thesis.tex

% demo.tex
%
% Enjoy, evolve, and share!
%
% Compile it as follows:
%   latexmk
%
% Check file `dithesis.cls' for other configuration options.
%
\documentclass[inscr,ack,preface]{dithesis}

%\usepackage{graphicx}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%% User-specific package inclusions %%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\usepackage{listings}
\lstset{%
  basicstyle=\ttfamily\footnotesize,
  breaklines=true,
}

\usepackage{tikz}
\usepackage{float}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage{hyperref}
\usepackage{enumerate}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{amsmath}
\hypersetup{
    unicode=true,                     % non-Latin characters in bookmarks
    pdffitwindow=true,                % page fit to window when opened
    pdfnewwindow=true,                % links in new window
    pdfkeywords={},                   % list of keywords
    colorlinks=true,                  % false: boxed links; true: colored links
    linkcolor=black,                  % color of internal links
    citecolor=black,                  % color of links to bibliography
    filecolor=black,                  % color of file links
    urlcolor=black,                   % color of external links
    pdftitle={Implementation of Constructive Negation in Higher-Order Logic Programming},
    pdfauthor={Ergys Dona},           % author
    pdfsubject={Logic Programming}    % subject of the document
}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%% User-specific package inclusions %%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newtheorem{theorem}{Theorem}[section]
\newtheorem{corollary}{Corollary}[theorem]
\newtheorem{lemma}[theorem]{Lemma}
\theoremstyle{definition}
\newtheorem{definition}{Definition}[]
\newtheorem{example}{Example}[chapter]

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%% User-specific configuration %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% \setcounter{tocdepth}{1}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%% User-specific configuration %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\h}{$\mathcal{H}$}
\newcommand{\hcn}{$\mathcal{H}_\mathsf{cn}$}
\newcommand{\msf}[1]{$\mathsf{#1}$}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%% Required Metadata %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% First name, last name
%
\authorFirstGr{Ergys}
\authorFirstAbrGr{E.} % abbreviation of first name
\authorMiddleGr{A.}   % abbreviation of father's first name
\authorLastGr{Dona}
\authorFirstEn{Ergys}
\authorFirstAbrEn{E.} % abbreviation of first name
\authorMiddleEn{A.}   % abbreviation of father's first name
\authorLastEn{Dona}
\authorSn{1115200900148}

%
% The title of the thesis
%
\titleEn{Implementation of Constructive Negation in Extensional Higher-Order Logic Programming}
\titleGr{Υλοποίηση Κατασκευαστικής Άρνησης σε Εκτατικό Λογικό Προγραμματισμό Υψηλής Τάξης}

%
% Month followed by Year
%
\dateGr{ΙΟΥΝΙΟΣ 2017}
\dateEn{JUNE 2017}

%
% Supervisor(s) info
%
\supervisorGr{Πάνος Ροντογιάννης}{Καθηγητής ΕΚΠΑ}
\supervisorGr{Άγγελος Χαραλαμπίδης}{Ερευνητής ΕΚΕΦΕ «Δημόκριτος»}
\supervisorEn{Panos Rondogiannis}{NKUA Professor}
\supervisorEn{Angelos Charalambidis}{N.C.S.R. ``Demokritos'' Researcher}

%
% Abstract, synopsis, inscription, ack, and preface pages.
%
\abstractEn{
  \begin{english}
    Constructive negation is a logic programming negation method that allows the handling of non-ground negative literals. Logic programming systems which are enhanced with constructive negation may produce not only equalities (assignments or unifications of variables), but also inequalities, that, roughly speaking, restrict variables to be different from some value.

    Extensional higher-order logic programming is a logic programming paradigm that extends classical (first-order) logic programming by introducing higher-order terms, while preserving all the well-known properties of the former. These higher-order terms (variables) represent sets, which contain elements for which the former succeed.

    An extensional higher-order logic programming language called HOPES (\h{}) has been recently proposed. \h{} has been enhanced with constructive negation to create \hcn{} (HOPES with constructive negation).

    While the foundations of \hcn{} are based on strong and well-defined semantics, implementing a logic programming system (interpreter) for it proved to be a real challenge. The reason is that the enhanced definition of the \hcn{} proof procedure does not define any particular method for selecting the next subgoal to be satisfied. We show that, while the language definition guarantees that there exist paths in the proof tree that lead to correct answers, if a naive selection policy (e.g. always selecting the left-most literal, like PROLOG does) is adopted, then one has to take extra measures in order to avoid following paths that will never lead to correct solutions.

    The contribution of this thesis consists of the redefinition of some of the rules in the \hcn{} proof procedure. We show that the redefined proof procedure allows the implementation of an interpreter for \hcn{}, which follows the left-most derivation rule of PROLOG and behaves correctly (only gives correct answers) for any given query.
  \end{english}
}

\abstractGr{
  \begin{greek}
    Η κατασκευαστική άρνηση είναι μια μέθοδος άρνησης στον λογικό προγραμματισμό, η οποία επιτρέπει το χειρισμό μη-συγκεκριμενοποιημένων αρνητικών προτάσεων. Τα συστήματα λογικού προγραμματισμού τα οποία είναι επαυξημένα με κατασκευαστική άρνηση μπορούν δυνητικά να παράγουν όχι μόνο ισότητες (αναθέσεις ή ενοποιήσεις μεταβλητών), αλλά και ανισότητες, οι οποίες, γενικά μιλώντας, περιορίζουν τις μεταβλητές έτσι ώστε να είναι διαφορετικές από κάποια τιμή.

    Ο εκτατικός λογικός προγραμματισμός υψηλής τάξης είναι ένα παράδειγμα λογικού προγραμματισμού που επεκτείνει τον κλασικό (πρώτης τάξης) λογικό προγραμματισμό εισάγοντας όρους υψηλής τάξης, ενώ παράλληλα διατηρεί τις καλά ορισμένες ιδιότητες του προηγούμενου. Αυτοί οι υψηλής τάξης όροι αναπαριστούν σύνολα, τα οποία περιλαμβάνουν στοιχεία για τα οποία οι προηγούμενοι είναι αληθείς.

    Μια γλώσσα λογικού προγραμματισμού υψηλής τάξης με όνομα HOPES (\h{}) έχει προταθεί πρόσφατα. Η γλώσσα αυτή έχει επαυξηθεί με κατασκευαστική άρνηση για να διαμορφωθεί η γλώσσα \hcn{} (HOPES with constructive negation).

    Ενώ η σημασιολογία της \hcn{} είναι καλά ορισμένη, η υλοποίηση ενός συστήματος λογικού προγραμματισμού (διερμηνευτή) για την τελευταία αποδείχθηκε δυσκολότερη υπόθεση απ'ότι αναμενόταν. Ο λόγος είναι πως η διαδικασία απόδειξης της \hcn{} δεν υποδεικνύει κανέναν συγκεκριμένο τρόπο επιλογής του επόμενου στόχου για ικανοποίηση. Δείχνουμε πως, ενώ ορισμός της γλώσσας εγγυάται την ύπαρξη μονοπατιών στο δέντρο απόδειξης, τα οποία οδηγούν σε σωστές λύσεις, εάν μια απλοϊκή πολιτική επιλογής (π.χ. η επιλογή πάντα του αριστερότερου υποστόχου, όπως κάνει η PROLOG) έχει υιοθετηθεί, τότε πρέπει να παρθούν επιπλέον μέτρα έτσι ώστε η υλοποίηση να αποφύγει μονοπάτια τα οποία δεν θα οδηγήσουν ποτέ σε σωστές λύσεις.

    Η συνεισφορά αυτής της πτυχιακής έγκειται στον επαναορισμό κάποιων εκ των κανόνων της διαδικασίας απόδειξης της \hcn{}. Δείχνουμε ότι η νέα διαδικασία απόδειξης επιτρέπει την υλοποίηση ενός διερμηνευτή για την \hcn{}, o οποίος ακολουθεί τον κανόνα της PROLOG για επιλογή του πάντα αριστερότερου υποστόχου και παράλληλα συμπεριφέρεται σωστά (δίνει σωστές λύσεις μόνο) για κάθε επερώτηση.
  \end{greek}
}

\acksEn{
  I would like to deeply thank NCSR ``Demokritos'' associate Angelos Charalambidis for his guidance and overall support during the writing of this thesis. His inputs were of vital importance and the working methodology we followed helped me develop many important research skills and maintain a solid workflow.

  I would also like to thank NKUA professor Panos Rondogiannis, for always being in line in order to help me and support my efforts. His way of teaching and his courses that I attended have sparkled my interest in the theoretical elements of computer science. This thesis is the result of that sparkle and I am very grateful to him.
}

\prefaceEn{
  This thesis constitutes my final step towards completing the undergraduate degree programme in the Department of Informatics and Telecommunications of the National and Kapodistrian University of Athens. It was carried out while working full-time in CERN, which added to the challenge.

  During the process of selecting and taking up a thesis subject, I encountered many interesting topics and had discussions with many professors. I would like to thank them all for their patience, cooperation and tips.

  The reason for selecting the current subject was that it was fascinating at first sight. I was no stranger to classical logic programming or high-order programming paradigms (e.g. Haskell), however it was the first time I encountered a combination of them.

  \hcn{} is a really expressive language. Its higher-order semantics allow one to write even some of the most complex predicates in a very elegant fashion. Of course the main property that enables such elegance is constructive negation, which is the principal feature of \hcn{}.

  \hcn{} borrows the semantics of constructive negation as defined by David Chan for the first-order case. It adapts them to the higher-order semantics of itself and does so perfectly in a theoretical level. However, implementing \hcn{} turned out to be a more challenging task than anticipated. The motivation behind this thesis is the identification and redefinition of those characteristics of the higher-order language \hcn{} that make it difficult for it to be implemented correctly.

  A correct implementation of \hcn{} shall enable a whole world of applications to demonstrate themselves in solving interesting problems and this is what we want to achieve via this thesis.
}

\inscriptionEn{
  \emph{Absence of evidence is not evidence of absence.} \\[8pt]
}

%
% Subject area and keywords
%
\subjectAreaGr{Λογικός Προγραμματισμός}
\subjectAreaEn{Logic Programming}
\keywordsGr{λογική, προγραμματισμός, άρνηση, υψηλή τάξη, εκτατικός}
\keywordsEn{logic, programming, negation, high-order, extensional}

%
% Set the .bib file containing your paper publications (leave the extension out)
%
% This is optional, but it should be specified when option 'lop' is passed to
% the document class.
%
% Then, inside the document environment, you may use the command '\nocitelop' to
% site your papers, as you would traditionally do with the commands '\cite' or
% '\nocite'.
%
% The papers are printed in reverse chronological order.
%
%\lopfile{mypapers/pubs}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%% Required Metadata %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{document}

\frontmatter

\mainmatter

\chapter{INTRODUCTION}
\label{chap:intro}

\section{Objective}
\hcn{} is a extensional, higher-order, logic programming language with costructive negation \cite{DBLP:conf/kr/CharalambidisR14}. All the terms in the previous sentence will be explained later on. An implementation of this language has been attempted and can be found at the following GitHub repository: \url{https://github.com/acharal/hopes}.

While the aforementioned implementation works fine for positive first and higher-order terms, as well as for negative first-order terms, when it comes to negative higher-order terms, it falls short to deliver the intended results.

The objective of this thesis is, initially, the identification of the rules in the proof procedure of \hcn{} that are problematic and contribute to the impractical behaviour of the implementation. Thereinafter, the various ways to fix the unwanted behaviour shall be considered and a solution to the problem shall be given.

\section{Motivation}
Some problems (i.e. predicates) can be expressed better and more elegantly via negation. Giving the programmer the ability to write such programs, makes the language a very powerful tool.

\begin{example}\label{ex:subset}
Consider the following higher-order logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  subset(P, Q) :- not(non_subset(P, Q)).
  non_subset(P, Q) :- P(X), not(Q(X)).
\end{lstlisting}
The above program contains two rules to define the \emph{subset} relation:
\begin{itemize}
  \item \msf{P} is a subset of \msf{Q} if it does not hold that \msf{P} is not a subset of \msf{Q}.
  \item \msf{P} is not a subset of \msf{Q} if there exists an \msf{X}, such that \msf{X} is in \msf{P}, but not in \msf{Q}.
\end{itemize}
Therefore, if there exists a predicate \msf{q} that is true for atoms \msf{0}, \msf{1} and \msf{2}, then the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- subset(P, q).
\end{lstlisting}
would return in \msf{P} all subsets of the set \msf{\left\{ 0, 1, 2 \right\}}.

What makes the above program powerful, is the ability to write the first rule, which makes use of constructive negation, in order to obtain answers by negating the very simple second rule. The second rule itself is not very useful in the sense that it states something very trivial.

If we try and think of how we would write the same program in a positive logic, then we would normally have to check whether every element of \msf{P} also exists in \msf{Q}. Namely, for all \msf{X \in P}, is \msf{Q(X)} true? This is considerably harder to express, if possible at all (in Horn logic), because it involves iterating through \msf{P} (in some way). However, the problem is way more easy to express in a negative logic: \msf{P} is a subset of \msf{Q} if there doesn't exist any \msf{X}, such that \msf{X} is in \msf{P} but not in \msf{Q}. Therefore, negation adds to the expressivity of the language, i.e. there are programs using negation that cannot be rephrased as positive ones.
\end{example}

The most common logic approach when it comes to negation in logic programming is negation as failure. Unfortunately, due to its nature, negation as failure does not provide variable bindings for a negated query. In SLDNF (the basic negation as failure proof procedure) only ``allowed'' programs (a subclass of all programs) can be proved. If the program is not allowed, then the correctness theorem for SLDNF does not hold. The real issue for higher-order logic programming is that there are many programs which are not allowed at all. Constructive negation alleviates both the above restrictions by introducing inequalities and the ``not in'' property for higher-order (set) variables. In the example above, notice that if the \texttt{not(non\_subset(P,q))} subgoal could not provide variable bindings, it would be impossible to answer the \texttt{subset(P,q)} query.

