Abstract
Coinductive reasoning about infinitary data structures has many applications in computer science. Nonetheless developing natural proof systems (especially ones amenable to automation) for reasoning about coinductive data remains a challenge. This paper presents a minimal, generic formal framework that uniformly captures applicable (i.e. finitary) forms of inductive and coinductive reasoning in an intuitive manner. The logic extends transitive closure logic, a general purpose logic for inductive reasoning based on the transitive closure operator, with a dual ‘co-closure’ operator that similarly captures applicable coinductive reasoning in a natural, effective manner. We develop a sound and complete non-well-founded proof system for the extended logic, whose cyclic subsystem provides the basis for an effective system for automated inductive and coinductive reasoning. To demonstrate the adequacy of the framework we show that it captures the canonical coinductive data type: streams.
Introduction
The principle of induction is used widely in computer science for reasoning about data types such as numbers or lists. The lesser-known principle of coinduction is used for reasoning about coinductive data types, which are data structures containing non-well-founded elements, e.g. infinite streams or trees [7, 25, 27, 32, 35, 37, 44, 46, 48]. A duality between the two principles is observed when formulating them within an algebraic, or categorical, framework [49]. However, such formulation does not account well for the way these principles are commonly used in deduction, where there is a mismatch in how they are usually applied.
Due to this tension between the abstract theory of coalgebras and its implementation in formal frameworks [41], coinductive reasoning is generally not fully and naturally incorporated into major proof assistants (e.g. Coq [7], Nuprl [20], Agda [8], Idris [9] and Dafny [36]). Even in notable exceptions such as [33, 36, 38, 44] the combination of induction and coinduction is not intuitively accounted for. The standard approach in such formalisations is to define inductive data with constructors and coinductive data with destructors, or observations [1]. In this paper we propose an alternative approach to formally integrating induction and coinduction that clearly reveals the duality between the two principles. Our approach has the advantage that the same signature is shared for both inductive and coinductive data, making certain aspects of the relationship between the two principles more apparent. To achieve this, we extend and combine two powerful frameworks: semantically we follow the approach of transitive closure logic, a generic logic for expressing inductive structures [3, 14–16, 31, 39, 51]; for deduction, we adopt non-well-founded proof theory [2, 5, 10–12, 17–19, 23, 24, 26, 50, 55]. This combination captures the intuitive dynamics of inductive and coinductive reasoning, reflecting how these principles are understood and applied in practice.
Transitive closure (
) logic minimally extends first-order logic by adding a single, intuitive notion: an operator, 
, for forming the (reflexive) transitive closures of an arbitrary formula (more precisely, of the binary relation induced by the formula). This operator alone is sufficient for capturing all finitary induction schemes within a single, unified language (unlike other systems that are a priori parametrized by a set of inductive definitions [12, 40, 42, 58]). Transitive closures arise as least fixed points of certain composition operators. In this paper we extend 
logic with the semantically dual notion: an operator, 
, for forming greatest fixed points of these same composition operators.1 We call these transitive co-closures, and show that they are equally as intuitive. Just as transitive closure captures induction, we show that transitive co-closure facilitates coinductive definitions and reasoning.
Non-well-founded proof theory formalises the infinite-descent style of induction. It enables a separation between local steps of deductive inference and global well-foundedness arguments (i.e. induction), which are encoded in traces of formulas through possibly infinite derivations. A major benefit of these systems is that inductive invariants do not need to be explicit. On the other hand, existing approaches for combining induction and coinduction rely on making (co)invariants explicit within proofs [4, 30, 59]. In previous work, a non-well-founded proof system for 
logic was developed [17, 18]. In this paper, we show that the meaning of the transitive co-closure operator can be captured proof-theoretically using inference rules having the exact same structure, with soundness now requiring infinite ascent (i.e. showing productivity) rather than descent. What obtains is a proof system in which induction and coinduction are smoothly integrated, and which very clearly highlights their similarities. Their differences are also thrown into relief, consisting in the way formulas are traced in a proof derivation. Specifically, traces of 
formulas show that certain infinite paths cannot exist (induction is well-founded), while traces of 
formulas show that other infinite paths must exist (coinduction is productive).
To demonstrate that our system naturally captures patterns of mixed inductive/coinductive reasoning, we formalise one of the most well-known examples of a coinductive data type: streams. In particular, we consider two illustrative examples: transitivity of the lexicographic ordering on streams; and transitivity of the substream relation. Both are known to be hard to prove. Our system handles these without recourse to general fixpoint operators or algebraic structures.
The transitive (co-)closure framework is contained in the first-order mu-calculus [43], but offers several advantages. The concept of transitive (co-)closure is intuitively simpler than that of general fixed-point operators, and does not require any syntactic restrictions to ensure monotonicity. Our framework is also related, but complementary to logic programming with coinductive interpretations [52, 53] and its coalgebraic semantics [34]. Logic programs, built from Horn clauses, have a fixed intended domain (viz. Herbrand universes), and the semantics of mixing inductive and coinductive interpretations is subtle. Our framework, on the other hand, uses a general syntax that can freely mix closures and co-closures, and its semantics considers all first-order models. Furthermore, the notion of proof in our setting is more general than the (semantic) notion of proof in logic programming, in which, for instance, there is no analogous concept of global trace condition.
Outline. Section 2 presents the syntax and semantics of the extended logic, 
. Section 3 describes how streams and their properties can be expressed in 
. Section 4 presents non-well-founded proof systems for 
, showing soundness and completeness. Section 5 then illustrates how the examples of Sect. 3 are formalised in this system. Section 6 concludes with directions for future work.
