (Theor. 14.1)

Proof of Theor. 14.3

Let G := { (ΠΔ, ℶ) | Π ∈ M } as in the Expansion rule of the tableau calculus of Definition 13.4. According to this definition of an Expansion step we have to show

{(Δ, ℶ)} ↘/↷_{C′,R′} ({(Φ, ℸ)}, G, ∅)

in case of “induction hypothesis application” and

{(Δ, ℶ)} ↘/↷_{C′,R′} (∅, G, {(Φ, ℸ)})

in case of “lemma application”. According to Definition 12.2 and due to ran(G) = {ℶ}, it is sufficient to show that, for A ∈ K, e an existential (A, R′)-valuation, and π (e, A)- compatible with (C′, R′), for any (π, e, A)-counterexample ((Δ, ℶ), τ), under the assumption that logic(G) is (δ, e, A)-valid for δ := ϵ(π)(τ) ⊎ τ, there is an (π, e, A)-counterexample ((Φ, ℸ), τ′) s.t. (in case of hypothesis application only), for ⊲ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<), ⊲ ∼ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲), w̄ := eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w), δ′ := ϵ(π)(τ′) ⊎ τ′, and w̄′ := eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(w′), we have ⊲ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′), w̄′⊲^{+}w̄, ⊲ ∘ ⊲ ∼ ⊆ ⊲^{+}, and ⊲ is wellfounded.

Since, for all Π ∈ M, ΠΔ ∈ logic(G) is assumed to be (δ, e, A)-valid whereas Δ is assumed to be not, we know that M is (δ, e, A)-valid. By the definition of M, this means that Φϱ is not (δ, e, A)-valid (due to (1)) and (in case of hypothesis application only) ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ) (due to (4)), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ) (due to (5)), eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w′ϱ)⊲w̄ (due to (2)), ⊲∘⊲ ∼ ⊆ ⊲^{+} (due to (6)), and ⊲ is wellfounded (due to (3)).

Define τ′(y^{∀,w}) := \{ \begin{matrix}ϵ(e)(δ)(ϱ(y^{∀,w})) & for y^{∀,w} ∈ Y \\ τ(y^{∀,w}) & for y^{∀,w} ∈ V_{∀,w}\Y \end{matrix} \} and δ′ := ϵ(π)(τ′) ⊎ τ′.

\underline{Claim 2:} For v^{∀,s} ∈ V_{∀,s}(Φ, ℸ) we have ϵ(π)(τ)(v^{∀,s}) = ϵ(π)(τ′)(v^{∀,s}). \underline{Proof of Claim 2:} Otherwise there must be some y^{∀,w} ∈ Y with y^{∀,w} S_{π} v^{∀,s}. Since v^{∀,s} ∈ V_{∀,s}(Φ, ℸ) we have v^{∀,s} R′ y^{∀,w} by definition of Y. But then R′ ∪S_{e} ∪S_{π} is not wellfounded, which contradicts π being (e, A)-compatible with (C′, R′). \underline{Q.e.d. (Claim 2)}

\underline{Claim 3:} For x^{∃} ∈ V_{∃}(Φ, ℸ) we have ϵ(e)(δ)(x^{∃}) = ϵ(e)(δ′)(x^{∃}). \underline{Proof of Claim 3:} Otherwise we have ϵ(e)(ϵ(π)(τ) ⊎ τ)(x^{∃}) ≠ ϵ(e)(ϵ(π)(τ′) ⊎ τ′)(x^{∃}). Then there must be some y^{∀,w} ∈ Y with y^{∀,w} S_{π} ∘ S_{e} x^{∃} (i.e. the first occurrence of τ′ makes a difference) or y^{∀,w} S_{e} x^{∃} when the second occurrence of τ′ makes a difference. Since x^{∃} ∈ V_{∃}(Φ, ℸ) we have x^{∃} R′ y^{∀,w} by definition of Y. But then R′ ∪ S_{e} ∪ S_{π} is not wellfounded, which contradicts π being (e, A)-compatible with (C′, R′). \underline{Q.e.d. (Claim 3)}

The resp. values of Φ, w′, <′, and ≲′ under eval(A ⊎ ϵ(e)(δ′) ⊎ δ′) are the same as the values of Φ, w′, <′, and ≲′ under eval(A ⊎ ϵ(e)(δ) ⊎ ϵ(π)(τ) ⊎ τ′) by definition of δ′, Claim 2, and Claim 3, which again are the same as the values of Φϱ, w′ϱ, <′ϱ, and ≲′ϱ under eval(A ⊎ ϵ(e)(δ) ⊎ δ) by the Substitution-Lemma and the definition of δ. Thus, due to Φϱ not being (δ, e, A)-valid, ((Φ, ℸ), τ′) is an (π, e, A)-counterexample with (in case of hypothesis application only) ⊲ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(<′ϱ) = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(<′), ⊲ ∼ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(≲′ϱ) = eval(A ⊎ ϵ(e)(δ′) ⊎ δ′)(≲′), and w̄′ = eval(A ⊎ ϵ(e)(δ) ⊎ δ)(w′ϱ) ⊲ w̄. Q.e.d. (Theor. 14.3)

Proof of Lemma A.1

Here we denote concatenation (product) of relations ‘∘’ simply by juxtaposition and assume it to have higher priority than any other binary operator.

\underline{\underline{(1):}} When e is an existential (A, R′)-valuation, R′ ∪ S_{e} is wellfounded. In case of R⊆R′, we have R ∪ S_{e} ⊆ R′ ∪ S_{e} and R ∪ S_{e} is wellfounded, too.

\underline{\underline{(2):}} Set σ′ := _{V_{∃}\dom(σ)}↿id ∪ _{V_{∃}}↿σ. Let e′ be an existential (A, R′)-valuation. Define

S_{e} := S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}} and the existential (A, R)-valuation e by (x ∈ V_{∃}, τ′ ∈ S_{e}⟨{x}⟩ → A): e(x)(τ′) := eval(A ⊎ ϵ(e′)(τ) ⊎ τ)(σ′(x)) where τ ∈ V_{∀} → A is an arbitrary extension of τ′. For this definition to be okay, we have to prove the following claims:

\underline{Claim 1:} For x ∈ V_{∃}, y ∈ V_{∀}(σ′(x)), the choice of τ ⊇ τ′ does not influence the value of τ(y). \underline{Claim 2:} For x ∈ V_{∃}, x′ ∈ V_{∃}(σ′(x)), the choice of τ ⊇ τ′ does not influence the value of ϵ(e′)(τ)(x′). \underline{Claim 3:} R ∪ S_{e} is wellfounded. \underline{Proof of Claim 1:} y ∈ V_{∀}(σ′(x)) means (y, x) ∈ U_{σ}↾_{V_{∃}}. By definition of S_{e} we have (y, x) ∈ S_{e}, i.e. y ∈ S_{e}⟨\{x\}⟩ = dom(τ′). \underline{Q.e.d. (Claim 1)} \underline{Proof of Claim 2:} x′ ∈ V_{∃}(σ′(x)) means (x′, x) ∈ _{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}} . Thus by definition of S_{e} we have S_{e′}{(x′, x)} ⊆ S_{e}, i.e. S_{e′}⟨{x′}⟩ ⊆ S_{e}⟨{x}⟩ = dom(τ′). Therefore ϵ(e′)(τ)(x′) = e′(x′)(_{S_{e′}⟨\{x′\}⟩}↿τ) = e′(x′)(_{S_{e′}⟨\{x′\}⟩}↿τ′). \underline{Q.e.d. (Claim 2)} \underline{Proof of Claim 3:} R′∪S_{e′} is wellfounded because e′ is an existential (A, R′)-valuation. Moreover, as R′ is the σ-update of R, we have^{30} R′ = R ∪ E_{σ} ∪ U_{σ}. Thus, (R ∪ E_{σ} ∪ U_{σ} ∪ S_{e′})^{+} is a wellfounded ordering, just like its subset (R ∪ S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}})^{+}, which is equal to (R ∪ S_{e})^{+}. \underline{Q.e.d. (Claim 3)} Now, for τ ∈ V_{∀} → A and x ∈ V_{∃} we have

ϵ(e)(τ)(x) = e(x)(_{S_{e}⟨{x}⟩}↿τ) = eval(A ⊎ ϵ(e′)(τ) ⊎ τ)(σ′(x)),

i.e. ϵ(e)(τ) = σ′ ∘ eval(A ⊎ ϵ(e′)(τ) ⊎ τ).

\underline{\underline{(3):}} Set σ′ := _{V_{∃}\dom(σ)}↿id ∪ _{V_{∃}}↿σ.