% The most common logic approach when it comes to negation in logic programming is negation as failure. Unfortunately, due to its nature, negation as failure does not provide variable bindings for a negated query. We would like an approach that, given a negated query, it returns variable bindings (or inequalities). Constructive negation does exactly that. In the example above, notice that if the \texttt{not(non\_subset(P,q))} subgoal could not provide variable bindings, it would be impossible to answer the \texttt{subset(P,q)} query.

The above example lays solid ground for solving generate and test type of problems. Suppose that we have a collection of objects that we want to test against some property. The \texttt{subset} predicate could serve as the generator of sets of objects that we want to test and will prove of special importance in the rest of the thesis. What we want, is to successfully implement the proof procedure that will give the expected answers to queries in programs like the one in example \ref{ex:subset}.

\subsection*{Preference-based queries}
The above paradigm can be applied to another interesting class of applications. An interpreter that supports higher-order predicates in conjunction with constructive negation is a system that can potentially answer preference-based queries.

In \cite{DBLP:conf/ppdp/CharalambidisRT16}, Charalambidis et al. propose the use of higher-order logic programming as a logical framework that handles preference-based queries. The aforementioned framework supports both \emph{preferences over tuples}, as well as \emph{preferences over sets}. It is shown that while the former can be easily expressed in first-order logic as well, preferences over tuples are more complex and could be better approached by using a higher-order logic programming language that supports existential higher-order variables. The extensional approach that is presented in \cite{DBLP:conf/ppdp/CharalambidisRT16}, is a natural candidate for implementing preferences over sets since the binding for higher-order variables are essentially sets.

In extensional languages, two sets that contain the same elements are considered equal. Working with sets in an extensional way is one of the main motivating points that led to the creation of \h{}. Working with and stating set preferences is one of the main motivating points that led to the creation of \hcn{}.

To give a flavour of the preferences over sets paradigm, imagine that there is a collection of books of various genres. Imagine that you have decided that you want to buy three books for your summer holidays and you really want them to be detective novels. However, you can only spend a limited time reading books and you get bored easily (it is summer after all), so you want them to have as few pages as possible.

Notice the order of preferences above. The first is the genre. You absolutely enjoy reading detective novels while on the beach. Even if a book of another genre contains fewer pages, you still prefer detective novels. This order of preferences may, depending on the collection of books, force you to buy less than three books (in case there are not enough, i.e. less than three, books of the selected genre in the collection).

The above problem can be reduced to the selection of the subsets of a collection of books that satisfy the imposed preferences. Those preferences over sets can be expressed more elegantly and more efficiently in an extensional higher-order language with constructive negation \cite{DBLP:conf/ppdp/CharalambidisRT16}.

\section{Overview}
To get a taste of where and how the current approach fails, consider a higher-order logic program containing the rules of example \ref{ex:subset}. The problematic point, which will be fully elaborated later, is the way that the current implementation constructs the higher-order variable values (sets).

Given the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- subset(P, q).
\end{lstlisting}
Then, the naive approach which is currently employed and involves the selection of the left-most subgoal (exactly like PROLOG does), will answer:
\begin{lstlisting}[language=Prolog,frame=single]
  yes
  P = { 0 } ;

  yes
  P = { 0, 0 } ;

  yes
  P = { 0, 0, 0 } ;

  ...
\end{lstlisting}
The problem comes down to the way the next candidate value to include in \msf{P} is considered. The naive approach takes no information into account from the context (namely, the values already in \msf{P}) and leads to the above result. The problem is two-fold: not only the returned answers contain duplicates, but also the procedure gets ``stuck'', i.e. some correct answers will never be returned (e.g. in the above, the implementation will continue returning ``sets'' that only contain zeroes, for ever).

The proposed approach involves the introduction of restrictions (constraints), so that the answer set which represents \msf{P} will only contain the expected members. This will in turn enable the implementation to avoid getting into a loop of returning meaningless answers, like above.

\section{Thesis Structure}
The rest of this thesis is organised as follows. Chapter \ref{chap:background} provides some background on the essential terms of negation as failure, constructive negation and higher-order logic programming. In chapter \ref{chap:hcn} the higher-order logic programming language \hcn{} is defined. In chapter \ref{chap:proof} the rules that make up the proof procedure of \hcn{} are outlined and the problem that makes the implementation challenging is identified and presented. Chapter \ref{chap:approach} shows the proposed approach to overcome the problem and outlines possible limitations. Finally, chapter \ref{chap:conclusion} concludes the thesis and outlines the various possibilities for future work.

\chapter{BACKGROUND}
\label{chap:background}

\section{Negation as Failure}
Negation as failure \cite{Lloyd:1987:FLP:39279} is the most widely used approach for handling negation in logic programming systems. The simplicity in its implementation as well as its efficiency make it a really attractive option to employ.

These two advantages of negation as failure originate from the simplicity of its operational semantics: \emph{If P cannot be proved based on the facts of the knowledge base (of the program), then assume that P is false}. The previous statement is also know as the \emph{closed world assumption rule}. This is an extremely simple approach that greatly simplifies the handling of negative literals. Given a negative literal, e.g. \msf{not(p)}, all one has to do is run the positive version of it, i.e. \msf{p}. If it succeeds, then fail. If it fails, then succeed.

This behaviour can be easily demonstrated if we consider the usual negation as failure implementation in Prolog, using cut and fail:

\begin{lstlisting}[language=Prolog,frame=single]
  not(Goal) :- call(Goal), !, fail.
  not(Goal).
\end{lstlisting}

A closer look at the above implementation immediately reveals the basic restriction of negation as failure. Note that nowhere in the above description variable bindings are discussed. This is because negation as failure can only be used as a test against program facts and cannot produce any variable bindings. This means that it can only handle ground literals (that is, literals that only contain ground atoms or, put otherwise, literals containing no variables).

\begin{example} Consider the following logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  p(X) :- not(q(X)).
  q(X) :- not(r(X)).

  r(1).
  r(2).
\end{lstlisting}
and the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- p(X).
\end{lstlisting}
Negation as failure will indeed confirm that \msf{p(X)} is true by answering yes, but it will be unable to provide any bindings for \msf{X}. This is due to the \texttt{fail} in the implementation, which causes any bindings that may have been produced by the \texttt{call} meta-predicate call to be lost.
\end{example}

Another problem with negation as failure is that its implementation is unsound.
\begin{example} Consider the following logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  p(X) :- not(q(X)), r(X).

  q(a).
  r(b).
\end{lstlisting}
Considering the semantics of negation as failure, the predicate \msf{p(X)} seems to succeed for \msf{X = b} and to fail for \msf{X = a}. Indeed, that is the case:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- p(a).
  no

  ?- p(b).
  yes
\end{lstlisting}
Therefore, if a query that asks for all \msf{X}, such that \msf{p(X)} is true is posed, the answer \msf{X = b} is expected. However, this is not the case because, as already stated, negation as failure cannot handle non-ground negative literals in a sound manner:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- p(X).
  no
\end{lstlisting}
\end{example}


\section{Constructive Negation}
The concept of Constructive Negation was first introduced by Chan \cite{DBLP:conf/iclp/Chan88} as an alternative to negation as failure. Constructive negation promises the handling of negative non-ground literals, by returning not only variable equalities (bindings) but also inequalities.

The idea behind constructive negation is simple: if a negated query, e.g. \msf{\lnot Q} is given, we run the positive version of it, i.e. \msf{Q}, and obtain the answers as a disjunction. Then, we return the negation of answers to \msf{Q} as an answer to \msf{\lnot Q}.

\begin{example} Suppose that we have the following very simple knowledge base:
\begin{lstlisting}[language=Prolog,frame=single]
  p(a).
  p(b).
  p(c).
\end{lstlisting}
and the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- not(p(X)).
\end{lstlisting}
We first run the positive version of the query, i.e. \msf{p(X)} and obtain the answer the disjunction: \msf{X = a \lor X = b \lor X = c}. Then, we return the negated disjunction as an answer to the original query: \msf{X \ne a \land X \ne b \land X \ne c}.
\end{example}

\begin{example} Consider the following logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  p(X) :- not(q(X)).

  q(a).
  q(b).
\end{lstlisting}
then, for the query \msf{p(X)} the answer will be:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- p(X).
  yes
  X /= a, X /= b
\end{lstlisting}
\end{example}

In the above example, notice how inequalities can be generated at any point of the computation where a negative literal is encountered. This resembles the constraint logic programming scheme, however simpler, because the restrictions here are only inequalities (\msf{\ne}) and not e.g. \msf{\le} or \msf{\ge}.

Please note that the above examples are fairly simple, in order to demonstrate the idea of constructive negation. In reality, a more complex formula is used in order to negate the answers to the positive version of the negated query. Furthermore, in both examples, notice how the positive version of the negated query returns a finite number of answers. How does constructive negation handle the negation of a disjunction of infinite answers? This issue is addressed in \cite{DBLP:conf/slp/Chan89}, where the constructive negation rule is extended to support the negation of infinite answers.

We will not analyse the techniques that are used in \cite{DBLP:conf/iclp/Chan88} and \cite{DBLP:conf/slp/Chan89} in order to apply the constructive negation rule in first-order logic programming. The reader is encouraged to refer to the respective texts. However, we will outline an important equivalence, that the constructive negation scheme makes use of when it encounters equalities, in order to negate the answers. This equivalence is of special importance to us, because it is the one that gets extended in order to apply the constructive negation rule to higher-order variables.

Let the goal list be \msf{A = A_1, \ldots, A_n} and the selected expression be \msf{A_i}, where \msf{A_i} is \msf{X=s}. Also, let \msf{A'} be the rest of the goal list except \msf{A_i}, i.e. \msf{A' = A_1, \ldots, A_{i-1}, A_{i+1}, \ldots, A_{n}}. Then, the negation formula is the following:

\begin{equation}\label{eq:cneg}
  \forall \mathsf{X} \Big(
    \lnot\exists \textbf{Y, Z} \big( \mathsf{X=s} \land \mathsf{A'} \big) ~\equiv~
    \lnot\exists \textbf{Y} \left(\mathsf{X=s}\right) \lor \exists \textbf{Y} \big( \mathsf{X=s} \land \lnot\exists \textbf{Z} ~ \mathsf{A'} \big)
  \Big)
\end{equation}

where \msf{\textbf{Y}} are the variables in \msf{s} and the free variables in \msf{A'} are contained in \msf{\textbf{Y}} and \msf{\textbf{Z}}.

The above formula is implied by the equality theory and is the mathematical formalisation of taking each component from the goal list \msf{A}, negating it and then recombining the components. We will later extend the above formula to apply to higher-order terms.

To better understand why the above formula works, consider the following:
\begin{align*}
  \mathsf{\lnot \left( A \land B \right)} & ~\Leftrightarrow~ \mathsf{\lnot A \lor \lnot B} & ~ \\
                                          & ~\Leftrightarrow~ \mathsf{true \land \left( \lnot A \lor \lnot B \right)} & \left( \mathsf{true} \land P \Leftrightarrow P \right) \\
                                          & ~\Leftrightarrow~ \mathsf{\left( \lnot A \lor A \right) \land \left( \lnot A \lor \lnot B \right)} & \left( P \lor \lnot P \Leftrightarrow \mathsf{true} \right) \\
                                          & ~\Leftrightarrow~ \mathsf{\lnot A \lor \left( A \land \lnot B \right)} & (\text{rev. distributive law})
\end{align*}

The reason why Chan decides to use the above formula in \cite{DBLP:conf/iclp/Chan88} when negating equalities is that the \msf{X=s} equality in the second term of the right-hand side of the equivalence may generate some interesting variable bindings that may lead to some extra welcome answers.

\begin{example} Consider the following logic program that defines the \texttt{even} predicate:
\begin{lstlisting}[language=Prolog,frame=single]
  even(0).
  even(s(X)) :- not(even(X)).
\end{lstlisting}
\end{example}
The above program defines a negation-based rule for the \texttt{even} property of natural numbers, which are encoded in the following notation:
\[
  \mathsf{s^{n}(0) = n, ~~ n \ge 0}
\]
When asked the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- even(X).
\end{lstlisting}
then using constructive negation, the implementation will answer:
\begin{lstlisting}[language=Prolog,frame=single]
  yes
  X = 0 ;

  yes
  X = s(V2)
  V2 /= 0
  V2 /= s(*V5) ;

  yes
  X = s(s(0)) ;

  yes
  X = s(s(s(V10)))
  V10 /= 0
  V10 /= s(*V14) ;

  yes
  X = s(s(s(s(0)))) ;

  ...
\end{lstlisting}
The second and the fourth answers above give a format for \texttt{X} along with some restrictions for some variables and they result from the constructive negation rule in equation \ref{eq:cneg}. For example, the second answer says that \texttt{X} is of the form \texttt{s(V2)}, but \texttt{V2} is neither \texttt{0} nor \texttt{s(V5)}, for all \texttt{V5} (the star universally quantifies the following variable).