Logic: Syntax and Semantics
Transitive closure (
) logic [3, 15] extends the language of first-order logic with a predicate-forming operator, 
, for denoting the (reflexive) transitive closures of (binary) relations. In this section we extend 
logic into what we call transitive (co-)closure (
) logic, by adding a single transitive co-closure operator, 
. Roughly speaking, whilst the 
operator denotes the set of all pairs that are related via a finite chain (or path), the 
operator gives the set of all pairs that are ‘related’ via a possibly infinite chain. In Sect. 3 we show that this allows capturing coinductive definitions and reasoning.
For simplicity of presentation we assume (as is standard practice) a designated equality symbol. Note also that we use the reflexive transitive closure; however the reflexive and non-reflexive forms are equivalent in the presence of equality.
Definition 1
(
Formulas). Let s, t and P range over the terms and predicate symbols, respectively, of a first-order signature 
. The language 
(of formulas over 
) is given by the following grammar:
 |
where the variables x and y in the formulas 
and 
must be distinct and are bound in the subformula 
, referred to as the body.
The semantics of formulas is an extension of the standard semantics of first-order logic. We write 
and 
to denote a first-order structure over a (non-empty) domain 
and a valuation of variables in 
, respectively. We denote by 
the valuation that maps 
to 
for each i and behaves as 
otherwise. We write 
for the result of simultaneously substituting each 
for the free occurrences of 
in 
. We use 
to denote a non-empty sequence of elements 
; and 
for a (countably) infinite sequence of elements 
. We use 
to denote syntactic equality.
Definition 2 (Semantics)
Let 
be a structure for 
, and 
a valuation in 
. The satisfaction relation 
extends the standard satisfaction relation of classical first-order logic with the following clauses:
 |
Intuitively, the formula 
asserts that there is a (possibly empty) finite 
-path from s to t. The formula 
asserts that either there is a (possibly empty) finite 
-path from s to t, or an infinite 
-path starting at s.
We can connect these closure operators to the general theory of fixed points, with 
and 
denoting, respectively, the least and greatest fixed points of a certain operator on binary relations.
Definition 3 (Composition Operator)
Given a binary relation X, we define an operator 
on binary relations, which post-composes its input with X, by: 
.
Notice that the set of all binary relations (over some given domain) forms a complete lattice under the subset ordering 
. Moreover, composition operators 
are monotone w.r.t. 
. Thus we have the following standard results, from the Knaster–Tarski theorem. For any binary relation X, the least fixed point 
of 
is given by 
, i.e. the intersection of all its prefixed points. Dually, the greatest fixed point 
of 
is given by the union of all its postfixed points, i.e. 
. Via the usual notion of formula definability, 
and 
are easily seen to be fixed point operators. For a model 
and valuation 
, denote the binary relation defined by a formula 
with respect to x and y by 
.
Proposition 1
The following hold.
-
(i)
iff 
or 
. -
(ii)
iff 
or 
.
Note that labelling the co-closure ‘transitive’ is justified since, for any model 
, valuation 
, and formula 
, the relation 
is indeed transitive.
The 
operator enjoys dualisations of properties governing the transitive closure operator (see, e.g., [16, Proposition 3]) that are either symmetrical, or involve the first component. This is because the semantics of the 
has an embedded asymmetry between the arguments. Reasoning about closures is based on decomposition into one step and the remaining path. For 
, this decomposition can be done in both directions, but for 
it can only be done in one direction.
Proposition 2
The following formulas, connecting the two operators, are valid.
-
i)
-
ii)
-
iii)
-
iv)
-
v)
Note that the converse of these properties do not hold in general, thus they do not provide characterisations of one operator in terms of the other. A counter-example for the converses of (ii) and (iii) can be obtained by taking 
to be 
. Then, for any domain D, the formulas 
, 
, and 
all denote the full binary relation 
, while 
denotes the identity relation on D.
Streams in 
Logic
This section demonstrates the adequacy of 
logic for formalising and reasoning about coinductive data types. As claimed by Rutten: “streams are the best known example of a final coalgebra and offer a perfect playground for the use of coinduction, both for definitions and for proofs.” [47]. Hence, in this section and Sect. 5 we illustrate that 
logic naturally captures the stream data type (see, e.g., [29, 48]).
The Stream Datatype
We formalise streams as infinite lists, using a signature consisting of the standard list constructors: the constant 
and the (infix) binary function symbol ‘
’, traditionally referred to as ‘cons’. These are axiomatized by:
Note that for simplicity of presentation we have not specified that the elements of possibly infinite lists should be any particular sort (e.g. numbers). Thus, the theory of streams we formulate here is generic in this respect. To refer specifically to streams over a particular domain, we could use a multisorted signature containing a 
sort, in addition to the sort 
of possibly infinite lists, with 
a constant of type 
and 
a function of type 
. Nonetheless, we do use the following conventions for formalising streams in this section and in Sect. 5. For variables and terms ranging over 
we use 
and 
, respectively; and for variables and terms ranging over possibly infinite lists we use 
and 
, respectively.
The (graphs of) the standard head (
) and tail (
) functions are definable2 by 
and 
. Finite and possibly infinite lists can be defined by using the transitive closure and co-closure operators, respectively, as follows.
 |
Roughly speaking, these formulas assert that we can perform some number of successive tail decompositions of the term 
. For the 
formula, this decomposition must reach the second component, 
, in a finite number of steps. For the 
formula, on the other hand, the decomposition is not required to reach 
but, in case it does not, must be able to continue indefinitely.
