fun-rec | Recommender system introductory tutorial , online reading

There isn't really much you can do here. Ideally, the strategy would be to define and prove the base case and the inductive-step separately, and then argue (at the meta-level) that the property is true for all strings.

For the base-case things are easy enough. I'd define:

This assertion:

This is by design. SMTLib's type system isn't designed to do any sort of inference, to make it easy for solvers to unambiguously load specifications. See section 3.6 of http://smtlib.cs.uiowa.edu/papers/smt-lib-reference-v2.6-r2017-07-18.pdf which discusses well-sortedness requirements. So CVC4 rightfully rejects your program.

But you are correct that this is rather annoying in practice. The typical solution is to simply define the required constant at the type you are interested in once and for all:

The "verbose" message is a hint here. mbqi stands for model-based-quantifier-instantiation. It's a method of dealing with quantifiers in SMT solving. In the first case, MBQI manages to find a model. But your transitive function is just too complicated for MBQI to handle, and thus it gives up. Increasing the limit will not likely address the problem, nor it's a long term solution.

Short story long, recursive definitions are difficult to deal with, and recursive definitions with quantifiers are even harder. The logic becomes semi-decidable, and you're at the mercy of heuristics. Even if you found a way to make z3 compute a model for this, it would be brittle. These sorts of problems are just not suitable for SMT solving; better use a proper theorem prover like Isabelle, Hol, Coq, Lean. Agda, etc. Almost all these tools offer "tactics" to dispatch subgoals to SMT solvers, so you have the best of both worlds. (Of course you lose full automation, but with quantifiers present, you can't expect any better.)

Pattern (also called triggers) may only contain uninterpreted functions. Since + is an interpreted function, you essentially provide an invalid pattern, in which case virtually anything can happen.

As a first step, I disabled Z3's auto-configuration feature and also MBQI-based quantifier instantiation:

At this page, I found the following quote:

The command eval evaluates an expression in the last model produced by Z3. It is essentially executing the "function program" produced by Z3.

Since eval is a , it follows that it cannot be used within a expression.

I believe model-enumeration should be easier using some API interface instead of the SmtLibv2 format, as one can easily write a loop that alternates satisfiability checks with learning of a blocking clause that removes previously find solutions from the search space.

The models used not to reflect the graph of recursive function definitions. So when evaluating recursive functions on values that had not been seen during solving it could produce arbitrary results. This behavior is now changed as the recursive definitions are included in models.