\section{Extensional Higher-Order Logic Programming}
Extensional higher-order logic programming was originally introduced by William W. Wadge \cite{DBLP:conf/slp/Wadge91} with Charalambidis et al. having also worked on that idea recently \cite{DBLP:journals/tocl/CharalambidisHRW13}. The paragim is essentially an extension of classical, first-order logic programming and its principal idea is that program predicates denote sets of objects and one can reason about such sets, i.e. use them in rules and facts. By looking at the name of this paradigm, we can see that it is made up of two terms: \emph{extensional} and \emph{higher-order}.

The term \emph{higher-order} refers to the capability of applying and passing around predicates and predicate variables as parameters. This is the most popular feature of higher-order logic programming languages like HiLog and allows for the sets-based reasoning that was mentioned above.

The term \emph{extensional} refers to the way program predicates can be passed and used, or otherwise, to what makes up a predicate or what a predicate really is. In an extensional language, two predicates are considered to be equal (i.e. the same) if they are true for the same set of arguments. The opposite of this term is \emph{intentional} and in languages belonging to this category (e.g. HiLog), predicates are more than just a set of arguments for which they are true (e.g. they are also discriminated by their name).

The difference between intensionality and extensionality is a fundamental one and, while at first sight intensionality may seem more natural for real world relations, extensionality better materialises our mathematical definition of what a relation is. To better understand the above, consider the following example from \cite{DBLP:journals/tocl/CharalambidisHRW13}.

\begin{example} Consider the predicate \texttt{all\_members(L, P)}, which is true if all elements of a list \texttt{L} have property \texttt{P}:
\begin{lstlisting}[language=Prolog,frame=single]
  all_members([], P).
  all_members([H|T], P) :- P(H), all_members(T, P).
\end{lstlisting}

If there exist two predicates \texttt{p} and \texttt{q} in our program that are true for exactly the same terms, e.g. the terms \texttt{a}, \texttt{b} and \texttt{c}, then we would expect both the following queries to succeed:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- all_members([a,b,c], p).
  yes

  ?- all_members([a,b,c], q).
  yes
\end{lstlisting}
However, this is not guaranteed under the context of an intensional language.
\end{example}


The notions of extensional higher-order logic programming and constructive negation proved to be very compatible and, based on that observation, the \hcn{} language was created \cite{DBLP:conf/kr/CharalambidisR14}.

\chapter{THE HIGHER-ORDER LANGUAGE \hcn}
\label{chap:hcn}

\section{Preliminaries}
The reader is presumed to be familiar with the basic concepts and definitions of classical Logic Programming \cite{Lloyd:1987:FLP:39279}. For example, the concepts \textbf{term}, \textbf{formula}, \textbf{atom}, \textbf{(program) clause} and \textbf{goal} are defined as in classical Logic Programming, with slight extensions on their definitions where necessary.

\section{Basic Definitions}
We describe the language by giving some definitions from the text where \hcn{} is defined \cite{DBLP:conf/kr/CharalambidisR14}, for the readers' convenience. These definitions are crucial to the understanding of the rest of the text.

\begin{definition}{\emph{Types}}

The type system of \hcn{} is based on two base types: $o$, the type of the boolean domain and $\iota$, the type of the individuals (data objects). For example, every classical logic programming term is of type $\iota$.

The types of \hcn{} are defined as follows:

\begin{center}
  \begin{tabular}{llll}
    $\sigma$ & $:=$ & $\iota ~~|~ \left( \iota \rightarrow \sigma \right)$ & \hspace*{2.5cm} \emph{(functional)} \\
    $\rho$   & $:=$ & $\iota ~~|~ \pi$ & \hspace*{2.5cm} \emph{(argument)} \\
    $\pi$    & $:=$ & $o ~~|~ \left( \rho \rightarrow \pi \right)$ & \hspace*{2.5cm} \emph{(predicate)} \\
  \end{tabular}
\end{center}

The argument type $\rho$ consists of the following subtypes:

\begin{center}
  \begin{tabular}{llll}
    $\mu$    & $:=$ & $\iota ~~|~ \kappa$ & \hspace*{2.5cm} \emph{(existential)} \\
    $\kappa$ & $:=$ & $\iota \rightarrow o ~~|~ \left( \iota \rightarrow \kappa \right)$ & \hspace*{2.5cm} \emph{(set)} \\
  \end{tabular}
\end{center}
\end{definition}

The operator \msf{\rightarrow} is right-associative.

Therefore, a functional type that is different from \msf{\iota} can also be written as \msf{\iota^n \rightarrow \iota}, \msf{n \ge 1}.
Similarly, a set type can also be written in the form \msf{\iota^n \rightarrow \mathnormal{o}}, \msf{n \ge 1}.
Finally, every predicate type $\pi$ can be written in the form \msf{\mathnormal{\rho}_1 \rightarrow \dots \rightarrow \mathnormal{\rho}_n \rightarrow \mathnormal{o}}, \msf{n \ge 0} (for \msf{n = 0} we assume that $\pi = o$).

\begin{definition}{\emph{Alphabet}}

The alphabet of \hcn{} consists of:
\begin{enumerate}
  \item \emph{Predicate variables} of every predicate type $\pi$.
  \item \emph{Predicate constants} of every predicate type $\pi$.
  \item \emph{Individual variables} of type $\iota$.
  \item \emph{Individual constants} of type $\iota$.
  \item \emph{Function symbols} of every functional type $\sigma \ne \iota$.
  \item The following logical constant symbols:
        \begin{enumerate}
          \item the \emph{propositional constants} \msf{false} and \msf{true}
                of type $o$;
          \item the \emph{equality constant} \msf{\approx}
                of type $\iota \rightarrow \iota \rightarrow o$;
          \item the \emph{generalised disjunction and conjunction constants} \msf{\bigvee_{\pi}} and \msf{\bigwedge_{\pi}}
                of type $\pi \rightarrow \pi \rightarrow \pi$,
                for every predicate type $\pi$;
          \item the \emph{equivalence constants} $\leftrightarrow_{\pi}$
                of type $\pi \rightarrow \pi \rightarrow o$,
                for every predicate type $\pi$;
          \item the \emph{existential quantifiers} $\exists_{\mu}$
                of type $\left( \mu \rightarrow o \right)$,
                for every existential type $\mu$;
          \item the \emph{negation constant} $\sim$ of type $o \rightarrow o$.
        \end{enumerate}
  \item The \emph{abstractor} $\lambda$ and the \emph{parentheses} ``\msf{(}'' and ``\msf{)}''.
\end{enumerate}

We define the set consisting of the predicate variables and the individual variables of \hcn{}, as the \emph{argument variables} of \hcn{}.
\end{definition}

\begin{definition}{\emph{Body expressions}}

The set of body expressions of \hcn{} is recursively defined as follows:
\begin{enumerate}
  \item
  \begin{enumerate}
    \item Every predicate variable (respectively, predicate constant) of type $\pi$ is a body expression of type $\pi$;
    \item Every individual variable (respectively, individual constant) of type $\iota$ is a body expression of type $\iota$;
    \item The propositional constants \msf{false} and \msf{true} are body expressions of type $o$.
  \end{enumerate}
  \item If \msf{f} is an \msf{n}-ary function symbol and \msf{E_1, \ldots, E_n} are body expressions of type $\iota$, then \msf{\left( f ~~ E_1 ~ \cdots ~ E_n \right)} is a body expression of type $\iota$.
  \item If \msf{E_1} is a body expression of type $\rho \rightarrow \pi$ and \msf{E_2} is a body expression of type $\rho$, then \msf{\left( E_1 ~ E_2 \right)} is a body expression of type $\pi$.
  \item If \msf{V} is an argument variable of type $\rho$ and \msf{E} is a body expression of type $\pi$, then \msf{\left( \lambda V. E \right)} is a body expression of type $\rho \rightarrow \pi$.
  \item If \msf{E_1, E_2} are body expressions of type $\pi$, then \msf{\left( E_1 \bigwedge_{\pi} E_2 \right)} and \msf{\left( E_1 \bigvee_{\pi} E_2 \right)} are body expressions of type $\pi$.
  \item If \msf{E_1, E_2} are body expressions of type $\iota$, then \msf{\left( E_1 \approx E_2 \right)} is a body expression of type $o$.
  \item If \msf{E} is a body expression of type $o$ and \msf{V} is an existential variable of type $\mu$, then \msf{\left( \exists_{\mu} V ~ E \right)} is a body expression of type $o$.
  \item If \msf{E} is a body expression of type $o$, then \msf{\left( \sim E \right)} is a body expression of type $o$.
\end{enumerate}
\end{definition}

The notions of \emph{free} and \emph{bound} variables are defined as usual. A body expression is called \emph{closed} if it does not contain any free variables.

In the following, we will write \msf{\widehat{A}} to denote a (possibly empty) sequence \msf{\langle A_1, \ldots, A_n \rangle}.

A body expression of the form \msf{\left( E_1 \approx E_2 \right)} will be called an \emph{equality}, while a body expression of the form \msf{\sim \exists \widehat{V} \left( E_1 \approx E_2 \right)} will be called an \emph{inequality}; in the latter case \msf{\widehat{V}} may be empty, in which case the inequality is of the form \msf{\sim \left( E_1 \approx E_2 \right)}.

Let \msf{\widehat{E}} and \msf{\widehat{E}'}, where all \msf{E_i}, \msf{E_i'} are of type $\iota$. We will write \msf{\left( \widehat{E} \approx \widehat{E}' \right)} to denote the expression \msf{\left( E_1 \approx E_1' \right) \land \dots \land \left( E_n \approx E_n' \right)}; if \msf{n = 0}, then the conjunction is the constant \msf{true}.

\begin{definition}{\emph{Clausal expressions}}

The set of clausal expressions of \hcn{} is defined as follows:
\begin{enumerate}
  \item If \msf{p} is a predicate constant of type $\pi$ and \msf{E} is a closed body expression of type $\pi$, then \msf{p \leftarrow_{\pi} E} is a clausal expression of \hcn{}, also called a \emph{program clause}.
  \item if \msf{E} is a body expression of type $o$ and each free variable in \msf{E} is of type $\mu$ (existential), then \msf{false \leftarrow_{o} E} (or \msf{\leftarrow_{o} E}, or just \msf{\leftarrow E} is a clausal expression of \hcn{}, also called a \emph{goal clause}.
  \item If \msf{p} is a predicate constant of type $\pi$ and \msf{E} is a closed body expression of type $\pi$, then \msf{p \leftrightarrow_{\pi} E} is a clausal expression of \hcn{}, also called a \emph{completion expression}.
\end{enumerate}

All clausal expressions of \hcn{} have type $o$.
\end{definition}

\begin{definition}{\emph{Program}}

A program of \hcn{} is a finite set of program clauses of \hcn{}.
\end{definition}

\begin{definition}{\emph{Completed definition of predicate}}\label{def:compdef}

Let \msf{P} be a program and let \msf{p} be a predicate constant of type $\pi$. Then, the \emph{completed definition} for \msf{p} with respect to \msf{P} is obtained as follows:
\begin{itemize}
  \item if there exist exactly \msf{k > 0} program clauses of the form \msf{p \leftarrow_{\pi} E_{i}}, where \msf{i \in \left\{ 1, \ldots, k \right\}} for \msf{p} in \msf{P}, then the completed definition for \msf{p} is the expression \msf{p \leftrightarrow_{\pi} E}, where \msf{E = E_1 \bigvee_{\pi} \cdots \bigvee_{\pi} E_k}.
  \item if there are no program clauses for \msf{p} in \msf{P}, then the completed definition for \msf{p} is the expression \msf{p \leftrightarrow_{\pi} E}, where \msf{E} is of type $\pi$ and \msf{E = \lambda \widehat{X}.false}.
\end{itemize}

The expression \msf{E} on the right-hand side of the completed definition of \msf{p} will be called the \emph{completed expression} for \msf{p} with respect to \msf{P}.
\end{definition}

\begin{definition}{\emph{Completion of program}}

Let \msf{P} be a program. Then, the \emph{completion} \msf{comp(P)} of \msf{P} is the set consisting of all the completed definitions for all predicate constants that appear in \msf{P}.
\end{definition}

\section{Examples}
The following examples consist valid higher-order logic programs with respect to \hcn{}.
\begin{example} Consider the following program:
\begin{lstlisting}[language=Prolog,frame=single]
  p(Q) :- Q(a), Q(b).
\end{lstlisting}
When taking into account that \texttt{p} represents a set, we can read the above rule as: ``\texttt{p} is a predicate that is true for all relations that contain, at least, \texttt{a} and \texttt{b}''.

Therefore, given the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- p(R).
\end{lstlisting}
the implementation is expected to answer something of the form:
\begin{lstlisting}[language=Prolog,frame=single,mathescape=true]
  yes
  R = { a, b } $\cup$ L
\end{lstlisting}

Following \hcn{} syntax, the above rule would be written as:
\begin{lstlisting}[mathescape=true]
  p $\leftarrow$ $\lambda$Q.((Q a) $\land$ (Q b))
\end{lstlisting}
In the above notation, notice how the parameter list of the definition of \texttt{p} is placed on the right hand side (because of \texttt{p} being defined as a lambda expression).
\end{example}

\begin{example} Consider the following higher-order logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  band(B) :- singer(S), B(S), guitarist(G), B(G).
\end{lstlisting}
The above rule states that \texttt{B} is a band if it contains at least one singer and one guitarist. Notice how \texttt{S} and \texttt{G} are first-order variables, while \texttt{B} is a higher-order (to be exact, second-order) one.