To define the notion of a necessarily infinite list (i.e. a stream), we specify in the body that, at each step, the decomposition of the stream cannot actually reach 
(abbreviating 
by 
). Moreover, since we are using reflexive forms of the operators we must also stipulate that 
itself is not a stream.
 |
This technique—of specifying that a single step cannot reach 
and then taking 
to be the terminating case in the 
formula—is a general method we will use in order to restrict attention to the infinite portion in the induced semantics of an 
formula. To this end, we define the following notation.
 |
Relations and Operations on Streams
We next show that 
also naturally captures properties of streams. Using the 
operator we can (inductively) define the extension relation 
on possibly infinite lists as follows:
 |
This asserts that 
extends 
, i.e. that 
is obtained from 
by prepending some finite sequence of elements to 
. Equivalently, 
is obtained by some finite number of tail decompositions from 
: that is, 
is a suffix of 
.
We next formalise some standard predicates.
 |
defines the possibly infinite lists that contain the element denoted by e; 
defines the constant stream consisting of the element denoted by e; and 
defines streams that are eventually constant.
We next consider how (functional) relations on streams can be formalised in 
, using some illustrative examples. To capture these we need to use ordered pairs. For this, we use the notation 
for 
,3 then abbreviate 
by 
(and similarly for 
formulas), and also write 
to stand for 
.
Append and Periodicity. With ordered pairs, we can inductively define (the graph of) the function that appends a possibly infinite list to a finite list.
 |
We remark that the formulas 
and 
are equivalent. To define this as a function requires also proofs that the defined relation is total and functional. However, this is generally straightforward when the body formula is deterministic, as is the case in all the examples we present here. Other standard operations on streams, such as element-wise operations, are also definable in 
as (functional) relations. For example, assuming a unary function 
, we can coinductively define its elementwise extension to streams 
as follows.
 |
As an example of mixing induction and coinduction, we can express a predicate coinductively defining the periodic streams using the append function.
 |
Lexicographic Ordering. The lexicographic order on streams extends pointwise an order on the underlying elements. Thus, we assume a binary relation symbol 
with the standard axiomatisation of a (non-strict) partial order.
 |
The lexicographic ordering relation 
is captured as follows, where we use 
as an abbreviation for 
.
 |
The semantics of the 
operator require an infinite sequence of pairs such that, until 
is reached, each two consecutive pairs are related by 
. This formula states that if the heads of the lists in the first pair are equal, the next pair of lists in the infinite sequence is their two tails, thus the lexicographic relation must also hold of them. Otherwise, if the head of the first is less than that of the second, nothing is required of the tails, i.e. they may be any streams.
Substreams. We consider one stream to be a substream of another if the latter contains every element of the former in the same order (although it may contain other elements too). Equivalently, the latter is obtained by inserting some (possibly infinite) number of finite sequences of elements in between those of the former. This description makes it clearer that defining this relation involves mixing (or, rather, nesting) induction and coinduction. We formalise the substream relation, 
using the inductive extension relation 
to capture the inserted finite sequences, wrapping it within a coinductive definition using the 
operator.
 |
On examination, one can observe that this relation is transitive. However, proving this is non-trivial and, unsurprisingly, involves applying both induction and coinduction. In Sect. 5, we give a proof of the transitivity of 
in 
. This relation was also considered at length in [6, §5.1.3] where it is formalised in terms of selectors, which form streams by picking out certain elements from other streams. The treatment in [6] requires some heavy (coalgebraic) metatheory. While our proof in Sect. 5 requires some (fairly obvious) lemmas, the basic structure of the (co)inductive reasoning required is made plain by the cycles in the proof. Furthermore, the 
presentation seems to enable a more intuitive understanding of the nature of the coinductive definitions and principles involved.
Proof Theory
We now present a non-well-founded proof system for 
, which extends (an equivalent of) the non-well-founded proof system considered in [17, 18] for transitive closure logic (i.e. the 
-fragment of 
).
A Non-well-Founded Proof System
In non-well-founded proof systems, e.g. [2, 5, 10–12, 23, 24, 50], proofs are allowed to be infinite, i.e. non-well-founded trees, but they are subject to the restriction that every infinite path in the proof admits some infinite progress, witnessed by tracing terms or formulas. The infinitary proof system for 
logic is defined as an extension of 
, the sequent calculus for classical first-order logic with equality and substitution [28, 56].4 Sequents are expressions of the form 
, for finite sets of formulas 
and 
. We abbreviate 
and 
by 
and 
, respectively, and write 
for the set of free variables of the formulas in 
. A sequent 
is valid if and only if the formula 
is.
Definition 4
(
). The proof system 
is obtained by adding to 
the proof rules given in Fig. 1.
Fig. 1.
Proof rules of 
Rules (6), and (8) are the unfolding rules for the two operators that represent the induction and coinduction principles in the system, respectively. The proof rules for both operators have exactly the same form, and so the reader may wonder what it is, then, that distinguishes the behaviour of the two operators. The difference proceeds from the way the decomposition of the corresponding formulas is traced in the non-well-founded proof system. For induction, 
formulas on the left-hand side of the sequents are traced through Rule (6); for coinduction, 
formulas on the right-hand side of sequents are traced through Rule (8).
Definition 5
(
Pre-proofs). An 
pre-proof is a rooted, possibly non-well-founded (i.e. infinite) derivation tree constructed using the 
proof rules. A path in a pre-proof is a possibly infinite sequence 
of sequents with 
the root of the proof, and 
a premise of 
for each 
.
We adopt the usual proof-theoretic notions of formula occurrence and sub-occurrence, and of ancestry between formulas [13]. A formula occurrence is called a proper formula if it is not a sub-occurrence of any formula.