Define S_{e} := (S_{π′} ∪_{V_{∀,w}}↿id)(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}) and the existential (A, R)-valuation e by (x ∈ V_{∃}, τ′ ∈ S_{e}⟨{x}⟩ → A):

e(x)(τ′) := eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(σ′(x))

where τ ∈ V_{∀,w} → A is an arbitrary extension of τ′. For this definition to be okay, we have to prove the following claims:

\underline{Claim 4:} For x ∈ V_{∃} and y ∈ V(σ′(x)), the choice of τ ⊇ τ′ does not influence:

(a) In case of y ∈ V_{∀,w}, the value of τ(y).

(b) In case of y ∈ V_{∀,s}, the value of ϵ(π′)(τ)(y).

(c) In case of y ∈ V_{∃}, the value of ϵ(e′)(ϵ(π′)(τ) ⊎ τ)(y).

\underline{Claim 5:} R ∪ S_{e} ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}} is wellfounded.

\underline{Proof of Claim 4:} Exercise! \underline{Q.e.d. (Claim 4)}

\underline{Proof of Claim 5:} R′ ∪S_{e′} ∪S_{π′} is wellfounded because π′ is (e′, A)-compatible with (C′, R′). Moreover, as R′ is the σ-update of R, we have^{31} R′ = R ∪ E_{σ} ∪ U_{σ}. Thus, (R ∪ E_{σ} ∪ U_{σ} ∪ R′ ∪ S_{e′} ∪ S_{π′})^{+} is a wellfounded ordering, just like its subset

(R ∪ (S_{π′} ∪_{V_{∀,w}}↿id)(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}) ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}})^{+}, which is equal to (R ∪ S_{e} ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}})^{+}. \underline{Q.e.d. (Claim 5)}

Q.e.d. (Lemma A.1)

Proof of Lemma A.2

Assuming σ, C, R, C′, R′, O, N, A, e′, π′ as described in the lemma, we set A := (V_{∀,s} ∩ dom(σ)) \ (N⊎O). As σ is quasi-existential, we have V_{∀} ∩ dom(σ) ⊆ N⊎O⊎A ⊆ V_{∀,s}. This leaves us in the following situation:

⟵V_{∀,s}⟶ ⟵V_{∃}⟶
⟵dom(C)⟶ ⋮
⟵dom(σ)⟶
⟵N⟶ ⟵O⟶ ⟵A⟶

Note that we are not really interested in A because the variables in A should not occur anywhere and thus their substitution is not of any interest. But, as we do not add requirements on this, we have to include the possibility of a nonempty A, although we do not spend much thought on A in this proof.

Note that C′ is an R′-choice-condition due to Lemma 9.6.

As π′ is (e′, A)-compatible with (C′, R′),

⊲ := (R′ ∪ S_{e′} ∪ S_{π′})^{+}

is a wellfounded ordering.

Let e be the existential (A, R)-valuation given by Lemma A.1(3) for e′. Then

S_{e} = (S_{π′} ∪_{V_{∀,w}}↿id) ∘ (S_{e′} ∘ (_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}) (A.2.1)

and for all δ ∈ V_{∀} → A, when τ abbreviates _{V_{∀,w}}↿δ: ϵ(e)(δ) = (_{V_{∃}\dom(σ)}↿id ∪ _{V_{∃}}↿σ) ∘ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ) (A.2.2) and

R ∪ S_{e} ∪ ⊲↾_{V_{∀}} is wellfounded. (A.2.3)

\underline{Claim 1:} For any term or formula B (possibly containing some unbound variables from a set W ⊆ V_{bound}) and any τ ∈ V_{∀,w} → A, χ ∈ W → A, and δ, δ′, δ̄′ ∈ V_{∀} → A with V_{∀,w}↿δ = τ, _{V_{∀}(⟨V_{∃}(B)⟩σ)}↿δ̄′ = _{V_{∀}(⟨V_{∃}(B)⟩σ)}↿δ′, δ′ = ϵ(π′)(τ) ⊎ τ:

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ)(Bσ)

= eval(A ⊎ ϵ(e)(δ) ⊎ _{V_{∀}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎ _{V\dom(σ)}↿δ̄′ ⊎ χ)(B).

\underline{Proof of Claim 1:} eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ)(Bσ) = (by the Substitution-Lemma) eval(A ⊎ (_{V\dom(σ)}↿id ⊎ σ) ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′ ⊎ χ))(B) = (by the Explicitness-Lemma (as the variables of W do not occur free in ran(σ)) and by _{V_{∀}(⟨V_{∃}(B)⟩σ)}↿δ̄′ = _{V_{∀}(⟨V_{∃}(B)⟩σ)}↿δ′)

eval( \begin{matrix}& A \\ ⊎ & (_{V_{∃}\dom(σ)}↿id ⊎_{V_{∃}}↿σ) ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) \\ ⊎ & _{V_{∀}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) \\ ⊎ & _{V\dom(σ)}↿δ̄′ ⊎ χ \end{matrix} )( B ) =

(by (A.2.2), _{V_{∀,w}}↿δ = τ, and δ′ = ϵ(π′)(τ) ⊎ τ)

eval(ϵ(e)(δ) ⊎ _{V_{∀}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎ _{V\dom(σ)}↿δ̄′ ⊎ χ)(B). \underline{Q.e.d. (Claim 1)} \underline{Claim 2:} _{V_{∀}}↿(R^{+}) ⊆ ⊲, U_{σ}∘R^{+} ⊆ ⊲, and S_{e}∘R^{+} ⊆ ⊲. \underline{Proof of Claim 2:} As R′ is the σ-update of R, we have^{32} R′ = R ∪ E_{σ} ∪ U_{σ}. Thus, Claim 2 follows from (A.2.1). \underline{Q.e.d. (Claim 2)}

Set S_{π} := ⊲ ∩ (V_{∀,w}×V_{∀,s}).

\underline{Claim 3:} R ∪ S_{e} ∪ S_{π} is wellfounded. \underline{Proof of Claim 3:} This follows from (A.2.3). \underline{Q.e.d. (Claim 3)}

The idea for the definition of the π we have to find is—roughly speaking—as follows: For y^{∀,s} ∉ N⊎O⊎A we take π(y^{∀,s}) to be π′(y^{∀,s}). For y^{∀,s} ∈ O we evaluate σ(y^{∀,s}) in the updated environment because we know that ⟨O⟩Q_{C,σ} is valid there by assumption of the lemma. For y^{∀,s} ∈ A we take the same because we do not think much about this case. For y^{∀,s} ∈ N, however, we have to take care of (e, A)-compatibility with (C, R) explicitly in an ⊲-recursive definition.

Let π be defined by (y^{∀,s} ∈ V_{∀,s}, τ ∈ V_{∀,w} → A)

π(y^{∀,s})(_{S_{π}⟨\{y^{∀,s}\}⟩}↿τ) := \{ \begin{matrix}f & if y^{∀,s} ∈ N \\ eval(A ⊎ ϵ(e′)(ϵ(π′)(τ) ⊎ τ) ⊎ ϵ(π′)(τ) ⊎ τ)(σ(y^{∀,s})) & if y^{∀,s} ∈ O⊎A \\ π′(y^{∀,s})(_{S_{π′}⟨\{y^{∀,s}\}⟩}↿τ) & otherwise \end{matrix}

where (for details cf. the proof of Lemma 9.3) f is chosen s.t., for C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B, and for any χ ∈ {v_{0}, …, v_{l−1}} → A

B becomes—if possible— (_{V_{∀,s}\{y^{∀,s}}}↿(ϵ(π)(τ)) ⊎ {y^{∀,s}↦f} ⊎ τ ⊎ χ, e, A)-valid. Note that this definition is okay because the only part of τ that is relevant on the righthand side is _{S_{π}⟨{y^{∀,s}}⟩}↿τ and because it is recursive in ⊲; indeed, we have (E_{σ} ∪ U_{σ})↾_{V_{∀}} ⊆ R′ due to R′ being the σ-update of R, and for x^{∃} ∈ V_{∃}(C(y^{∀,s})) we have x^{∃} R^{+} y^{∀,s} (as C is an R-choice-condition) and then for v^{∀} S_{e} x^{∃} we have v^{∀} ⊲ y^{∀,s} by Claim 2, and for z^{∀} ∈ V_{∀}(C(y^{∀,s}))\{y^{∀,s}} we have z^{∀} R^{+} y^{∀,s} z^{∀} ⊲ y^{∀,s} by Claim 2.

\underline{Claim 4:} For all y^{∀,s} ∈ O⊎A and τ ∈ V_{∀,w} → A, when we set δ′ := ϵ(π′)(τ) ⊎ τ:

ϵ(π)(τ)(y^{∀,s}) = eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′)(σ(y^{∀,s})).