One interesting thing to notice here, is how \texttt{B} is constructed. Subgoal \texttt{singer\{G\}} will enumerate all possible singers, while subgoal \texttt{guitarist\{G\}} will enumerate all possible guitarists. Finally, subgoal \texttt{B\{X\}} ``associates'' (includes) the respective \texttt{X} element to the answer set.

Therefore, given a knowledge base consisting of singers and guitartists, the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- band(B).
\end{lstlisting}
will return in \texttt{B} all the combinations of the singers and guitartists that may consist a band (with respect to the definition given by the program).

Following \hcn{} syntax, the above rule would be written as:
\begin{lstlisting}[mathescape=true]
  band $\leftarrow$ $\lambda$B.$\exists$S,G((singer S) $\land$ (B S) $\land$ (guitarist G) $\land$ (B G))
\end{lstlisting}
and the query, would be written as:
\begin{lstlisting}[mathescape=true]
  $\leftarrow$ band B
\end{lstlisting}

As explained in \cite{DBLP:conf/kr/CharalambidisR14}, \hcn{} operates under the assumption that free variables in a query are the ones for which the proof procedure will attempt to find bindings in order for the goal to be satisfied. That is why variable \texttt{B} above is not existentially quantified.
\end{example}

\chapter{THE PROOF PROCEDURE}
\label{chap:proof}
The proof procedure of \hcn{} incorporates and adapts the constructive negation rules, as described by David Chan in \cite{DBLP:conf/slp/Chan89}, to the higher-order case.

Before outlining the procedure itself, we give the following definition, which categorises the various inequalities based on the expressions on their left and right hand side (\cite{DBLP:conf/iclp/Chan88}, \cite{DBLP:conf/kr/CharalambidisR14}).

\begin{definition}{}
\label{def:inequalities}
An inequality \msf{\sim\exists \widehat{V} \left( E_1 \approx E_2 \right)} is considered:
\begin{itemize}
  \item \emph{valid} if \msf{E_1} and \msf{E_2} cannot be unified;
  \item \emph{unsatisfiable} if is there is a substitution $\theta$ that unifies \msf{E_1} and \msf{E_2} and contains only bindings of variables in \msf{\widehat{V}};
  \item \emph{satisfiable} if it is not unsatisfiable.
\end{itemize}
Also an inequality will be called \emph{primitive} if it is satisfiable, non-valid and either \msf{E_1} or \msf{E_2} is a variable.

\end{definition}

\section{The procedure}
In this section, we define the proof procedure, as proposed by Charalambidis et al. in \cite{DBLP:conf/kr/CharalambidisR14}. The procedure consists of three definitions. We explain each definition in its own section.

\begin{definition}{\emph{Single-step derivation}}
\label{def:singlestepderivation}

Let \msf{P} be a program and let \msf{G_{k}} and \msf{G_{k+1}} be goal clauses.

Let \msf{G_{k}} be a conjunction \msf{\leftarrow A_1 \land \dots \land A_n}, where each \msf{A_i} is a body expression of type $o$.

Let \msf{A_i} be one of \msf{A_1, \ldots, A_n} and let us call it the \emph{selected expression}.

Let \msf{A' = A_1 \land \dots \land A_{i-1} \land A_{i+1} \land \dots \land A_n}.

We say that \msf{G_{k+1}} \emph{is derived in one step} from \msf{G_k} using \msf{\theta}, if one of the following conditions applies:

\begin{enumerate}
  \item if \msf{A_i} is \msf{true} and \msf{n > 1},
        then \msf{G_{k+1} = \leftarrow A'} is derived from \msf{G_k}
        using \msf{\theta = \epsilon};
  \item if \msf{A_i} is \msf{\left( E_1 \lor E_2 \right)},
        then \msf{G_{k+1} = \leftarrow A_1 \land \dots \land E_j \land \dots \land A_n} is derived from \msf{G_k}
        using \msf{\theta = \epsilon}, where \msf{j \in \{1,2\}};
  \item if \msf{A_i} is \msf{\left( \exists V ~ E \right)},
        then \msf{G_{k+1} = \leftarrow A_1 \land \dots \land E \land \dots \land A_n} is derived from \msf{G_k} using \msf{\theta = \epsilon};
  \item if \msf{A_i \rightsquigarrow A_i'}, namely \msf{A_i} is reduced to \msf{A_i'},
        then \msf{G_{k+1} = \leftarrow A_1 \land \dots \land A_i' \land \dots \land A_n} is derived from \msf{G_k} using \msf{\theta = \epsilon};
  \item if \msf{A_i} is \msf{\left( E_1 \approx E_2 \right)},
        then \msf{G_{k+1} = \leftarrow A' \theta} is derived from \msf{G_k} using \msf{\theta = mgu \left( E_1, E_2 \right)};
  \item if \msf{A_i} is \msf{\left( R ~ \widehat{E} \right)}
        and \msf{R} is a predicate variable of type \msf{\kappa}
        then \msf{G_{k+1} = \leftarrow A' \theta} is derived from \msf{G_k}
        using \msf{\theta = \left\{ R \middle/ \left( \lambda \widehat{X} . \left( \widehat{X} \approx \widehat{E} \right) \bigvee_{\kappa} R' \right) \right\}},
        where \msf{R'} is a fresh predicate variable of type \msf{\kappa};
  \item if \msf{A_i} is \msf{\sim \exists \widehat{V} ~ E}
        and \msf{A_i} is negatively-reduced to \msf{A_i'}, \\
        then \msf{G_{k+1} = \leftarrow A_1 \land \dots \land A_i' \land \dots \land A_n} is derived from \msf{G_k} using \msf{\theta = \epsilon};
  \item if \msf{A_i} is \msf{\sim \exists \widehat{V} \left( R ~ \widehat{E} \right)}
        and \msf{R} is a predicate variable of type \msf{\kappa}
        and \msf{R \not\in \widehat{V}}, \\
        then \msf{G_{k+1} = \leftarrow A' \theta} is derived from \msf{G_k}
        using \msf{\theta = \left\{ R \middle/ \left( \lambda \widehat{X} . \sim \exists \widehat{V} \left( \widehat{X} \approx \widehat{E} \right) \bigwedge_{\kappa} R' \right) \right\}},
        where \msf{R'} is a fresh predicate variable of type \msf{\kappa};
  \item is \msf{A_i} is \msf{\sim \exists \widehat{V} \sim \left( R ~ \widehat{E} \right)}
        and \msf{R} is a predicate variable of type \msf{\kappa}
        and \msf{R \not\in \widehat{V}}, \\
        then \msf{G_{k+1} = \leftarrow A' \theta} is derived from \msf{G_k}
        using \msf{\theta = \left\{ R \middle/ \left( \lambda \widehat{X} . ~ \exists \widehat{V} \left( \widehat{X} \approx \widehat{E} \right) \bigvee_{\kappa} R' \right) \right\}}.
\end{enumerate}

Definition \ref{def:singlestepderivation} defines the single-step derivation of goals and is actually an extension of single-step derivation of classical logic programming to support higher-order terms and constructive negation. This definition is the most general of the three, in the sense that it delegates the handling of more ``special'' or complex subgoals to the other two definitions.
\end{definition}

\begin{definition}{\emph{Reduction}}
\label{def:reduction}

Let \msf{P} be a program and \msf{E}, \msf{E'} be body expressions of type $o$.

We say that \msf{E} is reduced (with respect to \msf{P}) to \msf{E'} (denoted as \msf{E \rightsquigarrow E'}) if one of following conditions applies:

\begin{enumerate}
  \item \msf{p ~ \widehat{A} \rightsquigarrow E ~ \widehat{A}}, where \msf{E} is the completed expression for \msf{p} with respect to \msf{P};
  \item \msf{\left( \lambda X. E \right) B ~ \widehat{A} \rightsquigarrow E\left\{ X / B \right\} \widehat{A}};
  \item \msf{\left( E_1 \bigvee_{\pi} E_2 \right) \widehat{A} \rightsquigarrow \left( E_1 ~ \widehat{A} \right) \lor_{o} \left( E_2 ~ \widehat{A}  \right)};
  \item \msf{\left( E_1 \bigwedge_{\pi} E_2 \right) \widehat{A} \rightsquigarrow \left( E_1 ~ \widehat{A} \right) \land_{o} \left( E_2 ~ \widehat{A}  \right)}.
\end{enumerate}

Definition \ref{def:reduction} is the simplest definition among the three. It corresponds to simple operations on a subgoal, in order to advance the its evaluation. More specifically, definition \ref{def:reduction}.1 replaces a predicate constant by its defined expressions within the program. Definition \ref{def:reduction}.2 corresponds to a $\beta$-reduction for a lambda expression, whereas definitions \ref{def:reduction}.3 and \ref{def:reduction}.4 ``transform'' the generalised disjunction and conjunction predicate constants $\bigvee_{\pi}$ and $\bigwedge_{\pi}$ to the normal boolean operators $\lor$ and $\land$, respectively.
\end{definition}

\begin{definition}{\emph{Negative reduction}}
\label{def:negreduction}

Let \msf{P} be a program and \msf{B}, \msf{B'} be body expressions where \msf{B = \sim \exists \widehat{U} \left( A_1 \land \dots \land A_n \right)} and each \msf{A_i} is a body expression except for conjunction.

Let \msf{A_i} be the selected expression and \msf{A' = A_1 \land \dots \land A_{i-1} \land A_{i+1} \land \dots \land A_n}.

Then, we say that \msf{B} is \emph{negatively-reduced} to \msf{B'} if one of the following conditions applies:

\begin{enumerate}
  \item if \msf{A_i} is \msf{false}, then \msf{B' = true};
  \item if \msf{A_i} is \msf{true} and \msf{n = 1}, then \msf{B' = false},
        else \msf{B' = \sim \exists \widehat{U} ~ A'};
  \item if \msf{A_i} is \msf{\left( E_1 \lor E_2 \right)},
        then \msf{B' = B_1' \land B_2'}, \\ where \msf{B_j' = \sim \exists \widehat{U} \left( A_1 \land \dots \land E_j \land \dots \land A_n \right)}, for \msf{j \in \{ 1, 2 \}};
  \item if \msf{A_i} is \msf{\left( \exists V ~ E \right)},
        then \msf{B' = \sim \exists \widehat{U} V \left( A_1 \land \dots \land E \land \dots \land A_n \right)};
  \item if \msf{A_i \rightsquigarrow A_i'}, namely \msf{A_i} is reduced to \msf{A_i'},
        then \msf{B' = \sim \exists \widehat{U} \left( A_1 \land \dots \land A_i' \land \dots \land A_n \right)};
  \item if \msf{A_i} is \msf{\left( E_1 \approx E_2 \right)}, then:
        \begin{enumerate}
          \item if \msf{\sim \exists \widehat{U} \left( E_1 \approx E_2 \right)}
                is valid, then \msf{B' = true};
          \item if \msf{\sim \exists \widehat{U} \left( E_1 \approx E_2 \right)}
                is non-valid and neither \msf{E_1} nor \msf{E_2} is a variable,
                \\then \msf{B' = \sim \exists \widehat{U} \left( A_1 \land \dots \land A_{i-1} \land \left( \widehat{X} \approx \widehat{X} \theta \right) \land A_{i+1} \land \dots \land A_n \right)},
                \\where \msf{\theta = unify \left( E_1, E_2 \right)} and \msf{\widehat{X} = dom\left( \theta \right)};
          \item if \msf{\sim \exists \widehat{U} \left( E_1 \approx E_2 \right)} is unsatisfiable and either \msf{E_1} or \msf{E_2} is a variable in \msf{\widehat{U}},
          \\then \msf{B' = \sim \exists \widehat{U} \left( A' \theta \right)}, where \msf{\theta = \{ X / E \}} and \msf{X} is the one expression that is a variable in \msf{\widehat{U}} and \msf{E} is the other;
          \item if \msf{\sim \exists \widehat{U} \left( E_1 \approx E_2 \right)}
                is primitive and \msf{n > 1}, \\
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~\land \sim \exists \widehat{U}_2 ~ A' \right)}, where \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i} and \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1};
        \end{enumerate}
  \item if \msf{A_i} is \msf{\left( R ~ \widehat{E} \right)} and \msf{R} is a predicate variable, then:
        \begin{enumerate}
          \item if \msf{R \in \widehat{U}},
                then \msf{B' = \sim \exists \widehat{U}' \left( A' \theta \right)},
                where substitution \msf{\theta = \left\{ R \middle/ \left( \lambda X . \left( X \approx E \right) \bigvee_{\kappa} R' \right) \right\}}, \msf{R'} is a predicate variable of the same type as \msf{R} and \msf{\widehat{U}'} is the same as \msf{\widehat{U}}, except that variable \msf{R} has been replaced with \msf{R'};
          \item if \msf{R \not \in \widehat{U}} and \msf{n > 1},
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~\land \sim \exists \widehat{U}_2 ~ A' \right) \land B},
                where \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i} and \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1};
        \end{enumerate}
  \item if \msf{A_i} is \msf{\sim \exists \widehat{V} ~ E} and \msf{A_i} is negatively-reduced to \msf{A_i'}, \\
        then \msf{B' = \sim \exists \widehat{U} \left( A_1 \land \dots \land A_i' \land \dots \land A_n \right)};
  \item if \msf{A_i} is a primitive inequality \msf{\sim \exists \widehat{V} \left( E_1 \approx E_2 \right)}, then:
        \begin{enumerate}
          \item if \msf{A_i} contains free variables in \msf{\widehat{U}} and \msf{A'} is a conjunction of primitive inequalities, then \msf{B' = \sim \exists \widehat{U} ~ A'};
          \item if \msf{A_i} does not contain any free variables in \msf{\widehat{U}}, then \msf{B' = \exists \widehat{V} \left( E_1 \approx E_2 \right) \lor \sim \exists \widehat{U} ~ A'};
        \end{enumerate}
  \item if \msf{A_i} is \msf{\sim \exists \widehat{V} \left( R ~ \widehat{E} \right)} and \msf{R \not\in \widehat{V}} is a predicate variable,
        then:
        \begin{enumerate}
          \item if \msf{R \in \widehat{U}},
                then \msf{B' = \sim \exists \widehat{U}' \left( A' \theta \right)},
                where substitution \\ \msf{\theta = \left\{ R \middle/ \left( \lambda X . \sim \exists \widehat{V} \left( X \approx E \right) \bigwedge_{\kappa} R' \right) \right\}},
                \msf{R'} is a predicate variable of the same type \msf{\kappa} as \msf{R}
                and \msf{\widehat{U}'} is the same as \msf{\widehat{U}}, except that variable \msf{R} has been replaced with \msf{R'};
          \item if \msf{R \not\in \widehat{U}} and \msf{n > 1},
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~ \land \sim \exists \widehat{U}_2 ~ A' \right) \land B},
                where \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i} and \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1};
          \item if \msf{R \not\in \widehat{U}}, \msf{n = 1} and \msf{\widehat{V}} is non-empty, \\
                then \msf{B' = \exists \widehat{V} \sim \exists \widehat{U} \left( \sim \left( R ~ \widehat{E} \right) \land \sim \exists \widehat{V}' \left( R ~ \widehat{E}' \right) \right)};
        \end{enumerate}
  \item if \msf{A_i} is \msf{\sim \exists \widehat{V} \sim \left( R ~ \widehat{E} \right)} and \msf{R} is a predicate variable and \msf{R \not\in \widehat{V}}, then:
        \begin{enumerate}
          \item if \msf{R \in \widehat{U}},
                then \msf{B' = \sim \exists \widehat{U}' \left( A' \theta \right)},
                where substitution \\ \msf{\theta = \left\{ R \middle/ \left( \lambda X . \exists \widehat{V} \left( X \approx E \right) \bigvee_{\kappa} R' \right) \right\}},
                \msf{R'} is a predicate variable of the same type \msf{\kappa} as \msf{R} and \msf{\widehat{U}'} is the same as \msf{\widehat{U}}, except that variable \msf{R} has been replaced with \msf{R'};
          \item if \msf{R \not\in \widehat{U}} and \msf{n > 1},
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~ \land \sim \exists \widehat{U}_2 ~ A' \right) \land B};
          \item if \msf{R \not\in \widehat{U}}, \msf{n = 1} and \msf{\widehat{V}} is non-empty, \\
                then \msf{B' = \exists \widehat{V} \sim \exists \widehat{U} \left( \left( R ~ \widehat{E} \right) \land \sim \exists \widehat{V}' \sim \left( R ~ \widehat{E}' \right) \right)}.
        \end{enumerate}
\end{enumerate}