Definition 6 ((Co-)Traces)
A trace (resp. co-trace) is a possibly infinite sequence 
of proper 
(resp. 
) formula occurrences in the left-hand (resp, right-hand) side of sequents in a pre-proof such that 
is an immediate ancestor of 
for each 
. If the trace (resp. co-trace) contains an infinite number of formula occurrences that are principal for instances of Rule (6) (resp. Rule (8)), then we say that it is infinitely progressing.
As usual in non-well-founded proof theory, we use the notion of (co-)trace to define a global trace condition, distinguishing certain ‘valid’ pre-proofs.
Definition 7
(
Proofs). An 
proof is a pre-proof in which every infinite path has a tail followed by an infinitely progressing (co-)trace.
In general, one cannot reason effectively about infinite proofs, as found in 
. In order to do so our attention has to be restricted to those proof trees which are finitely representable. That is, the regular infinite proof trees, containing only finitely many distinct subtrees. They can be specified as systems of recursive equations or, alternatively, as cyclic graphs [22]. One way of formalising such proof graphs is as standard proof trees containing open nodes (called buds), to each of which is assigned a syntactically equal internal node of the proof (called a companion). The restriction to cyclic proofs provides the basis for an effective system for automated inductive and coinductive reasoning. The system 
can naturally be restricted to a cyclic proof system for 
logic as follows.
Definition 8 (Cyclic Proofs)
The cyclic proof system 
for 
logic is the subsystem of 
comprising of all and only the finite and regular infinite proofs (i.e. proofs that can be represented as finite, possibly cyclic, graphs).5
It is decidable whether a cyclic pre-proof satisfies the global trace condition, using a construction involving an inclusion between Büchi automata [10, 54]. However since this requires complementing Büchi automata (a PSPACE procedure), 
is not a proof system in the Cook-Reckhow sense [21]. Notwithstanding, checking the trace condition for cyclic proofs found in practice is not prohibitive [45, 57].
Although 
is complete (cf. Theorem 2 below) 
is not, since arithmetic can be encoded in 
logic and the set of 
proofs is recursively enumerable.6 Nonetheless, 
is adequate for 
logic in the sense that it suffices for proving the standard properties of the operators, as in, e.g., Proposition 2.
Example 1
Figure 2 demonstrates an 
proof that the transitive closure is contained within the transitive co-closure. Notice that the proof has a single cycle, and thus a single infinite path. Following this path, there is both a trace (consisting of the highlighted 
formulas, on the left-hand side of sequents) which progresses on traversing Rule (6) (marked 
), and a co-trace (consisting of the highlighted 
forumlas, on the right-hand side of sequents), which progresses on traversing Rule (8) (marked 
). Thus, Fig. 2 can be seen both as a proof by induction and a proof by coinduction. It exemplifies how naturally such reasoning can be captured within 
.
Fig. 2.
Proof in 
of 
A salient feature of non-well-founded proof systems, including this one, is that (co)induction invariants need not be mentioned explicitly, but instead are encoded in the cycles of a proof. This facilitates the automation of such reasoning, as the invariants may be interactively constructed during a proof-search process.
Soundness
To show soundness, i.e. that all derived sequents are valid, we establish that the infinitely progressing (co-)traces in proofs preclude the existence of counter-models. By local soundness of the proof rules, any given counter-model for a sequent derived by a proof identifies an infinite path in the proof consisting of invalid sequents. However, the presence of a (co-)trace along this path entails a contradiction (and so conclude that no counter-models exist). From a trace, one may infer the existence of an infinitely descending chain of natural numbers. This relies on a notion of (well-founded) measure for 
formulas, viz. the measure of 
with respect to a given model 
and valuation 
—denoted by 
—is defined to be the minimum number of 
-steps needed to connect 
and 
in 
. Conversely, from a co-trace beginning with a formula 
one can construct an infinite sequence of 
-steps beginning at s, i.e. a witness that the counter-model does in fact satisfy 
.
The key property needed for soundness of the proof system is the following strong form of local soundness for the proof rules.
Proposition 3 (Trace Local Soundness)
Let 
be a model and 
a valuation that invalidate the conclusion of an instance of an 
inference rule; then there exists a valuation 
that invalidates some premise of the inference rule such that the following hold.
If
is a trace following the path from the conclusion to the invalid premise, then 
; moreover 
if the rule is an instance of (6) and 
is the principal formula.If
is a co-trace following the path from the conclusion to the invalid premise, with 
and 
, then: (a) 
if and only if 
, for all elements d and 
in 
; and (b) 
if 
is the principal formula of an instance of (8), and 
otherwise.
The global soundness of the proof system then follows.
Theorem 1
(Soundness of
). Sequents derivable in 
are valid.
Proof
Take a proof deriving 
. Suppose, for contradiction, that there is a model 
and valuation 
invalidating 
. Then by Proposition 3 there exists an infinite path of sequents 
in the proof and an infinite sequence of valuations 
such that 
and 
invalidate 
for each 
. Since the proof must satisfy the global trace condition, this infinite path has a tail 
followed by an infinitely progressing (co-)trace 
.
If
is a trace, Proposition 3 implies an infinitely descending chain of natural numbers: 
If
is a co-trace, with 
and 
, then Proposition 3 entails that there is an infinite sequence of terms 
with 
such that 
for each 
. That is, it follows from Definition 2 that 
.
In both cases we have a contradiction, so conclude that 
is valid. 
Since every 
proof is also an 
proof, soundness of 
is an immediate corollary.