\underline{Proof of Claim 4:} Immediately by the definition of π. \underline{Q.e.d. (Claim 4)}

\underline{Claim 5:} For all y^{∀,s} ∈ V_{∀,s}\(N⊎O⊎A) and τ ∈ V_{∀,w} → A : ϵ(π)(τ)(y^{∀,s}) = ϵ(π′)(τ)(y^{∀,s}). \underline{Proof of Claim 5:} Immediately by the definition of π. \underline{Q.e.d. (Claim 5)}

\underline{Claim 6:} For any term or formula B (possibly containing some unbound variables from a set W ⊆ V_{bound}) with N∩V(B) = ∅, and for any τ ∈ V_{∀,w} → A and χ ∈ W → A, when we set δ := ϵ(π)(τ) ⊎ τ and δ′ := ϵ(π′)(τ) ⊎ τ, we have

eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B).

\underline{Proof of Claim 6:} eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′ ⊎ χ)(Bσ) = (by Claim 1) eval(A ⊎ ϵ(e)(δ) ⊎ _{V_{∀}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) ⊎ _{V\dom(σ)}↿δ′ ⊎ χ)(B) =

(by O⊎A ⊆ V_{∀} ∩ dom(σ) ⊆ N⊎O⊎A and N∩V(B) = ∅)

eval(A ⊎ ϵ(e)(δ) ⊎ _{O⊎A}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) ⊎ _{V\(N⊎O⊎A)}↿δ′ ⊎ χ)(B) =

(by Claim 4 and Claim 5)

eval(A ⊎ ϵ(e)(δ) ⊎ δ ⊎ χ)(B). \underline{Q.e.d. (Claim 6)}

\underline{Claim 7:} For any set of sequents G′ (possibly containing some unbound variables from a set W ⊆ V_{bound}) with N∩V(G′) = ∅, and for any τ ∈ (V_{∀,w} ∪ W) → A: (ϵ(π)(τ)⊎τ, e, A)-validity of G′ is logically equivalent to (ϵ(π′)(τ)⊎τ, e′, A)-validity of G′σ. \underline{Proof of Claim 7:} This is a trivial consequence of Claim 6. \underline{Q.e.d. (Claim 7)} \underline{Claim 8:} For y^{∀,s} ∈ dom(C) \ N we have N ∩ V(C(y^{∀,s})) = ∅. \underline{Proof of Claim 8:} Otherwise there is some z^{∀,s} ∈ N∩V(C(y^{∀,s})), but then z^{∀,s} R^{∗} y^{∀,s} as C is an R-choice-condition, and then, as dom(C) ∩ ⟨N⟩R^{+} ⊆ N, we would have the contradicting y^{∀,s} ∈ N. \underline{Q.e.d. (Claim 8)}

\underline{\underline{Claim 9:}} Let y^{∀,s} ∈ dom(C) and C(y^{∀,s}) = λv_{0}…. λv_{l−1}. B. Let τ ∈ V_{∀,w} → A and

χ ∈ {v_{0}, …, v_{l−1}} → A and suppose that, for some η ∈ {y^{∀,s}} → A, B is (δ̄, e, A)-

valid for δ̄:= _{V_{∀,s}\{y^{∀,s}}}↿(ϵ(π)(τ))⊎η ⊎τ ⊎χ. Now: B is (δ, e, A)-valid for δ := ϵ(π)(τ)⊎τ ⊎χ.

\underline{\underline{Proof of Claim 9:}} Set δ̄′ := _{V_{∀,s}\\{y^{∀,s}\}}↿(ϵ(π′)(τ)) ⊎ η ⊎ τ ⊎ χ and δ′ := ϵ(π′)(τ) ⊎ τ ⊎ χ.

\underline{y^{∀,s} ∉ O⊎N:} In this case, we have y^{∀,s} ∉ dom(σ) because of dom(C) ∩ dom(σ) ⊆ O⊎N.

Thus, as (C′, R′) is the extended σ-update of (C, R), we have C′(y^{∀,s}) =

(C(y^{∀,s}))σ. By Claim 8 we have N∩V(B) = ∅. For later application of Claim 1, note that V_{∀}(⟨V_{∃}(B)⟩σ)↿δ̄′ = _{V_{∀}(⟨V_{∃}(B)⟩σ)}↿δ′; otherwise there would be some x^{∃} ∈ V_{∃}(B) = V_{∃}(C(y^{∀,s})) with y^{∀,s} U_{σ} x^{∃}, and then, as C is a R-choice-condition, y^{∀,s} U_{σ} ∘ R^{+} y^{∀,s}, and then, by Claim 2, y^{∀,s} ⊲ y^{∀,s}, which contradicts the wellfoundedness of ⊲. Note that _{V_{∀,s}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) = _{V_{∀,s}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′); otherwise there would be some z^{∀,s} ∈ V_{∀,s}(C(y^{∀,s})) with y^{∀,s} ∈ V(σ(z^{∀,s})), which implies y^{∀,s} R′ z^{∀,s} R^{∗} y^{∀,s} (as R′ is the σ-update of R and C is an R-choice-condition), and then, by Claim 2, y^{∀,s} ⊲ z^{∀,s} ⊴ y^{∀,s}, which contradicts the wellfoundedness of ⊲. V(B)↿δ̄ = (due to y^{∀,s} ∉ dom(σ), N ∪ (dom(σ) ∩ V_{∀}) = N⊎O⊎A, N∩V(B) = ∅, Claim 5) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{∀,s}(B)}↿(ϵ(π)(τ)) = (by Claim 4) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{∀,s}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ′) = (cf. above) V(B)\dom(σ)↿δ̄′ ⊎ _{(O⊎A)∩V_{∀,s}(B)}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′). Now: TRUE = (by assumption of Claim 9) eval(A ⊎ ϵ(e)(δ̄) ⊎ δ̄)(B) = (by the above and dom(σ) ∩ V_{∀}(B) = (O⊎A) ∩ V_{∀,s}(B)) eval(A ⊎ ϵ(e)(δ̄) ⊎ _{V_{∀}}↿σ ∘ eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′) ⊎ _{V\dom(σ)}↿δ̄′)(B) = (by Claim 1) eval(A ⊎ ϵ(e′)(δ′) ⊎ δ̄′)(Bσ) = (as otherwise for some x^{∃} ∈ V_{∃}(Bσ) = V_{∃}(C′(y^{∀,s}))

we have y^{∀,s} S_{e′} x^{∃} R′^{+} y^{∀,s}, i.e. y^{∀,s}⊲y^{∀,s})

eval(A ⊎ ϵ(e′)(δ̄′) ⊎ δ̄′)(Bσ). As π′ is (e′, A)-compatible with (C′, R′), we know that Bσ is (δ′, e′, A)-valid. Thus, by Claim 7, B is (δ, e, A)-valid.

\underline{y^{∀,s} ∈ O:} N∩V(B) = ∅ by Claim 8. Let y ∈ V_{bound}\V(C(y^{∀,s})) and D be the formula ∃y.

(B{y^{∀,s}(v_{0}) ⋯ (v_{l−1}) ↦ y}) s.t. Q_{C,σ}(y^{∀,s}) is equal to ∀v_{0}…. ∀v_{l−1}. (D ⇒ B)σ. We have N∩V(D) = ∅. As B is valid in A⊎ϵ(e)(δ̄)⊎δ̄, by the standard semantical definition of ∃ (cf. e.g. Wirth (1997), p. 188, or Enderton (1973), p. 82) and the Substitution-Lemma, D is valid in A ⊎ ϵ(e)(δ̄) ⊎ δ̄, too, and then (as y^{∀,s} does not occur in D anymore (as all occurrences of y^{∀,s} in B are of the form y^{∀,s}(v_{0}) ⋯ (v_{l−1}) according to Definition 9.1)) also valid in A ⊎ ϵ(e)(δ̄) ⊎ δ. Moreover, D is even valid in A ⊎ ϵ(e)(δ) ⊎ δ; otherwise there would be some v^{∃} ∈ V(D) with y^{∀,s} S_{e} v^{∃}, but then v^{∃} ∈ V(C(y^{∀,s}))\{y^{∀,s}} and (as C is an R-choice-condition) v^{∃} R^{+} y^{∀,s}, which contradicts the wellfoundedness of R ∪ S_{e}, which contradicts e being an existential (A, R)-valuation. By Claim 7, Dσ is (δ′, e′, A)-valid. But by assumption of the lemma on Q_{C,σ} and by the standard definition of ∀, we know that (D ⇒ B)σ is (δ′, e′, A)-valid. Thus, Bσ is (δ′, e′, A)-valid. By Claim 7, B is (δ, e, A)-valid.