Definition \ref{def:negreduction} is the most complex of the three definitions that make up the proof procedure. The reason is that it handles negative subgoals. In order to achieve that, it has to employ the constructive negation paradigm as defined by Chan \cite{DBLP:conf/slp/Chan89}, however extended in order to support higher order terms. These higher-order terms are in essence set variables, therefore the procedure in our case shall not only return ``equality'' relations, but also ``belongs to'' relations.
\end{definition}

\section{Extending constructive negation for \h{}}
Recall that predicates in \h{} represent sets. In \h{}, a set is constructed via the $\bigvee_{\pi}$ operator, (of type $\pi \rightarrow \pi \rightarrow \pi$) which is a primitive and generalised version of the set union operator ($\cup$).

\begin{example} Lets assume that a predicate \msf{P} in a program is true for the atoms \msf{a}, \msf{b} and \msf{c}. Therefore, it represents the following set that contains (at least) \msf{a}, \msf{b} and \msf{c}:
\begin{center}
  \msf{P = \left\{ a, b, c \right\} \cup L}
\end{center}

The above bracket-notion is just a short (or pretty-print) version of the following:
\begin{center}
  \msf{P = \{ a \} ~\bigvee_{\pi}~ \{ b \} ~\bigvee_{\pi}~ \{ c \} ~\bigvee_{\pi}~ L}
\end{center}
\end{example}

In order to extend the constructive negation rule for the higher-order logic programming language \h{}, we have to keep in mind that we are also dealing with higher-order (set) variables like in the example above.

Recall equation \ref{eq:cneg}, which outlines the rule that is applied in constructive negation, when negating equality subgoals. This rule works well when first order literals (equalities or inequalities) are selected and is employed in rule 6(d) of definition \ref{def:negreduction}. We now want to extend this rule to support higher-order predicate variables. The reason why we extend the aforementioned rule is because it is the rule that handles equalities. In the higher-order case, the analogous of an equality, is an element belonging to a set.

When considering the higher-order terms of \h{}, then a more sophisticated version of that formula is required. The reason is that higher-order terms are not ``flat''. To understand what that means, let us consider the principal difference between first and higher-order logic programming: the latter allows the usage of uninstantiated predicate variables, which denote sets. Since they denote sets, we would like to express two properties:
\begin{itemize}
  \item that an element belongs to a set.
  \item that an element does not belong to a set.
\end{itemize}
The first point is implemented via positive computation logic, while the second point requires negative computation logic. Furthermore, the first point may also be the result of the application of double negation.

What the implementation is supposed to do when it encounters a higher-order (predicate) variable, is to perform a systematic enumeration of the possible values that variable can take. The variable itself represents a set, therefore the implementation must be able to generate multiple values that ``belong'' to the set that the variable represents.

Suppose that a negated expression (goal list) \msf{B} contains the subgoal \msf{(R ~ E)}, where \msf{R} is a predicate variable and \msf{E} is an expression. The way \msf{R} will be constructed is by first adding variables to it and then producing bindings for those variables. It is clear that the formula in equation \ref{eq:cneg} is not enough to add multiple values to \msf{R}, because the two terms of the conjunction will argue about whether \msf{E}, and only \msf{E}, belongs or not to the set.

What we would like to do is to continue arguing about more variables, i.e. try to satisfy the rest of the goal list if \msf{R} contained more variables. In essence, what we want to do is, after having argued about \msf{R} containing \msf{E}, to argue about \msf{R} not containing anything else or \msf{R} containing one more element. If in every step we repeat this process, we can argue about \msf{R} containing as many elements as it can.

The above idea translates to appending \msf{B} (the negated expression) itself in conjunction with the second term of the disjunction in rule \ref{eq:cneg}. This is the approach that \hcn{} takes and is reflected in rules \ref{def:negreduction}.7 (b), \ref{def:negreduction}.10 (b) and \ref{def:negreduction}.11 (b). Notice however, that this approach automatically makes the rule (i.e. the procedure) recursive. And, as we know, for a recursive procedure to stop at some point, there has to be some condition that, when satisfied, stops it. The above procedure seems to have none. We analyse this issue further in the next section.

Notice however that, theoretically, the above procedure is perfectly fine, because the rules do not make any assumption about the expression selection policy. There exist paths in the computation tree that ``escape'' from the infinite recursion and a non-deterministic policy may follow these paths. The problem is that when it comes to implementing things (writing algorithms), we cannot employ non-deterministic strategies.

\section{Identifying the Problem}
While being theoretically correct, the above approach does not work if implemented in a naive way (for example, selecting the left-most reducable literal in every step of the derivation). The reason is the repeated subgoal \msf{B}. As discussed earlier, when a higher-order variable \msf{R} is encountered, \msf{B} is re-added to the goal list in order to explore whether \msf{R} can contain extra elements. However, notice that \msf{B} is repeated exactly ``as is'', without any care being taken in order to restrict the new values that are to be added to \msf{R}.

If we now look at this procedure from an implementation point of view, it is only logical that exactly the same computation steps will be repeated, because \msf{B} is exactly the same as before. It seems inevitable that the new goal will produce exactly the same bindings as the previous one. And this is actually the case, which is easily demonstrable if we look at the proof procedure computation steps of an example.

\begin{example}
\label{ex:subsettrace}
Because program predicates represent sets, the most typical example we can investigate and which also shows off the problem pretty well, is the \texttt{subset} predicate, which was first presented in example \ref{ex:subset}.

This time we make sure that our program also contains some facts, so that we can run \texttt{subset} against the facts' predicate. So, consider the following higher-order logic program:
\begin{lstlisting}[language=Prolog,frame=single]
  subset(P, Q) :- not(non_subset(P, Q)).
  non_subset(P, Q) :- P(X), not(Q(X)).

  q(0).
  q(1).
  q(2).
\end{lstlisting}
and the query:
\begin{lstlisting}[language=Prolog,frame=single]
  ?- subset(P, q).
\end{lstlisting}
which asks for all subsets of \msf{q}. Since \msf{q} represents the set \msf{\left\{ 0, 1, 2 \right\}}, normally, 8 answers are expected and their order does not matter. Let us see what happens if we run the query by hand, highlighting the rules of the proof procedure that are applied at each step. In each step, we will show the pending goal list, as well as the unifications that are produced at that point of the computation.

The steps shown next are the steps that the current implementation follows, when given the above program and query. Please note that a left to right derivation order, just like in PROLOG, is followed. Also note that, following PROLOG notation, a comma (\texttt{,}) represents a logical AND, while a semicolon (\texttt{;}) represents a logical OR.

\begin{enumerate}[\bfseries Step 1:]
\item The first step is just the expansion of the \texttt{subset} query:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\lambda$ P Q. $\sim$(non_subset(P, Q))(P, q) ?
\end{lstlisting}

\item By applying reduction rule \ref{def:reduction}.2, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$(non_subset(P, q)) ?
\end{lstlisting}

\item Next, the \texttt{non\_subset} predicate is expanded:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\lambda$ P Q. ($\exists$X P(X), $\sim$Q(X))(P, q)) ?
\end{lstlisting}

\item By applying reduction rule \ref{def:reduction}.2, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?
\end{lstlisting}
Notice that in this step that, while variable \texttt{X} is renamed to \texttt{V4}, the query variable \texttt{P} is left intact.

\item This is the first interesting step of the example. We are inside the scope of a negated expression, therefore one of the negative reduction (definition \ref{def:negreduction}) rules will be applied. Notice that, with respect to the aforementioned definition, \msf{\widehat{U} = \langle \texttt{V4} \rangle}. Since the selected literal is \texttt{P(V4)}, rule \ref{def:negreduction}.7 matches, with \msf{R = \texttt{P}} and \msf{\widehat{E} = \langle \texttt{V4} \rangle}. Since \msf{R \not\in \widehat{U}} and \msf{n=2}, we follow case (b):
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 P(V4));
  ($\exists$V4 P(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?
\end{lstlisting}
The above is an application of the extended constructive negation rule for higher-order predicate variables, as proposed in \cite{DBLP:conf/kr/CharalambidisR14}.

\item We now have two paths to follow (logical OR). Rule \ref{def:singlestepderivation}.2 is applied and, initially, the first path is followed:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 P(V4)) ?
\end{lstlisting}

\item Rule \ref{def:singlestepderivation}.8 is applied and substitution \msf{\theta=\left\{ \texttt{P} / \left( \lambda \texttt{X}. \sim\exists \texttt{V4} ( \texttt{X} = \texttt{V4}) \bigwedge_{\kappa} \texttt{P'} \right) \right\}} is produced. What this substitution says is that there doesn't exist any variable in \texttt{P}, i.e. \texttt{P} is the empty set. The goal list is now empty, and the first answer is returned:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  yes
  P = { }
\end{lstlisting}
So far so good, the empty set is a subset every possible set.

\item At this point, the implementation backtracks and the second path of step 5 is followed. Notice that in the goal list there are two mathematical contexts, as suggested by the parentheses and the variable quantifications.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  ($\exists$V4 P(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item The selected expression is \texttt{($\exists$V4 P(V4), $\sim$($\sim$q(V4)))}, which matches with rule \ref{def:singlestepderivation}.3, where \msf{V = \texttt{V4}} and \msf{E = \texttt{P(V4), $\sim$($\sim$q(V4))}}.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  P(V5), $\sim$($\sim$q(V5)), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?
\end{lstlisting}
Notice that the \texttt{$\exists$V4} quantification is removed and a fresh variable is used.