Corollary 1
A sequent 
is valid if there is an 
proof deriving it.
Completeness
The completeness proof for 
is obtained by extending the completeness proof of the 
-fragment of 
found in [17, 18], which, in turn, follows a standard technique used in e.g. [12]. We next outline the core of the proof, full details can be found in the appendix.
Roughly speaking, for a given sequent 
one constructs a ‘search tree’ which corresponds to an exhaustive search strategy for a cut-free proof for the sequent. Search trees are, by construction, recursive and cut-free. In case the search tree is not an 
proof (and there are no open nodes) it must contain some untraceable infinite branch, i.e. one that does not satisfy the global trace condition. We then collect the formulas occurring along such an untraceable branch to construct a (possibly infinite) ‘sequent’, 
(called a limit sequent), and construct the Herbrand model 
of open terms quotiented by the equalities it contains. That is, taking 
to be the smallest congruence on terms such that 
whenever 
, the elements of 
are 
-equivalence classes and every k-ary relation symbol q is interpreted as 
(here [t] denotes the 
-equivalence class containing t). This model, together with the valuation 
defined by 
for all variables x, can be shown to invalidate the sequent 
. The completeness result therefore follows.
Theorem 2 (Completeness)
All valid sequents are derivable in 
.
Proof
Given any sequent S, if some search tree for S is not an 
proof then it has an untraceable branch, and the model 
and valuation 
constructed from the corresponding limit sequent invalidate S. Thus if S is valid, then the search tree is a recursive 
proof deriving S. 
We obtain admissibility of cut for the full infinitary system as the search tree, by construction, is cut-free. Since the construction of the search tree does not necessarily produce 
pre-proofs, we do not obtain a regular completeness result using this technique.
Corollary 2 (Cut admissibility)
Cut is admissible in 
.
Proving Properties of Streams
We now demonstrate how (co)inductive reasoning about streams and their properties is formalised in the cyclic fragment of the proof system presented above. For the sake of clarity, in the derivations below we elide detailed applications of the proof rules (including the axioms for list constructors), instead indicating the principal rules involved at each step. We also elide (using ‘
’) formulas in sequents that are not relevant to the local reasoning at that point.
Transitivity of Lexicographic Ordering. Fig. 3 outlines the main structure of an 
proof deriving the sequent 
, where x, y, and z are distinct variables. All other variables in Fig. 3 are freshly introduced. 
abbreviates the set 
(i.e. the result of unfolding the step case of the formula 
using 
and 
as the intermediate terms).
Fig. 3.
High-level structure of an 
proof of transitivity of 
.
The proof begins by unfolding the definitions of 
and 
, shown in Fig. 3b. The interesting part is the sub-proof shown in Fig. 3a, when each of the lists is not 
. Here, we perform case splits on the relationship between the head elements a, b, and c. For the case 
, i.e. the heads are equal, when unfolding the formula 
on the right-hand side, we instantiate the second components of the 
formula to be the tails of the streams, 
and 
. In the left-hand premise we must show 
, which can be done by matching with formulas already present in the sequent. The right-hand premise must derive 
, i.e. the tails are lexicographically related. This is where we apply the coinduction principle, by renaming the variables and forming a cycle in the proof back to the root. This does indeed produce a proof, since we can form a co-trace by following the formulas 
on the right-hand side of sequents along this cycle. This co-trace progresses as it traverses the instance of Rule (8) each time around the cycle (marked 
).
Transitivity of the Substream Relation. Fig. 4 outlines the structure of an 
proof of the sequent 
, for distinct variables x, y, and z. As above, other variables are freshly introduced, and we use 
to denote the set 
(i.e. the result of unfolding the step-case of the formula 
using 
and 
as the intermediate terms).
Fig. 4.
High-level structure of an 
proof of transitivity of 
.
The reflexive cases are handled similarly to the previous example. Again, the work is in proving the step cases. After unfolding both 
and 
, we obtain 
and 
, as part of 
and 
, respectively. We also have (for fresh variables a and b) that: (i) 
; (ii) 
(
is the immediate tail of y); (iii) 
(
is some tail of y); and (iv) 
(
is the immediate tail of z). Ultimately, we are looking to obtain 
and 
(for some tail 
), so that we can unfold the formula 
on the right-hand side to obtain 
and thus be able to form a (coinductive) cycle.
The application of Rule (6) shown in Fig. 4 performs a case-split on the formula 
. The left-hand branch handles the case that 
is, in fact, the immediate tail of y; thus 
and 
, and so we can substitute b and 
in place of a and 
, respectively, and take 
to be 
. In the right-hand branch, corresponding to the case that 
is not the immediate tail of y, we obtain 
from the case-split. Then we apply two lemmas; namely: (i) if 
and 
, then there is some 
such that 
and 
; and (ii) if 
and 
, then 
(a form of transitivity for the extends relation). For space reasons we do not show the structure of the sub-proofs deriving these, however, as marked in the figure, we note that they are both carried out by induction on the 
relation.
In summary the proof contains two (inductive) sub-proofs, each validated by infinitely progressing inductive traces, and also two overlapping outer cycles. Infinite paths following these outer cycles have co-traces consisting of the highlighted formulas in Fig. 4, which progress infinitely often as they traverse the instances of Rule (8) (marked 
).
Conclusion and Future Work
This paper presented a new framework that extends the well-known, powerful transitive closure logic with a dual transitive co-closure operator. An infinitary proof system for the logic was developed and shown to be sound and complete. Its cyclic subsystem was shown to be powerful enough for reasoning over streams, and in particular automating combinations of inductive and coinductive arguments.