\underline{y^{∀,s} ∈ N:} By definition of π. \underline{\underline{Q.e.d. (Claim 9)}}

By Claim 3 and Claim 9, π is (e, A)-compatible with (C, R), and then items 1 and 2 of the lemma are trivial consequences of Claim 6, Claim 7, resp.. Q.e.d. (Lemma A.2)

C Notes

Note 1: Indeed, despite Sieg & Byrnes (1998), the old fashion of Shanin &al. (1965), namely to find a proof in a sequent calculus in disguise and then to translate it into natural deduction, still seems to be the state of the art of proof search in natural deduction in classical logic.

Note 2: We attribute α, β, γ, and δ to inference rules (as it seems to be intended in Smullyan (1968)) and not to formulas (as in Fitting (1996)). This has the advantage that nothing changes when we switch from positive to refutational theorem proving, e.g. β always stands for “branching”, as already indicated in Smullyan (1968), contrary to the strange branching α-rules in Fitting (1996), p. 51.

Note 3: Note that x^{∃} ∉ V_{∃}(F) is not required for soundness or safeness (cf. the proof of Theor. 14.1), but only in order not to lose possible proofs.

Note 4: Note that for soundness and safeness of the δ-rule x^{∀,w} ∉ V(A, Γ Π, ℶ) ∪ dom(R) is sufficient for F = (F, C, R, L, H), cf. the proof of Theor. 14.1. Nevertheless, we require x^{∀,w} ∉ V(F) in order not to lose possible proofs.

Note 5: Note that for soundness and safeness of the liberalized δ-rule x^{∀,s} ∉ V(A) ∪ dom(C∪R) is sufficient for F = (F, C, R, L, H), cf. the proof of Theor. 14.1. Nevertheless, we require x^{∀,s} ∉ V(F) in order not to lose possible proofs.

Note 6: The notation ⟨A⟩R is in the tradition of Bourbaki (1954), Chapitre II, § 3, Définition 3, where R⟨A⟩ is written in order to clearly distinguish relation application ⟨A⟩R from function application R(A). In Wirth (1997) we still used to write R[A] instead of ⟨A⟩R. In this paper, however, this notation would lead to confusion with our use of optional brackets.

Note 7: Note that R^{−1} is an inverse (in the sense that R∘R^{−1} =_{dom(R)}↿id and R^{−1}∘R = ran(R)↿id holds) iff R is an injective function.

Note 8: We do not need the more complicated definitions of a sequent as a pair of lists of formulas or as a T/F-tagged list of formulas because we do not consider calculi where the separation of a sequent into antecedent and succedent is important, like LJ in Gentzen (1935) or the “symmetric Gentzen systems” in Smullyan (1968).

Note 9: The name “syntactical construct” was already used before Wirth & Becker (1995) and we will keep it in order to avoid extra confusion until we find a really better one.

Note 10: It may be objected that in the modal logics of, say, Fitting (1999), Cerrito & Cialdea (2001), Fitting (2002), the Substitution-Lemma is not valid because it only holds for the substitution of rigid and rigidified (grounded, annotated, non-relativized) terms. This is, however, a wrong view: Those substitutions for that the Substitution-Lemma does not hold are no proper substitutions. They cannot occur in proof steps because such proof steps would be unsound. And therefore we do not need them at all, and simply do not call them substitutions, which renders the Substitution-Lemma valid again. Indeed, the substitutions for that the Substitution-Lemma does not hold when applied to a certain term or formula B, are not “free” for B in some sense. The problem is that an implicit variable is captured by some quantifier. We will explain this for the higher-order modal logic of Fitting (2002) because there the relativization operator ↓ makes this obvious. For a term t of intensional type ↑α, the term ↓t has the extensional type α. Instead of ↓t one could also write tw where w is a variable valuated to the current world, so that tw is the extension of t at world w. The quantifiers □, ♢ and the binder λ implicitly bind this implicit variable w. Let us now have a look on the standard example for the violation of the Substitution-Lemma. Let x, y be variables of the extensional type 0, let h, p be constants of the intensional type ↑0 standing for the intentional notions of Hesperus (morning star) and phosphorus (evening star), and assume that □ means “the ancients knew”. Then

x = y ⇒ □(x = y)

is valid because the ancients knew that two identical things are identical. On the other hand its instance

↓h = ↓p ⇒ □(↓h = ↓p)

via the “substitution” {x ↦ ↓h, y ↦ ↓p} is not valid in our world because here the extensions of Hesperus and phosphorus are identical but the ancients did not know that. But with the variable w made explicit, the first formula reads

x = y ⇒ □w. (x = y)

for which the “substitution” {x ↦ hw, y ↦ pw} is obviously not “free” because the w is captured by the quantifier □w.

Note 11: Indeed, the problems of higher-order logic do not interfere because we do not Skolemize, the word “completeness” will not occur anymore in the rest of the whole paper, and we consider efficiency (like unification) only in so far as that we do not inhibit it.

Note 12: x^{∀,w} ∈ V_{∀,w} is in solved form in the syntactical construct Γ (x^{∀,w}≠t) Π; ℶ if x^{∀,w} ∉ V(t, Γ Π, ℶ) and V_{∀,s}(t, Γ Π, ℶ) ∪ V_{∃}(t, Γ Π, ℶ) ⊆ R^{+}⟨{x^{∀,w}}⟩.

Note 13: In order to show that there is nothing out of the ordinary with lexicographic combination up to m, let us indicate how it could be modeled with fixed-arity many-sorted functions in the specification formalism of QuodLibet.

For m = 2 the lexicographic combination up to m can be inductively defined in the following way that can be easily generalized to any natural number m. In our signature we need, for any user-defined type s, the constructor symbol lex : nat → s → s → ORD representing the lexicographic combination of length 0, 1, or 2 as indicated by the first argument, e.g. lex(s(0), x, y) models the 1-tuple (x) while lex(0, x, y) models the 0-tuple or empty word (). Moreover, lex(s(s(n)), x, y) models the n+2-tuple xy^{n+1}, where only n = 0 is intended, but n ≻ 0 does not destroy wellfoundedness. It is important that s is different from ORD because otherwise we can form tuples of arbitrary length via the old idea of set theory to construct tuples from pairs, namely (x_{n+2}, x_{n+1}, …, x_{0}) := (x_{n+2}, (x_{n+1}, …, x_{0})), thereby destroying the wellfoundedness. Now we can inductively define < : ORD → ORD → bool as follows, where n_{i} : nat and x_{i}, y_{i} : s.

(≲1) ∀n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. lex(0, x_{0}, y_{0}) ≲ lex(n_{1}, x_{1}, y_{1})
(≲2) ∀n_{0}, x_{0}, x_{1}, y_{0}, y_{1}. ¬( lex(s(n_{0}), x_{0}, y_{0}) ≲ lex(0, x_{1}, y_{1}) )

(≲3) ∀n_{0}, n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. ( \begin{matrix}& lex(s(n_{0}), x_{0}, y_{0}) ≲ lex(s(n_{1}), x_{1}, y_{1}) \\ ⇔ & \binom{x_{0}≲x_{1}}{∧ ( x_{1}≲x_{0} ⇒ lex(n_{0}, y_{0}, y_{0}) ≲ lex(n_{1}, y_{1}, y_{1}) )} \end{matrix} )

(<1) ∀n_{0}, n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. ( \begin{matrix}& lex(n_{0}, x_{0}, y_{0}) < lex(n_{1}, x_{1}, y_{1}) \\ ⇔ & \binom{lex(n_{0}, x_{0}, y_{0}) ≲ lex(n_{1}, x_{1}, y_{1})}{∧ ¬( lex(n_{1}, x_{1}, y_{1}) ≲ lex(n_{0}, x_{0}, y_{0}) )} \end{matrix} )

(≲1) and (≲2) say that the empty tuple is smallest. (≲3) says that for non-empty tuples we compare the first elements and have to compare the rest of the tuples when they turn out to be equivalent. (<1) is just the standard way to define the ordering of a quasi-ordering. The analogous definitions for boolean functions are admissible in QuodLibet. Note that we get the following theorems that have been proved in QuodLibet deductively and without using any ordering properties:

(<2)  ∀n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. lex(0, x_{0}, y_{0})<lex(s(n_{1}), x_{1}, y_{1})

(<3) ∀n_{0}, n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. ( \begin{matrix}lex(s(n_{0}), x_{0}, y_{0}) & < & lex(s(n_{1}), x_{1}, y_{1}) \\ ⇐ & ( \begin{matrix}x_{0} & ≲ & x_{1} \\ ∧ & \binom{x_{1}≲x_{2}}{⇒ lex(n_{0}, y_{0}, y_{0})<lex(n_{1}, y_{1}, y_{1})} \end{matrix} ) \end{matrix} )

Using reflexivity of ≲ on the user-defined types and the definition of < as the ordering of ≲, we get the following consequences of (<3) that are implemented (besides (<2)) as special inference rules in QuodLibet instead of (<3) since the quasi-orderings are not implemented in QuodLibet for pragmatic reasons. The orderings, however, are available for any type s of the signature Σ via predicate symbols < : s → s → bool of Σ.