\item The selected expression is now \texttt{P(V5)}, which matches rule \ref{def:singlestepderivation}.6, where \msf{R = \texttt{P}} and \msf{\widehat{E} = \langle \texttt{V5} \rangle}.
Therefore, substitution \msf{\theta = \left\{ \texttt{P} / \left( \lambda \texttt{X}. (\texttt{X} = \texttt{V5}) \bigvee_{\kappa} \texttt{V8} \right) \right\}} is produced and the goal list becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$q(V5)), $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item The selected expression is now \texttt{$\sim$($\sim$q(V5))}. Since \texttt{q} is a predicate constant, it will be replaced by the completed definition for \texttt{q} with respect to the input program (definition \ref{def:compdef}). That is, \msf{q \leftrightarrow_{\pi} E}, where \msf{E = (\lambda X. X=0) \bigvee_{\kappa} (\lambda X. X=1) \bigvee_{\kappa} (\lambda X. X=2)}.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(($\lambda$X.X=0) $\vee_{\kappa}$ ($\lambda$X.X=1) $\vee_{\kappa}$ ($\lambda$X.X=2))(V5)),
  $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item After reducing the completed expression with \texttt{V5} according to definition \ref{def:reduction} and applying the distributive law for the inner negation ($\sim$), we end up with the following goal list:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(($\lambda$X.X=0)(V5)), $\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
  $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}
And after reducing the first expression of the completed definition, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(V5=0), $\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
  $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item We are inside the scope of a negated expression where \msf{\widehat{U}} is empty and the selected expression is \texttt{$\sim$(V5=0)}, which is a primitive inequality (definition \ref{def:inequalities}). Rule \ref{def:negreduction}.9 (b) matches and the resulting goal list is:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  V5=0; $\sim$($\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
  $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

The logical OR takes precedence and creates two possible paths. Initially, the first one is followed:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  V5=0, $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

The selected expression is \texttt{V5=0}, which is a simple unification. Rule \ref{def:singlestepderivation}.5 is applied, which gives:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 (($\lambda$X.X=0) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?
\end{lstlisting}

Here the situation becomes interesting, because we are now ready to compute the \msf{\ldots \land B} part of the constructive negation rule (definition \ref{def:negreduction}.7 (b)).

\item We are once more inside the scope of a negated expression where \msf{\widehat{U} = \langle \texttt{V4} \rangle}. The selected expression is \texttt{(($\lambda$X.X=0) $\vee_{\kappa}$ V8)(V4)} and after applying the reduction rule 3 from definition \ref{def:reduction}, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 ($\lambda$X.X=0)(V4); V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

Now, the logical OR again takes precedence, thus the selected expression is \texttt{($\lambda$X.X=0)(V4); V8(V4)}. This means that rule \ref{def:negreduction}.3 is applied and the resulting goal list is:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 ($\lambda$X.X=0)(V4), $\sim$q(V4)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

Which after reducing the lambda expression (rule \ref{def:reduction}.2), becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 V4=0, $\sim$q(V4)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

And after applying the unification, gives:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 $\sim$q(0)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item We have to substitute the completed definition of \msf{q} in place of the predicate constant \texttt{q}. After substituting, reducing and distributing the negation constant, as we previously did in steps 11 and 12, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 $\sim$(($\lambda$X.X=0)(0)), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
  $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

Furthermore, we reduce the first lambda expression of the completed expression:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 $\sim$(0=0), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
  $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item The selected expression is now \texttt{$\sim$(0=0)}, which is a negated expression. Therefore, the have to ``descend'' one level down (inside the negated expression) and the selected expression becomes \texttt{0=0}. Rule \ref{def:negreduction}.6 (b) is applied and the resulting expression is \msf{true}. Therefore, the goal list becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 $\sim$(true), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
  $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

Equivalently, after applying rule \ref{def:negreduction}.1:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 false, $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
  $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

The first negated expression is now a conjunction of expressions, the first of which is \texttt{false}, therefore the whole expression is \texttt{true} (rule \ref{def:negreduction}.1 again), thus the remaining goal list is:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

There is one important observation to make at this point. The above goal list is exactly the same as the goal list in step 4, except for one difference: instead of predicate variable \texttt{P} we now have \texttt{V8}.

Recall that, from step 10, predicate variable \texttt{P} is bound to \texttt{($\lambda$X.(X=V5) $\bigvee_{\kappa}$ V8)} and, from step 13, variable \texttt{V5} is bound to \texttt{0}. Therefore, \texttt{P = 0 $\bigvee_{\kappa}$ V8}.

This should give more clear view of how the extended constructive negation rule for higher-order predicates works. Higher-order variable \texttt{V8} occured from step 9 and acts as the ``tail'' of \texttt{P}. However, should the rule not contain the \msf{\dots \land B} part, it would never have a chance to be computed.

\item At this point, the constructive negation rule (definition \ref{def:negreduction}.7 (b)) is applied again:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 V8(V4));
  ($\exists$V4 V8(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

As in step 6, the first path is followed:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 V8(V4)) ?

  true ?
\end{lstlisting}

and the second answer is returned:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  yes
  P = { 0 }
\end{lstlisting}

The computation continues with the second path:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  ($\exists$V4 V8(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

Since the rules that are applied are identical as before, in the following we omit detailed explanation of every rule application.

\item Rule \ref{def:singlestepderivation}.3 is applied and a fresh variable is introduced in place of \texttt{V8} in the previously quantified context:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  V8(V12), $\sim$($\sim$q(V12)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item The selected literal is now \texttt{V8(V12)}, therefore rule \ref{def:singlestepderivation}.6 is applied and substitution \msf{\theta = \left\{ \texttt{V8} / \left( \lambda \texttt{X}. (\texttt{X} = \texttt{V12}) \bigvee_{\kappa} \texttt{V15} \right) \right\}} is produced.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$q(V12)), $\sim$($\exists$V4 (($\lambda$X.X = V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}

\item As before, the completed definition of predicate \msf{q} is replaced in place of predicate constant \texttt{q}.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(($\lambda$X.X=0) $\vee_{\kappa}$ ($\lambda$X.X=1) $\vee_{\kappa}$ ($\lambda$X.X=2))(V12)),
  $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}
which, as before, becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(($\lambda$X.X=0)(V12)), $\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
  $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}
And after reducing the first expression of the completed definition, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\sim$(V12=0), $\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
  $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}
Application of rule \ref{def:negreduction}.9 (b) gives:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  V12=0; $\sim$($\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
  $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}
Which gives:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  V12=0, $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
\end{lstlisting}
Recall that the composition of unifiers up to this point have bounded \texttt{P} to be \texttt{P = 0 $\vee_{\kappa}$ ($\lambda$X.(X=V12) $\vee_{\kappa}$ V15)}. After applying the unification and reducing, we get:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
$\sim$($\exists$V4 ($\lambda$X.X=0)(V4); V15(V4), $\sim$q(V4)) ?
\end{lstlisting}
So \texttt{P} becomes: \texttt{P = 0 $\vee_{\kappa}$ 0 $\vee_{\kappa}$ V15}.

\item Skipping some rule applications identical to previous steps, the goal list becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
$\sim$($\exists$V4 V15(V4), $\sim$q(V4)) ?
\end{lstlisting}

The constructive negation rule (definition \ref{def:negreduction}.7 (b)) is applied at this point and the goal list becomes:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  $\sim$($\exists$V4 V15(V4));
  ($\exists$V4 V15(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V15(V4), $\sim$q(V4)) ?
\end{lstlisting}

The first path is followed, which leads to \msf{true} and the third answer is returned:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true]
  yes
  P = { 0, 0 }
\end{lstlisting}
\end{enumerate}

Steps 17 through 21 will repeat for ever, adding only zeroes to the returned answers. In the absence of restrictions for the next selected expression, the implementation will always add the first choice it finds. Furthermore, the rest of paths that would occur from selecting alternative expressions will never be followed.

If we consider the computation tree (show in figure \ref{fig:comptreeold} below), the above process would correspond to following the leftmost branch every time, thus ending up at the bottom left of the tree (which is of course of infinite depth assuming that the machine it runs on has infinite memory).

\tikzset{
  label/.style = {align=center, black}
}

\begin{figure}[H]
\centering\scriptsize
\begin{tikzpicture}[sibling distance=10em, level distance=5em]
  \node[label] {\msf{P = \underline{X_1} \bigvee_{\kappa} X_2}}
    child[red,thick] { node[label] {\msf{P = 0 \bigvee_{\kappa} \underline{X_2} \bigvee_{\kappa} X_3}}
      child { node[label] {\msf{P = 0 \bigvee_{\kappa} 0 \bigvee_{\kappa} \underline{X_3} \bigvee_{\kappa} X_4}}
        child { node[label] {\msf{P = 0 \bigvee_{\kappa} 0 \bigvee_{\kappa} 0 \bigvee_{\kappa} \underline{X_4} \bigvee_{\kappa} X_5}}
          child[dashed,red,thick] {
            edge from parent node[above left] {\tiny\msf{X_4 = 0}}
            node {\msf{\dots}}
          }
          child[missing] {}
          child[missing] {}
          edge from parent node[above left] {\tiny\msf{X_3 = 0}}
        }
        child[black,thin] { node[label] {\msf{\dots}}
          edge from parent node[left] {\tiny\msf{X_3 = 1}}
        }
        child[black,thin] { node[label] {\msf{\dots}}
          edge from parent node[above right] {\tiny\msf{X_3 = 2}}
        }
        edge from parent node[above left] {\tiny\msf{X_2 = 0}}
      }
      child[black,thin] { node[label] {\msf{\dots}}
        edge from parent node[left] {\tiny\msf{X_2 = 1}}
      }
      child[black,thin] { node[label] {\msf{\dots}}
        edge from parent node[above right] {\tiny\msf{X_2 = 2}}
      }
      edge from parent node[above left] {\tiny\msf{X_1 = 0}}
    }
    child[black,thin] { node[label] {\msf{\dots}}
            edge from parent node[left] {\tiny\msf{X_1 = 1}} }
    child[black,thin] { node[label] {\msf{\dots}}
            edge from parent node[above right] {\tiny\msf{X_1 = 2}} }

  ;
\end{tikzpicture}
\caption{The (simplified) computation tree of the current implementation}
\label{fig:comptreeold}
\end{figure}
\end{example}

\chapter{THE PROPOSED APPROACH}
\label{chap:approach}

\section{Tweaking the proof procedure}
Based on the previous chapter, it is obvious that any implementation of \hcn{} has to take measures in order to make sure that the sets that are constructed via the constructive negation rule do not contain duplicate members. Therefore, some kind of restriction has to be put in place before the proof procedure continues with the computation of the ``next'' element.

This is the approach that we take. We introduce restrictions in the format of (in)equalities, when the constructive negation rule is applied. These (in)equalities have to be introduced in such a way, that will cause the computation to fail when an expression is to be ``inserted'' for the second time in a set and they will allow it to proceed otherwise.

Based on the above description, an obvious observation can be made. As the number of elements in a set increases, so does the number of the restrictive inequalities. This is normal, as we need an inequality per element currently in the set.

In this section we will define the modified proof procedure. In the next section we will present how and explain why the proposed approach works. Before outlining the modified versions of the rules of negative reduction (definition \ref{def:negreduction}), we need to define the \emph{trimmed substitution} operator.

\begin{definition}{\emph{Trimmed substitution operator}}
\label{def:trimmedsub}

Let \msf{L} be a lambda expression and \msf{P} be a predicate variable of type $\kappa$.

The trimmed substitution operator \msf{S^{-}} is defined as follows:
\begin{enumerate}
  \item \msf{S^{-}\left( L \bigvee_{\kappa} P \right) = P };
  \item \msf{S^{-}\left( L \bigwedge_{\kappa} P \right) = P }.
\end{enumerate}

Namely, given an expression that matches one of the above, \msf{S^{-}} drops the lambda expression \msf{L} and only returns the predicate variable \msf{P}, i.e. it trims the expression to only contain \msf{P}.
\end{definition}

In the following, we will write \msf{\left( \widehat{E} \approx_{\lor} \widehat{E}' \right)} to denote the expression \msf{ \left( E_{1} \approx E_{1}' \right) \lor \dots \lor \left( E_{n} \approx E_{n}' \right)}; if \msf{n=0}, then the disjunction is the constant \msf{false}.

We can now give the modified negative reduction definition. Notice that we only need to tweak the rules that correspond to the constructive negation application for higher-order expressions, namely rules 7 (b), 10 (b) and 11 (b) of definition \ref{def:negreduction}.

\begin{definition}{\emph{Negative reduction (tweaked)}}
\label{def:negreduction_new}

Let \msf{P} be a program and \msf{B}, \msf{B'} be body expressions where \msf{B = \sim \exists \widehat{U} \left( A_1 \land \dots \land A_n \right)} and each \msf{A_i} is a body expression except for conjunction.

Let \msf{A_i} be the selected expression and \msf{A' = A_1 \land \dots \land A_{i-1} \land A_{i+1} \land \dots \land A_n}.