Much remains to be done to fully develop the new logic and its proof theory, and to study its implications. Although we have shown that our framework captures many interesting properties of the canonical coinductive data type, streams, a primary task for future research is to formally characterise its ability to capture finitary coinductive definitions in general. In particular, it seems plausible that 
is a good candidate setting in which to look for characterisations that complement and bridge existing results for coinductive data in automata theory and coalgebra. That is, it may potentially mirror (and also perhaps even replace) the role that monadic second order logic plays for (
-)regular languages.
Another important research task is to further develop the structural proof theory of the systems 
and 
in order to describe the natural process and dynamics of inductive and coinductive reasoning. This includes properties such as cut elimination, admissibility of rules, regular forms for proofs, focussing, and proof search strategies. For example, syntactic cut elimination for non-well-founded systems has been studied extensively in the context of linear logic [5, 26]. The basic approach would seem to work for 
, however, one expects that cut-elimination will not preserve regularity.
Through the proofs-as-programs paradigm (a.k.a. the Curry-Howard correspondence) our proof-theoretic synthesis of induction and coinduction has a number of applications that invite further investigation. Namely, our framework provides a general setting for verifying program correctness against specifications of coinductive (safety) and inductive (liveness) properties. Implementing proof-search procedures can lead to automation, as well as correct-by-construction synthesis of programs operating on (co)inductive data. Finally, grounding proof assistants in our framework will provide a robust, proof-theoretic basis for mechanistic coinductive reasoning.
Acknowledgements
We are grateful to Alexandra Silva for valuable coinductive reasoning examples, and Juriaan Rot for helpful comments and pointers. We also extend thanks to the anonymous reviewers for their questions and comments.
Footnotes
The notation 
comes from the categorical notion of the opposite (dual) category.
Although 
and 
could have been defined as terms using Russell’s
operator, we opted for the above definition for simplicity of the proof theory.
Here we use the fact that ‘
’ behaves as a pairing function. In other languages one might need to add a function 
, and (axiomatically) restrict the semantics to structures that interpret it as a pairing function. Note that incorporating pairs is equivalent to taking 2n-ary operators 
and 
for every 
.
Unlike in the original system, here we take 
to include the substitution rule.
The 
-fragment of 
was shown complete for a Henkin-style semantics [17].
Contributor Information
Nicolas Peltier, Email: nicolas.peltier@univ-grenoble-alpes.fr.
Viorica Sofronie-Stokkermans, Email: sofronie@uni-koblenz.de.
Liron Cohen, Email: cliron@cs.bgu.ac.il.
Reuben N. S. Rowe, Email: reuben.rowe@rhul.ac.uk
References
- 1.Abel A, Pientka B. Well-founded recursion with copatterns and sized types. J. Funct. Program. 2016;26:e2. doi: 10.1017/S0956796816000022. [DOI] [Google Scholar]
- 2.Afshari, B., Leigh, G.E.: Cut-free completeness for modal mu-calculus. In: Proceedings of the 32nd Annual ACM/IEEE Symposium on Logic in Computer Science (LICS 2017), Reykjavik, Iceland, 20–23 June 2017, pp. 1–12 (2017). 10.1109/LICS.2017.8005088
- 3.Avron A. Transitive closure and the mechanization of mathematics. In: Kamareddine FD, editor. Thirty Five Years of Automating Mathematics, Applied Logic Series. Netherlands: Springer; 2003. pp. 149–171. [Google Scholar]
- 4.Baelde D. Least and greatest fixed points in linear logic. ACM Trans. Comput. Log. 2012;13(1):2:1–2:44. doi: 10.1145/2071368.2071370. [DOI] [Google Scholar]
- 5.Baelde, D., Doumane, A., Saurin, A.: Infinitary proof theory: the multiplicative additive case. In: Proceedings of the 25th EACSL Annual Conference on Computer Science Logic (CSL 2016), 29 August–1 September 2016, Marseille, France, pp. 42:1–42:17 (2016). 10.4230/LIPIcs.CSL.2016.42
- 6.Basold, H.: Mixed Inductive-Coinductive Reasoning Types, Programs and Logic. Ph.D. thesis, Radboud University (2018). https://hdl.handle.net/2066/190323
- 7.Bertot Y, Casteran P. Interactive Theorem Proving and Program Development. Heidelberg: Springer; 2004. [Google Scholar]
- 8.Bove A, Dybjer P, Norell U. A brief overview of Agda – a functional language with dependent types. In: Berghofer S, Nipkow T, Urban C, Wenzel M, editors. Theorem Proving in Higher Order Logics; Heidelberg: Springer; 2009. pp. 73–78. [Google Scholar]
- 9.Brady E. Idris, a general-purpose dependently typed programming language: design and implementation. J. Funct. Program. 2013;23:552–593. doi: 10.1017/S095679681300018X. [DOI] [Google Scholar]