(<4) ∀n_{0}, n_{1}, x_{0}, x_{1}, y_{0}, y_{1}. \binom{lex(s(n_{0}), x_{0}, y_{0})<lex(s(n_{1}), x_{1}, y_{1})}{⇐ x_{0}<x_{1}}
(<5)  ∀n_{0}, n_{1}, x_{0}, y_{0}, y_{1}. \binom{lex(s(n_{0}), x_{0}, y_{0})<lex(s(n_{1}), x_{0}, y_{1})}{⇐ lex(n_{0}, y_{0}, y_{0})<lex(n_{1}, y_{1}, y_{1})}

Note 14: An anonymous referee of a previous version of this text wrote:

A minor item: After stating the relevant induction principle the author writes: “Now by the Principle of Dependent Choice (cf. Rubin & Rubin (1985)) ….” I find this reference quite inappropriate: Of course, one needs some form of the axiom of choice to prove the existence of minimal elements in general, however in the context of inductive reasoning the used ordering is always concretely given and consequently the fact that “a class without minimal elements contains a chain without a least element” is always obvious in any particular scenario of theorem proving.

I do not follow this argumentation:

The problem is that there may be several counterexamples and the induction ordering be partial. So you have to pick and pick and pick smaller counterexamples from unstructured non-empty classes.

Nevertheless, it was the above remark which finally made me change my definition of wellfoundedness from non-termination of the reverse relation to existence of minimal elements, which resulted in a tautological soundness of the Method of Descente Infinie.

Note 15: Consider the valid Henkin quantified IF logic formula

∀x_{0}. ∀x_{1}. ∃y_{0}/x_{1}. ∃y_{1}/x_{0}. ( x_{0}=y_{0} ∧ x_{1}=y_{1} )

or its logically equivalent raised form

∃y_{0}. ∃y_{1}. ∀x_{0}. ∀x_{1}. ( x_{0}=y_{0}(x_{0}) ∧ x_{1}=y_{1}(x_{1}) )

The idea to represent this in our framework as the formula x0^{∀}=y0^{∃} ∧ x1^{∀}=y1^{∃} with variable-condition R = {(y0^{∃}, x1^{∀}), (y1^{∃}, x0^{∀})} fails to be R-valid. Indeed, while {y0^{∃}↦x0^{∀}} and {y1^{∃}↦x1^{∀}} are existential R-substitutions, their combination σ = {y0^{∃}↦x0^{∀}, y1^{∃}↦x1^{∀}} is no R-substitution:

y0^{∃} _{R}  x0^{∀}^{U_{σ}} y1^{∃}  _{R} x1^{∀}_{U_{σ}}

Now, if you want to turn this wrong representation into a proper one, you have to use the notions from the weak version of Wirth (1998) instead. Reformulated according to the slightly different notion of a substitution used in this paper, they read:

Definition Note 15.1 (Weak Variable-Condition) (Cf. Definition 4.6) A variable-condition is a subset of V_{∃} × V_{∀}.

Definition Note 15.2 (Weak R-Substitution) (Cf. Definition 5.2) Let R be a variable-condition. σ is an R-substitution if σ is a substitution for that U_{σ} ∘ R is irreflexive.

Definition Note 15.3 (Weak σ-Update) (Cf. Definition 5.3) Let R be a variable-condition and σ be a substitution. The σ-update of R is (_{V_{∃}\dom(σ)}↿id ∪ E_{σ}) ∘ R.

Note that for this weak version we have to pay the price that we cannot use a liberalized version of the δ-rule, which makes our proofs dependent on the order in which we eliminated quantifiers, thereby severely violating our design goal of a natural flow of information, cf. Section 2.1.

Note 16: If you nevertheless want to have re-use and permutations of free existential variables you have use the following alternative notions instead.

Definition Note 16.4 (Alternative Variable-Condition) (Cf. Definition 4.6) A variable-condition is a subset of V_{free} × V_{∀}.

Definition Note 16.5 (Alternative R-Substitution) (Cf. Definition 5.2) Let R be a variable-condition. σ is an R-substitution if σ is a substitution for that (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ}) ∘ R ∪ (E_{σ} ∪ U_{σ})↾_{V_{∀}} is wellfounded.

Definition Note 16.6 (Alternative σ-Update) (Cf. Definition 5.3) Let R be a variable-condition and σ be a substitution. The σ-update of R is (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ}) ∘ R ∪ (E_{σ} ∪ U_{σ})↾_{V_{∀}}.

In an implementation, substituted free existential variables should get new nodes while their old nodes lose their labels. E.g., (where we have boxed the old occurrences of the re-used free existential variables x^{∃} and u^{∃}) for

R := {( x^{∃} , y^{∀}), ( x^{∃} , z0^{∀}), ( x^{∃} , z1^{∀}), ( x^{∃} , z2^{∀}), ( u^{∃} , v^{∀}), (w^{∃}, v^{∀})}.

and the existential R-substitution (in the alternative sense!)

σ := { x^{∃} ↦ (u^{∃} + v^{∀}), u^{∃} ↦ x^{∃}, y^{∃} ↦ v^{∀}}

we should update

u^{∃}  _{R} v^{∀}  w^{∃}^{R} y^{∀}  x^{∃}_{R}_{R}  _{R}  _{R} z0^{∀}  z1^{∀}  z2^{∀}

first to

y^{∃} x^{∃} _{E_{σ}} u^{∃}  _{R} v^{∀}_{U_{σ}} _{U_{σ}}  w^{∃}_{R} y^{∀}  x^{∃}_{R}_{R}  _{R}  _{R} u^{∃}_{E_{σ}} z0^{∀}  z1^{∀}  z2^{∀}

and then to

x^{∃}  •  v^{∀}  w^{∃} y^{∀}  •  u^{∃} z0^{∀}  z1^{∀}  z2^{∀}

representing the σ-update of R in the alternative sense. Note that the edge from v^{∀} to y^{∃} has been completely removed in the last step because y^{∃} has no out-going R-edge. This may be an efficiency advantage over the non-alternative version, cf. also Section 15. Therefore, we have spared no efforts and included the treatment in case of the alternative definitions of R-substitution and σ-update in all our proofs!

Note 17: The other reason is that we do not have to insert R⟨{z^{∀}}⟩ × {y^{∀,s}} into the variable-condition R anymore (as was the case in Wirth (1998)) because the transitive closure now takes care of this.

Note 18: It should be pointed out that the “some π” in this definition is something we can play around with. Indeed, in Wirth (1998), Definition 5.7 (resp. Definition 4.4 in short version), we can read “each π” instead, which is just the other extreme. The reason why we prefer “some π” to “each π” here and in Wirth (2002) is that the latter results in more valid formulas (e.g. (E2) in Wirth (2002)) and makes theorem proving easier. Contrary to the former and to all semantics for Hilbert’s ε in the literature, the latter frees us from considering all possible choices: We just have to pick a single one and fix it in a proof step. As the major notion here and in Wirth (2002) is not strong validity but reduction (cf. Definition 11.1), where the quantification of π must be universal no matter how we quantify in the notion of strong validity, changing the quantification of π in Definition 10.1 would only have very local consequences. Roughly speaking, in Section 10 and Section 11 only Theor. 11.2(6a) for the case of O ≠ ∅ as well as Theor. 11.2(5a) become false for a different choice on the quantification of π in Definition 10.1.

Note 19: Since the definition of wellfoundedness was changed from non-termination of the reverse relation to existence of minimal elements, the soundness of this step does not require the Principle of Descente Infinie, cf. Definition 4.4, anymore.

Note 20: Note that in Wirth (1998) the (non-liberalized) δ-rules were no sub-rules of Expansion rule of the sequent calculus of Definition 13.4 because there was only one kind of free universal variables and the δ-rule had to use the same kind of free universal variables as the liberalized δ-rule, cf. the discussion on p. 25 of Wirth (1998).

Note 21: Indeed, for the alternative notions in Note 16, we get R := ∅ here because (x1^{∃}, x2^{∃}) gets removed just as the edge from v^{∀,s} to y^{∃} in the example of Note 16.

Note 22: Indeed, for the alternative notions in Note 16, our variable-condition would still be empty.