Then, we say that \msf{B} is \emph{negatively-reduced} to \msf{B'} if one of the conditions of definition \ref{def:negreduction}, overriden by the following rules where indicated, applies:

\begin{enumerate}
  \item[7.] if \msf{A_i} is \msf{\left( R ~ \widehat{E} \right)} and \msf{R} is a predicate variable, then:
        \begin{enumerate}
          \item[(b)] if \msf{R \not \in \widehat{U}} and \msf{n > 1}, then
                \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~\land \sim \exists \widehat{U}_2 ~ A' ~\land B_{1} \right)},

                where \msf{B_{1} = \sim\exists \widehat{U}' \left( \left( S^{-}\left( R \right) ~\widehat{E}' \right) \land \left( A'' \lor \left( \widehat{E} \approx_{\lor} \widehat{E}' \right) \right) \right)},

                \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i}, \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1}, \msf{\widehat{U}'} and \msf{\widehat{E}'} are renamed versions of variables in \msf{\widehat{U}} and \msf{\widehat{E}} respectively and \msf{A''} is the same as \msf{A'}, except that all occurrencies of \msf{R} have been replaced with \msf{S^{-}(R)}.
        \end{enumerate}
  \item[10.] if \msf{A_i} is \msf{\sim \exists \widehat{V} \left( R ~ \widehat{E} \right)} and \msf{R \not\in \widehat{V}} is a predicate variable,
        then:
        \begin{enumerate}
          \item[(b)] if \msf{R \not\in \widehat{U}} and \msf{n > 1},
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~ \land \sim \exists \widehat{U}_2 ~ A' \land B_{1} \right)},

                where \msf{B_{1} = \sim\exists \widehat{U}' \left( \left( S^{-}\left( R \right) ~\widehat{E}' \right) \land \left( A'' \lor \left( \widehat{E} \approx_{\lor} \widehat{E}' \right) \right) \right)},

                \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i}, \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1}, \msf{\widehat{U}'} and \msf{\widehat{E}'} are renamed versions of variables in \msf{\widehat{U}} and \msf{\widehat{E}} respectively and \msf{A''} is the same as \msf{A'}, except that all occurrencies of \msf{R} have been replaced with \msf{S^{-}(R)}.
        \end{enumerate}
  \item[11.] if \msf{A_i} is \msf{\sim \exists \widehat{V} \sim \left( R ~ \widehat{E} \right)} and \msf{R} is a predicate variable and \msf{R \not\in \widehat{V}}, then:
        \begin{enumerate}
          \item[(b)] if \msf{R \not\in \widehat{U}} and \msf{n > 1},
                then \msf{B' = \sim \exists \widehat{U}_1 ~ A_i \lor \exists \widehat{U}_1 \left( A_i ~ \land \sim \exists \widehat{U}_2 ~ A' \land B_{1} \right)},

                where \msf{B_{1} = \sim\exists \widehat{U}' \left( \left( S^{-}\left( R \right) ~\widehat{E}' \right) \land \left( A'' \lor \left( \widehat{E} \approx_{\lor} \widehat{E}' \right) \right) \right)},

                \msf{\widehat{U}_1} are the variables in \msf{\widehat{U}} that are free in \msf{A_i}, \msf{\widehat{U}_2} are the variables in \msf{\widehat{U}} not in \msf{\widehat{U}_1}, \msf{\widehat{U}'} and \msf{\widehat{E}'} are renamed versions of variables in \msf{\widehat{U}} and \msf{\widehat{E}} respectively and \msf{A''} is the same as \msf{A'}, except that all occurrencies of \msf{R} have been replaced with \msf{S^{-}(R)}.
        \end{enumerate}
\end{enumerate}
\end{definition}

In order to introduce a restriction among the variables in the selected expression \msf{A_i} and the ones in the repeated expression \msf{B}, the latter needs to be within the scope of the quantification of \msf{\widehat{U}_1}. That's why \msf{B} was moved inside the aforementioned scope, in conjunction with the other subgoals and renamed to \msf{B_1} for the needs of the definition.

The first thing to observe here is that we have not introduced inequalities, but equalities! The reason is that these equalities are inside a negated expression and upon its evaluation they will turn into inequalities. Another interesting point is that the restrictive inequalities have been introduced in disjunction with the rest of the goal (\msf{A'}).

The detailed reasons for the above choices will become evident in the next section. Intuitively however, think again of expression \msf{B_1}, which is a negated expression. If we distribute the negation (after evaluating \msf{S^{-} \left( R \right) \widehat{E}'}, which causes the constructive negation rule for higher-order expressions to be applied again), the disjunction will become a conjunction and its expressions will become negated.


\section{Why the approach works}
It may be initially unclear why the proposed approach works and the truth is that it is not so obvious. It took a ``reverse engineering'' methodology in order to come up with it and once we delve into it, everything will become more clear.

First of all, let us consider the computation point that does not exhibit the desired behaviour. Look at step 20 of example \ref{ex:subsettrace}. At that step, the implementation computes the second value of \texttt{P}, which is variable \texttt{V12}. There are three choices for \texttt{V12}: \texttt{0}, \texttt{1} or \texttt{2}. The computation procedure is obliged to check all of them. When it picks the first value (\texttt{V12 = 0}), there has to be something in the goal list that will cause the path that is currently being followed to fail.

To help us with the task, we consider a simplified snapshot of the computation procedure for the \texttt{subset} query. A trace that goes up to the second returned answer is sufficient in order to demonstrate the desired points:
\\
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
?- subset(P, q).

   (1) $\sim$(non_subset(P, q)) ?

   (2) $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?

   (3) $\sim$($\exists$V4 P(V4));
       ($\exists$V4 P(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?

   (4) $\sim$($\exists$V4 P(V4)) ?

   (5) true ?

   yes
   P = { }

   (6) ($\exists$V4 P(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?

   (7) P(V5), $\sim$($\sim$q(V5)), $\sim$($\exists$V4 P(V4), $\sim$q(V4)) ?

   (8) $\sim$($\sim$q(V5)), $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

   ...

   (9) $\sim$($\sim$(($\lambda$X.X=0)(V5)), $\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
       $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

  (10) $\sim$($\sim$(V5 = 0), $\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
       $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

  (11) V5 = 0; $\sim$($\sim$(($\lambda$X.X=1)(V5)), $\sim$(($\lambda$X.X=2)(V5))),
       $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

  (12) V5 = 0, $\sim$($\exists$V4 (($\lambda$X.X=V5) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

  (13) $\sim$($\exists$V4 (($\lambda$X.X=0) $\vee_{\kappa}$ V8)(V4), $\sim$q(V4)) ?

  (14) $\sim$($\exists$V4 (($\lambda$X.X=0)(V4); V8(V4), $\sim$q(V4)) ?

  (15) $\sim$($\exists$V4 (($\lambda$X.X=0)(V4), $\sim$q(V4)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (16) $\sim$($\exists$V4 V4 = 0, $\sim$q(V4)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (17) $\sim$($\exists$V4 $\sim$q(0)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

   ...

  (18) $\sim$($\exists$V4 $\sim$(($\lambda$X.X=0)(0)), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
       $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (19) $\sim$($\exists$V4 $\sim$(0 = 0), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
       $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (20) $\sim$($\exists$V4 $\sim$(true), $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
       $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (21) $\sim$($\exists$V4 false, $\sim$(($\lambda$X.X=1)(0)), $\sim$(($\lambda$X.X=2)(0))),
       $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (22) $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (23) $\sim$($\exists$V4 V8(V4));
       ($\exists$V4 P(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (24) $\sim$($\exists$V4 V8(V4)) ?

  (25) true ?

  yes
  P = { 0 }

  (26) ($\exists$V4 V8(V4) $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (27) V8(V12), $\sim$($\sim$q(V12)), $\sim$($\exists$V4 V8(V4), $\sim$q(V4)) ?

  (28) $\sim$($\sim$q(V12)), $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

   ...

  (29) $\sim$($\sim$(($\lambda$X.X=0)(V12)), $\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
       $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

  (30) $\sim$($\sim$(V12 = 0), $\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
       $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

  (31) V12 = 0; $\sim$($\sim$(($\lambda$X.X=1)(V12)), $\sim$(($\lambda$X.X=2)(V12))),
       $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

  (32) V12 = 0, $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

  (33) $\sim$($\exists$V4 (($\lambda$X.X=0) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?

  (34) $\sim$($\exists$V4 ($\lambda$X.X=0)(V4); V15(V4), $\sim$q(V4)) ?

  (35) $\sim$($\exists$V4 ($\lambda$X.X=0)(V4), $\sim$q(V4)), $\sim$($\exists$V4 V15(V4), $\sim$q(V4)) ?

  ...

  (36) $\sim$($\exists$V4 V15(V4), $\sim$q(V4)) ?

  (37) $\sim$($\exists$V4 V15(V4));
       ($\exists$V4 V15(V4), $\sim$($\sim$q(V4))), $\sim$($\exists$V4 V15(V4), $\sim$q(V4)) ?

  (38) $\sim$($\exists$V4 V15(V4)) ?

  (39) true ?

  yes
  P = { 0, 0 }
  ...
\end{lstlisting}

By carefully looking at the trace above, we notice two things:
\begin{itemize}
  \item Look that the expression \texttt{(($\lambda$X.X=0) $\vee_{\kappa}$ V15)} at step 28.

  This expression occurs from the substitution of variable \texttt{V8} at step 27. The path that is due to the lambda expression within the above expression (that is, the first context in step 35) contributes nothing to the computation. This is because in step 32, \texttt{V12} is being assigned a value from the completed definition of \msf{q} and then the aforementioned path essentially asks whether the resulting expression is true for \msf{q} (look at steps 15-21 for a detailed sequence of steps). Of course, that is always true. We utilise this property in our modified procedure (we essentially trim that path, recall definition \ref{def:trimmedsub} -- trimmed substitution).

  The reason for trimming the aforementioned path is because, along with our introduced restrictions, it caused our modified procedure to fail. Since it contribues nothing to the computation, we can safely trim it.

  \item Now look at the second context of step 35, whose computation commences at step 36. Since its first expression is a higher-order expression, the constructive negation rule will be applied, leading to step 37. By then, it is too late to apply any restriction, because step 38 always succeeds. Therefore, we need to add our restriction in such a way, so that in step 32 there is another subgoal that disproves the \texttt{V12=0} equality, namely:
  \begin{lstlisting}[language=Prolog,%
    frame=single,breaklines=false,mathescape=true]
  (32) V12 = 0, $\sim$(V12 = 0), $\sim$($\exists$V4 (($\lambda$X.X=V12) $\vee_{\kappa}$ V15)(V4), $\sim$q(V4)) ?
  \end{lstlisting}
\end{itemize}

Pay close attention to the variables that we want to restrict: variable \texttt{V12} will be the second variable to be added to \texttt{P} and we want to find an acceptable value for it. We want that value to be different from the value of the variable already in \texttt{P}. This means that any restriction has to be put into place while we still have access to the first variable of \texttt{P} (namely, \texttt{V5} from step 7).

Our modified definition adds the restriction upon the first application of the constructive negation rule, that is step 3. At that point, we do not yet know what value of the first variable will be, but we surely know that we want its value to be different from the value of the second variable.

Let us now show how the modified proof procedure works. The first step that changes is step 3. Instead of appending \msf{B} to the goal list, we insert it into the context of the quantified \texttt{V4} variable and also include an equality in disjunction with \msf{A'}:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
   (3) $\sim$($\exists$V4 P(V4));
       ($\exists$V4 P(V4), $\sim$($\sim$q(V4)), $\sim$($\exists$V5 S<@\textsuperscript{-}@>(P)(V5), ($\sim$q(V5); V4 = V5))) ?
\end{lstlisting}

The first expression in the disjunction remains the same, so it leads to the first answer being returned, as before.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
   (4) $\sim$($\exists$V4 P(V4)) ?

   (5) true ?

   yes
   P = { }
\end{lstlisting}

The computation now continues with the second path:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
   (6) ($\exists$V4 P(V4), $\sim$($\sim$q(V4)), $\sim$($\exists$V5 S<@\textsuperscript{-}@>(P)(V5), ($\sim$q(V5); V4 = V5))) ?
\end{lstlisting}

Notice that now, the \texttt{$\exists$V4} quantification is over the whole goal list, therefore every \texttt{V4} variable gets renamed to \texttt{V6}.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
   (7) P(V6), $\sim$($\sim$q(V6)), $\sim$($\exists$V5 S<@\textsuperscript{-}@>(P)(V5), ($\sim$q(V5); V6 = V5)) ?

   (8) $\sim$($\sim$q(V6)), $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=V6) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); V6 = V5)) ?

   ...

   (9) $\sim$($\sim$(($\lambda$X.X=0)(V6)), $\sim$(($\lambda$X.X=1)(V6)), $\sim$(($\lambda$X.X=2)(V6))),
       $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=V6) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); V6 = V5)) ?

  (10) $\sim$($\sim$(V6 = 0), $\sim$(($\lambda$X.X=1)(V6)), $\sim$(($\lambda$X.X=2)(V6))),
       $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=V6) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); V6 = V5)) ?

  (11) V6 = 0; $\sim$($\sim$(($\lambda$X.X=1)(V6)), $\sim$(($\lambda$X.X=2)(V6))),
       $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=V6) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); V6 = V5)) ?

  (12) V6 = 0, $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=V6) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); V6 = V5)) ?

  (13) $\sim$($\exists$V5 S<@\textsuperscript{-}@>(($\lambda$X.X=0) $\vee_{\kappa}$ V9)(V5), ($\sim$q(V5); 0 = V5)) ?
\end{lstlisting}

The first variable that has been inserted to \texttt{P} (that is \texttt{V6}) has gotten the value \texttt{0}. At step 13 the implementation has to apply the trimmed substitution operator, which trims the lambda expression and returns only predicate variable \texttt{V9}:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (14) $\sim$($\exists$V5 V9(V5), ($\sim$q(V5); 0 = V5)) ?
\end{lstlisting}

At this point, the extended constructive negation rule is applied again and another restriction is introduced. The purpose of this restriction is to prevent the third variable that may later be added to \texttt{P} of being equal to the first or the second one.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (15) $\sim$($\exists$V5 V9(V5));
       ($\exists$V5 V9(V5), $\sim$($\sim$q(V5); 0 = V5),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(V9)(V13), ($\sim$q(V13); 0 = V13; V5 = V13))) ?
\end{lstlisting}

In the above step 15, \texttt{V13} is the next (third) variable to be inserted to \texttt{P}, \texttt{0 = V13} restricts it be different than the first one and \texttt{V5 = V13} restricts it to be different than the second one.