- 10.Brotherston J. Formalised inductive reasoning in the logic of bunched implications. In: Nielson HR, Filé G, editors. Static Analysis; Heidelberg: Springer; 2007. pp. 87–103. [Google Scholar]
- 11.Brotherston, J., Bornat, R., Calcagno, C.: Cyclic proofs of program termination in separation logic. In: Proceedings of the 35th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL 2008), pp. 101–112 (2008). 10.1145/1328438.1328453
- 12.Brotherston J, Simpson A. Sequent calculi for induction and infinite descent. J. Log. Comput. 2010;21(6):1177–1216. doi: 10.1093/logcom/exq052. [DOI] [Google Scholar]
- 13.Buss, S.R.: Handbook of proof theory. In: Studies in Logic and the Foundations of Mathematics. Elsevier Science (1998)
- 14.Cohen L. Completeness for ancestral logic via a computationally-meaningful semantics. In: Schmidt RA, Nalon C, editors. Automated Reasoning with Analytic Tableaux and Related Methods; Cham: Springer; 2017. pp. 247–260. [Google Scholar]
- 15.Cohen L, Avron A. Ancestral logic: a proof theoretical study. In: Kohlenbach U, Barceló P, de Queiroz R, editors. Logic, Language, Information, and Computation; Heidelberg: Springer; 2014. pp. 137–151. [Google Scholar]
- 16.Cohen, L., Avron, A.: The middle ground-ancestral logic. Synthese, 1–23 (2015). 10.1007/s11229-015-0784-3
- 17.Cohen, L., Rowe, R.N.S.: Uniform inductive reasoning in transitive closure logic via infinite descent. In: Proceedings of the 27th EACSL Annual Conference on Computer Science Logic (CSL 2018), 4–7 September 2018, Birmingham, UK, pp. 16:1–16:17 (2018). 10.4230/LIPIcs.CSL.2018.16
- 18.Cohen, L., Rowe, R.N.S.: Non-well-founded proof theory of transitive closure logic. Trans. Comput. Logic (2020, to appear). https://arxiv.org/pdf/1802.00756.pdf
- 19.Cohen L, Rowe RNS, Zohar Y. Towards automated reasoning in Herbrand structures. J. Log. Comput. 2019;29(5):693–721. doi: 10.1093/logcom/exz011. [DOI] [Google Scholar]
- 20.Constable RL, et al. Implementing Mathematics with the Nuprl Proof Development System. Upper Saddle River: Prentice-Hall Inc; 1986. [Google Scholar]
- 21.Cook SA, Reckhow RA. The relative efficiency of propositional proof systems. J. Symbolic Log. 1979;44(1):36–50. doi: 10.2307/2273702. [DOI] [Google Scholar]
- 22.Courcelle B. Fundamental properties of infinite trees. Theor. Comput. Sci. 1983;25:95–169. doi: 10.1016/0304-3975(83)90059-2. [DOI] [Google Scholar]
- 23.Das, A., Pous, D.: Non-Wellfounded Proof Theory for (Kleene+Action)(Algebras+Lattices). In: Proceedings of the 27th EACSL Annual Conference on Computer Science Logic (CSL 2018), pp. 19:1–19:18 (2018). 10.4230/LIPIcs.CSL.2018.19
-
24.Doumane, A.: Constructive completeness for the linear-time
-calculus. In: Proceedings of the 32nd Annual ACM/IEEE Symposium on Logic in Computer Science (LICS 2017), pp. 1–12 (2017). 10.1109/LICS.2017.8005075
- 25.Endrullis, J., Hansen, H., Hendriks, D., Polonsky, A., Silva, A.: A coinductive framework for infinitary rewriting and equational reasoning. In: 26th International Conference on Rewriting Techniques and Applications (RTA 2015), vol. 36, pp. 143–159 (2015). 10.4230/LIPIcs.RTA.2015.143
- 26.Fortier, J., Santocanale, L.: Cuts for circular proofs: semantics and cut-elimination. In: Rocca, S.R.D. (ed.) Computer Science Logic 2013 (CSL 2013). Leibniz International Proceedings in Informatics (LIPIcs), vol. 23, pp. 248–262. Dagstuhl, Germany (2013). 10.4230/LIPIcs.CSL.2013.248
- 27.Gapeyev V, Levin MY, Pierce BC. Recursive subtyping revealed. J. Funct. Program. 2002;12(6):511–548. doi: 10.1017/S0956796802004318. [DOI] [Google Scholar]
- 28.Gentzen G. Untersuchungen über das Logische Schließen. I. Mathematische Zeitschrift. 1935;39(1):176–210. doi: 10.1007/BF01201353. [DOI] [Google Scholar]
- 29.Hansen, H.H., Kupke, C., Rutten, J.: Stream differential equations: specification formats and solution methods. In: Logical Methods in Computer Science, vol. 13(1), February 2017. 10.23638/LMCS-13(1:3)2017
- 30.Heath Q, Miller D. A proof theory for model checking. J. Autom. Reasoning. 2019;63(4):857–885. doi: 10.1007/s10817-018-9475-3. [DOI] [Google Scholar]
- 31.Immerman N. Languages that capture complexity classes. SIAM J. Comput. 1987;16(4):760–778. doi: 10.1137/0216051. [DOI] [Google Scholar]
- 32.Jacobs B, Rutten J. A tutorial on (co) algebras and (co) induction. Bull. Eur. Assoc. Theor. Comput. Sci. 1997;62:222–259. [Google Scholar]
- 33.Jeannin JB, Kozen D, Silva A. CoCaml: functional programming with regular coinductive types. Fundamenta Informaticae. 2017;150:347–377. doi: 10.3233/FI-2017-1473. [DOI] [Google Scholar]
- 34.Komendantskaya E, Power J. Coalgebraic semantics for derivations in logic programming. In: Corradini A, Klin B, Cîrstea C, editors. Algebra and Coalgebra in Computer Science; Heidelberg: Springer; 2011. pp. 268–282. [Google Scholar]