Note 23: Or, more formally, using the lexicographic combination of Note 13 according to w2^{∃}(x) := lex(s(0), x, 0) and w3^{∃}(x, y) := lex(s(s(0)), x, y), or even more formally we apply the existential R-substitution {w2^{∃} ↦ λx. lex(s(0), x, 0), w3^{∃} ↦ λx, y. lex(s(s(0)), x, y)}.

Note 24: If it wellfoundedness or termination were a first-order property, the first-order theory of the Peano algebra of natural numbers would be first-order axiomatizable and enumerable, but it is not even arithmetically definable, cf. e.g. Enderton (1973), p. 228.

Note 25: There is one disadvantage, however, of the liberalized δ-rule compared to the non-liberalized δ-rule. Sometimes the liberalized δ-rule results in a bigger variable-condition than the non-liberalized one because the liberalized one additionally introduces dependencies from the weak free universal variables of the principle formula, which are necessary for lemma and induction hypothesis application. One consequence of this is that simplification becomes more difficult: E.g., in item 2 at the end of Section 4.1 we safely removed the literal x^{∀,w}≠s(y^{∀,w}) from x^{∀,w}≠s(y^{∀,w}), 0 + s(y^{∀,w}) = s(y^{∀,w}); w1^{∃}(s(y^{∀,w})) because x^{∀,w} was in solved form in this sequent, cf. Note 12. If we had applied the liberalized δ-rule instead, we would have got x^{∀,w}≠s(y^{∀,s}), 0 + s(y^{∀,s}) = s(y^{∀,s}); w1^{∃}(s(y^{∀,s})), where x^{∀,w} is not in solved form because this sequent contains the strong free universal variable y^{∀,s} which is not in R^{+}⟨{x^{∀,w}}⟩. Moreover, we cannot extend the variable-condition R s.t. R^{+}⟨{x^{∀,w}}⟩ contains y^{∀,s} because the liberalized δ-rule has introduced the dependency (x^{∀,w}, y^{∀,s}) into R, so that R would become cyclic. Note that y^{∀,s} stands for εy. (x^{∀,w}=s(y)), which means that x^{∀,w} still occurs hidden the latter sequent. Indeed, under the variable-condition R := {(x^{∀,w}, y^{∀,s})}, the choice-condition C := {(y^{∀,s}, (x^{∀,w}=s(y^{∀,s})))}, and (nat1) from Section 4.1, the removal of x^{∀,w}≠s(y^{∀,s}) from x^{∀,w}≠s(y^{∀,s}), y^{∀,s}≠0; … is not safe in the sense of Definition 13.9; to wit, let A have the universe {+, −} × N with s^{A}(+, n) := (+, n+1), s^{A}(−, n+1) := (−, n), s^{A}(−, 0) := (+, 1), and 0^{A} := (+, 0), and set

π(y^{∀,s})(τ) := \{ \begin{matrix}(+, 0) & if τ(x^{∀,w})=(+, 0) \\ (−, 0) & if τ(x^{∀,w})=(+, 1) \\ (+, n+1) & if τ(x^{∀,w})=(+, n+2) \\ (−, n+1) & if τ(x^{∀,w})=(−, n) \end{matrix} \},

which is compatible with (C, R) and makes x^{∀,w}≠s(y^{∀,s}), y^{∀,s}≠0 valid, but not y^{∀,s}≠0. There is, however, a general way to overcome this shortcoming for constructive domains. For our special case of natural numbers it looks as follows: When we add the axiom (nat2) or (nat3) (which together with (nat1) is strictly stronger than (nat2)) from below, then the removal of x^{∀,w}≠s(y^{∀,s}) from x^{∀,w}≠s(y^{∀,s}), Γ; … is always safe because the image of the predecessor function on the universe without 0^{A} is the whole universe and if Γ is false for τ(x^{∀,w}) = 0^{A} then x^{∀,w}≠s(y^{∀,s}), Γ is false for the τ′ which differs from τ in τ′(x^{∀,w}) = s^{A}(π(y^{∀,s})(τ)) because then π(y^{∀,s})(τ′) = π(y^{∀,s})(τ).

(nat2) ∀x, y. ( s(x)=s(y) ⇒ x=y )
(nat3) ∀x, y. ( x⟶y ⇔ x=s(y) ) ∧ ⟶^{−1} is wellfounded

Note 26: In terms of Hilbert’s ε-operator, this asymmetry can be understood from the argumentation of Nonnengart (1996), which, for some new variable z ∈ V_{bound} and t denoting the term εz. (¬A{x↦z} ∧ (A ∨ x=z)), employs the logical equivalence of ∀x. (A∨B) with ∀x. A ∨ ∀x. (B{x↦t}) and then the logical equivalence of ∀x. A with ∃x. (A{x↦t}).

Note 27: These calculi were presented at the 2^{nd} Int. Workshop on First-Order Theorem Proving (FTP) in Nov. 1998 in Vienna (cf. Wirth (1998)), where nobody in the audience was able to point out other work in this direction besides the unsound calculi in Kohlhase (1995) and Kohlhase (1998), cf. Section 4.7.

Note 28: For the alternative notions in Note 16, we have to replace this sentence with the following: As R′ is the σ-update of R, we have

U_{σ}R^{∗}↾_{V_{∀}} ⊆ U_{σ}RR^{∗} ∪ U_{σ}↾_{V_{∀}} = U_{σ}R(_{V_{∀}}↿R)^{∗} ∪ U_{σ}↾_{V_{∀}} ⊆ R′^{+},

the second step being due to ran(R) ⊆ V_{∀} for any alternative variable-condition R. Similarly, _{V_{∀}}↿(R^{+}) = (_{V_{∀}}↿R)^{+} ⊆ R′^{+}. \underline{Q.e.d. (Claim 1)}

Note 29: For the alternative notions in Note 16, we have to replace this sentence with the following: As R′ is the σ-update of R, we have

(_{V_{∃}\dom(σ)}↿id ∪ E_{σ})R^{∗}↾_{V_{∀}} ⊆ (_{V_{∃}\dom(σ)}↿id ∪ E_{σ})RR^{∗} ∪_{V_{free}}↿id ∪ E_{σ}↾_{V_{∀}} =

(_{V_{∃}\dom(σ)}↿id ∪ E_{σ})R(_{V_{∀}}↿R)^{∗} ∪_{V_{free}}↿id ∪ E_{σ}↾_{V_{∀}} ⊆ R′^{∗},

the second step being due to ran(R) ⊆ V_{∀} for any alternative variable-condition R. Q.e.d. (Claim 2)

Note 30: For the alternative notions in Note 16, we have to deviate here in the following way: Moreover, as R′ is the σ-update of R, we have

R′ = (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ})R ∪ (E_{σ} ∪ U_{σ})↾_{V_{∀}}.

As (R′ ∪ S_{e′})^{+} is a wellfounded ordering, so is its subset

(_{V_{∀}∪(V_{∃}\dom(σ))}↿R ∪ S_{e′}↾_{V_{∃}\dom(σ)} ∪ S_{e′}E_{σ}↾_{V_{∃}}R ∪ U_{σ}↾_{V_{∃}}R)^{+}.

The alternative version of a variable-condition guarantees ran(R) ⊆ V_{∀}. Thus, additional steps with _{V_{∃}∩dom(σ)}↿R must cause immediate termination; i.e.

(R ∪ S_{e′}↾_{V_{∃}\dom(σ)} ∪ S_{e′}E_{σ}↾_{V_{∃}}R ∪ U_{σ}↾_{V_{∃}}R)^{+}

is a wellfounded ordering, too. As ran(E_{σ}↾_{V_{∃}} ∪ U_{σ}↾_{V_{∃}}) ⊆ V_{∃} and dom(S_{e′} ∪ U_{σ}) ⊆ V_{∀}

(R ∪ S_{e′}↾_{V_{∃}\dom(σ)} ∪ S_{e′}E_{σ}↾_{V_{∃}} ∪ U_{σ}↾_{V_{∃}})^{+}

is a wellfounded ordering, which is equal to (R ∪ S_{e})^{+} by definition of S_{e}. \underline{Q.e.d. (Claim 3)}

Note 31: For the alternative notions in Note 16, we have to deviate here in the following way: Moreover, as R′ is the σ-update of R, we have

R′ = (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ})R ∪ (E_{σ} ∪ U_{σ})↾_{V_{∀}}.

As (R′ ∪ S_{e′} ∪ S_{π′})^{+} is a wellfounded ordering, so is its subset

( \begin{matrix}_{V_{∀}∪(V_{∃}\dom(σ))}↿R ∪ (S_{π′} ∪_{V_{∀,w}}↿id)(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}})(R ∪ R′) \\ ∪ & (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}} \end{matrix} )^{+}.