Continuing with the computation, the first branch of step 15 leads to the second answer being returned:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (16) $\sim$($\exists$V5 V9(V5)) ?

  (17) true ?

  yes
  P = { 0 }
\end{lstlisting}

And the second branch does its magic as follows:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (18) ($\exists$V5 V9(V5), $\sim$($\sim$q(V5); 0 = V5),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(V9)(V13), ($\sim$q(V13); 0 = V13; V5 = V13))) ?

  (19) V9(V14), $\sim$($\sim$q(V14); 0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(V9)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (20) $\sim$($\sim$q(V14); 0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (21) $\sim$($\sim$q(V14)), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?
\end{lstlisting}

Notice how at step 21 above, due to the negation, the equality in disjunction became an inequality in conjunction. The computation continues by replacing the completed definition of \msf{q} and selecting the first possible value (\texttt{V14=0}).

\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (21) $\sim$($\sim$q(V14)), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  ...

  (22) $\sim$($\sim$(($\lambda$X.X=0)(V14)), $\sim$(($\lambda$X.X=1)(V14)), $\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (23) $\sim$($\sim$(V14 = 0), $\sim$(($\lambda$X.X=1)(V14)), $\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (24) V14 = 0; $\sim$($\sim$(($\lambda$X.X=1)(V14)), $\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (25) V14 = 0, not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?
\end{lstlisting}

The goal list in step 25 above contains everything that we have been fighting for. Obviously the first two expressions form a contradiction and will cause this path to fail.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (26) not(0 = 0),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=0) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 0 = V13)) ?

  (27) not(true),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=0) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 0 = V13)) ?

  (28) false,
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=0) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 0 = V13)) ?
\end{lstlisting}

At this point the implementation will backtrack to step 24 and select the other path:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (25) $\sim$($\sim$(($\lambda$X.X=1)(V14)), $\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (26) $\sim$($\sim$(V14 = 1), $\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (27) V14 = 1; $\sim$($\sim$(($\lambda$X.X=2)(V14))), not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (28) V14 = 1, not(0 = V14),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=V14) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; V14 = V13)) ?

  (29) not(0 = 1),
          $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=1) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 1 = V13)) ?
\end{lstlisting}

At step 29 above, rule \ref{def:negreduction}.6 is applied. The inequality \texttt{not(0 = 1)} is valid, therefore the first expression evaluates to \msf{true}.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (30) true,
       $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=1) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 1 = V13)) ?

  (31) $\sim$($\exists$V13 S<@\textsuperscript{-}@>(($\lambda$X.X=1) $\vee_{\kappa}$ V17)(V13), ($\sim$q(V13); 0 = V13; 1 = V13)) ?

  (32) $\sim$($\exists$V13 V17(V13), ($\sim$q(V13); 0 = V13; 1 = V13)) ?
\end{lstlisting}

The extended constructive negation rule is applied again and the first path of the resulting goal list will provide us with the third answer.
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  (33) $\sim$($\exists$V13 V17(V13));
       ($\exists$V13 V17(V13), $\sim$($\sim$q(V13); 0 = V13; 1 = V13),
          $\sim$($\exists$V30 V17(V30), ($\sim$q(V30); 0 = V30; 1 = V30; V13 = V30))) ?

  (34) $\sim$($\exists$V13 V17(V13)) ?

  (35) true ?

  yes
  P = { 0, 1 }

  ...
\end{lstlisting}

In step 33 above, a third restriction is placed, in order to restrict the possible values for the fourth member of \texttt{P}. Since the third member will be selected to be \texttt{2}, there is no possible value for the fourth member, so there will be no fourth member. The implementation will backtrack and will try to find an alternative value for the second member, then try to recompute a third element, etc.

The above procedure will continue until all possible combinations of valid values for the members of \texttt{P} have been checked. It is also obvious that the above procedure terminates, since the completed definition of \msf{q} is finite and every value from the latter that is added to \texttt{P} is different from the values added before it.

\section{Solving generate and test problems}
The modified proof procedure allows us to easily select elements from a collection of objects. This enables us to solve generate and test problems fairly easily.

\begin{example} \label{ex:twocolor}
Consider the following logic program:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  twocolor(G, R) :- subset(R, vertex_set(G)),
                    not(non_twocolor(G, R)).

  vertex_set(G)(X) :- G(X, _).
  vertex_set(G)(X) :- G(_, X).

  non_twocolor(G, R) :- G(X, Y), R(X), R(Y).
  non_twocolor(G, R) :- G(X, Y), not(R(X)), not(R(Y)).
\end{lstlisting}
The above program defines the \texttt{twocolor} predicate, which is true if \texttt{R} is a subset of the vertices of a graph \texttt{G} that can be painted with the same colour in a two-colouring of \texttt{G}. Note that in order to exist a valid two-coloring for a graph, we must be able to paint each pair of vertices consisting an edge with different colors.

The \texttt{twocolor} predicate first enumerates all subsets of vertices of \texttt{G} and then tests whether they can be painted with the same colour. The \texttt{vertex\_set} predicate returns a set with all the vertices of \texttt{G}.

The \texttt{non\_twocolor} predicate is interesting. It states that the set of vertices \texttt{R} of graph \texttt{G} cannot be painted with the same colour, if there exist some vertices \texttt{X} and \texttt{Y}, such that \texttt{X} and \texttt{Y} are adjacent in \texttt{G} and both \texttt{X} and \texttt{Y} are in \texttt{R}. Alternatively, vertices in \texttt{R} cannot be painted with the same colour, if there exist some vertices \texttt{X} and \texttt{Y}, such that \texttt{X} and \texttt{Y} are adjacent in \texttt{G} and neither of them is in \texttt{R} (because then there would not be enough colours remaining to paint \texttt{X} and \texttt{Y}).

If we have the following simple definition for a (undirected) graph:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  graph(a, b).
  graph(b, c).
\end{lstlisting}

Then the answers to the following query shall be (not necessarily in the indicated order):
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  ?- two_color(graph, R).

  yes
  R = { b } ;

  yes
  R = { a, c } ;

  no
\end{lstlisting}
\end{example}

\begin{example} \label{ex:clique}
Consider the following logic program:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  clique(G, R) :- subset(R, vertex_set(G)),
                  not(non_clique(G, R)).

  vertex_set(G)(X) :- graph(X, _).
  vertex_set(G)(X) :- graph(_, X).

  non_clique(G, R) :- R(X), R(Y), not(G(X, Y)), not(G(Y, X)).
\end{lstlisting}
The above program defines the \texttt{clique} predicate, which is true if \texttt{R} is a subset of the vertices of a graph \texttt{G} that form a subgraph of \texttt{G}, which is a clique (every vertex is connected to every other vertex in the set).

Notice that the main skeleton of the program is the same as in example \ref{ex:twocolor}. We only added the \texttt{non\_clique} predicate definition, which simply states that a subset of the vertices of a graph \texttt{G} is not a clique if there exist two nodes \texttt{X} and \texttt{Y} in \texttt{G}, such that there is no edge between them.

Suppose that we have the following simple definition for a (undirected) graph:
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  graph(a, b).
  graph(b, c).
  graph(c, a).
\end{lstlisting}
which is know as \msf{K_3} (the complete graph with 3 vertices).

Then the answers to the following query shall be (not necessarily in the indicated order):
\begin{lstlisting}[language=Prolog,%
  frame=single,breaklines=false,mathescape=true,escapeinside={<@}{@>}]
  ?- clique(graph, R).

  yes
  R = { a } ;

  yes
  R = { a, b } ;

  yes
  R = { b } ;

  yes
  R = { b, c } ;

  yes
  R = { c } ;

  yes
  R = { a, b, c } ;

  no
\end{lstlisting}
\end{example}

\section{Limitations}
\label{section:limitations}
While the approach outlined in the previous sections fixes the problem of non-termination when there exist higher-order negative expressions in the goal list, it stills produces duplicate answers, in the sense that it may return the same set more than once, with its elements in different order. This would normally cause the queries in the examples \ref{ex:twocolor} and \ref{ex:clique} to return the same answer more than once. However, this is a different and more fundamental problem, which is out of the scope of this thesis.

To understand why this problem exists, consider again the \texttt{subset} trace (example \ref{ex:subsettrace}). Every time that the negation rule is applied on the expression that extends \msf{P}, normally the definition of predicate \msf{q} is inserted into the computation. The completed definition of \msf{q} is always the same and the implementation has to choose one of the possible values (in example \ref{ex:subsettrace} the possible values are \msf{0}, \msf{1} or \msf{2}). Our modified rule inserts inequalities in order to restrict the new value to be different from any previous value.

This is however not enough, because when the computation backtracks, the inequalities are lost (and are meant to be lost, so that new subsets can be computed). The computation finds itself in the following situation:

\begin{itemize}
\item After \msf{P = \left\{ 0, 1, 2 \right\}} has been computed, there is no other expression with which \msf{P} can be extended and there is no other choice in place of the third member (\msf{2}), therefore the implementation backtracks in order to find an alternative choice in place of the second member (\msf{1}).
\item Indeed, since there is only one restriction for the second member, namely to be different that \msf{0}, there is one alternative expression: \msf{2}. Therefore, the following set is computed: \msf{P = \left\{ 0, 2 \right\}}.
\item As the computation continues, it will attempt to find whether there is a third expression (from the completed definition of \msf{q}) that can be ``put'' into \msf{P}, that also satisfies the restrictions of it being different than \msf{0} and \msf{2}. There is such an expression: \msf{1} is different than \msf{0} and \msf{2}, so it is chosen and the following answer is computed: \msf{P = \left\{ 0, 2, 1 \right\}}.
\end{itemize}

Clearly, another tweak is necessary in order to avoid the above behaviour. One idea would be, instead of inequalities, to introduce ``greater than'' restrictions for the members of \msf{P}. However, for a complete set of answers to be computed, this would require the completed expression of \msf{q} to be ``sorted''. When talking about numbers, sorting is obvious. However, in the general case that is not true. Furthermore, it is not straight-forward neither how one would sort the completed expression, nor how sorting would affect the performance of the implementation.

\section{Implementation}
A prototype implementation of the above modified procedure can be found at the following GitHub repository: \url{https://github.com/errikos/hopes} (branch \texttt{cn\_restrict}). The aforementioned implementation is in essence the same with Angelos Charalambidis' implementation, with minor changes to reflect the modified procedure and it is written in Haskell.

%It is written in Haskell, which is provably the most appropriate language to implement interpreters for languages whose definition is given via ``rules'', like the case with \hcn{}.

\chapter{CONCLUSIONS AND FUTURE WORK}
\label{chap:conclusion}

\section{Conclusions}
We modified the proof procedure of \hcn{} to make it more implementation-oriented. The new proof procedure avoids the non-termination problem that the previous one encountered when it had to deal with negated higher-order expressions.

We did so by introducing expressions that restrict the new elements of the respective set when applying the constructive negation rule to higher-order predicate expressions. These expressions are essentially inequalities which are handled by the proof procedure itself and emulate an $\in$ operator for the set constructed so far.

\section{Future work}
\subsection*{Avoiding multiple answers}
While the modified proof procedure allows the implementation to find the correct paths in the computation tree, there is still room for improvement. One issue that has to be tackled is that the same answer may be returned multiple times, with its terms re-ordered (see ``Limitations'' -- section \ref{section:limitations}). This may require extra restrictions placed in the proof procedure rules, as well as a different order of evaluation of program predicates.

One may argue that, since the arrangement of terms differs, the answers are not the same. However, recall that in \hcn{}, predicates represent sets, which normally have no ordering. Therefore, in order to be compatible with the language semantics, an implementation ideally shall not return multiple answers.

\subsection*{Employing CLP techniques in \hcn{}}
While looking for possible solutions to the problem that this paper tries to address, one particular scheme kept coming forward. In every step made towards solving the problem, there was always the thought that everything would possibly be simpler if constraint logic programming (CLP) techniques were employed in order to restrict variable values.

Indeed, the concept of CLP seems to very compatible with the semantics of \hcn{}. This is mainly due to the nature of constructive negation, which in addition to variable assignments, also generates inequalities. Handling these inequalities the way a CLP language does, could have multiple benefits for the implementation and this idea deserves further investigation.

\subsection*{Warren Abstract Machine for \hcn{}}
Recently, work has been done in extending the Warren Abstract Machine in order to implement higher-order logic programming languages \cite{1324952}. It would be really interesting to use the extended WAM definition in order to implement \hcn{} and see how constructive negation behaves in that case.

\backmatter

% abbreviations table
\abbreviations
\begin{center}
	\renewcommand{\arraystretch}{1.5}
	\begin{longtable}{ l @{\qquad} l }
	\toprule
	  HOPES ($\mathcal{H}$)    & Higher Order Prolog with Extensional Semantics \\
    \hcn{}   & HOPES with Constructive Negation \\
	\bottomrule
	\end{longtable}
\end{center}

% % appendix
% \begin{appendix}
% % mark the beginning of the appendix
% \appendixstartedtrue
%
% % add appendix line to ToC
% \phantomsection
% \addcontentsline{toc}{chapter}{APPENDICES}
%
% \chapter{FIRST APPENDIX}
%
% \end{appendix}

% manually include the bibliography
\bibliographystyle{plain}
\bibliography{references}
% include it also in ToC (do sth on your own)
\addcontentsline{toc}{chapter}{REFERENCES}

\end{document}