- 35.Kozen D, Silva A. Practical coinduction. Math. Struct. Comput. Sci. 2017;27(7):1132–1152. doi: 10.1017/S0960129515000493. [DOI] [Google Scholar]
- 36.Leino, R., Moskal, M.: Co-induction simply: automatic co-inductive proofs in a program verifier. Technical report MSR-TR-2013-49, Microsoft Research, July 2013. https://www.microsoft.com/en-us/research/publication/co-induction-simply-automatic-co-inductive-proofs-in-a-program-verifier/
- 37.Leroy X, Grall H. Coinductive big-step operational semantics. Inf. Comput. 2009;207(2):284–304. doi: 10.1016/j.ic.2007.12.004. [DOI] [Google Scholar]
- 38.Lucanu D, Roşu G. CIRC: a circular coinductive prover. In: Mossakowski T, Montanari U, Haveraaen M, editors. Algebra and Coalgebra in Computer Science; Heidelberg: Springer; 2007. pp. 372–378. [Google Scholar]
- 39.Martin RM. A homogeneous system for formal logic. J. Symbolic Log. 1943;8(1):1–23. doi: 10.2307/2267976. [DOI] [Google Scholar]
- 40.Martin-Löf, P.: Hauptsatz for the intuitionistic theory of iterated inductive definitions. In: Fenstad, J.E. (ed.) Proceedings of the Second Scandinavian Logic Symposium, Studies in Logic and the Foundations of Mathematics, vol. 63, pp. 179–216. Elsevier (1971). 10.1016/S0049-237X(08)70847-4
- 41.McBride C. Let’s see how things unfold: reconciling the infinite with the intensional (extended abstract). In: Kurz A, Lenisa M, Tarlecki A, editors. Algebra and Coalgebra in Computer Science; Heidelberg: Springer; 2009. pp. 113–126. [Google Scholar]
- 42.McDowell R, Miller D. Cut-elimination for a logic with definitions and induction. Theor. Comput. Sci. 2000;232(1–2):91–119. doi: 10.1016/S0304-3975(99)00171-1. [DOI] [Google Scholar]
- 43.Park DMR. Finiteness is mu-ineffable. Theor. Comput. Sci. 1976;3(2):173–181. doi: 10.1016/0304-3975(76)90022-0. [DOI] [Google Scholar]
- 44.Roşu G, Lucanu D. Circular coinduction: a proof theoretical foundation. In: Kurz A, Lenisa M, Tarlecki A, editors. Algebra and Coalgebra in Computer Science; Heidelberg: Springer; 2009. pp. 127–144. [Google Scholar]
- 45.Rowe, R.N.S., Brotherston, J.: Automatic cyclic termination proofs for recursive procedures in separation logic. In: Proceedings of the 6th ACM SIGPLAN Conference on Certified Programs and Proofs (CPP 2017), Paris, France, 16–17 January 2017, pp. 53–65 (2017). 10.1145/3018610.3018623
- 46.Rutten J. Universal coalgebra: a theory of systems. Theor. Comput. Sci. 2000;249(1):3–80. doi: 10.1016/S0304-3975(00)00056-6. [DOI] [Google Scholar]
- 47.Rutten, J.: On Streams and Coinduction (2002). https://homepages.cwi.nl/~janr/papers/files-of-papers/CRM.pdf
- 48.Rutten J. The Method of Coalgebra: Exercises in Coinduction. Amsterdam: CWI; 2019. [Google Scholar]
- 49.Sangiorgi D, Rutten J. Advanced Topics in Bisimulation and Coinduction. 1. Cambridge: Cambridge University Press; 2011. [Google Scholar]
- 50.Santocanale L. A calculus of circular proofs and its categorical semantics. In: Nielsen M, Engberg U, editors. Foundations of Software Science and Computation Structures; Heidelberg: Springer; 2002. pp. 357–371. [Google Scholar]
- 51.Shapiro S. Foundations Without Foundationalism : A Case for Second-order Logic. Oxford Logic Guides: Clarendon Press; 1991. [Google Scholar]
- 52.Simon L, Bansal A, Mallya A, Gupta G. Co-logic programming: extending logic programming with coinduction. In: Arge L, Cachin C, Jurdziński T, Tarlecki A, editors. Automata, Languages and Programming; Heidelberg: Springer; 2007. pp. 472–483. [Google Scholar]
- 53.Simon L, Mallya A, Bansal A, Gupta G. Coinductive logic programming. In: Etalle S, Truszczyński M, editors. Logic Programming; Heidelberg: Springer; 2006. pp. 330–345. [Google Scholar]
- 54.Simpson A. Cyclic arithmetic is equivalent to peano arithmetic. In: Esparza J, Murawski AS, editors. Foundations of Software Science and Computation Structures; Heidelberg: Springer; 2017. pp. 283–300. [Google Scholar]
-
55.Sprenger C, Dam M. On the structure of inductive reasoning: circular and tree-shaped proofs in the
calculus. In: Gordon AD, editor. Foundations of Software Science and Computation Structures; Heidelberg: Springer; 2003. pp. 425–440. [Google Scholar] - 56.Takeuti G. Proof Theory. Dover Books on Mathematics. New York: Dover Publications, Incorporated; 2013. [Google Scholar]
- 57.Tellez G, Brotherston J. Automatically verifying temporal properties of pointer programs with cyclic proof. In: de Moura L, editor. Automated Deduction – CADE 26; Cham: Springer; 2017. pp. 491–508. [Google Scholar]
- 58.Tiu, A.: A Logical Framework For Reasoning About Logical Specifications. Ph.D. thesis, Penn. State University (2004)
- 59.Tiu A, Momigliano A. Cut elimination for a logic with induction and co-induction. J. Appl. Log. 2012;10(4):330–367. doi: 10.1016/j.jal.2012.07.007. [DOI] [Google Scholar]