The alternative version of a variable-condition guarantees ran(R ∪ R′) ⊆ V_{∀}. Thus, additional steps with _{V_{∃}∩dom(σ)}↿R must cause immediate termination; i.e.

(R ∪ (S_{π′} ∪_{V_{∀,w}}↿id)(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}})(R ∪ R′) ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}})^{+}

is a wellfounded ordering, too. As ran(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}) ⊆ V_{∃} and dom(S_{π′} ∪_{V_{∀,w}}↿id ∪ S_{e′} ∪ S_{π′}) ⊆ V_{∀}

(R ∪ (S_{π′} ∪_{V_{∀,w}}↿id)(S_{e′}(_{V_{∃}\dom(σ)}↿id ∪ E_{σ}↾_{V_{∃}}) ∪ U_{σ}↾_{V_{∃}}) ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}})^{+}

is a wellfounded ordering, which is equal to (R ∪ S_{e} ∪ (R′ ∪ S_{e′} ∪ S_{π′})^{+}↾_{V_{∀}})^{+} by definition of S_{e}. \underline{Q.e.d. (Claim 5)}

Note 32: For the alternative notions in Note 16, we have to deviate here in the following way: As R′ is the σ-update of R, we have

R′ = (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ})∘R ∪ (E_{σ} ∪ U_{σ})↾_{V_{∀}}.

As the alternative version of a variable-condition guarantees ran(R) ⊆ V_{∀} and ⊲ is transitive, we have _{V_{∀}}↿(R^{+}) ⊆ ⊲ and (_{V_{∀}∪(V_{∃}\dom(σ))}↿id ∪ E_{σ} ∪ U_{σ})∘R^{+} ⊆ ⊲. The latter implies S_{e}∘R^{+} ⊆ ⊲ by (A.2.1). \underline{Q.e.d. (Claim 2)}

D References

Peter B. Andrews (1972). General Models, Descriptions, and Choice in Type Theory. J. Symbolic Logic 37, pp. 385–394.

Peter B. Andrews (2002). An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof. 2^{nd} ed., Academic Press.

Matthias Baaz, Christian G. Fermüller (1995). Non-elementary Speedups between Different Versions of Tableaus. 4^{th} TABLEAU 1995, LNAI 918, pp. 217–230, Springer.

Matthias Baaz, Uwe Egly, Christian G. Fermüller (1997). Lean Induction Principles for Tableaus. 6^{th} TABLEAU 1997, LNAI 1227, pp. 62–75, Springer.

Leo Bachmair (1988). Proof By Consistency in Equational Theories. 3^{rd} IEEE symposium on Logic In Computer Sci., pp. 228–233, IEEE Press.

Peter Baumgartner, Ulrich Furbach, Frieder Stolzenburg (1997). Computing Answers with Model Elimination. Artificial Intelligence 90, pp. 135–176.

Bernhard Beckert, Reiner Hähnle (1998). Analytic Tableaus. In: Bibel & Schmitt (1998), Vol. 1, pp. 11–41.

Bernhard Beckert, Reiner Hähnle, Peter H. Schmitt (1993). The Even More Liberalized δ-Rule in Free Variable Semantic Tableaus. Kurt Gödel Colloquium, LNCS 713, pp. 108– 119, Springer.

Wolfgang Bibel (1987). Automated Theorem Proving. 2^{nd} rev. ed., Vieweg, Braunschweig.

Wolfgang Bibel, Peter H. Schmitt (eds.) (1998). Automated Deduction — A Basis for Applications. Kluwer.

Susanne Biundo, Birgit Hummel, Dieter Hutter, Christoph Walther (1986). The Karlsruhe Induction Theorem Proving System. 8^{th} CADE 1986, LNCS 230, pp. 672–674, Springer.

Adel Bouhoula, Michaël Rusinowitch (1995). Implicit Induction in Conditional Theories. J. Automated Reasoning 14, pp. 189–235, Kluwer.

Nicolas Bourbaki (1954). Livre I — Théorie des Ensembles. Hermann, Paris.

Robert S. Boyer, J Strother Moore (1979). A Computational Logic. Academic Press.

Robert S. Boyer, J Strother Moore (1988). A Computational Logic Handbook. Academic Press.

Alan Bundy, Andrew Stevens, Frank van Harmelen, Andrew Ireland, Alan Smaill (1993). Rippling: A Heuristic for Guiding Inductive Proofs. Artificial Intelligence 62, pp. 185– 253.

Ricardo Caferra, Gernot Salzer (eds.) (2000). Automated Deduction in Classical and Non-Classical Logics. LNAI 1761, Springer.

Domenico Cantone, Marianna Nicolosi-Asmundo (2000). A Further and Effective Liberalization of the δ-Rule in Free Variable Semantic Tableaus. In: Caferra & Salzer (2000), pp. 109–125.

Serenella Cerrito, Marta Cialdea (2001). Free-Variable Tableaus for Constant-Domain Quantified Modal Logics with Rigid and Non-Rigid Designation. 1^{st} IJCAR 2001, LNAI 2083, pp. 137–151, Springer.

Herbert B. Enderton (1973). A Mathematical Introduction to Logic. 2^{nd} printing, Academic Press.

Melvin C. Fitting (1996). First-Order Logic and Automated Theorem Proving. 2^{nd} extd. ed., Springer.

Melvin C. Fitting (1999). On Quantified Modal Logic. Fundamenta Informaticae 39, pp. 105–121.

Melvin C. Fitting (2002). Types, Tableaus, and Gödel’s God. Kluwer.

Dov M. Gabbay, C. J. Hogger, J. Alan Robinson (eds.) (1993 ff.). Handbook of Logic in Artificial Intelligence and Logic Programming. Clarendon Press.

Gerhard Gentzen (1935). Untersuchungen über das logische Schließen. Mathematische Zeitschrift 39, pp. 176-210, 405–431.

Gerhard Gentzen (1938). Die gegenwärtige Lage in der mathematischen Grundlagenforschung – Neue Fassung des Widerspruchsfreiheitsbeweises für die reine Zahlentheorie. Forschungen zur Logik und zur Grundlegung der exakten Wissenschaften, Folge 4, Leipzig.

Alfons Geser (1995). A Principle of Non-Wellfounded Induction. In: Tiziana Margaria (ed.). Kolloquium Programmiersprachen und Grundlagen der Programmierung, MIP– 9519, pp. 117–124, Univ. Passau.

Martin Giese (1998). Integriertes automatisches und interaktives Beweisen: die Kalkülebene.

Master’s thesis, Univ. Karlsruhe. http://i11www.ira.uka.de/~giese/da.ps.gz
(May09,2000).

Martin Giese, Wolfgang Ahrendt (1999). Hilbert’s ε-Terms in Automated Theorem Proving. 8^{th} TABLEAU 1999, LNAI 1617, pp. 171–185, Springer.

Kurt Gödel (1986 ff.). Collected Works. Solomon Feferman (ed.), Oxford Univ. Press.

Bernhard Gramlich, Wolfgang Lindner (1991). A Guide to Unicom, an Inductive Theorem Prover Based on Rewriting and Completion Techniques. SEKI-Report SR–91–17 (SFB),

Univ. Kaiserslautern. http://agent.informatik.uni-kl.de/seki/1991/Lindner.
SR-91-17.ps.gz (May09,2000).

Bernhard Gramlich, Claus-Peter Wirth (1996). Confluence of Terminating Conditional Term Rewriting Systems Revisited. 7^{th} RTA 1996, LNCS 1103, pp. 245–259, Springer.

Reiner Hähnle, Peter H. Schmitt (1994). The Liberalized δ-Rule in Free Variable Semantic Tableaus. J. Automated Reasoning 13, pp. 211–221, Kluwer.

David Hilbert, Paul Bernays (1968/70). Grundlagen der Mathematik. 2^{nd} ed., Springer.

K. Jaakko J. Hintikka (1996). The Principles of Mathematics Revisited. Cambridge Univ. Press.

Paul Howard, Jean E. Rubin (1998). Consequences of the Axiom of Choice. Math. Surv. and Monographs, Vol. 58, American Math. Society. http://www.math.purdue.edu/

~jer/Papers/conseq.html (Oct.15,2002).

Dieter Hutter (1997). Colouring Terms to Control Equational Reasoning. J. Automated Reasoning 18, pp. 399–442, Kluwer.

Stig Kanger (1963). A Simplified Proof Method for Elementary Logic. In: Siekmann & Wrightson (1983), Vol. 1, pp. 364–371.

Deepak Kapur, Hantao Zhang (1989). An Overview of Rewrite Rule Laboratory ( Rrl). 3^{rd} RTA 1989, LNCS 355, pp. 559–563, Springer.

Manfred Kerber (1998). Proof Planning: A Practical Approach to Mechanized Reasoning in Mathemantics. In: Bibel & Schmitt (1998), Vol. 3, pp. 77–95.

Donald E. Knuth (1997 f.). The Art of Computer Programming. 3^{rd} ed., Addison-Wesley.

Michaël Kohlhase (1995). Higher-Order Tableaus. 4^{th} TABLEAU 1995, LNAI 918, pp. 294– 309, Springer. Revised version is: Kohlhase (1998).

Michaël Kohlhase (1998). Higher-Order Automated Theorem Proving. In: Bibel & Schmitt (1998), Vol. 1, pp. 431–462.

Georg Kreisel (1965). Mathematical Logic. In: T. L. Saaty (ed.). Lectures on Modern Mathematics, Vol. III, pp. 95–195, John Wiley & Sons, New York.

Christoph Kreitz, Brigitte Pientka (2000). Matrix-based Inductive Theorem Proving. 9^{th} TABLEAU 2000, LNAI 1847, pp. 294–308, Springer.

Ulrich Kühler (2000). A Tactic-Based Inductive Theorem Prover for Data Types with Partial Operations. Ph.D. thesis, Infix, Sankt Augustin.

Ulrich Kühler, Claus-Peter Wirth (1996). Conditional Equational Specifications of Data Types with Partial Operations for Inductive Theorem Proving. SEKI-Report SR–96–11, Univ. Kaiserslautern. Short version in: 8^{th} RTA 1997, LNCS 1232, pp. 38–52, Springer.

http://ags.uni-sb.de/~cp/p/rta97/welcome.html (Aug.05,2001).

Richard C.-T. Lee (1967). A Completeness Theorem and a Computer Program for Finding Theorems Derivable from Given Axioms. Ph.D. thesis, Univ. of California, Berkeley.

A. C. Leisenring (1969). Mathematical Logic and Hilbert’s ε-Symbol. Gordon and Breach, New York.

Vladimir A. Lifschitz (1971). Specialization of the Form of Deduction in the Predicate Calculus with Equality and Function Symbols. In: Orevkov (1971), pp. 1–24.

Vladimir A. Lifschitz (1989). What Is the Inverse Method?. J. Automated Reasoning 5, pp. 1–23, Kluwer.

Sergey Yu. Maslov (1971). The Inverse Method for Establishing Deducibility for Logic Calculi. In: Orevkov (1971), pp. 25–96.

Dale Miller (1992). Unification under a Mixed Prefix. J. Symbolic Computation 14, pp. 321– 358, Academic Press.

Andreas Nonnengart (1996). Strong Skolemization. MPI–I–96–2–010, Max Planck-Inst. für Informatik, Saarbrücken.

Vladimir P. Orevkov (1971). The Calculi of Symbolic Logic.I. American Mathematical Society, Providence, Rhode Island.

Peter Padawitz (1996). Inductive Theorem Proving for Design Specifications. J. Symbolic Computation 21, pp. 41–99, Academic Press.

Peter Padawitz (1998). Expander. A System for Testing and Verifying Func-

   tional Logic Programs. http://LS5.cs.uni-dortmund.de/~peter/ExpaTex.ps.gz
   (Sept.14,1999).

Michaël S. Paterson, Mark N. Wegman (1978). Linear Unification. J. Computer and System Sci. 16, pp. 158–167, Academic Press.

Dag Prawitz (1960). An Improved Proof Procedure. In: Siekmann & Wrightson (1983), Vol. 1, pp. 159–199.

Dag Prawitz (1965). Natural Deduction. Almquist & Wiksells, Uppsala.

Martin Protzen (1994). Lazy Generation of Induction Hypotheses. 12^{th} CADE 1994, LNAI 814, pp. 42–56, Springer. Long version in: Protzen (1995).

Martin Protzen (1995). Lazy Generation of Induction Hypotheses and Patching Faulty Conjectures. Ph.D. thesis, Infix, Sankt Augustin.

Herman Rubin, Jean E. Rubin (1985). Equivalents of the Axiom of Choice. Elsevier.

N. A. Shanin, G. V. Davydov, Sergey Yu. Maslov, G. E. Mints, Vladimir P. Orevkov, A. O. Slisenko (1965). An Algorithm for a Machine Search of a Natural Logical Deduction in a Propositional Calculus. In: Siekmann & Wrightson (1983), Vol. 1, pp. 424–483.

Wilfried Sieg, John Byrnes (1998). Normal Natural Deduction Proofs (in classical logic). Studia Logica 60, pp. 67–106, Kluwer.

Jörg H. Siekmann, G. Wrightson (eds.) (1983). Automation of Reasoning. Springer.

Raymond M. Smullyan (1968). First-Order Logic. Springer.

Wayne Snyder, Jean Gallier (1989). Higher-Order Unification Revisited: Complete Sets of Transformations. J. Symbolic Computation 8, pp. 101–140, Academic Press.

Balder Ten Cate, Chung-chieh Shan (2002). Question Answering: From Partitions to Prolog. 11^{th} TABLEAU 2002, LNAI 2381, pp. 251–265, Springer.

Lincoln A. Wallen (1990). Automated Proof Search in Non-Classical Logics. MIT Press. Cf.,

   however, http://ags.uni-sb.de/~cp/p/wallen/all.txt for some obsolete aspects of

this fascinating book.

Christoph Walther (1992). Computing Induction Axioms. 3^{rd} LPAR 1992, LNAI 624, pp. 381–392, Springer.

Christoph Walther (1994). Mathematical Induction. In: Gabbay &al. (1993 ff.), Vol. 2, pp. 127–228.

Claus-Peter Wirth (1997). Positive/Negative-Conditional Equations: A Constructor-Based Framework for Specification and Inductive Theorem Proving. Ph.D. thesis, Verlag Dr. Kovač, Hamburg.

Claus-Peter Wirth (1998). Full First-Order Sequent and Tableau Calculi With Preservation of Solutions and the Liberalized δ-Rule but Without Skolemization. Report 698/1998, FB Informatik, Univ. Dortmund. Short version in: Gernot Salzer, Ricardo Caferra (eds.). Proc. 2^{nd} Int. Workshop on First-Order Theorem Proving (FTP’98), pp. 244–255, Tech. Univ. Vienna, 1998. Short version also in: Caferra & Salzer (2000), pp. 283–298. http:

//ags.uni-sb.de/~cp/p/ftp98/welcome.html (Aug.05,2001).

Claus-Peter Wirth (1999). Full First-Order Free Variable Sequents and Tableaus in Implicit Induction. 8^{th} TABLEAU 1999, LNAI 1617, pp. 293–307, Springer. http://ags.

uni-sb.de/~cp/p/tab99/welcome.html (Aug.05,2001).

Claus-Peter Wirth (2002). A New Indefinite Semantics for Hilbert’s epsilon. 11^{th} TABLEAU 2002, LNAI 2381, pp. 298–314, Springer. http://ags.uni-sb.

de/~cp/p/epsi/welcome.html (Feb.04,2002).

Claus-Peter Wirth (2003). History and Future of Implicit and Inductionless Induction: Beware the old jade and the zombie!. Festschrift to Jörg H. Siekmann’s 60^{th} Birthday,

LNAI , Springer. http://ags.uni-sb.de/~cp/p/zombie/welcome.html (Dec.02,
2002).

Claus-Peter Wirth, Klaus Becker (1995). Abstract Notions and Inference Systems for Proofs by Mathematical Induction. 4^{th} CTRS 1994, LNCS 968, pp. 353–373, Springer. http:

//ags.uni-sb.de/~cp/p/ctrs94/welcome.html (Aug.05,2001).

Claus-Peter Wirth, Bernhard Gramlich (1994a). A Constructor-Based Approach for Positive/Negative-Conditional Equational Specifications. J. Symbolic Computation 17,

pp. 51–90, Academic Press. http://ags.uni-sb.de/~cp/p/jsc94/welcome.html
(Aug.05,2001).

Claus-Peter Wirth, Bernhard Gramlich (1994b). On Notions of Inductive Validity for First-Order Equational Clauses. 12^{th} CADE 1994, LNAI 814, pp. 162–176, Springer. http:

//ags.uni-sb.de/~cp/p/cade94/welcome.html (Aug.05,2001).

Ludwig Wittgenstein (1939). Lectures on the Foundations of Mathematics, Cambridge. Cora Diamond (ed.), from the notes of R. G. Bosanquet, Norman Malcolm, Rush Rhees, and Yorick Smythies, Univ. of Chicago Press, 1989.